Skip to main content

Bind TCP Shellcode x86 - SLAE Assignment 0x1

Bind TCP Shellcode - Linux x86  (Null free/PI)
Before we start , I would like to bring your attention to this SLAE course from securitytube which will help you learn Shellcoding -

1. Introduction to Bind shell
2. Analysis of Bind Shell
3. Writing Bind tcp shellcode

1. Introduction to Bind shell

Bind Shell
With a bind shell, you open up a communication port or a listener on the target machine. The listener then waits for an incoming connection, you connect to it, the listener accepts the connection and gives you shell access to the target system.

I would define bind shell with reference to above diagram  :
First Step : a bind shell basically opens a port(listener port) on target machine and waits for incoming requests on that port

Second Step : An Attacker try to connect using the target ip address and target listner port and gets a shell :)

2. Analysis of Metasploit Bind Shell through Libemu

 From above diagram it is clear that main syscalls are :
 socket,bind,listen,accept,dup2 and execve 

3. Writing Bind TCP Shellcode

 Lets look for syscalls number and arguements from following link :

Task :
1. Create A shell Bind Tcp -
[x] Binds to a port
[x] Exec shell on incoming connection
[x] Null Free
[x] Register Independent
[x] Short and sweet ;) :p

Lets break the task in small parts -
 [x] Create a socket
 [x] Bind to a specific port
 [x] Setting up listener
 [x] Accepting incoming connections
 [x] dup2 (Redirect stdin, stdout and stderr)
 [x] Spawns Shell

Let's start writing :
 [x] Create a Socket ;) [ int sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_IP); ]

I have commented the explanation so that it would be easy for the readers to understand each instruction step by step .
int socketcall(int call, unsigned long *args);

Socketcall needs EBX to be 1 i.e SYS_Socket number and ECX should contain pointer to arguments therefore for a successful call , I have pushed the socket arguments on stack in order IPPROTO_IP,
SOCK_STREAM,AF_INET because we are dealing with stack . :p
As the requirement says that we need ECX to contain pointer to arguments therefore MOV ECX,ESP is used .
At last :
EAX= 0x66 [socket sys call number]
EBX= 0x1 [SOCKET create number]
ECX= pointer to socket arguments  [ 2 1 0]
Note: I used the push pop method to save few bytes , you can either use xor eax with itself and then move the socket sys call number in AL and so on .
After a successful sys call by calling interrupt 0x80 at the end EAX will contain the socket file descriptor which needs to be saved for future use . I have used ESI register to save sockfd .
[x] Bind [ bind(sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr)); ]

Bind is lil messy :p so I will try to explain this with a diagram . Before that let's see which registers should contain what ?
EAX = socket sys call number 0x66
EBX= SYS_BIND number
ECX= pointer to arguments which are  : sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr)
sockfd and size can be given easily but second parameter deal with structures therefore I have broken the second parameter in simple parts :
 Now again pushing the parameters in way - length of sockaddr,ECX,sockfd
Saving pointer to argument in ECX will solve the purpose and ECX will contain all the three parameters which are required .
At last -
EAX = 0x66
EBX= SYS_BIND number - 2
ECX= pointer to arguments
[x] Listen [ listen(sockfd, 2); ]
For listen we need only two arguments in ECX and EBX should contain SYS_LISTEN number(4) and obviously EAX should contain socket sys call number .
I hope this not a big deal so skipping the explanation because its already there in comments .
[x] Accept [accept(sockfd, (struct sockaddr *)&cli_addr, &sin_size); | here accept(int sockfd, NULL, NULL);]
accept(int sockfd, NULL, NULL);
For accept only three parameters should be used which are sockfd which we already saved in esi then  rest two parameter should be null as we don't require them as of now .
SO basically
EAX = 0x66 socket sys call number
EBX= SYS_ACCEPT number - 5
ECX= pointer to  arguments [sockfd null null]
[x] Dup2

[x] Spawn Shell [ execve("/bin//sh", NULL, NULL); ]
EXECVE call is made in order to spawn shell on incoming connection in above scenario . For execve call we need - EAX to contain execve sys call number EBX to contain pointer to /bin//sh string[which is null terminated] ECX contains null This part is easy and can be understand by comments so skipping this .
[x] All together ;)
Let's compile using my script and test the shellcode .
[x] C code here -
[x] bindtcp.nasm  - [92 bytes]
I have commented the Port number field and can be easily configured .. Check Configure your port comment string in comments of bindtcp.nasm .
Proof of Concept :

Thanks for Reading !!!! :)

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:
Student-ID: SLAE-1219


Popular posts from this blog

Review of Pentester Academy - Attacking and Defending Active Directory Lab

Few months ago I didn't know what Active Directory is, and why should I care about it and never heard about ACL abuse and all. Although I had attended a BPAD (Breaking and Pwning Active Directory) training which was provided by Nullcon but I was not confident enough to go for this course exam, since my day-today activity involves VAPT stuffs related to Web/Network/Mobile and sometimes basic malware analysis (very basic one :p).  I started doing offshore lab and took help from some friends in understanding few Active Directory concepts. I did many silly mistakes during the lab and learned a lot. Meanwhile I registered for Active Directory Lab Course and got it in a discounted offer for first 50 students of about 11k INR  ( 1 mont lab access) :). Before wasting time any further let's dive into the review. The course - Certification - Certified Red Team Professional The Course Content  - After paying the course fee,

Backdoring PE files using code caves : OSCE/CTP Module 0x03 (OSCE Preparation)

Hello Readers, This post will cover Backdooring of P.E file by using code caves . There are already good tools to do this for you eg. Backdoor Factory and Shelter which will do the same job and even bypass some static analysis of few antiviruses . I will be covering the manual approach of backdooring a PE file . Let's understand some terms : [x] PE file : The Portable Executable (PE) format is a file format for executables, object code, and DLLs, used in 32-bit and 64-bit versions of Windows operating systems. [x] Code Cave : Wikipedia says - "A code cave is a series of null bytes in a process's memory. The code cave inside a process's memory is often a reference to a section of the code’s script functions that have capacity for the injection of custom instructions. For example, if a script’s memory allows for 5 bytes and only 3 bytes are used, then the remaining 2 bytes can be used to add external code to the script." [x] Shellcode : Wikipedia - &qu

Hacking Thick Clients – Authorization Bypass

Hello Readers, This post will be focused on setting up a vulnerable thick client application and finding vulnerabilities. The blog post is an unofficial part of the on going series of post by NetSPI. NetSPI has released a vulnerable thick client app called BetaFast which has two versions - BetaBank and BetaFast based on 2-tier and 3-tier architecture respectively. The app is coded by Austin Altmann  and he is writing the walk-through series. Note: At the time of writing this blog, the walk-through/write-up for authorization bypass vulnerability was yet to be published by NetSPI and therefore I decided to create this blog post. All the credit for developing and maintaining this app goes to Austin and NetSPI team. You can find some of the cool write-ups here . Let's start. Setting up Betafast - 1. Download the files from github -  . 2. Extract and open the .sln file with