Linux Shellcoding (Part 1.0)

asm
shellcode

#22

i’ve tried to start the shell this way to, and works perfectly

but calling it from the stack is the point…


#23

I agree, i don’t know why it does not work

Disassembly of section .text:

0000000000400080 <_start>:
400080: 48 31 c0 xor %rax,%rax
400083: 50 push %rax
400084: 68 2f 2f 73 68 pushq $0x68732f2f
400089: 68 2f 62 69 6e pushq $0x6e69622f
40008e: 48 89 e7 mov %rsp,%rdi
400091: 48 89 c6 mov %rax,%rsi
400094: 48 89 c2 mov %rax,%rdx
400097: b8 3b 00 00 00 mov $0x3b,%eax
40009c: 0f 05 syscall
40009e: b8 3c 00 00 00 mov $0x3c,%eax
4000a3: bf 00 00 00 00 mov $0x0,%edi
4000a8: 0f 05 syscall


#24

Like I said, I didn’t test either of them.
I quite frankly have no clue as to why it doesnt work, I would have to see a hexdump with ascii on the side.
I personally think the 2nd program is way better, because it loads the string in the RBX register. This shows the potential of x64 shellcoding.


#25

Woah this one is pretty, msg is on the stack right?
then pop/lea it in rdi?
also the add al, 0x3b was cool


#26

The second one works fine!

sorry for the trouble!


#27

Woah no trouble at all :wink:
I’ve just checked it and there seems to go something wrong with the string /bin//sh
It seems a delimiter get’s added between the pushes. (Trying to figure out why).
Another method is using a short jump.

global _start
_start:
jmp short stuff

return:
pop rdi
xor rax, rax
(rest of the shellcode)

stuff:
db '/bin/sh',0
call return

#28

interesting, when you declare the ‘/bin/sh’,0 with no name, the program automatically pushes the string into the stack?

short jump is for relative jump right?


#29

These two should be the other way around like so:

stuff:
call return
db '/bin/sh', 0

This pushes the string onto the stack because whenever a call is used, the address of the next instruction within db '/bin/sh', 0 gets pushed as the return value.


(pico) #30

It is in the text segment and the address is read directly from the beginning of the text segment. A pop will not work. I wrote to try the RIP-relative addressing mode on the x64… as a shellcode it needs tweak… It has a null at the beginning :yum:


(pico) #31

Thanks for checking… Yep, I understood the point. It was just another example


#32

Ooh yes, that’s what I meant


(Command-Line Ninja) #33

Does it still make you head hurt?


#34

This was awesome, nice job!


#35

Thanks @unh0lys0da for the tutorial, found it nice and clear.
Just wanted to say for anyone on a 64bit system(which is surely most of us by now?) you can still compile and link everything as 32 bit like so:
nasm -f elf -o shell.o shell.asm << no change here
ld -m elf_i386 -o shell shell.o << use mode elf_i386
So you can follow along with the tut as it is for simplicity.


(Shellexploit) #36

Thanks for the tutorial.


#37

The quality of tutorials on this site never cease to amaze me.
Awesome work @IoTh1nkN0t!


#38

This topic was automatically closed after 30 days. New replies are no longer allowed.