Shellcode to reverse bind a shell with netcat
morgawr.github.io
Shellcode to reverse bind a shell with netcat
1–10 of 19 posts
Re: Shellcode to reverse bind a shell with netcat
#2Which distros don't have the openbsd package?
Re: Shellcode to reverse bind a shell with netcat
#3Which distros don't have the openbsd package?
OpenBSD is a type of UNIX operating system. The OpenBSD project focuses on security. Www.openbsd.org
Re: Shellcode to reverse bind a shell with netcat
#4Which distros don't have the openbsd package?
Some of them allow you to choose, I don't think many distros have the openbsd-netcat installed as default choice though.
I run Manjaro on my laptop and we have gnu-netcat as default with the choice of installing openbsd-netcat instead. On my Debian servers I have just "nc" which, if I'm not wrong, is the standard netcat (non-gnu/non-bsd).
Re: Shellcode to reverse bind a shell with netcat
#5Good writeup, not enough people go in depth like this on shellcode!
Metasploit has some decent shellcode. What you wrote here is essentially a specialized execve payload. Some of metasploit's execve payloads support passing arguments to execve, by building the args array on the fly:
https://github.com/rapid7/metasploit-framework/blob/master/m...
There are also lots of reverse shells like this, and reverse stagers too. Additionally, there are other solutions to bind shells being noisy:
See https://github.com/rapid7/metasploit-framework/pull/3017
Which causes the port to show as "closed" in a scan, and
https://github.com/rapid7/metasploit-framework/pull/2981
Which prevents other IPs from jacking your shells.
EDIT: also I think you need a null byte at the end of everything, otherwise the last arg string might not terminate correctly depending on what's in memory.
Re: Shellcode to reverse bind a shell with netcat
#6Which distros don't have the openbsd package?
Lots of network devices will not have nc, wget, curl, etc. Which makes exploiting cmd injection annoying, you often have to drop a bin in chunks using hex-formatted echo.
Re: Shellcode to reverse bind a shell with netcat
#7Good writeup, not enough people go in depth like this on shellcode! Metasploit has some decent shellcode. What you wrote here is essentially a specialized execve payload. Some of metasploit's execve payloads support passing arguments to execve, by building the args array on the fly: https://github.com/rapid7/metasploit-framework/blob/master/m... There are also lots of reverse shells like this, and reverse stagers too…
>also I think you need a null byte at the end of everything, otherwise the last arg string might not terminate correctly depending on what's in memory.
That is what mov long [esi+64],eax does at line 19, it puts a NULL on top of FFFF to properly terminate the array of parameters. It is also reused as last argument of execve() at line 23.
I know I have tested this shellcode against a vulnerable machine (as a CTF, nothing illegal) and it worked well enough.
Re: Shellcode to reverse bind a shell with netcat
#832 / 64 bit shellcoding courses + assembly basics for anyone who is interested:
http://www.pentesteracademy.com/course?id=3
http://www.pentesteracademy.com/course?id=7
Re: Shellcode to reverse bind a shell with netcat
#9Now lets see you find kernel32.dll and do it on windows when you can't make syscalls however you want =].
Good write-up it was well written and very understandable.
Re: Shellcode to reverse bind a shell with netcat
#10Good writeup, not enough people go in depth like this on shellcode! Metasploit has some decent shellcode. What you wrote here is essentially a specialized execve payload. Some of metasploit's execve payloads support passing arguments to execve, by building the args array on the fly: https://github.com/rapid7/metasploit-framework/blob/master/m... There are also lots of reverse shells like this, and reverse stagers too…
>also I think you need a null byte at the end of everything, otherwise the last arg string might not terminate correctly depending on what's in memory. That is what mov long [esi+64],eax does at line 19, it puts a NULL on top of FFFF to properly terminate the array of parameters. It is also reused as last argument of execve() at line 23. I know I have tested this shellcode against a vulnerable machine (as a CTF, noth…
"I know I have tested this shellcode against a vulnerable machine..."
In your article you say arguments to syscalls via interrupt 0x80 are passed in registers. That sounds like Linux and Microsoft.
Have you tested this against a vulnerable machine that passes arguments on the stack?
I think I read somewhere that this is how UNIX handles arguments.