Everybody welcome to the next video.
So this video we're gonna be going over something called up code now up code is just hex equivalent
code to assembly language so there's certain hex values that are directly equivalent to an assembly
command or an assembly instructions such as move interrupt jump.
As an example so I want to take a second look at our example here.
We don't need this so based on our example here we're moving you know are our right command or right
Cisco we're passing in.
This works just like we did in a previous example we're issuing the interrupt and we're going to head
and exiting the application.
Now if we go ahead and go in and combine that run it link it we get just it prints out to the screen
which is perfectly fine.
So what.
Remember how this generates the main file.
So we do file main.
This is an e l f binary.
Now what we can do is use this giant bunch of text.
However this is text that I'm going to leave linked blows.
You can copy and paste it.
Well the understanding here is using object dump and then it's actually taking a look at the binary
itself so in this case if you are writing shell code right.
So Shell code is essentially code.
Now the shell code is used to perform a specific action.
So once it's in memory it maybe launches or rights it's called overwrite a file or it tries to create
a socket connection or creates a user.
Whatever the case might be but the shell code is written in assembly.
So keep that in mind shell code is written in assembly.
So it does.
It does exactly what you ask it to.
So in this case this would be are we've generated our shell code that we want to send to an on our exploit.
So this is what our code does.
Right.
So in this case we just print something in the screen but we're not going to do anything really fancy
in this particular video.
So we've created it.
We've linked it we've ran it.
Make sure it looks good.
Now we see here we've got Maine which is our name of our file.
What we're doing is we're piping this into another file called Shell.
So if we go ahead run this we do see that nothing happens.
However we see that we have a file called Shell code cap shell code.
We can see we get some hex so slash X and then some digits or or ASCII characters or both is his hex.
Now we've gone over what hex is but this is another way to abbreviate it.
So this is what Shell code is.
So these are direct operations in assembly.
So we'll do a G and it g edit shell code.
We'll go ahead and remove us the quotes on the end.
We won't need those.
So what I want to show you is let's say we've written our shell code right.
So we wrote our shell coding assembly.
We've compiled it.
We use this giant command to generate our shell code.
Then we would copy this and plop it into our exploit and then we would launch the exploit and assuming
the exploit works the shell code would then print this out to standard output not very useful but you
can see how we can tune this to whatever we want.
But let's say we have an exploit that we got off line that we want to take a look at the Shell cuts.
We see the shell code that's in there more like.
OK.
So what does this actually do.
So with that Shell code what we can do is where is it.
Right there.
So object dump dash D for disassemble all dash n is I 386 because that's what we're using we're using
32 bit.
The name of the executable or the shell code and then actual changes to the shell code then we have
dash M for Intel so we can get a more readable format.
So actually this is going to be if we wanted to get the show code from the actual binaries.
So if we didn't mean here we can see we see our instructions we see our moves 0 x 4 we see R E C X which
is r This is the memory address of our string.
This is the length.
We'd see our interrupt.
We see our exit and we see the exit cleanly.
Now this is the string.
So this is what it's doing to create the string.
We don't need to worry about that at this point.
But what happens if we want to take this shell code and actually find out what it does.
So what we can do is we can copy the shell code and keep on all these commands will be in the description
below.
So we're going to do echo dash and a and then we're gonna go ahead and throw in the shell code name
this shell code to pop that in there.
OK.
Show code to perfect.
You can see it actually built it in a compiled way.
Now what we're going to use is an end datum so it's the Naismith.
This assembler so be 32 and then show Code 2.
Now we can see that these are the exact instructions from our shell code.
So if we took shell code from somebody else we would then take this echo to the file with this with
Ed Nash and an E.
So that way it sets it in a compiled way.
And it uses the raw actual interpretation then you use Nasim as this assembler as a 32 bit on the shell
code file and then we can see we get our exact same shell code here.
So this is how you can identify what Shell code is doing as it's actually running.
And what's interesting about this is if you do it this way you're not actually having to run the shell
code itself to be able to figure out what it does.
But this is a good way for you to sit down and look at that Shell code as a red team or to make sure
that there isn't any issue with it.