SLAE ASSIGNMENT 4 | Custom ENCODER/DECODER - LINUX X86

SLAE ASSIGNMENT 4 | Custom ENCODER/DECODER - LINUX X86

April 26, 2020   assembly, custom decoder, custom encoder, custom encoder/decoder, egghunter shellcode, pentester academy, security tube, shellcoding, SLAE, SLAE x86,

This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification: http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ Student ID: SLAE - 1342

Hello Shellcoders,
     Welcome to Pwsec land once again. Again it's been a week since I wrote my last article. But I guess I get the motivation to complete the assignment only during the weekend. If you haven’t seen my Assignment 3 blog post on EggHunter x86 shellcode, then you can check it [Here]. Today in this post we will be creating our own Custom Encoding Shema and will encode our execve-stack x86 Shellcode with it. Also we will be writing our encoder in python and decoder in ASM. This is the fourth assignment for the completion of SLAE exam. So, the requirement is:

• Create a Custom Encoding Scheme
• PoC with using execve-stack x86 shellcode to encode with our schema and execute.

So I thought a lot but I am not a cryptographer, Therefore, I decided to create a simple encoding scheme which will first add and then xor the output with 0xbb. Let’s start by creating the encoder in python.

Well as you can see we are first adding 73 and then XORing it with 0xBB. Well you must be wondering why 73? Right? Well I have been watching Big Bang Theory from so long now and I am a huge fan of Sheldon Cooper. In episode 73 "The Alien Parasite Hypothesis," the number 73 is actually pretty special. "73 is the 21st prime number," which Sheldon explains. "Its mirror, 37, is the 12th and its mirror, 21, is the product of multiplying 7 and 3 ... and in binary 73 is a palindrome, 1001001, which backward is 1001001." Haha xD Need any more explanation to why not to use it? and talking about 0xbb for xoring. Why? because why not? xD

Pretty easy, huh? If you still have any doubt, then please feel free to ping me on twitter [@Pwsecspirit].

Here is the output of what it looks like.

Now we have the encoded shellcode with us. Let’s write the decoder for it in assembly. Beginning with the assembly code.

aaaa Well, in this piece of code we will be taking a short jump to “call_shellcode”. Also, everything is explained in the comment, let me clear some stuff. In assembly we use ";" (semicolon) to comment something. Ez-Pz… right? Moving ahead.

So in this code, we will be calling the “shellcode” and the next line below the call instruction will get pushed onto the stack, which is nothing but our encoded shellcode. Also I have defined the mlen variable which stores the length of shell ( our encoded shellcode).

So now our encoded shellcode is on stack. Let’s pop it out inside the ESI register. Then we will be xoring the eax with eax to make it 0/null. Then we are moving the length of our encoded shellcode inside the AL register. Which are the lower 8 bits of EAX.

This is the place where the real magic began. So first we are xoring the current ESI value with "0xbb" and then subtracting 73 from it because we have added 73. Then we are decreasing the value of al which is holding the length of the encoded shellcode. Once it set the zero flag then we will jump to the decoded shellcode else we will keep incrementing the ESI address by 1 i.e [ESI+1]..[ESI+n] and taking a short back jump to decode to do the whole process byte-by-byte till our whole shellcode gets decoded.

Here is the execve-stack x86 shellcode code.

In the 1st pane, I've just encoded the shellcode.
In pane 2, I have pasted it inside decode_shellcode.NASM  and assembled the assembly file and linked the object file.
In pane 3, I have just copied the opcode of the disassembled decoder shellcode inside the shellcode.c and compiled it with GCC.
In pane 4, I have executed the shellcode.

Thanks,

Continue Reading

SLAE ASSIGNMENT 3 | EggHunter SHELLCODE - LINUX X86

SLAE ASSIGNMENT 3 | EggHunter SHELLCODE - LINUX X86

April 18, 2020   assembly, egghunter shellcode, pentester academy, security tube, shellcoding, SLAE, SLAE x86,

This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification: http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ Student ID: SLAE - 1342

Hello Shellcoders,
It has been a week since I wrote my last article. Yesterday, I got a chance to work on my SLAE assignments again, if you haven’t seen my Assignment 2 blog post on Shell Reverse TCP x86 shellcode, then you can check it [Here]. Today in this post we will be discussing the EggHunter x86 Shellcode which is the third assignment for the SLAE exam.
So the requirement is:

• Create an egghunter shellcode 
• Should Be Configurable for different payloads. 

So first, let’s see what Corelen has to say about EggHunter, 

It is a small amount of custom shellcode to find your actual (bigger) shellcode (the “egg”) by searching for the final shellcode in memory.  In other words, first, a small amount of code is executed, which then tries to find the real shellcode and executes it.

Pretty easy, huh? If you still have any doubt, then please feel free to ping me on twitter [@Pwsecspirit]

Let's start by viewing the pseudo code for the egghunter shellcode to get an idea for implementation in assembly x86.

fun egg(addr)
{
if (value(addr) == <*egg>)
      jump_to(addr)
else
     egg(addr+1)
}

It gives us a rough idea about what we need to do. Also, I read a ton of blog posts to understand a lot of things and a great paper on egghunting by Skape. Hence I got the basic idea of what we need to do.
So in Skape's paper, he talked about 3 methods -> Well sure there are other methods also to make the egghunting shellcode. But for starters, it might be a great place to start. Anyways, in my assignment, I will be using the 3rd method i.e using sigaction systemcall.

Alright so these are the syscalls that we need to use, but how would we be able to call them? Well for that we will need sigaction().

Now in my first shellcoding post I read the value from “unistd_32.h” itself, but now I use sysref tool by one of my friends @berkcgoksel. Go try it if you know which syscall you want to look for.

Okay so " sys_sigactionl " is at numbe 67, in hex it's value would be 0x43.
Well, we need to look for the value for EFAULT error also, Which is basically just a “Bad address.”

Okay, we will be needing -14 for EFAULT values. You might be wondering why I said -14, when 14 is written over there. Well, the standard errno is a positive number but Linux kernel uses the negative values. Now let's begin with the assembly code.

Your assembly must have _start (It could be any name) in the code so it will understand that the code will begin from that point. Now start writing in the _start section:

This simple instruction will jump to next_addr

Well, here in this piece of code we will be increasing the ECX value by one and calling sys_sigaction syscall to get the next address. Also, everything is explained in the comment, let me clear some stuff. In assembly we use " ; " semicolon to comment something.
Also who are new then here is a cheat sheet for you.

• EAX- System call number 
• EBX- First argument 
• ECX- Second argument 
• EDX- Third argument 
• ESI- Forth argument 
• EDI- Fifth argument

In the end, when everything is done we use " int 0x80 " to interrupt the call. In normal language it's like calling the kernel, giving them all register values and using those values the kernel will get the work done for us. Ez Pz? Moving ahead.

So as you can see my linux page size is 4096 bytes which is 4.096 kb.

We will be doing the bitwise or operation on the current ecx register. Well 0x0fff is nothing but the 4095. After this again the next_addr will run and then the same check_if_efault. Till we get the value where zero flag won’t be set once we find it then we will go inside check_if_egg, 

So inside check_if_egg our cute little egg will be defined. So we will be moving the egg value in eax , after it we will be moving the current value that ecx holds inside edi, which is generally the address pointer. Because  “scasd” instruction checks if the EAX == EDI , if not equals then we will check the next address. We will do it till we get the same address and when it will find the address we will jump to EDI, which currently holds the address to our bind/reverse/execve shellcode (Any shellcode we wanna jump to).

I will be using my Bind Shell from assignment 1.

In the 1st pane I've just compiled my C code and ran the executable.
In pane 2 , I'm just showing my IP address.
In pane 3,  I'm just showing using netstat command that the port 1337 is opened and is in LISTINING state.
In pane 4, I've used the nc command which is short for netcat. I used it to to connect to the Ubuntu box where port 1337 is listening.

Thanks,

Continue Reading

SLAE Assignment 2 | Shell Reverse TCP Shellcode - Linux x86

SLAE Assignment 2 | Shell Reverse TCP Shellcode - Linux x86

April 10, 2020   assembly, pentester academy, reverse tcp shellcode, security tube, shellcoding, SLAE, SLAE x86,

This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification:http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/Student ID: SLAE - 1342

Hello Shellcoders,
    It's been a while since I have written any article. So due to the COVID-19 outbreak, I got a chance to relearn assembly and start working on my SLAE assignments again, if you haven’t seen my Assignment 1 blog post on bind shell x86 shellcoding, then you can check it [Here].
Today in this post we will be discussing the Reverse Tcp Shell x86 Shellcode which is the second assignment for the SLAE exam. So the requirement is:
Create a shell_reverse_tcp shellcode

• Reverse connection to configured IP and port.
• Execs shell on successful connection 

IP and port should be easily configurable.
So, first let’s see what a reverse shell is and how it works,

So unlike the previously discussed post on bind shell x86 shellcoding, reverse shell is slightly different. If you will pay attention to the above diagram, in reverse shell what an attacker generally do is,  he first initiates a reverse TCP connection from the victim machine that has been compromised and uses it to get back to a host (which the attacker controls). Then after successful connect b/w victim computer and attacker computer it launches a bash or sh shell in case of Linux with which the attacker can interact.

I hope the basic understanding about the reverse shell is clear in your mind now. If you still have any doubt then feel free to ping me on twitter [@Pwsecspirit] Let's start by seeing the C code first for the reverse shell to get the idea of implementation in assembly x86. So I am referring to this C code, which you can find [Here].

It gives us a rough idea about what syscalls we will be needing in our journey.

• socket()
• connect()
• dup2()
• execve()

Alright so these are the syscalls that we need to use, but how would we be able to call them? Well for that we will need socketcall() Now in my last post I read the value from “unistd_32.h” itself, but now I use sysref tool by one of my friends @berkcgoksel. Go try it if you know which syscall you want to look for.

Okay so " sys_Socketcall " is at 102 number, in hex it's value would be 0x66. Now in assembly we can't write use connect().  A particular value is assigned to each call instead. We need call numbers for the socket and connect calls.

Okay we will need 1 for socket() and 3 for connect() AF_MAX values. Now let's begin with the assembly code.

Your assembly must have _start in the code so it will understand that the code will begin from that point. Now start writing in the _start section:

As discussed in the previous post we are going to use the same XOR operation. If you don’t know about XOR, let me tell you there is a very beautiful property of XOR which we are using here,
The property says , XOR something with itself will always be 0.
So, " xor eax, eax " will be 0 or NULL out the eax register , same with “xor ebx,ebx” ebx register and same with “xor ecx,ecx” ecx register. All of these  instruction takes 2 bytes in our shellcode so in order to save our 1 byte I have used cdq because the CDQ instruction copies the sign (bit 31) of the value in the EAX register into every bit position in the EDX register.

Everything is explained in the comments but let me clear some stuff just in case.. In assembly we use " ; " semicolon to comment something.

• EAX- System call number
• EBX- First argument
• ECX- Second argument
• EDX- Third argument
• ESI- Forth argument
• EDI- Fifth argument

In the end when everything is done we use " int 0x80 " to interrupt the call. In normal language it's like calling the kernel, giving them all register values and using those values the kernel will  get the work done for us. Ez Pz? Moving ahead.

Well, whenever you interrupt the call the return value of the function gets stored in the eax register. So to save it for our future reference we can save it in some other register that we are not using. So I chose the esi register and I am using xchg instruction so it will simply exchange the value between them.

Its like if esi -> 0 

And eax -> 4

Then after (xchg esi, eax) , the values or the data will get exchanged. ESI will now have 4 and EAX will have 0. Now lets have a look at connect().

It will call connect() , also if you want to change the ip address and port number then you can simply change “push dword 0x8198a8c0 ” for ip in hex-> little endian , " mov word dx,0x697a " for port , with your hex value of your port number.

Now we will need dup2() , Read more about from [Here]. First thing first, we need to find the dup2 syscall number.

The syscall number for dup2 is 63 which is 0x3f in hex.

So we are just running the loop and it will run 3 times with the value. Here we are using a loop for duplicating in, out and error with the file descriptor. Now we are left with the final thing.

This is the basic execve() shellcode. It will just pop the " /bin/sh " shell for us xD . Read more about it. [Here]

Here is the result

In the 1st pane I've just assembled the assembly file and linked the object file.
In the 2nd pane , the attacker is listening on port 31337, "nc -nvlp 31337" command is running to start listening on port 31337.
In pane 3 , I am just executing the shellcode.
In pane 4, I have just shown my IP address.

Please let me know if I made any mistakes,

Thanks,
Spirited Wolf

Continue Reading