ShellcodeHandler Generic LinkBindTrans

Vulnerability

Description

Reference

Analysis

	/*
		00402111   ba 83538300      mov edx,835383
		00402116   ffd6             call esi                                 ; socket()
		00402118   53               push ebx
		00402119   53               push ebx
		0040211a   53               push ebx
		0040211b   68 0200d63a      push 3ad60002                            ; 3ad6 <- port
		00402120   8bd4             mov edx,esp
		00402122   8bd8             mov ebx,eax
		00402124   6a 10            push 10
		00402126   52               push edx
		00402127   53               push ebx
		00402128   ba 0090a6c2      mov edx,c2a69000
		0040212d   ffd6             call esi                                 ; bind()
		0040212f   40               inc eax
		00402130   50               push eax
		00402131   53               push ebx
		00402132   ba 7a3b73a1      mov edx,a1733b7a
		00402137   ffd6             call esi                                 ; listen()
		00402139   50               push eax
		0040213a   50               push eax
		0040213b   53               push ebx
		0040213c   ba 10d36900      mov edx,69d310
		00402141   ffd6             call esi                                 ; accept()
		00402143   8bd8             mov ebx,eax
		00402145   33c0             xor eax,eax
		00402147   50               push eax
		00402148   b4 02            mov ah,2
		0040214a   50               push eax
		0040214b   55               push ebp
		0040214c   53               push ebx
		0040214d   ba 005860e2      mov edx,e2605800
		00402152   ffd6             call esi                                 ; recv()
		00402154   bf 1cf174c0      mov edi,c074f11c                         ; authentication key
		00402159   ffe5             jmp ebp
	*/

Pattern

	const char *pcre =
		"\\xba\\x83\\x53\\x83\\x00\\xff\\xd6\\x53\\x53\\x53\\x68\\x02\\x00"
		"(..)\\x8b\\xd4\\x8b\\xd8\\x6a\\x10\\x52\\x53\\xba\\x00\\x90"
		"\\xa6\\xc2\\xff\\xd6\\x40\\x50\\x53\\xba\\x7a\\x3b\\x73\\xa1\\xff"
		"\\xd6\\x50\\x50\\x53\\xba\\x10\\xd3\\x69\\x00\\xff\\xd6\\x8b\\xd8"
		"\\x33\\xc0\\x50\\xb4\\x02\\x50\\x55\\x53\\xba\\x00\\x58\\x60\\xe2"
		"\\xff\\xd6\\xbf(....)\\xff\\xe5";

Dependencies

 
documentation/modules/shellcodehandler/sch_generic_link_bind_trans.txt · Last modified: 2006/02/17 14:01
 
Recent changes RSS feed Creative Commons License Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki