Hello, my name is typhoon and now let's switch to assembly and explore executing bash using the exec
call and all while utilizing the execute technique.
So what we're going to do here is we will create a section data section data and we will create the
path here DB double slash I will explain why we did this double slash here.
And of course we need the zero after that.
And now we will create a section text section text uh global start is going to be starting point of
our assembly application and label.
And now XOR rax rax posh rax move rdx rsp and here xor rax racks.
Plush racks move and after that we will move the RDA.
RSP, I will explain all of these codes here.
Don't worry, this will be actually don't this won't be actually the long code here.
And now we just need to clean the RDX.
And we will move the al.
It will move this 59 to al which this is the exact we exec we syscall number.
Let's actually comment it down here.
Executesql number.
And after that we will call the Cisco.
Now that's it.
And now let's exit our program.
Racks.
Racks again.
And move our die racks.
MOV rax 60.
Will, this is the exit call Sysctl.
Number exit.
Exit syscall number and we will call the syscall again.
So here we start storing the string double slash bin slash uh s h in the data section.
And we start the start label for our program.
We set the rax to zero using x or x rax and push it onto the stack.
And this is used as a null terminator marker here.
And we move the stack pointer to r d x uh to get our third argument.
And we push another null value and use its address as our d I here.
So as you can see here.
Now after that we load the address of path uh into RSI and Ves.
And again we are zeroing out the RDX uh, here.
And we are setting the Al to 59, which is the syscall number for exec.
We and we trigger the syscall using this syscall here.
And we clear the RDA and set Rax to 60 uh which is the syscall number for exit.
And we trigger uh exit syscall using this syscall here and continuing our exploration.
And now we complete the task of parsing bin sh path onto the stack.
However we are faced with a constraint here.
So let's actually, uh, compile it here.
Yes.
Assemble it and then link it.
So.
It was.
Yeah.
Source shellcode LLS and xigui.
Hey!
Look out!
And a Ram stack.
All here.
So that's it.
Now clear here.
Now let's, um.
Assemble it using this, um, an ASM here.
So in order to do that, we will just write an ASM.
DSM here.
After that, we will need to use the, uh, f elf64 because this will be run on 64 bit machines and,
um.
Exactly.
And no, it was.
A zig zag technique that asm.
Um.
Oh, here, uh, this is going to be our object file exec v dot o.
And after that we will link it.
So ld exec v dot o and output file is going to be which is executable file.
It's going to be exec v.
That's it.
Now let's run it.
And as you can see we got nothing.
But actually we did need to get something from here, which is the shell call here.
And.
The reason we are not getting this we because we are.
We need to turn this into the.
Uh, bytecode.
Firstly, and in order to do that we will use Python here.
Again let's actually use the Python two.
And now we will define a string with double slash bin s h.
So this was the skeleton of our assembly program here.
And now we will change a little bit codes from there.
And.
In order to do that.
So as as you can see, we have faced with a constraint here, as I said.
So our code structure can't accommodate null bytes.
Therefore, we adapt our approach approach by employing the double slash here and or here or there.
So it actually it will work on both ways, but it's actually looks pretty nicer with like that.
Now uh, we will go to Python.
Now let's actually.
Yes yes yes yes.
And now we will define a string in Python two because we will encode it and reverse it.
You know, we will first reverse it and then encode it.
So string here.
Um double slash bin s h.
And after that.
Enter.
Let's print a string.
String.
And yeah, this is our string.
And now we will create an encoded string here, which is we will reverse it firstly minus one.
And after that we will encode it with hex in quotes.
That's it.
And let's actually print the encoded.
Encoded?
No.
Encoded string.
And that's it.
So this is our encoded string here.
So with this here we define a string containing the desired path.
In this case bin sh.
And after that uh here somewhere.
Yeah.
And here we are.
We are also defining encoded string.
But now we will using this this string which has been a sage and reversing the string using the slicing.
And after that we obtain the like reverse this here.
Let's actually show this.
So string.
Minus one.
Here.
And as you can see, we are getting something like H, S and IB which is the reverse side of this,
um, bush.
And um, after that we are encoding this.
And as a result we are getting this encoded string here.
Now let's copy this to some text pad notepad not text.
And that's it.
So the sequence of operation generates the hex encoded value for our adjusted path.
So by reversing the string and encoding it, we have achieved a workaround to ensure compatibility with
our code structure.
So this allows us to embed embed the path on to the stack without introducing null bytes.
And as we progress, remember that these intricate steps embodied a sense of crafting efficient and
functional shell code.
And our journey continues as we build on this foundation, unraveling deeper layers of assembly, programming
and system interaction.
And now we will need to parse the strings into the stack here, which is this shell bytecode.
And first we are going to pass our prepared path string into the stack.
Since the string consists of eight bytes, we will employ the rbx register for this task and we will
load the value.
Uh, this value into RB, which corresponds to the SK representation of behnisch, and then push RB
onto the stack.
So we have uh, move something like move rb x here.
So, uh, we will first delete here RDX, and here we will, uh, move the RDX.
Here and now we will.
Patchett.
Again, as we did in previously.
And after that.
Now we loaded.
Push it here.
And.
Yeah, sure.
We have done with this, I think.
Or since we are created this we might get.
Aw, yeah.
After that, we punched the RHB.
Here we will move the DH.
That's actually.
No, we don't want this.
So we have deleted this.
So move the RSP.
And.
Let's delete this code and start it here.
Because it's editing assembly code is actually pretty challenging thing to do.
And uh, now we will move the RDI, RSP and push Rax again and push RTI.
And we will move the.
RSI.
RSP like this.
Yeah.
RSP and we will add racks 59 which is a Cisco for Cisco number for our.
Program here.
And after that, we don't want to end this program for now.
But here we got some errors, I think expression syntax error with the problem.
Hmm.
Yeah.
Because we need also we need to tell the assembly to that this is a, uh, byte code here.
And.
Yeah, that's fixed.
Now, let's, uh, assemble and link our program again.
And as you can see this compiled successfully and LD linking here and exec we got the segmentation fault.
Hmm'hmm.
And I got a segmentation fault here.
Which actually we also need to delete this data here.
So we are not going to use any data.
And start.
Section?
Yeah.
Section.
And also we will need to define this global section on the first line global.
Start.
Let's run this again.
We've got the segmentation fault again.
And I think I found this error here because after this call, we need to also call the syscall.
That's it.
Now let's.
To compile it.
And here we got the shell.
Uh, which is a good thing to do.
And as you can see here, um, we can do everything like we do in terminal here, like move LSL, a
full MI, and so on.
Now we will get, uh, we will convert this into a shell code, as we always do.
Now I will get my, um, this command here because it's actually takes almost four minutes to write.
Without any errors.
And it should be somewhere here.
And as I was, as I always do, I will share it with you here.
Yeah.
This is our objdump command.
Let's go to here now.
Now we will go to stack.
We will go to see the source and shellcode.
And here we have this exec.
We, we will get this shellcode here and change.
Hello to Execve.
That's it.
Now this is our shellcode.
Now copy this and we will use C code to inject our shellcode.
Now we will go back to sysinfo dot c file.
Now let's delete this.
Actually this is not the sysinfo.
This is let's name it the exec shell dot c.
So we will firstly include the uh studio age.
And then we will also include the string here.
Yeah.
We will also include the string.
And after that we will define our main.
And then the shell code so include include stdio.h include include the.
Include the string dot h.
And after that we will define main here.
Printf.
We will, as we always do.
We will also print the shell code length.
So shell code length.
And we will use Z.
You here.
New line.
And we will use strlen.
Const character.
And we will enter our code here.
But let's actually define our code.
So we will define unsigned character character shellcode here.
And that's it.
Also we need to define as a string.
So we will open the quotes here.
After quotes we will close this line here.
So const character and shell code here.
That's it.
Now after that we will also define this integer function here pointer function here.
So red.
And we will name it integer.
And.
Shellcode here again.
And that's it.
We will also call this ret.
And that's it.
They also defined it.
Here.
Now.
Perfect.
Now let's compile it.
And.
In order to compile it.
Um, we will use the no stack protector and exec stack here.
So gcc f no stack protector.
Can you hear my voice?
Sorry.
Yeah.
Uh, z exec stack and exec um, exit exec v, we got an error here, so let's find out.
Wait.
No, no, we need to compile this.
Exactly.
Here.
Not the assembly program.
Yeah.
Let's see.
And that's it.
It's compiled successfully.
And congratulations.
Congratulations on reaching to this point.
So you have masterfully transformed complex assembly concepts into a functional shell code.
And now, uh, we will delve even deeper into the realm of shell code, exploring the advanced techniques
and widening our understanding of how these powerful tools are developed and applied.
So now let's execute this program and see what happens.
Right.
So.
It was a drought.
Yeah, we have the shell code length and.
But we are not getting the shell here.
So there's something wrong in our code here.
Let's actually go back there.
Yeah.
We need to call this function.
Sorry.
Now let's recompile it again and run it.
And as you can see here, we got the shell clear.
Now let's run it.
That's it.
So LZ LZ la Amie.
And here.
So as we execute this program, you are essentially triggering your carefully crafted shell code.
So the results you observe are testament on your dedication and skill in the realm of shell code development.
So you have harnessed the power of the kernel to execute the execute with skill.
And in doing so, you've opened the door or you opened the door to limitless possibilities.
So your journey into the depths of assembly, shell code, and system interaction is undoubtedly a fascinating
and rewarding one.
As you continue, uh, holding your skills, don't hesitate to explore further and experiment with more
intricate concepts in the ever evolving landscape of cybersecurity and low level programming.
My name is Stephen and I'm waiting you in the next lecture.