Hello, students.
My name is Stephan, and in the previous sessions we have been delving into the world of Shellcode development
and assembly programming, and we learned about crafting shellcode, addressing bad characters, utilizing
relative addressing and refining our code to ensure efficient execution.
In today's lecture, we are about to embark on an exciting journey.
We will focus on assembling and linking our code, ultimately creating a piece of C malware.
But that's not all.
And we are taking things a step further by injecting our carefully crafted shellcode into our application.
So this integration promises to be a fascinating intersection of theory and practical implementation.
So fasten your shellcodes because we are about to explore the process of turning concepts into tangible
executable code.
Now let's dive into the world of assembling, linking and injecting a shellcode into our CPP.
So we're reached an important let's actually close this, open a new tab.
Yeah, we have this here.
So we have here we have reached an important juncture in our learning journey.
As you recall, we have been carefully constructing a shellcode that encompasses a series of intricate
steps.
And one of these steps involves manipulating memory addresses.
So in our current phase, we are dealing with address of this malware injected string.
So this address is expertly pushed onto the stack and the pivotal area of memory used for temporary
data storage.
So subsequently we perform a pivotal operation which is the pop RC here.
So this instruction takes the address we have placed on the stack and seamlessly transfers it into the
RC register.
So a specialized storage location within the CPU.
So by executing the pop RC here, we facilitate efficient access to the address now stored in the RC
register.
So this action will prove crucial as we proceed to build this address in this next step of our shellcode
development.
And remember, each step contributes to the intricate dance of assembly programming, resulting in culmination
of our meticulously designed shellcode.
Now let's actually.
So we have compiled this assembly code.
We have assembled it, linked it in previous lectures.
And as you can see here, when we run this, it prints out in the terminal that the malware is injected.
So this is just the print print function here.
Actually, we didn't have any malware in it, but we can manipulate this in a way that we can here,
like the buffer overflows and other privilege escalation attacks.
Now what we're going to do is we will we will create the shellcode since we have already have this assembly
program here, runnable here.
So we will again use this long cmd long terminal command here Objdump m Intel D Hello here the Hello.
And as we write this I will explain this line by line.
Let's actually first write it down here.
090.
Oops.
Actually, let me fix this microphone here or can you hear me?
Yeah, perfect.
Now what we're going to do is we will use the 9AF.
And here pipe grep v So we are.
We will, we will.
We don't want to see any files here cut or header information.
So if 2D cut.
Uh, cut F1FF17D.
Here.
Here's.
Here.
A.R..
He.
Set as here.
And dollar sign.
Double slash g.
Said.
As.
Next.
And lastly, paste.
The.
S.
Objdump.
Not objdump.
Oops.
And we also need to enter our program here.
So hacked here, as you can see.
And we got this option requires an argument.
We actually have this here.
So cut.
Here.
Yeah, I think.
Yeah.
We need to make space here.
Right?
We got this error again.
Like this.
Here.
Let's fix that also.
And as you can see here, this is our shell code.
And as you can see here, we have something wrong in the shell code because we need to add spaces between
these.
Courts here.
Also, I think we need to know we don't need this spaces here.
Let's try it.
And as you can see here, this is a valid shell code.
So if you are seeing this axis without any values hexadecimal characters, then this means there is
something wrong with your shell code here.
And this is our shell code here.
Now, what we're going to do is I want to also explain this Objdump command here.
So this objdump m Intel hacked here.
This part runs the objdump command on the file named hacked and disassembles it using the Intel syntax.
And it provides a detailed disassembly of the binary.
And we have grep 09AF, and this here.
This filters the lines that start with the hexadecimal number, followed by a colon which are indicative
of assembler instruction and grep with file here.
This excludes the lines that contain the word file, possibly removing some hidden information from
the output.
And we also have this here cut F2D this extracts the second field.
This is the actual assembler code using the colon as the delimiter delimiter.
And we also have cut F17D with quotes here.
So this is extracts the first two seven fields from the output which are usually the hexadecimal opcodes.
And as you can see, we also have t r s with quotes.
So this says this.
This squeezes multiple spaces into a single space, helping to standardize the format.
And we also have this like double quotes here.
No double single quotes here.
So this replaces tabs with spaces.
And we also have set a set dollar sign G.
So this removes any trailing spaces at the end of each line.
And we also have set s slashes a lot and this replaces each space with this X to format the output in
a way that's often used for shellcode.
This is this as you can see, the that's it.
And we also have the paste, the lastly paste the s, so this constant, so this actually concentrates
all the lines together to form a continuous string of formatted shellcode.
So when you run this entire command together, it takes the disassembled machine code output from Objdump
process, it processes it through the of series of transformations and outputs as a string of shellcode
in a specific format.
So this format of shellcode is then ready for use in your C or assembly programming.
Now what we're going to do is we will create a new.
Her main dot see here.
Or hacked.
Hacked to hear that.
See?
And now what we're going to do is we will include the include the Stdio.h.
So do H, include the string.
That age and now we will create our main function.
In this main function we will oops.
Notice here this main function.
We will firstly create our unsigned character, which we will name it our shellcode.
And after that we will enter this output into our array here.
So unsigned character array called array or actually let's make it Shellcode Shellcode array here.
And with this we will enter in the codes here.
Let's copy this.
From here.
Paste here and semicolon.
Now, we will here we will also print that how the length of our shell code print f the shell code length.
We will use the here.
And after that, we will actually use the new line.
After printing our shellcode length.
So integer str Len.
And cut.
Shellcode.
Now.
That's it.
Here.
No, not here.
Here.
And now.
We will also use the integer.
Create a new function here, basically.
And Integer does.
Here.
And I saw outside of the civil right shellcode.
And we will call this function.
That's it.
Now, this code is a C program that's designed to execute a shell code, which represented as a sequence
of hexadecimal values.
Now, let's break it down step by step here.
So here we are using two includes.
We are including two header files.
So these are the preprocessor directives that include the necessary standard libraries for input output
and string manipulation.
And we also have the this is the main function, this is the main function of the program where the
execution starts.
And here in this unsigned cash shell code, this line, initialize an array named Shellcode to hold
our shell codes.
So the shell code itself is carries of hexadecimal values that represent machine instructions, and
it's stored as an array of unsigned characters, which is also we can call bytes.
Now here, this part contains the actual shell code represented as a hexadecimal values, and each pair
of hexadecimal digits represents a byte of machine code.
So the shell code here performs a specific action such as executing our syscall and printing the here
injected malware injected string on the command line here, and we also have integer.
So the print here.
Uh, yeah.
Before this read we have print.
So this line prints the length of the shell code.
Using this print f function, it calculates the length of the shell code using the using shell code
array using this str Len and prints it as an integer.
And we also have the integer read integer shell code.
So this line declares a function pointer named read.
So this function pointer is initialized to point to the memory address of the code array.
So this effectively creates a callable function from the shell code.
And with this, here we are.
This line call.
With this line here we are calling function pointer to by the read pointer.
And in other words, it executes the shell code.
So in summary, this C program acts as an executor for this provided shell code and it calculates and
prints the length of the shell code, converts the shell code into a callable function using the function
pointer and then executes the shell code.
And this also allows you to test and observe the behavior of your shell code within a controlled environment.
Now, what we're going to do is we will let's actually compile this main here.
Clear.
Now we have this.
Hacks tool that see here.
Now, in order to compile it, there's a simple command.
We will use the GCC F.
No stack protector.
Z x x stack here and here we will hacked tool dot C.
Now we have some problem here.
As you can see here, integer from incompatible pointer type integer.
Let's see it here.
So we got the type conversion error, but we can simply fix that easily here.
Now, as I said, we have some type conversion errors here.
And in the this initial code, we were trying to calculate the length of the shell code array using
the STR Len, which returns a value of size t.
However, we were trying to cast it into integer, which could lead to potential users, especially
in the length is larger than what an integer can hold.
So in this corrected code here, what we're going to change is we will change it to Xu here and here
we will use we will actually.
Delete that and we will use str Len here and const character here pointer and after that we will enter
code shellcode.
And that's it.
Here, our code is fixed.
Now let's try this.
And we got that.
Error again.
So integer from incompatible pointer type.
Integer pointer here.
Shellcode character.
And we also have at the line eight here you.
And we've got the same error here, but we change this.
So if because it's actually our error was not raised here, but since we changed it, it actually we
did a good thing here because if our shellcode was bigger than the size of our integer, then we will
get the error at line seven.
And now what we're going to do is we will fix that here so we get some type of problem.
Integer Shellcode here.
So the problem is here.
After that.
Yeah.
And here.
Now, the problem will be fixed here.
And as you can see here, our.
Program is compiled and we can run it a dot out.
Now let's run it again in the new line.
And as you can see here, Shellcode length is 55 and malware is injected.
So fantastic.
All right.
So you've wrapped a.
Uh, so now we have wrapped our.
Lecture beautifully and in the session.
We have covered a wide range of crucial topics from the Shellcode, which we used here.
Let's actually go here.
So we use the GMP technique to explore new debugging styles with GDB and utilizing tools like valgrind.
In previous lectures.
So these insights are invaluable for anyone interested in shellcode and exploit exploit creation.
So by delving into these techniques and tools you are, you are equipping yourself with essential skills
for creating efficient and secure code as well as gaining deeper understanding of the intricate world
of shellcode development.
So I'm excited to continue this learning journey with you in our next lecture.
Feel free to bring any questions, doubts or ideas you'd like to explore further.
Until then, keep up the great work and I look forward to our next session.