Here we are embarking on the execution of the Dup2 system call.
This is an essential task in managing file descriptors, and we are essentially duplicating the my client
if the file descriptor and associating it with the standard output zero, standard output one, and
thus standard error two streams.
So this ensures that the communication channel established with the client encompasses all aspects of
input and output.
So now we will execute it three times to duplicate our file descriptor to stdin, stdout and stderr
error here, which will take zero, one, two respectively.
So the subsequent step here will involve, uh, tripling the impact of our dup2 operations, effectively
enabling communication through all fundamental input and output streams.
So we had the let's actually call this bind listen and accept.
We called here.
So we will do that same to uh dump.
Oh, actually, sorry for this.
We need to change this to dove.
I just realized not a big deal, but this typos happen.
So it actually happened just two times.
The first one is okay.
Now, uh, here, what we're going to do is we will use a DOP cue.
And as you can see, we got a 33.
So executing this command facilitates the identification of the numeric code corresponding to the Dup2
system call.
And this numeric representation greets the operating system in seamlessly duplicating and managing file
descriptors.
So we will also copy this.
So syscall syscall for dup2.
And here.
It was, um, for the 33 here.
Now, let's, uh, build the, uh, dup to, uh, syscall in our assembly program here.
So actually, let's make it not know.
Now?
Yes.
Now what we're going to do is we will just add the command dup.
Two and 33.
Now we will move the die.
Move our die.
RBCs.
Uh, XOR racks.
Racks and add racks.
Um, 33, as we always do here.
Uh, so 33 here.
So.
Because in this case, uh, we will need to enter this because we want to call the syscall for dup2.
And now we will, uh, lastly XOR.
XOR, uh, RSI, RSI and after that we will call the Cisco.
And that's it.
So and also we will call this three times as you remember.
So because we did that in here.
So the first one is for errors no input.
The second one output and the third one is errors.
So zero for input.
Um the.
Yeah.
So the standard output for zero, standard input for one and standard error two uh streams here.
So let's oops.
Yeah.
Now let's go to TCP minus m here.
So.
Here.
In which is zero.
And now we will make the same dub.
Two 3233 again.
But.
Here we will study in.
One.
And now let's, um, here, let's actually copy this from this actually, let's write it down here.
So XOR.
Racks.
Racks here.
And after that.
The last need to call the increment here after add.
So add racks.
33 and we will increment RSI by one.
Increment RSI.
Buy one and Cisco here.
And now we will use the top two for St.
No it was this.
This one was STD out.
And now we will STD error here which is STD standard error.
So dub 233 and std error here which is two.
Now we will do the same here, but we will instead of.
That's actually.
Copy this.
Axle racks, racks and racks.
33.
Increment size is called here.
So in this case we will call this um.
Third here.
So STD error here.
So no second.
So in this case we are after this one here we are incrementing this by one.
And this happens that 33 uh that now has this uh two in its value here.
So and I want to explain this again, uh, here.
So in this DUP system call DUP two system call, we are placing the value of x which holds the client,
uh, my client, if the value variable into the RDF register, it is an essential step in preparing
the old file descriptor for the duplication process.
And by executing this, uh, XOR of racks, racks, we are clearing the racks register, preparing it
for its upcoming role.
And subsequently we increment this value by racks here, um, by 32.
No.
The value in racks by yeah 33 effectively assigning it to uh dup to syscall number here and we ensure
that the RSA register is set to zero.
And um, aligning it for the second phase of our operation here.
And we ensure and here we ensure that.
And after that this instruction is executed propelling the operating system to enact the DUP to action.
And when we then repeat the process two more times by incrementing RSI each time ensuring that the DUP
two operation is carried out for all three streams one, two, three and uh, here we will also.
Um, what we.
What we have left to do is you.
We have completed this, uh, top here.
And now we need to add our exec Cisco.
So now let's actually.
Prepare the arguments for the exec syscall.
Here.
So.
Exec.
We.
No.
Exactly.
Siskel.
And that exec syscall.
We did that in previous lecture here.
I found that.
So you can find it find this in this lectures attachment sections.
But also you can just write it.
So it's not a long program here.
So after that, let's call this.
And here our code is ready.
Now, now let's put all the pieces together in one code.
So you remember we firstly called this socket call here.
No we don't we didn't we didn't call the socket call firstly.
Yes.
And after that?
We had to call this.
Listen, posh port numbers and bind here.
Yes.
And before that, now we will first define our global start.
So global start section text here.
This is where our code will be here.
And now what we're going to do.
Yes we will.
Firstly.
Yeah.
Open this code here.
I've already explained this code, so I will not explain this almost second time here.
So I don't want to waste our lecture times because in next lecture we have a better things to do.
And learning things here.
So yeah let's make it tops tabs here.
It won't take long.
Yeah.
So remember we got this from our older lectures attachment section.
But you can look at this and write but I will share this code as well.
So let's go back to our now.
So see this source shell code.
So remember what our exit method did.
Plus here a dot out.
So with our execute method we got gained shell here with this.
So less.
And as you can see here less.
Lay and that's it.
So this is why we implemented the exit we, uh, method here because we will.
That's why we wrote this.
Uh, TCP uh, shell bind program.
Uh, shell code here.
So let's actually add the tabs here.
And Add and I think that's it.
Yeah.
Perfect.
Now what we're going to do now is we will firstly uh, call the socket syscall.
In this case it's was 41.
Let's actually try that.
Exit.
Clear.
And it was.
Circuit.
Yeah.
41.
I think we got this here now.
So syscall for socket.
It's 41.
And now what we're going to do is we have written the text section.
Now we will start our program from here.
And now we will call the circuit here.
So.
Socket.
Syscall.
And now we will again do XOR.
Rags, rags and add.
Rex 41 and then XOR.
RTI.
RTI at RTI two.
XOR.
RSI.
And the increment RSI bond here and XOR are the x.
RDX here and we will call the Siskel here.
Cisco.
And now we will explain this circuit cycle here.
So Zorak tracks.
So this this instruction uses the XOR operator or XOR operation to set the Rax register to zero.
So Rax is commonly used to store the system call number, and setting it to zero often indicates that
you are preparing to make a system call, and here add rax for to one.
This instruction adds the value for to one to the Rax register, and this is a system call for circuit
operations.
Um and also we have the XOR Aadhi Aadhi here.
And also after that we are, uh, setting here.
As you can see, we have the two here.
So with this, we are setting telling the assembly to telling the operating operating system to set
RDA to AF init, which in this case IP version four.
And with this we are clearing the RSI RSI to prepare for socket type, in this case socket stream TCP.
And we are setting the uh.
So we are after.
And here we are clearing the decks to prepare for circuit protocol, in this case zero.
And after that we are executing this circuit syscall.
So here um the main here, the main new nuances here I want to explain is these three lines of code.
Because here, um incrementing the value in RDI by two which sets RDI to Afinet.
So this value represents the domain for IP version for communication.
And here X or RSI, RSI here.
This clears the RSI register to prepare it for the socket type argument.
So and we also have the increment RSI this increment value in RSI by one which sets the RSI to socket
stream.
So this value indicates that we are working with the TCP socket which is reliable stream oriented communication
and accelerated RDX.
RDX, which you already know that we are clearing the RDX register to prepare it for the socket protocol
argument, and after that we will need to save the soc FD in RDI register.
So save SoC socket FD.
Left in RDI register and with this we will need to do mov rdc rax.
And here we have pushed the port number.
So binded the calls, binding, listening, accepting the three times top exec with Cisco.
And now I think we have done.
Now let's assemble it to see.
What we need now.
An Asme FL, FL 64 bind shell now tcp bind here tcp bind dot asm object file tcp bind dot all here and
lld tcp bind object file no bind all here and the output file is going to be TCP bind.
And let's run it here TCP bind.
And as you can see here we got.
This, but no reaction here.
Let's actually open the Wireshark now.
Listen.
Oops.
But actually, instead of just opening Wireshark we can also use this netstat here.
Let's actually close this clear.
Open the new and run this TCP bind.
And let's run the netstat n t n t lp.
And as you can see here, the output of this command shows us that this code is works here.
The program name name is TCP bind.
And now we will.
What are we going to do is we will need to get this bind here, the shellcode from it.
And now let's start writing our code.
And.
But firstly, we will need to get the shell code from our assembly program.
And in order to do that, we had some, uh, ready to use terminal here.
I should find it somewhere here.
And as I as I always do, I will share it with you in the attachment sections of this course.
And, uh, here.
We have this.
Let's copy this.
Paste.
Yes.
Now here we will change the hello to mom TCP bind TCP bind.
And.
Source shellcode.
TCP bind here.
S and.
Yeah.
That said, now let's copy this.
Go back to our Top Point C program.
So we don't need we will not use it anything.
But it works here.
So we just rotate it in both languages.
But now we will inject our shell code here.
So.
Exact racial here.
Now we will use that and change it to our this.
And also.
That's it.
Now let's actually copy this and paste it in shell code.
Yes.
And we will name it the Real.
Real TCP.
Shellcode.
Now we will need to compile this with gcc.
Without step stack protector.
So gcc f no stack protector.
The exec stack.
And this should be rename it real.
This shellcode.
And now let's run this.
Now it was a dot out.
A that out shell length is 159.
And now let's check it with.
So we should check it with our netstat nelp command clear netstat NLP.
And here we go.
The program name a dot out and local address foreign address.
So congratulations here.
Uh, this is your first shellcode.
And with these actions, we validate the efficiency of our shellcode.
And the successful execution and interaction exemplify your mastery of assembly, programming and the
intricacies of shellcode.
And now I'm giving you 10s to figure out what can we use that for to connect to this shell.
We can use the NC here and now NC localhost 7117331.
This is our port and that's it.
So let's actually.
Rename.
No.
Yeah.
So let's actually open the new.
No, no, I want to open the new terminal here.
Just make it on the right side of the screen.
And this is the left side.
And now clear.
Yes, netstat almost works now.
Here.
This is a shackle length, so we will use the NC localhost 717331 and RLS here RLS.
Here.
Now go to here.
And now.
Here.
And say localhost.
And a dot out.
Run this.
And as you can see here we got this.
Less clear less clear.
And now let's exit this.
And as you can see when we exit this just exit is also here.
So now we will clear it.
Now firstly we will open this a dot out then NC here.
So LZ LZ.
And as you can see here you can execute commands.
Let's exit.
And that's it.