-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathread_files.asm
More file actions
105 lines (84 loc) · 1.65 KB
/
Copy pathread_files.asm
File metadata and controls
105 lines (84 loc) · 1.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
;
; Author: BITAM Salim (github.com/soolidsnake)
; Lenght: 184 bytes
; Purpose: read files from a directory
;
; nasm -f elf64 read_files.asm; ld -m elf_x86_64 -s -o read_files read_files.o
;
section .text
global _start
_start:
;; put string in stack
xor rax, rax
push rax
mov rbx, 'passwd'; directory to open, change here
push rbx
mov rbp, rsp
add rsp, 0x100
;; sys_open("passwd", 0, 0)
mov al, 2
mov rdi, rbp
xor rsi, rsi
xor rdx, rdx
syscall
;; getdents(fd, rsp, 0x3210)
mov rdi,rax
xor rdx,rdx
xor rax,rax
mov dx, 0x3210
sub rsp, rdx
mov rsi, rsp
mov al, 78
syscall
;; FIRST LOOP
mov rbx, rsp
LOOP1:
xor rcx, rcx
mov cx, WORD [rbx + 0x10];get lenght from d_reclen
mov r8, rcx
mov rax, rbx
add rax, 0x0b;pin point to d_name
sub rcx, 0x13;lenght of d_name
;add directory path here for instance "passwd/"
mov dl, 'p'
mov BYTE [rax], dl
mov dl, 'a'
mov BYTE [rax+0x01], dl
mov dl, 's'
mov BYTE [rax+0x02], dl
mov dl, 's'
mov BYTE [rax+0x03], dl
mov dl, 'w'
mov BYTE [rax+0x04], dl
mov dl, 'd'
mov BYTE [rax+0x05], dl
mov dl, '/'
mov BYTE [rax+0x06], dl
;/************CODE***************/
;open file
xor rsi, rsi
mov rdi, rax
mov eax, 0x02
syscall
test rax, rax
jl ERROR_OPEN
;read content of file
mov rdi, rax
lea rsi, [rbp+0x100]
mov dl, 0x30
xor rax, rax
syscall
;write content to stdout
xor rdx, rdx
mov rdi, 0x01
mov dl, al; get number of read bytes
mov al, 0x01
syscall
;/************CODE***************/
ERROR_OPEN:
add rbx, r8;next dirent structure
cmp QWORD [rbx], 0
jnz LOOP1
xor rax, rax
mov al, 60
syscall;exit