Hello, my name is Tayfun.
Now, in this lecture, let's embark on an exciting journey into the world of Shellcode creation.
We will utilize our existing knowledge to generate straightforward and fully customized shellcode.
As we will delve deeper, we will encounter challenges like problematic characters and learn strategies
to eliminate them.
And continuing our exploration, we will delve into the creation of more advanced shellcodes and additionally,
we will discover how to generate our own shell codes automatically using the Metasploit framework.
And in this section we will explore the fundamentals and dealing with troublesome characters.
We will learn the relative addressing technique.
We will also gain understanding of the exec weak syscall.
We will create a bind TCP shell.
We will develop a reverse TCP shell.
And lastly, we will generate Shellcode through Metasploit framework.
Now get ready to enhance your understanding of Shellcode creation.
So to kick things off, let's grab the concept of Shellcode.
So as we previously explored, Shellcode refers to a set of machine instructions.
Here.
Let's actually open our Hello World program that we created in assembly here.
So it serves as a payload often utilized in stack overflow attacks.
So these instructions are derived from assembly language and our approach is straightforward.
We will write the desired functionality of the shellcode using assembly language and subsequently if
you adjustments will be made before converting it into machine code.
So let's take a shot at creating a simple Hello world shellcode and then transforming it into executable
machine code.
So for this task we will employ the Objdump command.
But first, as you can see here, we already developed this in previous lectures and you can also just
simply copy this and I will share this source code in the downloadable sections of our lecture.
And now what we're going to do is we will open our terminal here.
Let's actually.
Open our terminal again and hear what we're going to go is.
We'll go to this directory.
CD our source source here assembly and hello dot ASM.
Oops.
Hello dot ACM is a directory of course.
So that's it.
So now in assembly we will go to Hello world.
Uh, now, as you can see here we have this.
Hello.
So whenever we run this program.
Hello?
And we are printing just Hello world.
And now we will use the obj dump.
Actually, we can also use the make to create this Halo program from zero LA.
And as you can see here, it is followed from zero.
And now what we're going to do is we will run the objdump here, Objdump, Uppercase D, M and Intel
and we will use the hello and that's it.
So you can see here we have several outputs here.
Now here we have the disassembly of section debug line.
But what's important to us is the disassembly of section text and data for now.
It should be somewhere.
Disassembly of section as you can see, disassembly of section inter ARP.
But we need the data and text.
And I will show you the interesting thing about this.
Age frame dynamics.
The SS command.
Debug info.
And the bug line seems like we don't have.
Output here.
Dynamic.
Oh, seems like we have this here.
I just skipped it and didn't see it.
And here we.
You should see this, uh, text section.
After the year.
Action text.
Where are you?
Text?
Yes.
Yeah, we have the text section in it.
And section text.
And as you can see here, there's a content displayed in the middle of the.
Hour terminal output.
So this content here represents the machine code corresponding to our Hello world example.
However, we aim to convert it into specific format.
Something like this.
Actually, let's open the new text file.
So we will turn it something like like x.
F, f x.
F.
F or x.
A b.
X this.
So this is actually a shell code.
So where our F so each two characters here, hex characters signifies an operation code while it's possible
to perform this conversion manually.
So I didn't I don't recommend that nobody does that and doing so line by line can also become a quite
labourers.
So luckily there's a more efficient method available to us.
So if you want to do that manually, it would take like hours or even weeks to complete this and even
without an error.
So of course, so now what we're going to do is we will use again, we will use a objdump obj obj dump
M here, Intel D and here you will enter your file name.
In this case, it's Hello.
And after that you will also use the grab this here.
09AF.
Sorry.
Here.
Yeah.
Uh, that's actually right.
From zero again.
Uh, I accidentally pressed enter here while typing.
So here.
Uh, now we will again use pip.
We will use grep v file.
Part.
Since I have a microphone I don't like, the microphone is always interrupting with the keyboard and
that's why I accidentally pressed enter previous time.
So F2D here pipe.
Part F one.
Zero.
Let's actually check it from zero.
So we objdump m Intel grep from zero nine and a f.
And after that we have again pipe grip we file at F2.
Yes, that's it.
And here.
Yes.
And also, we need to.
After this, we need to write some more codes here.
After cut here, we will so cut f2 d and after that cut F1.
F1.
D here.
And pipe again.
TR.
S.
Public on.
T.
I will also share this moment for you because it's it's sometimes struggle to write it from zero.
So the backslash and not much here.
And.
So said as.
Yeah.
And dollar sign.
I will slack here.
Let's again here.
Six.
Um.
Here we will be paste.
Be here.
And it's actually try it again.
So objdump m Intel grep.
Run grab file cut f2 d.
Card F17D.
Uh, tears.
Like, uh, the courts here.
But this courts has spaces in it.
I will share this, uh, code with you, as I said.
And here.
R e.
Via three courts.
And set.
Yeah, I think it's okay.
Yeah, that's it.
And here, this is our machine language code here.
So next, uh, we can use the CP, uh, code for testing our machine, uh, here.
So in order to do that, we will open the new main.cpp here.
Actually, let's close the previous one.
And.
Delete that too.
Of again and iel new text file.
So let's save it.
And the source code.
We also have this here.
Yeah, we can save it here.
Replace and that's it.
And here what we're going to do is we will include the stdio dot h and we will also include the string
here.
String dot h.
And we will create the unsigned character code, an unsigned character character, and let's name it
code here, just basically code.
And here we will use quotation marks here and we will get this here from just last ring, last character
and without spaces.
And copy this from the start of this.
What?
Here?
Control shift C And after that we will put it here.
That's it.
And now what we're going to do is we will create our main function, integer main.
And here.
We will print f.
This is.
My shell cord length here.
Now I'll use the decimal to show the shell length, and after that we will use a new line.
And what we're going to do is we will use the comma here.
Integer.
STR Len here to show the string length and we will pass this code variable which we created earlier
here.
Code unsigned character.
And that's it.
And the code again.
And we will use the integer.
Right here.
Oops.
That's it.
And after that, we will call this right here.
And we are done.
And what we're going to do is now we will open the oops, sorry here.
So what we're going to do is now we will open the new terminal here, see to our project.
I think it was on source here, say the shell code, LZ.
And as you can see here, we have that main.cpp here and we have the shell code and main function.
Now we need to compile this, right?
So GCC F, no stack protector, protector, the exec stack here and main.cpp.
And that's you can see here we got some error here related to this invalid conversion from unsigned
character to const character.
So this error actually seems to be related to an incorrect type conversion in our Printf statement here.
So the error message is indicating that there is an invalid conversion from unsigned character, unsigned
character to const character.
And when you are trying to calculate the length of your shellcode, so.
And and in C plus plus, when working with character arrays or strings, you should use appropriate
datatypes and functions to handle them.
Since you are dealing with shell code represented as unsigned character array, you need to use the
correct format specifier in the parentheses as well.
So what we're going to do is we will actually, um, use instead of using D here, we will use Z U and
we will also use this.
So we will delete this integer.
And in Strlen actually it's this and write it again.
But let's actually add the printf race here.
So str Len str Len.
Const.
Character.
And we will pass the code.
So again, we got some error.
So expected an expression here.
Yes, because we also need to add this string and let's actually close this.
That's it here.
Let's actually try and run this.
And as you can see here, our program is compiled successfully and we have that a dot out.
So let's run it.
Pay that out.
And as you can see here, my shellcode length is 27.
And we also have this segmentation file and I will explain what this output means.
But before that, let's actually explain this code.
So you basically know this main function here.
What this main means, this is the main function, the starting point of the program's execution.
And this is the where the program begins to run.
And we also have this printf.
Printf my shell code Strlen const char code.
So this printf is a function from the C standard library used for formatted output.
So if we delete this C studio here.
And we will get with this on an undefined printf here.
So we need this.
We include this STD input output for the printf command here and also.
Uh, so we have this is a marshall code length, uh, Z u.
And here, this is a format string to display a message followed by an integer.
And this remember we wrote, we actually coded it firstly with D for showing decimal, but now we've
changed it.
So this is a format specifier indicating that an unsigned size value will be inserted in place of the
U here.
And we also have the strlen, this expression here.
So the Strlen function, as you know, calculates the length of the null terminated string.
So here code is cast to const character type to match the expected argument type.
And we also have the integer ret.
So this declares.
So here firstly, we are declaring a function pointer named ret.
So this, this is a pointer to a function that takes no argument and returns an integer.
And here we are assigning the address of code array to the RET function pointer and it uses the typecast
integer here, as you can see here, to treat the address of code as a function pointer with a specified
signature.
And this RET also we have here, this is a function pointer declared in the previous line.
So we are calling this with this syntax.
We are calling the function pointed to by red.
Since red points to the code here and the red points the codes arrays address.
So this effectively starts executing the shell code.
So in summary, this code takes advantage of function pointers and the ability to treat data, the code
array in this case as executable code.
So it prints the length of the code array which represents shell code, converts the arrays, address
into function pointer and then calls that function pointer, effectively executing the shell code.
And as you can see here, while we started this here, a dot out, we are seeing the, uh, you, you
can see this output here and the segmentation fault because, uh.
Our shellcode didn't work.
So the reason was that there is a bad characters in it.
So this takes us to the next lecture, which you will learn that here.
So whenever no matter how many tries you make, you will get segmentation fault.
And I did that on purpose too for the which is the as the next lectures.
Uh, topic here.
You will see how to avoid these bad characters and how not to get the segmentation fault error because
this means that our shellcode did not execute it.
Awaiting you in next lecture.