Apple Mac OS X Shellcode


This section contains Mac OS X payloads.

 osx_ppc_bind Src Gen
Mac OS X (PPC) 224 bytes
This payload listens on a TCP port and waits for a connection. Once the connection has been established it executes /bin/sh with standard I/O redirected to the client TCP connection.


 osx_ppc_bind_stg Src Gen
Mac OS X (PPC) 152 bytes
This payload listens on a TCP port and waits for a connection. Once the connection has been established it reads in a second stage payload and executes it. This is useful for scenarios where you have limited room for your payload.


 osx_ppc_reverse Src Gen
Mac OS X (PPC) 160 bytes
This payload establishes a TCP connection to a given host on a given port and redirects standard I/O from /bin/sh to the established connection.


 osx_ppc_reverse_stg Src Gen
Mac OS X (PPC) 100 bytes
This payload establishes a TCP connection to a given host on a given port. Once the connection is established a second stage payload is read in and executed. This is useful for scenarios where you have limited room for your initial payload.


 osx_ppc_reverse_nf_stg Src Gen
Mac OS X (PPC) 152 bytes
This payload establishes a TCP connection to a given host on a given port. Once the connection is established a second stage payload is read in and executed. This is useful for scenarios where you have limited room for your initial payload. This payload is null-free.


 osx_ppc_findrecv_stg Src Gen
Mac OS X (PPC) 76 bytes
This payload searches all open file descriptors for a four byte tag that is sent by the attacker over the established exploit connection. Once the connection is located the payload executes /bin/sh and redirects standard I/O to the established exploit connection. This is useful for bypassing firewall and NAT restrictions by repurposing the already established exploit connection. This payload is null-free.


 osx_ppc_findrecv_peek_stg Src Gen
Mac OS X (PPC) 76 bytes
This payload searches all open file descriptors for a four byte tag that is sent by the attacker over the established exploit connection. Once the connection is located the payload executes /bin/sh and redirects standard I/O to the established exploit connection. This is useful for bypassing firewall and NAT restrictions by repurposing the already established exploit connection. This payload is null-free and used the MSG_PEEK flag for the recv system calls.