A post about shellcode

Jun 10, 2018

27 comments

So you may ask yourself, like I did what is shellcode? And the deeper you dig the more questions you will ask yourself, well that's how it went with me. I am not a shellcode guru but I would like to share my knowlegde, when I write / teach about something, I understand (I think) it better. This is not a giant introduction explaining everything, it's more about a journey of digging in to shellcode. To answer the first question, shellcode is nothing more then a bunch of binary code like this:

\xf7\xe6\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x8d\x3c\x24\xb0\x3b\x0f\x05

But what is shellcode really? And what the hell does the above code do?! I'll answer the second question direclty, it spawns a shell on a Linux 64-bit system. Now we get a hint, so shellcode is operating system and CPU architecture bound? Yup that's right, shellcode is operating system and CPU architecture specific. Now what is the code above? the code is binary, represented here as hexadecimal numbers. I didn't get it at first, at first I was like: "this is hex I just parse this with a hex parser" but these are bytes and it could be that they don't have an ASCII representation. But what is shellcode now really? shellcode is binary data that can be read direclty by a CPU. In fact it's 0 and 1, and a CPU, when you feed it this data, can read it and execute whatever it says. I don't believe you, show me the code!

Ok here it is:

#include <stdio.h>

char *code = "\xf7\xe6\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x8d\x3c\x24\xb0\x3b\x0f\x05";

int main () {

    int (*ret)() = (int(*)()) code;
    ret();

    return 0;

}

Compile it with gcc and run it:

$ gcc shell.c -o shell
$ ./shell

You will need to execute it on a 64-bit Linux system. If executed you will see it spawned /bin/sh.

So how this line int (...); really works I don't know a 100%. I do know is that it will take a pointer the character array "code" put it in memory and I want to say execute here, but it does not execute the shellcode, it does set up registers so something points to the address of the shellcode which was put into memory. Can you exlain it even vaguer? Sorry maybe next post explanation :). But now we go deeper in the shellcode, let's analyze that bunch of binary, let's try to see if there is something readable, the hexadecimal readable spectrum goes from 21 to 7E hex or 33 to 127 decimal see man ascii:

#include <stdio.h>
#include <string.h>

char * code = "\xf7\xe6\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x8d\x3c\x24\xb0\x3b\x0f\x05";

int main () {

    for (int i = 0; i < strlen(code); i++) {

        if ((int) code[i] > 33 && (int) code[i] < 128) {

            printf("%c", code[i]);

        }

    }

    printf("\n");

    return 0;

}

The output of the previous is:

RH/bin//shSH<$;

So we see something like "/bin//sh", well interesting but this is not the right way to go, A better approach is to look at the assembly code, which is how I wrote the shellcode in the first place.

Disassembly of section .text:

0000000000400080 <_start>:
  400080:   f7 e6                   mul    esi
  400082:   52                      push   rdx
  400083:   48 bb 2f 62 69 6e 2f    movabs rbx,0x68732f2f6e69622f
  40008a:   2f 73 68 
  40008d:   53                      push   rbx
  40008e:   48 8d 3c 24             lea    rdi,[rsp]
  400092:   b0 3b                   mov    al,0x3b
  400094:   0f 05                   syscall 

What the shit is "0x68732f2f6e69622f"?? Yeah my first reaction to, it is actually super straight forward, remember "/bin//sh" from 10 seconds ago? Well that is that:

                    | Lets take a look at this piece |
\xf7\xe6\x52\x48\xbb \x2f\x62\x69\x6e\x2f\x2f\x73\x68\ x53\x48\x8d\x3c\x24\xb0\x3b\x0f\x05

\x2f \x62 \x69 \x6e \x2f \x2f \x73 \x68\

Now there is something called little endian, I always forget about. you need to reverse per 8 bytes ea 64 bits

\x68\ \x73 \x2f \x2f \x6e \x69 \x62 \x2f

0x68732f2f6e69622f

hs//nib/

which if we reverse is /bin//sh

But why /bin//sh and not /bin/sh, the most simple explanation; otherwise it won't work, you need the 2 "/" in the middle. There is another magic code in the assembly "0x3b", which is hex for 59, which is the opcode for the linux system call execve, see https://filippo.io/linux-syscall-table/ for a complete list about syscall codes.

Better commented assembly code:

Disassembly of section .text:

0000000000400080 <_start>:
  400080:   f7 e6                   mul    esi ; zero out value esi
  400082:   52                      push   rdx ; push the value in rdx to the stack
  400083:   48 bb 2f 62 69 6e 2f    movabs rbx,0x68732f2f6e69622f ; /bin/sh in hexadecimal
  40008a:   2f 73 68 
  40008d:   53                      push   rbx ; push the string "/bin/sh" to the stack

; load the memory address of the stack pointer, which points to "/bin/sh"  
  40008e:   48 8d 3c 24             lea    rdi,[rsp]

; load the value 59 into register al, which is used as an identifier for system calls  
  400092:   b0 3b                   mov    al,0x3b 

; execute the system call according to the value in register al  
  400094:   0f 05                   syscall

Probably some people will ask: "But how can I hack with this?". Well there are 2 ways that I know of:

1
1 year ago
By: Israel

I was able to find good info from your blog articles. where to buy cbd oil in ct where to buy cbd oil in ct

1
1 year ago
By: Aretha

Hello mates, how is all, and what you want to say concerning this piece of writing, in my viuew its genuinely awesome in support of me.

https://servicethesis.info help me write an essay help me write an essay https://servicethesis.info

1
1 year ago
By: Taj

Hello there! This post couldn't be written any better! Reading this post reminds me of my good old room mate! He always kept chatting about this. I will forward this page to him. Pretty sure he will have a good read. Many thanks for sharing! https://essaywritingusauk.com/ law essay writing service buy essay uk services ukbuy essay uk services uk buy essay uk services uk buy essay uk services uk https://essaywritingusauk.com/ buy essay uk services uk https://essaywritingusauk.com

1
1 year ago
By: Lela

Appreciate this post. Will try it out. https://buyessaysearch.com/ buy essays online buy essays online https://buyessaysearch.com/

1
1 year ago
By: John

As the admin of this web page is working, no uncertainty very soon it will be famous, due to its feature contents. https://onlineessayforyou.com/ buy essay papers online essays orderonline essays order https://onlineessayforyou.com/ https://onlineessayforyou.com/

1
1 year ago
By: Niklas

Hi there, just wanted to say, I loved this post. It was helpful. Keep on posting! https://essaywritingtld.com/ best essay writing service cheap best essay writing service cheap https://essaywritingtld.com/

1
1 year ago
By: Albertina

Hello there! This is kind of off topic but I need some guidance from an established blog. Is it difficult to set up your own blog? I'm not very techincal but I can figure things out pretty quick. I'm thinking about creating my own but I'm not sure where to start. Do you have any ideas or suggestions? Cheers https://allbestessaywritingservice.com/ best custom writing help best custom writing help https://allbestessaywritingservice.com/

1
1 year ago
By: Ted

Thanks for the auspicious writeup. It inn fact used to be a leeisure account it. Look complex to more brought agreeable from you! However, how couldd we communicate?

https://buycustomessay.info/ college application essay writing service college application essay writing service https://buycustomessay.info

1
1 year ago
By: Rosie

I don't even know the way I ended up right here, however I thought this put up used to be good. I don't know who you are but certainly you are going to a famous blogger when you aren't already. Cheers! https://essayservicesall.com/ student essay online student essay online https://essayservicesall.com

1
1 year ago
By: Blaine

Right now it sounds like Drupal is the preferred blogging platform out there right now.

(from what I've read) Is that what you're using on your blog?

https://essayhelpforall.com/ writing service writing service https://essayhelpforall.com/

1
1 year ago
By: Lorna

If you wish for to get much from this piece of writing then you have to apply such methods to your won website. my review here my review here https://vietnam-money.com

1
1 year ago
By: Hai

Amazing blog! Do you have any recommendations for aspiring writers? I'm planning to start my own ebsite soon but I'm a little lost on everything. Woyld you advise starting with a free platform like Wordpress or go for a paid option? There are so many options outt there that I'm compltely confused .. Any tips? Many thanks! http://iyfgm.com/__media__/js/netsoltrademark.php?d=forum.plastic-surgeon.com.ua%2Fforumdisplay.php%3Ff%3D11 Akilah

1
1 year ago
By: Sandra

Great beat ! I wish to apprentice while you amend your site, how could i subscribe for a blog web site? The account helped me a acceptable deal. I had been a little bit acquainted of this your brooadcast provided bright clear concept https://klugprodrent.medium.com/character-essay-c1eda55c241c essay writing services essay writing services https://medium.com/@darnelllkpdxi3a/essay-1c08d356e4b3

1
1 year ago
By: Keesha

Touche. Solid arguments. Keep upp thee great work.

https://professionalessaywritingservice.com help me write my paper help me write my paper https://professionalessaywritingservice.com

1
1 year ago
By: Kevin

I could not refrain from commenting. Perfectly written! https://ordertermpaperonline.com buy custom essay online buy custom essay online https://ordertermpaperonline.com/

1
1 year ago
By: Jani

The other day, while I was at work, my sister stole my iPad and tested to see if it can survive a 40 foot drop, just so she can be a youtube sensation. My apple ipad iis now destroyed and she has 83 views. I know this is completely off topic buut I had too share iit with someone!

http://hippiesaredead.blogspot.com/2009/06/clues-clues.html write my essay cheap write my essay cheap http://hippiesaredead.blogspot.com/2010/

1
1 year ago
By: essay

Yoou said that fantastically. Best Essay writing essay https://essayserviceusukua.com

1
1 year ago
By: Kristal

Howdy! I'm at work surfing around your blog from my new iphone 4! Just wanted to say I love reading your blog and loiok forward to all your posts! Carry on the fantastic work! https://essaygood.com writihg essay website writing essay website (Kristal) https://essaygood.com https://essaygood.com/

1
1 year ago
By: Isis

Seriously tons of very good info! Best Essay writing https://tinyurl.com/yc9xe6c3 (Isis) https://tinyurl.com/y7pguqvh

1
1 year ago
By: Joel

I think this is one of the most significant info for me. And i'm gld readibg your article. But shoulod remark on some general things, The website style is great, the articles is really nice : D. Good job, cheers https://www.patreon.com/posts/45476087 best custom essay writing service best custom essay writing service

1
1 year ago
By: Delila
1 year ago
By: Lauren

Hi Dear, are you truly visiting this web page on a regular basis, if so then you will without doubt take pleasant know-how.

https://clients1.google.com.tj/url?q=https://bestwwwkratom.com Lauren Asa https://clients1.google.sm/url?q=https://cbdwwwkratom.com

1
1 year ago
By: Jeremy

Thanks for any other informative blog. Where else may jut I get thast type of information written inn such an ideal means? I've a undertaking that I am simply now running on, and I've been att the look out foor such information. https://clients1.google.st/url?q=https://kratomwwwtea.com Jeremy Ervin https://clients1.google.me/url?q=https://kratomwwwtea.com

1
1 year ago
By: Emanuelsic

Доставка алкоголя якутск

1
8 months ago
By: Blondell

Kudos! I enjoy it. Blondell https://americandental.ru/ - Melvin - https://americandental.ru/

1
4 months ago
By: Leanne

Hello, its good article about media print, we all be familuar with media is a enormous source of facts.

накачать мышцы для женщин webpage нарастить мышечную массу

1
1 week ago
By: dugelurf

canadian pharmacy viagra 50 mg viagra pranks viagra online

1