Skip to main content

Egg Hunter Shellcode x86 - SLAE Assignment 0x3

Before we start , I would like to bring your attention to this SLAE course from securitytube which will help you learn Shellcoding - http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

AGENDA : :
1. Introduction to Egg Hunter
2. Dummy Algo of Egg Hunter
3. Writing Egg Hunter Shellcode
4. Wrapper Script to generate shellcode with custom EGG tag

1. Introduction to Egg Hunters

Egg Hunter :-
Fuzzysecurity says :
The egg hunter is composed of a set of programmatic instructions that are translated to opcode and in that respect it is no different than any other shellcode (this is important because it might also contain badcharacters!!). The purpose of an egg hunter is to search the entire memory range (stack/heap/..) for our final stage shellcode and redirect execution flow to it.
After reading a lot of blog post I found this common paper link so thought of going through it.The paper contains very good information and different methods of egg hunting . I found sigaction method easy but every method has their own pros and cons. 
Please read this paper if you are interested in egg hunter's use/implementation.

2. Dummy Algo of Egg Hunter

dummyfunc_egghunt(addr)
{
if (value(addr)==EGGTAG/STRING)then
jmp to addr
else
dummyfunc_egghunt(addr+1)
}

3. Writing Egg Hunter Shellcode


4. Wrapper Script to generate custom TAG shellcode
Reverse TAG/EGG python program -

Final Script -


[x] C code here - https://github.com/hexachordanu/SLAE/blob/master/Assignment-3/shellcode.c
[x] egghunter.nasm - https://github.com/hexachordanu/SLAE/blob/master/Assignment-3/egghunter.nasm [32 bytes]
[x] Wrapper Script to generate egg hunter with custom tag can be found here - https://github.com/hexachordanu/SLAE/blob/master/Assignment-3/eggwrapperscript.sh
[x] All scripts can be found here - https://github.com/hexachordanu/SLAE/tree/master/Assignment-3
Proof of Concept :


This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ 
Student-ID: SLAE-1219
Labels:

Comments

Post a Comment

Popular posts from this blog

Review of Pentester Academy - Attacking and Defending Active Directory Lab

Few months ago I didn't know what Active Directory is, and why should I care about it and never heard about ACL abuse and all. Although I had attended a BPAD (Breaking and Pwning Active Directory) training which was provided by Nullcon but I was not confident enough to go for this course exam, since my day-today activity involves VAPT stuffs related to Web/Network/Mobile and sometimes basic malware analysis (very basic one :p).  I started doing offshore lab and took help from some friends in understanding few Active Directory concepts. I did many silly mistakes during the lab and learned a lot. Meanwhile I registered for Active Directory Lab Course and got it in a discounted offer for first 50 students of about 11k INR  ( 1 mont lab access) :). Before wasting time any further let's dive into the review. The course -  https://www.pentesteracademy.com/activedirectorylab Certification - Certified Red Team Professional The Course Content  - After paying the course fee,
4 comments
Read more

Brute Force Basic Authentication - PSP Assignment 0x1

Before we start I would like to bring your attention to this PSP course from Pentester Academy   - https://www.pentesteracademy.com/course?id=21 . The course is focused on Powershell scripting which can be used in pentesting activities. AGENDA  : 1. Introduction to Powershell 2. Basic Authentication lab setup 3. Brute-force Basic Authentication using Powershell Script -   - cmdlet   - IP,Port and word-list should be easily configurable 1.  Introduction to Powershell  -  Microsoft says- PowerShell is a task-based command-line shell and scripting language built on .NET. PowerShell helps system administrators and power-users rapidly automate tasks that manage operating systems (Linux, macOS, and Windows) and processes. PowerShell commands let you manage computers from the command line. PowerShell providers let you access data stores, such as the registry and certificate store, as easily as you access the file system. PowerShell includes a rich expression parser and a fu
1 comment
Read more

Shellcode Analysis x86 - SLAE Assignment 0x5

Before we start , I would like to bring your attention to this SLAE course from securitytube which will help you learn Shellcoding -  http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ We all use metasploit in our daily pentest engagements so let's break-up some of the shellcode comes with metasploit. Analysis :  1. linux/x86/chmod  2. linux/x86/exec  3. linux/x86/read_file 1. linux/x86/chmod -   msfvenom -p linux/x86/chmod -f raw | ndisasm -u - msfvenom -p linux/x86/chmod -f c msfvenom -p linux/x86/chmod -f raw | sctest -vvv -Ss 100000 -G chmod.dot dot chmod.dot -Tpng -o chmod.png  2. linux/x86/exec -   msfvenom -p linux/x86/exec CMD=ls FILE=tmp.bin -f raw | ndisasm -u - msfvenom -p linux/x86/exec CMD=ls -f c msfvenom -p linux/x86/exec CMD=ls FILE=tmp.bin -f raw | /opt/libemu/bin/sctest -vvv -Ss 100000 -G exec.dot dot exec.dot -Tpng -o exec.png 3. linux/x86/read_file - msfvenom -p linux/x86/shell/revers
1 comment
Read more