Revision as of 20:38, 6 April 2012

Printable ascii shellcode is used to evade sanitizing on the network and software layers during buffer overflow exploitation.

Introduction

Ascii shellcode bypasses many character filters and is somewhat easy to learn due to the fact that many ascii instructions are only one or two byte instructions. The smaller the instructions, the more easily obfuscated and randomized they are. During many buffer overflows the buffer is limited to a very small writeable segment of memory, so many times it is important to utilize the smallest possible combination of opcodes. In other cases, more buffer space is available and things like ascii art shellcode are more plausible.

Available Instructions

Constructing your NOP Sled

Instructions

Implementation

There are also other operations can be used as NOPs as well. Of course, these operations do actually do things. This won't affect exploit code because register values are preserved.

• For example, '4' or 0x34 is:

<syntaxhighlight lang="asm">xor al, 0x??</syntaxhighlight>

• While '5', or 0x35, is:

<syntaxhighlight lang="asm">xor eax, 0x????</syntaxhighlight>

So, if P5LULZX were to execute, nothing would happen other than a waste of cpu cycles. The Assembly looks like :

 [intel]				[att sysV]
 push eax			        pushl %eax
 xor eax, 0x4c554c5a		        xorl $0x4c554c5a, %eax
 pop eax				popl %eax

The value of the %eax register is momentarily changed and then restored.. That's not really going to modify execution flow, save for cpu cycle count. There's more examples of this too, if the goal is only to create effective NOPs. For example, PhLULZX5LULZX, adds more bytes to the NOP sled:

 [intel]				[att sysV]
 push eax			        pushl %eax
 push 0x4c554c5a			pushl $0x4c554c5a
 pop eax				popl %eax
 xor eax, 0x4c554c5a		        xorl $0x4c554c5a, %eax
 pop eax				popl %eax

PUSH/POPS can be mixed with INC/DEC operands without much difficulty. Once a register has been pushed to the stack, anything can be done to its value before popping that register back off the stack.

Even arithmetic calculations can be used as long as the original values of the registers are restored. This preserves the environment for the executing shellcode.

In this example using the PUSH and POP instructions, PRQXYZQPRXZY, the code simply re-arranges the register values and puts them back in the right place.

The assembly is as follows:

 [intel]				[att sysV]
 push eax			        pushl %eax
 push edx			        pushl %edx
 push ecx			        pushl %ecx
 pop eax				popl %eax
 pop ecx				popl %ecx
 pop edx				popl %edx
 push ecx			        pushl %ecx
 push eax			        pushl %eax
 push edx			        pushl %edx
 pop eax				popl %eax
 pop edx				popl %edx
 pop ecx				popl %ecx

As far as the INC/DEC instructions are concerned, shellcode like ACBKJI leave the %ecx, %edx, and %ebx registers completely unchanged. Therefore any register can be incremented any number of times so long as the register is decremented the same amount.

Basic Encoding

Single Byte Register Manipulation

• Using only ASCII, the smallest method to zero out the %eax register is five bytes, jXX4X, examined below:

push byte 0x58

pop eax

xor al, 58

• Reviewing that five-byte combination line by line:

push 0x58

pop eax

xor al, 58

Reviewing XOR

XOR (exclusive OR) can sometimes be a serious inconvenience to developers due to the time consuming and tedious nature of xor-encoding by hand. The XOR instruction performs a Bitwise Operation on two values. If the bits are the same, then the corresponding or respective bit is reset to 0. If the two bits are different, then the corresponding or respective bit is set to 1. For example, F xor 3: 1111 F xor 0011 3 = ------------ 1100 C

• Right now, one can preform an ASCII-only XOR instruction on the al one byte register. However, one byte will not always be enough.

DWORD Manipulation

• Some of the more important printable instructions include:

push 0x########

xor eax, 0x########

xor al, 0x##

pop eax

push 0x##

push ecx

push eax

pop ecx

pop edx

• So, a small example of ASCII to modify the entire DWORD value of the eax register and set the register value to zero is hLULZX5LULZ:

push 0x5a4c554c

pop eax

xor eax, 0x5a4c554c

• And the DWORD eax register has been manipulated and set to 0 in 11 bytes.

An introduction to Polymorphic Shellcode

Due to the nature of the stack and the x86 architecture, the stack grows backwards, but executes forwards. During the first instruction of a buffer overflow payload's execution, the esp register points to the location of the executing code. By manipulating this register properly during shellcode execution, code within the context of the currently executing buffer can be modified or overwritten. To apply this concept to polymorphic shellcode, the esp register must be pointing to a location in the stack ahead of the code currently executing. Because the stack grows backwards, pushed bytes will be written in front of the code being executed, and the code executing will eventually hit the bytes of machine code pushed to the stack.

Basic Polymorphic Shellcode Example

Suppose one wanted to decode binary into the currently executing printable ascii code. Whenever a register is popped from the stack, the esp has 4 bytes added to its pointer. When the popad or popa instruction is used, esp has 32 bytes added to its pointer, as 8 registers are popped off the stack at once.

Pushing Nops

eax register, set it to all NOPs (0x90) and push it onto the stack, using nothing but ASCII. We can't use the \x90 opcode, because the \x90 code does not live in the ASCII keyspace. So how do we go about this?

Polymorphic code refers to a piece of code's ability to change itself. Machine code can modify itself through any of the functions which allow modification of registers. Self-modifying code is generally used to prevent the reverse-engineer from understanding the code. This method of code obfuscation is quite common and is considered a standard in most targeted exploitations.

Polymorphic code is how we will push 0x90909090 onto the stack without referencing the actual value 0x90 a single time. In the shortest amount of bytes possible, the shellcode to do so is jFX4FH5ooooP (12 bytes), let's analyze that:

 Ascii	Machine Code	     Assembly
 jF	\x6a\x46             push 0x46
 X	\x58                 pop eax
 4F	\x34\x46             xor al, 0x46
 H	\x48                 dec eax
 5oooo	\x35\x6f\x6f\x6f\x6f xor eax, 0x6f6f6f6f
 P	\x50                 push eax

If you're still a little confused, lets break it down even further:

 Assembly	        Value of EAX Register
 push 0x46	
 pop eax               0x00000046
 xor al, 0x46          0x00000000
 dec eax               0xffffffff
 xor eax, 0x6f6f6f6f   0x90909090
 push eax

There are two things happening here which I have not yet covered thoroughly. The first one of these is the dec eax, or the \x48 instruction. Usually, dec simply decrements the affected register. However, when that register is already equal to 0x00000000, dec will go all the way back and set the register to 0xffffffff. The second thing is that XOR instruction. The XOR instruction in the above code does an exclusive or as follows:

 0xffffffff xor
 0x6f6f6f6f

And stores the value in eax, then PUSHes eax. Nybble by nybble, Byte by Byte following of the exclusive or instruction:

 1111	1111	1111	1111	1111	1111	1111	1111	(FFFFFFFF) xor
 0110	1111	0110	1111	0110	1111	0110	1111	(6F6F6F6F) =
 ----	----	----	----	----	----	----	----	--------------
 1001	0000	1001	0000	1001	0000	1001	0000	(90909090)

Polymorphic code should consist of methods which place a random or comment value into a register, and then XOR the register until the desired value has been reached. We can start the register value at any ASCII value, 0x00000000, or 0xffffffff, by XORing a register with itself, or by setting the register value to zero and then decrementing it.

Notice that this shellcode is 100% alphanumeric. There is of course, non-ASCII and non-alphanumeric polymorphic code, which has much less inhibitions than printable ASCII or alpha-numeric bytecode.

A sequence for exit

In linux/x86 the exit interrupt is pretty straight forward: .section .data .section .text .globl _start _start: xorl %eax, %eax incl %eax xorl %ebx, %ebx int $0x80

 
as exit.s --32 -o exit.o ; ld exit.o -o exit ; ./exit
 

 
./exit ; echo $?
 

.section .data
.section .text
.globl _start
_start:
 xorl %eax, %eax
 incl %eax
 movl $3, %ebx
 int $0x80

From assembling to machine code

To get shellcode for the exit sequence, one can use the objdump command line bash utility: [user@host ~]$ objdump -d exit exit: file format elf64-x86-64 Disassembly of section .text: 0000000000400078 <_start>: 400078: 31 c0 xor  %eax,%eax 40007a: ff c0 inc  %eax 40007c: bb 03 00 00 00 mov $0x3,%ebx 400081: cd 80 int $0x80

• Objdump did a decent favor here - breaking the output into table format:

• It can be easily determined that the machine code for this is "\x31\xc0\xff\xc0\xbb\x03\x00\x00\x00\xcd\x80"

Converting Exit to Printable Ascii

We need to keep the following in mind when converting our exit shellcode to ascii: For successful exploitation, we'll have to use a trick from our nop example to get eax to 0xffffffff. Our target is ????80cd, because it must go onto the stack backwards The first two bytes will be completely irrelevent, as they will occur in our stack after the kernel interrupt for exit. The %eax register must equal the value '1' when the interrupt is called. The %ebx register must equal the decimal value '3' or hexidecimal value 0x03 when the interrupt is called.

• First, lets write our code to put "3" into %ebx. To get '1' into eax, we can just decrement it twice once %ebx has been stored.

Lets take a look at %ebx. We'll need to set its value to 0x03. The best way we can do that is by manipulating the %eax register, then pushing the eax register and popping the value back into %ebx. We can do that with the following code:

pushb $0x30
pop %eax
xorb $0x33, %al
pushl %eax
pop %ebx

When analyzed:

So, in ascii code, our manipulation of the %ebx register looks like "j0X43P[". Right after this, we can decrement %eax (H in alpha) twice to get the register to the value of '1'.

This next part is a bit more difficult. We need to construct \xcd\x80 on the stack. So, first, lets zero out the eax register, and decrement it to get 0xffffffff:

push $0x6a       jj
pop %eax       X
xor $0x6a, %al    4j
decl %eax       H

Once we've run jjX4jH, we've got eax set to 0xffffffff. Now, lets determine what our target xor should be:

 FFFF xor
 80CD = 
----------
 7F32

• Now due to the way xor works, we can just assume we're trying to find two ascii sequences that when xor'd together come out to 0x7f32. For our example, I was able to find that 0x4f65 xor 0x3057 = 0x7f32. To tie this into code and push it onto the stack:

xor $0x4f65, %ax   \x66\x35\x4f\x65      f5Oe
xor $0x3057, %ax   \x66\x35\x30\x57      f50W
pushl %eax

• And all put together, our ascii code for getting \xcd\x80 onto the stack in the correct order looks like "jjX4jHf5Oef50WP". Now we need to tie all of these things together along with our knowledge of the stack to ensure proper execution of the code. The first thing we have to do is add to ESP. Lets find out how many bytes we must add by adding up all this shellcode. So far, we've got "jjX4jHf5Oef50WPj0X43P[HH" to push \xcd\x80 onto the stack and set %eax to 1 and %ebx to 3. Our problem here is that we rely on push to apply values and we've just pushed instructions (\xcd\x80) onto the stack with the first bit, which could get overwritten or have instructions written in front of it.

There are multiple solutions to this. One is overwriting a dword between us and our code with nops after its been used for the stack. The other is to adjust so that once the code for exit is written, pop twice to add 8 to the stack pointer. This will not only prevent us from overwriting our exit code with push instructions, but also prevent the push instructions from overwriting code before we get to the exit code.

So, in review:

• The stack pointer (%esp) must be set to the value of our shellcode's length in bytes above the instruction pointer (%eip)
• We'll have to manipulate the stack properly to avoid overwriting reconstructed instructions.

Because %edi doesn't matter for this payload, we can use the "GO" nop sequence that increments and decrements %edi as "nops". To align our stack pointer, we'll use a combination of the popad instruction, pop register instructions, and decl %esp - this will ensure the smallest possible code. Assuming that %eip = %esp at the time of our code's execution (it rarely will; we'll get to that) the smallest possible code is 28 bytes:

 aPjjX4jHf5eOf5W0PZZj0X43P[HH

So, lets see what's going on here:

• Now we just need to get this to ascii that we can put onto the stack. The preferred method to do this is by using "strings" against the generated object file. Save the above code in a file called payload.s, assemble it with 'as' and run strings on payload.o, as follows:

 [user@host ~]$ as payload.s --32 -o payload.o
 [user@host ~]$ strings payload.o 
 aPjjX4jHf5eOf5W0PZZj0X43P[HH

• And to make sure its 28 bytes:

 [user@host ~]$ echo -n $(strings payload.o)|wc
   1       1      28

More Xor and poly stuff, needs moved elsewhere

Lets start by using our twelve-byte ASCII NOP-constructing code jFX4XH5oooP. We can actually leave that just the way it is because of the PUSH eax instruction at the end. Let's just add a JMP esp. You'll find that the app will execute the four NOPs before running itself into non-sensible instructions left on the stack as data. But wait! There's more!

What if we pushed the new code onto the stack backwards and then executed that? Holy hex! The code would construct its decryptor, decrypt the value 0x90909090, construct it onto the stack, and then execute the NOP sequence! Using this concept, we can actually construct and decrypt our code multiple times before the code is fully decrypted, constructed, or executed. This is done by manipulating the value of esp so that, as the values are pushed onto the stack, eventually esp runs into eip, and then executes in temporary execution and stack space.

The question is "When does this become overkill and preformance-sacrificing versus efficient and anti-heuristic?" Well, there are a few ways that we can manipulate the value of ESP. Just about any modifier is able to do so - however, to keep it mostly alphanumeric, we're gonna have a few limitations. Those limitations being that the value we assign to the esp register must be relative in order to make ourselves run into our own code. For example, the popad instruction (a or 0x61) pops all registers... So we've lost register data, but that's okay - we have now added 32 to the value of ESP. The pushad instruction will work similarly, subtracting 32 from the value of ESP. Eventually with enough tinkering, you should be able to figure out how to use instructions other than xor, including but not limited to ror, rol, shr, shl, add, sub, imul, idiv, and others.

Encoding Shellcode : Ascii Art

Jump restrictions are between 48 and 122

Lets start out with Koshi's 14 byte alphanumeric NtGlobalFlags Payload:

jpXV34dd3v09Fh je dubugger present (in alpha, 't(operand)').

we'll want to exit if there's a debugger present.

but lets get onto the real fun, shall we?

push 'p' #jp pop eax #X push esi #V xor esi, dword ptr ss:[esp] #34d (now contains esi), esi = 0 xor esi, dword ptr ss:[esi+30] #d3v0 (store offset 0x30 into esi) cmp dword ptr ds:[esi+68], eax #9Fh (compare esi pointer offset 0x68 with 0x70.)

So for our beginning notes, we can be assured that the following must be sequential, and registers must be preserved:

V34dd4v0 - ESI must be zeroed, NtGlobalflags must be stored in ESI. esi cannot be modified until eax is set to 0x6a/'j' and then 9Fh is run as a comparison.

So lets see here, our comparisons are a little hacky. We can compare eax to a dword using the '=' opcode 0x3a, after that we're limited to the unpredictable 0x38-0x3b instructions. So, for sanity sake, we'll use the '=' opcode here. Our other cmp operators will be reserved for future instructions, as they get a lot more complex.

So suppose we wanted to jump 30 bytes ahead in pure ascii. The easy way to do this is by setting the value of the eax register to a controllable ascii DWORD. In our case, we'll use the string 'code':

hcodeX=codet0

Disassembled, this represents: push 'code' pop  %eax cmp 'code', %eax je 0x30

Lets get ourselves some ascii art. This ascii art is 80 bytes wide, so each line is 81 bytes including the newline (0x0a).

                      oooooooooo.              .o8                             
                      `888'   `Y8b            "888                             
ooo. .oo.    .ooooo.   888      888  .ooooo.   888oooo.  oooo  oooo   .oooooooo
`888P"Y88b  d88' `88b  888      888 d88' `88b  d88' `88b `888  `888  888' `88b 
 888   888  888   888  888      888 888ooo888  888   888  888   888  888   888 
 888   888  888   888  888     d88' 888    .o  888   888  888   888  `88bod8P' 
o888o o888o `Y8bod8P' o888bood8P'   `Y8bod8P'  `Y8bod8P'  `V88V"V8P' `8oooooo. 
                                                                     d"     YD 
                                                                     "Y88888P' 

Lets see which lines look the best for code insertion. The string 'hcodeX=codet0' is 13 bytes. We can start with a jump to the big string of o's at the top of the 'D' in Debug. The first 'o' is at row two, column 23. 81 + 23 = 104, or 0x68, the 'h' character:

hcodeX=codeth                                                                  
                      oooooooooo.              .o8                             
                      `888'   `Y8b            "888                             
ooo. .oo.    .ooooo.   888      888  .ooooo.   888oooo.  oooo  oooo   .oooooooo
`888P"Y88b  d88' `88b  888      888 d88' `88b  d88' `88b `888  `888  888' `88b
 888   888  888   888  888      888 888ooo888  888   888  888   888  888   888
 888   888  888   888  888     d88' 888    .o  888   888  888   888  `88bod8P'
o888o o888o `Y8bod8P' o888bood8P'   `Y8bod8P'  `Y8bod8P'  `V88V"V8P' `8oooooo.
                                                                     d"     YD
                                                                     "Y88888P'

We have now jumped to the top of the D. So, going back to our shellcode, as long as we preserve eax, we can jump in the string '=codeth' which is 7 bytes, which lets us squeeze shellcode in spaces. Using our dword 'code' will actually let us tag our shellcode, serving as a tag on the next line in empty space. Because we can only jump 122 bytes, we can't get to a part of the ascii art with enough room. We can solve this problem by finding empty enough space to toss our jump code in, along with a little bit of the necessary shellcode:

hcodeX=codeth                                                                  
                      V34d=codet4              .o8                             
   d4v0=codet?        `888'   `Y8b            "888                             
ooo. .oo.    .ooooo.   888      888  .ooooo.   888oooo.  oooo  oooo   .oooooooo
`888P"Y88b  d88' `88b  888      888 d88' `88b  d88' `88b `888  `888  888' `88b
 888   888  888   888  888      888 888ooo888  888   888  888   888  888   888
 888   888  888   888  888     d88' 888    .o  888   888  888   888  `88bod8P'
o888o o888o `Y8bod8P' o888bood8P'   `Y8bod8P'  `Y8bod8P'  `V88V"V8P' `8oooooo.
                                                                     d"     YD
                                                                     "Y88888P'

We've actually gotten up to the ? mark, and all the way through the bit of code to store the PEB value into the %esi register using the string 'V34dd4v0' while maintaining our ability to jump around. Our next bit of code is going to be tricy. We'll have to jump 80 bytes to land at the top of our 'e'. From there we'll go to the lower top of the 'n', then to the middle of the 'e'. From there to the middle of the g to the bottom of the b, create an extra bottom on the D to accentuate, then jump to the bottom of the 'g' when we're finished. The end result, after calculating out the ascii looks like:

hcodeX=codeth                                                                  
                      V34d=codet4              .o8                             
   d4v0=codeti        `888'   `Y8b            "888                             
ooo. .oo.    .ooooo.   888      888  =codet.   888oooo.  oooo  oooo   .oooooooo
`888codetn  d88' `88b  888      888 d88' `88b  d88' `88b `888  `888  888' `88b 
 888   888  888   888  888      888 88=codetk  888   888  888   888  888   888 
 888   888  888   888  888     d88' 888    .o  888   888  888   888  `=codet5' 
o888o o888o `Y8bod8P' o888bood8P'   `Y8bod8P'  `=codet0'  `V88V"V8P' `8oooooo. 
                     =codet|                                         d"     YD 
                                                                     "jpX9Fht?