Monday, 9 April 2018

Coding a custom TCP Bind Shell Shellcode for Linux x86 with Assembly

A shell is a small program that takes input from the user and sends it back to operating system and vice versa. In this writeup I will show you how we can create a custom tcp bind shell shellcode.

So how does TCP Bind exploit shell work ?
In a TCP Bind Shell Exploit Shellcode, the exploit listens for an incoming connection and when the attacker connect to the port on which the exploit runs , it will open up a shell and transfer the control to the attacker. So the attacker now has a shell access to the victims machine and can run any commands.

So there are few points I need to make clear while I write this post
1. The code that I have written went through  lot of  debugging and modification and I am still modifying ( to minimize , to remove bad characters like  PUSH 0x0 can introduce bad characters so I replaced them with something that had the value NULL and then pushed them to on stack like PUSH ECX )

2. Some code which I have written might look STUPID (for example mov eax,edx  followed by mov edx,eax). I just wrote them to remember few things like ( X will always hold Y data before the operation ) and I am optimizing them still to remove them. As I will keep updating my code , I will continue to remove them)

3. I will try to keep the documentation and the details in the code itself , so that I can constantly modify them from the github instead of modifying them twice , i.e here and in the github again.

Part 1 : Writing a TCP Bind Shell in C. Now why did we start wring with a C code?

Firstly while coding with C we will use some  function calls which we will re-implement them exactly the same in our Assembly Code
Secondly due to the availability of the documentation in linux. So we can look up any documentation of the function by issuing the "man" command e.g man socket

Part 2: Replicating the same TCP Bind Shell in NASM

Part 3: The Generated Opcodes

Part 4: Testing our shellcode. Here I wrote the code in such a way that the port number is reconfigurable to any port instead of the default 9000

This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification:
Student ID: PA-1191