Hello everyone.
My name is Stephen and in this lecture we are diving into the realm of creating a functional shell code
using the exec with syscall.
But first let's grab the concept of the exec syscall.
So the exec syscall plays a key role in executing programs or scripts.
And to understand it better, let's refer to the man page.
Uh for using with using this command man two exec v and as you can see here, exec V means execute program
library standard C library synopsis here is used.
We are firstly need to include this header file and the executes the program referred to by Pathname.
So this causes the program that is currently being run by the calling process to be replaced with new
programs with newly initialized stack heap and initialize an uninitialized data segments.
And here we have.
The Pathname must be either a binary executable or a script, starting with a line of the form interpreter.
And uh, here we also have our argue.
Here is an array of pointers to strings based on the new program as its command line arguments.
And we have a envp here.
This is an array of pointers of two strings, conventionally, uh, of the form key value, which are
passed as the environment of the new program.
So the Envp array must be terminated by a null pointer.
And the first argument here.
My actually this scroll.
Mouse scroll is pretty broken and that's why I'm struggling.
Now we're getting this fixed.
Yeah.
And here the first argument is the program we intend to execute.
And the second argument Ari give here is an array of arguments related to the program.
And importantly, it should include the program's name itself.
And we have the Envp here.
This is the third argument.
Envp allows us to pass arguments to the environment.
In our case, we can set it to null.
So now let's go to Visual Studio again and create a new program.
Let's actually delete this one here and new new C file.
So let's name it uh c Sysinfo dot c.
And now we will include the uh honesty dot header file.
Now this not include yeah include here.
And after that after that we will integer main.
Uh, character.
Const are give here and the first we will pass the cat and and then the.
Etk.
Uggie.
And Newell.
Here.
And after that, we will call the exec.
We.
And pin cat.
Here are give.
No.
And we will return zero.
And we compile this code and execute it to see the contents of ATC Udgir.
Let's do that.
Source shellcode.
Lzw.
Sysinfo.
Let's compile gcc sysinfo.
That's it.
And now let's run this executable.
And as you can see here Caligineus GNU Linux rolling.
So if you run this cat.
E-t-c Usuay we will get the same result.
So we are basically executing this command here.
And, uh.
Here.
That's it.
Right.
So we executed our code successfully.
And now we will delve into the direct and technical approach of utilizing the Executesql within a C
program.
And our goal is to execute the command without relying on intricate shellcode techniques for now.
So let's, uh, dissect the provided code here.
Uh, actually, let's, uh, change this provided code.
And uh, for a deeper understanding, you will see.
So we will open a terminal here and it will be awesome here.
So const we will not change anything here.
Just we will change the bin.
S h here.
And been.
S h.
So there's a magic comes in.
Clear.
Uh, can you hear my voice?
Yeah.
Perfect.
Now GCC here and a dot on we have unexpected.
Yeah.
Where.
Mm.
Const r r g v.
Here.
Cat.
No, no, we don't need that cat here.
Perfect.
And that's it.
So we got this shell here.
But now let's let's explain this code here.
So we begin by including the necessary header file and an honest.
On SDH here, which contains system call declarations for our Zigbee and with main.
Here, our program starts with the main function serving as the entry point for execution, and here
an array named RGV.
Here arguments uh is defined.
It holds two elements boenisch and uh null here.
So boenisch represents the shell binary acting as the command interpreter, and null here signifies
the end of the argument array as required by the Zigbee syscall, and so executes syscall behnisch rg
with rgv null.
Here this line invokes the Zigbee syscall directly, and uh.
The first argument, minus h, specifies the program to execute the shell, and the second argument
RGV points to our array of arguments, in this case boenisch and the, uh, second argument null and
indicates no additional environment arguments.
And here we have the return.
Lastly, the program concludes with the standard return statement.
And that's it.
Yeah.
We are basically got this here.
Who am I typhoon.
Yeah.
Clear.
Yeah.
We are basically got this shell here.
So what's the significance here.
Is that direct utilization of this execution cycle within a C program.
So this sidesteps the need for complex shell code accomplishing command execution through straightforward
means.
So this approach not only simplifies the process but also fosters a solid grasp of core system call
mechanics.
And our journey continues as we delve into assembly programming.
In our next example, by examining registers, memory, and Ram instructions, and we will gain a deeper
insight into system interactions and execution.
So in the next lecture, let's start.
Let's delve into the world of low level programming and further expanding our knowledge.
I'm waiting you in next lecture.