“A vulnerability provides an assembly language for a computer that has never been programmed before, and that was not designed with programmability in mind.“
— Halvar Flake

As part of our ongoing and upcoming vulnerability research projects, I’ve been developing some new shellcode samples for slightly exotic architectures, such as SPARC and MIPS. I’ve decided to share them with the community, because they might have some value to fellow security researchers who have an interest in these platforms.

For a fascinating journey in the lost art of shellcoding, I recommend this article by Dave Aitel.

Real hackers were so multi-lingual they often knew more platforms than they had pants.
— @daveaitel < so truehttps://t.co/7hgGqF90Xi

— raptor@infosec.exchange (@0xdea) March 5, 2021

You can download the new shellcode samples from their GitHub repository at https://github.com/0xdea/shellcode, along with some vintage (aged 20+ years 🍷) x86 shellcode of mine for Linux and BSD, which made an appearance in the infamous Vault 7 CIA tools leak that was published by Wikileaks in 2017.

In this small collection, you will find my latest Solaris/SPARC shellcode snippets, including the 36-bytes chmod() shellcode featured in my recent Phrack article. You will also find a new MIPS N32 MSB reverse shellcode for Linux that I’ve written while hunting for bugs on a security appliance based on the Cavium Octeon III processor architecture.

We will continue to upload new samples that we develop during our research projects. Stay tuned for some exciting news and vulnerability disclosures!