Hello everyone.
My name is Stephan and now let's delve deeper into a significantly valuable aspect of our study the
construction of a TCP bind trail.
The concept of TCP bind trail revolves around the establishing a server instance on a designated machine,
referred to as the victim or target, so the server remains in a state of anticipation, awaiting an
incoming connection from a separate machine termed as the attacker or hacker.
So the critical functionality of this connection lies in its facilitation of command execution on the
server by the remote attacker.
In a sense, a TCP bind shell serves as a pivotal mechanism for remote command execution.
By skillfully configuring this arrangement, an attacker can efficiently and effectively wield control
over a victim's machine throughout the execution of commands, so the sense of this process resides
in the establishment of a connection between the attacker and the victim's server, so subsequently
enabling the seamless transition and execution of instruction.
So the intricacies of crafting a TCP bind trail span the domains of networking protocols and programming
paradigms.
So the victim's machine server is meticulously configured to bind to a specific port, allowing it to
listen attentively for incoming connection requests.
So this implies that the victim server is in a state of readiness.
So a poised to response and to an engage initiated by the attacker.
So upon the successful establishment of this connection, the attacker is endowed with a gateway to
remotely communicate with the victim's server.
So this interaction materialized rises in the form of command transmission, enabling the execution
of directives on the victim's machine.
Such a mechanism inherently raises concerns pertaining to security and ethical considerations, as an
authorized command, execution can lead to compromised systems and networks.
In our exploration of the TCP bind trail, we shall delve into the intricate details of port selection,
socket programming, and orchestration of communication flows.
By grasping these intricacies, you will be equipped to not only comprehend the mechanisms of remote
command execution, but also appreciate the importance of robust security measures to thwart potential
misuse.
So throughout this comprehensive study of the TCP bind, shall we aspire to empower you with the knowledge
and insights necessary to navigate the multifaceted landscape of network programming and security?
So the creation of the creation and analysis of such construct necessitate a nuanced understanding of
programming languages, network protocols, and ethical dimensions that underscore the digital realm.
So, at its core, a bandshell in the context of C programming is sophisticated embodiment of the network
programming concepts.
So this construct encompasses the orchestration of socket creation, binding, and listening, all of
which culminate in the establishment of a robust network communication channel.
So this channel, forged throughout meticulous programming techniques, facilitates the interaction
between the victim's machine server and the external attacker.
Now, our journey into the realm of C based bind trails is poised to equip you with the foundational
knowledge required to construct and dissect this intricate construct, and by unraveling its inner workings,
you shall gain in an in-depth understanding of network programming, security implications, and the
symbiotic interplay between attacker and victim's machines.
So now we will create the new file here, which is the C program file.
So let's name it TCP bind dot c.
And now we will include the yeah five headers here include c s socket dot age include system.
Include system types here.
Include.
System.
Now we are enough of system here, so we will include the stdlib here.
And we will include the.
On S.T.D., which we use that in previous lectures.
Yeah.
And we will also include the.
Net init and in dot h.
And now we will first create our main function here as we always do.
So integer main void here.
And we will first declare variables for socket descriptors.
In this case it's going to be integers.
So integer uh my client FD and uh sock here my sock feet.
And after that we will specify a port number.
In this case let's actually make it um.
Yeah.
Integer port.
My port here.
Uh, three.
One two.
Yeah.
Three.
You know.
Or seven.
Three.
One.
And here we will declare a sock address in structure.
So struct, uh, sock or my sock or actually.
Yeah, yeah.
No, you can use my sock, my sock adder here.
In.
And which.
Or.
Uh, yeah.
And we will also name it, uh, stock adder in here.
That's it.
And after that we will create a socket with IP version four and TCP protocol.
So we will use.
The my sock feet.
So my sock feet.
Here we go.
Socket AF in it.
Sock stream.
Just for TCP here.
And zero.
And after that we will set the address family to IP version four.
And in order to do that we will use this my sock order here.
So.
My sock adder here.
Actually, let's delete this in here.
So we don't need that.
So my my sock address here.
My socket address.
And after that we will use sin family.
And it will be AF init.
That's it.
And that's it.
As I said with this line of code, here we are setting the address family to, uh, IP version four.
And now we will convert the port to network byte order and assign it to SoC address structure.
In this case we will going to assign it to my SoC address here.
And, uh, what we're going to do here is.
Yeah, we did the.
Same family.
And.
Yeah.
So my sock order here.
Address and sin port, which is.
We will.
Sorry.
So which is we will do the heat tones.
Part.
That's it.
My port.
And after that we will need to bind the socket to all available network interfaces on the machine.
And now we will do a bind.
Bind sock.
My, uh.
Socket.
My soft.
And we will use the struct here.
Struct.
My socket.
Address here, pointer.
And after that we will do.
My my socket.
Oops.
My socket.
Address.
So address here and we will size.
We will use the size of here.
My socket address again.
That's it here.
And now let's end this code.
And now we will listen for incoming connections on the bound socket here.
So in order to do that we will just use this simple function.
Listen my sock address and no my sock my socket FD here.
And we will as a second argument we will pass one and that's it.
And after that we will accept any incoming connection and get a new socket descriptor for communication.
And now we will do my.
Oh, yeah.
We will define this.
My client left here and accept.
My socket feet.
EFT and we will pass two nulls as a no.
We will pass one null per parameter in this case the second and third parameter here null and null.
And now what we're going to do is let's actually end this line of code.
Now we will duplicate the client socket descriptor onto the standard output zero.
Uh, no.
Standard output of zero.
Standard.
Standard input zero, standard output one, and standard error two.
And now we will use DUP here.
And my client left.
Zero.
This is for the standard input.
Let's actually write it down.
So this is for.
It's not.
This for the STD.
Actually, this just.
Write it and I will explain that after this.
Right completing this code.
So my client fd1 for the output standard output here, let's actually make it nice.
And after that we will use lastly the my client FD.
Here, which is for errors.
And now we will prepare the arguments for the Execvp function to execute the shell, in this case bash.
So character.
Actor pointer const.
Here.
Const RGV here.
No RC, no, not RC here we will use the RGV argument V and the array.
C.H..
Null.
Null as a second and third argument parameter.
So now we will replace the current process with the shell uh using the bin sh program.
So exec v we use that you learned that exec function in previous lectures.
So bin sh.
Here and our arguments V and null.
That's it.
And now we will just.
Return here.
Uh, but the this line will never be reached since Ziggy replaces the process.
So it actually has no purpose.
But it's okay to write a return, uh, cause in every C program here, not every.
But, like, mostly.
And now let's explore.
Uh, explain this here.
So.
But we got some errors.
Yeah.
Because of that.
I finished.
Yeah.
Perfect.
Now, let's, uh, begin explanation here.
So with this, include directives include necessary header files for using socket types and other related
functions.
And with with this here uh integer my client FD, my SoC fd here my socket FD.
We are declaring the integer variables to store socket descriptors, um, socket descriptors and integer.
My port uh 7331.
We are setting the port number to 7331.
And with this year's uh, struct uh socket address in my socket address is we are declaring a struct
to store socket address information, in this case IP version four.
And, uh, here we are, my, uh, so-called FD, my sock FD here.
Uh, we are creating a new socket using an IP version four and TCP protocol.
And we are telling the city to store the socket descriptor in my socket FD here.
And after that we are.
As you can see, we have two lines here which uses scene family and scene port.
This means actually here that we are telling the C language to convert the port number to network byte
order and assign it to scene port in my socket address.
And we are doing the same here, uh, with uh, family here.
Uh, write my socket address.
In family, we are setting the address family of my, uh, socket address to IP version four.
And yes, this info as I explained.
Here we are.
Converting the port number to network byte order here and.
There.
There should be some interesting line of code here.
So we need to actually.
Mhm.
Yes.
I think we need to.
Write the sin address, and to bind the circuit to all available network interfaces on the machine.
In this case, I think we didn't do it.
So let's actually do that.
So we will need to my socket address here.
Sin.
Address.
That's address here.
And we will use in adder here.
Any.
So with this we are binding the socket to all the available network interfaces on the machine.
So this is important if you are writing the shell code or some uh malicious files for ethical hacking
purposes.
And now what we're going to do here is that's it.
So.
And as I explained, we are doing this for the bind the socket to all available network interfaces on
the machine.
Now after that we have the struct.
So we are binding the socket to the address specified in my socket address variable.
And here.
So after that we are listening for incoming connections on the bound socket.
And after that we are accepting an incoming connection and get a new socket descriptor for communication.
And with this three lines of code here.
We are duplicating duplicating the client socket descriptor on the standard output in standard input
output and error here.
So.
And yeah.
And after that we have the character array.
So we are preparing an array of arguments for the exec v function.
And it specifies the program to execute shell and null terminates the argument list.
And after that we have exec.
We boenisch arguments v we are replacing the current process with the shell, uh, inheriting the duplicated
uh file descriptors.
So this effectively gives the connected client a shell on the server and the return zero.
As I said, the line is never reached since exec replaces the current process with the shell, and so
this line won't have any practical effect on this example.
So this program sets up a basic server that listens on a specified port, accepts incoming connections,
and provides a remote shell to the connected client.
Now, it's important to note, keep in mind that it's important to keep in mind that this code resembles
a basic example of a reverse shell, which can have security implications if used improperly or maliciously.
So try this code on your virtual machine or some safe environment.
So now um, here.
First let's talk about the creating a socket in C.
So this is like setting up a line of communication between computers.
So we need three pieces of information here the protocol family.
So think of this as the type of communication we are setting up.
We use Afinet to say we are using IP version four and older version of Internet Protocol.
And the second is connection type.
So this is like saying how we want to talk.
So socket stream here.
This is for reliable connection.
Like when you are talking on the phone and don't want to miss any words.
And the third is protocol.
So this is a bit like telling the computer to how to handle the communication.
So we set it to zero, which means the computer will pick the best way for us.
And now let's switch to something simpler.
Finding the number that represents this socket thing we just talked about.
Now, when programmers want to do things with computers, they use special numbers for different actions.
It's like using a remote control to change the TV channel.
And every button on the remote has a number.
Similarly, computer actions have numbers to.
And we are looking for the special number.
That means create a socket.
So by knowing this number we can interact with computers deeper parts to make our communication work.
Understanding this numbers helps us to how different parts of computer work together.
So while the last, um, explanation had some complex words, the bottom line is that we are discovering
the secret number that lets us set up communication between computers.
Now, this takes us beyond just writing basic code and helps us to understand how computers really work
together.
Now, to locate this system call number associated with the socket operation, you can use this cat
command.
So cat user include here x86 64, Linux GNU here ASM and honest D here 64.
And we will use grep socket.
And as you can see here, this command accomplishes the task of extracting the relevant information
from the system's header files.
But before that actually let me check the.
Microphone.
Yeah, it's working.
Now, by examining the output of this command, you can identify the numeric code corresponds to the
socket system call.
So this numeric code serves as a fundamental identifier for the operating system to understand and execute
the socket action requested by your program.
So as we embark on this endeavor, we will journey through the realms of assembly language, understanding
how instructions are composed and executed on a micro level.
So furthermore, we shall orchestrate a.
Our assembly knowledge with the network programming techniques creating seamless interaction between
the attacker and the victim machine.
Additionally, uh, we will delve into the nuances of payload generation, ensuring that our shellcode
operates reliably and securely within the intended context.
So this encompasses considerations such as size constraints, memory layout, and compatibility across
different systems.
So throughout the comprehensive study of these intricacies, you will be equipped with the skills and
insights needed to craft and comprehend shellcode creation.
However, it's important to emphasize that the ethical dimensions of this knowledge should be upheld
at all times, as the potential for misuse is substantial, so responsible and ethical usage of this
technique is paramount to maintaining the integrity and security of digital systems and networks.
So in an upcoming lecture, we shall embark on accelerating journey through the realms of assembly,
networking and security, and ultimately arming you with the pruners to construct and analyze shellcode.
This is a national asset in the domain of cybersecurity and penetration testing.
My name is Stephan and I'm waiting you in the next lecture.