The Nihilism Blog

Assembly x86_64 - Spawning a Shell

Assembly Code

We're going to use vim to write our code


[ 192.168.0.18/24 ] [ /dev/pts/88 ] [~/binexp/asm]
→ vim 7.asm



section .text
        global _start

_start:
        xor esi, esi
        xor edx, edx

        push 0x3b
        pop rax
        mov rbx, 0x68732f2f6e69622f
        push rsi
        push rbx
        mov rdi, rsp
        syscall

Now let's check out what is new in the above code:


_start:
        xor esi, esi
        xor edx, edx

using xor on the same register has the property of being equivalent to mov esi, 0 but being shorter (only 2 bytes) the processor recognizes the special case and treats it as a mov esi, 0 so the execution time is the same. so we clear out the esi and edx registers,


push 0x3b                       ;push the value of the syscall id onto the stack (0x3b is 59)
pop rax                         ;take the out the top of the stack to put it into rax

Next we push the value 0x3b (59) onto the stack, and then pop the value out into rax, The equivalent is mov rax, 59 However this results in a shorter shellcode as we're going to see later on. Now since we have our execve() syscall, we want to give it an arguement, we want it to spawn /bin/sh and we want it to be 8 bytes so we get the following: /bin//sh:


[ 192.168.0.18/24 ] [ /dev/pts/3 ] [~/binexp/asm]
→ echo '/bin//sh' | xxd
00000000: 2f62 696e 2f2f 7368 0a                   /bin//sh.

[ 192.168.0.18/24 ] [ /dev/pts/3 ] [~/binexp/asm]
→ echo 'hs//nib/' | xxd
00000000: 6873 2f2f 6e69 622f 0a                   hs//nib/.

So we get our following mov instruction:


mov rbx, 0x68732f2f6e69622f     ; put the little endian hex val of '/bin//sh'  into rbx

Compiling

Here we're going to use nasm to compile our assembly code and then ld to create the binary file: 


[ 192.168.0.18/24 ] [ /dev/pts/3 ] [~/binexp/asm]
→ nasm -f elf64 7.asm

[ 192.168.0.18/24 ] [ /dev/pts/3 ] [~/binexp/asm]
→ ld 7.o -o 7

[ 192.168.0.18/24 ] [ /dev/pts/3 ] [~/binexp/asm]
→ ./7

[ 192.168.100.1/24 ] [ /dev/pts/3 ] [/home/nothing/binexp/asm]
→ echo $0 ; exit
bash
exit

[ 192.168.0.18/24 ] [ /dev/pts/3 ] [~/binexp/asm]
→ echo $0
/bin/zsh

And that's it! But if we wanted to create shellcode for binary exploitation, we would adjust the assembly code as follows:


[bits 64]

xor esi, esi                    ; xor out esi and edx
xor edx, edx

push 0x3b                       ;push the value of the syscall id onto the stack (0x3b is 59)
pop rax                         ;take the out the top of the stack to put it into rax

mov rbx, 0x68732f2f6e69622f     ; put the little endian hex val of '/bin//sh'  into rbx

push rsi                        ; push the value of rsi
push rbx                        ; push the value of rbx
mov rdi, rsp                    ; move the value of rsp ( ) into rdi (first arguement)
syscall

And then we would compile it not with the elf64 flag, but this time we don't need a binary file, we want what's called shellcode to use in conjunction with python pwntools:


[ 192.168.0.18/24 ] [ /dev/pts/8 ] [~/binexp/asm]
→ nasm -f bin 7.asm

[ 192.168.0.18/24 ] [ /dev/pts/8 ] [~/binexp/asm]
→ cat 7
11j;XH/bin//shVSH%

Now let's view the hexdump of our shellcode inside of python pwntools:


[ 192.168.0.18/24 ] [ /dev/pts/7 ] [~/binexp/asm]
→ vim hexdump.py



from pwn import *

#read the shellcode file we compiled
with open('7', 'rb') as f:
  shellcode = f.read()

print(shellcode)

Here basically we take our shellcode file (named 7) and we store its contents into the shellcode variable. Then we print it:


[ 192.168.0.18/24 ] [ /dev/pts/18 ] [~/binexp/asm]
→ python3 hexdump.py
b'1\xf61\xd2j;XH\xbb/bin//shVSH\x89\xe7\x0f\x05'

However this isn't all that accurate for us. Here you can see the non-ascii characters being represented as \x00 \x01 \x02 and such. So to get more information on the shellcode characters we should use the hexdump function that's built-in to pwntools:


from pwn import *

#read the shellcode file we compiled
with open('7', 'rb') as f:
  shellcode = f.read()

print(hexdump(shellcode))

And we get the following result:


[ 192.168.0.18/24 ] [ /dev/pts/18 ] [~/binexp/asm]
→ python3 hexdump.py
00000000  31 f6 31 d2  6a 3b 58 48  bb 2f 62 69  6e 2f 2f 73  │1·1·│j;XH│·/bi│n//s│
00000010  68 56 53 48  89 e7 0f 05                            │hVSH│····│
00000018

And that's it! we have some payload ready to be used for binary exploitation purposes.