Alphanumeric shellcode example for peace and magic.

-
So a friend of mine was having trouble doing syscalls in his exploration of alphanumeric shellcode, and I thought i would lend him a hand :D enjoy. this all turns into: "h0ppoXH50p0o4nPYhAAAAX1A0jNX4rNDqq" you will need to replace the absolute address magic with your own to have this run :P 



[bits 64]

_start:
; printable: 0x20 - 0x7e
; alphanum:  0x30 - 0x39, 0x41 - 0x5A, 0x61 - 0x7A

;     CODE               | ASCII  | HEX
;________________________|________|_________________________
;    and rax, 0x7a7a7a7a ; H%zzzz | 0x48,0x25,0x7a,0x7a,0x7a,0x7a
;    and eax, 0x7a7a7a7a ; %zzzz  | 0x25,0x7a,0x7a,0x7a,0x7a
;    and ax, 0x7a7a      ; f%zz   | 0x66,0x25,0x7a,0x7a
;    and al, 0x7a        ; $z     | 0x24,0x7a
;    sub rax, 0x7a7a7a7a ; H-zzzz | 0x48,0x2d,0x7a,0x7a,0x7a,0x7a
;    sub eax, 0x7a7a7a7a ; -zzzz  | 0x2d,0x7a,0x7a,0x7a,0x7a
;    sub ax, 0x7a7a      ; f-zz   | 0x66,0x2d,0x7a,0x7a
;    sub al, 0x7a        ; ,z     | 0x2c,0x7a
;    xor rax, 0x7a7a7a7a ; H5zzzz | 0x48,0x35,0x7a,0x7a,0x7a,0x7a
;    xor eax, 0x7a7a7a7a ; 5zzzz  | 0x35,0x7a,0x7a,0x7a,0x7a
;    xor ax, 0x7a7a      ; f5zz   | 0x66,0x35,0x7a,0x7a
;    xor al, 0x7a        ; 4z     | 0x34,0x7a
;    cmp rax, 0x7a7a7a7a ; H=zzzz | 0x48,0x3d,0x7a,0x7a,0x7a,0x7a
;    cmp eax, 0x7a7a7a7a ; =zzzz  | 0x3d,0x7a,0x7a,0x7a,0x7a
;    cmp ax, 0x7a7a      ; f=zz   | 0x66,0x3d,0x7a,0x7a
;    cmp al, 0x7a        ; <z     | 0x3c,0x7a
;    push rax            ; P      | 0x50
;    push rbx            ; S      | 0x53
;    push rcx            ; Q      | 0x51
;    push rdx            ; R      | 0x52
;    push rdi            ; W      | 0x57
;    push rsi            ; V      | 0x56
;    push rsp            ; T      | 0x54
;    push rbp            ; U      | 0x55
;    push r8             ; AP     | 0x41,0x50
;    push r9             ; AQ     | 0x41,0x51
;    push r10            ; AR     | 0x41,0x52
;    push r11            ; AS     | 0x41,0x53
;    push r12            ; AT     | 0x41,0x54
;    push r13            ; AU     | 0x41,0x55
;    push r14            ; AV     | 0x41,0x56
;    push r15            ; AW     | 0x41,0x57
;    push ax             ; fP     | 0x66,0x50
;    push bx             ; fS     | 0x66,0x53
;    push cx             ; fQ     | 0x66,0x51
;    push dx             ; fR     | 0x66,0x52
;    push di             ; fW     | 0x66,0x57
;    push si             ; fV     | 0x66,0x56
;    push sp             ; fT     | 0x66,0x54
;    push r8             ; fAP    | 0x66,0x41,0x50
;    push r9w            ; fAQ    | 0x66,0x41,0x51
;    push r10w           ; fAR    | 0x66,0x41,0x52
;    push r11w           ; fAS    | 0x66,0x41,0x53
;    push r12w           ; fAT    | 0x66,0x41,0x54
;    push r13w           ; fAU    | 0x66,0x41,0x55
;    push r14w           ; fAV    | 0x66,0x41,0x56
;    push r15w           ; fAW    | 0x66,0x41,0x57
;    push 0x7a7a7a7a     ; hzzzz  | 0x68,0x7a,0x7a,0x7a,0x7a
;    push word 0x7a7a    ; fhzz   | 0x66,0x68,0x7a,0x7a
;    push 0x7a           ; jz     | 0x6a,7a
;    pop rax             ; X      | 0x58
;    pop rbx             ; [      | 0x5b
;    pop rcx             ; Y      | 0x59
;    pop rdx             ; Z      | 0x5a
;    pop rdi             ; _      | 0x5f
;    pop rsi             ; ^      | 0x5e
;    pop rsp             ; \      | 0x5c
;    pop rbp             ; ]      | 0x5c
;    pop r8              ; AX     | 0x41,0x58
;    pop r9              ; AY     | 0x41,0x59
;    pop r10             ; AZ     | 0x41,0x5a
;    pop r11             ; A[     | 0x41,0x5b
;    pop r12             ; A\     | 0x41,0x5c
;    pop r13             ; A]     | 0x41,0x5d
;    pop r14             ; A^     | 0x41,0x5e
;    pop r15             ; A_     | 0x41,0x5f
;    pop ax             ; fX      | 0x66,0x58
;    pop bx             ; f[      | 0x66,0x5b
;    pop cx             ; fY      | 0x66,0x59
;    pop dx             ; fZ      | 0x66,0x5a
;    pop r8w              ; fAX     | 0x66,0x41,0x58
;    pop r9w              ; fAY     | 0x66,0x41,0x59
;    pop r10w             ; fAZ     | 0x66,0x41,0x5a
;    pop r11w             ; fA[     | 0x66,0x41,0x5b
;    pop r12w             ; fA\     | 0x66,0x41,0x5c
;    pop r13w             ; fA]     | 0x66,0x41,0x5d
;    pop r14w             ; fA^     | 0x66,0x41,0x5e
;    pop r15w             ; fA_     | 0x66,0x41,0x5f
;    jo short 0x7b       ; pz     | 0x70,0x7a
;    jno short 0x7b      ; qz     | 0x71,0x7a
;    jb short 0x7b       ; rz     | 0x72,0x7a
;    jnae short 0x7b     ; rz     | 0x72,0x7a
;    jc short 0x7b       ; rz     | 0x72,0x7a
;    jnb short 0x7b      ; sz     | 0x73,0x7a
;    jae short 0x7b      ; sz     | 0x73,0x7a
;    jnc short 0x7b      ; sz     | 0x73,0x7a
;    jz short 0x7b       ; tz     | 0x74,0x7a
;    je short 0x7b       ; tz     | 0x74,0x7a
;    jnz short 0x7b      ; uz     | 0x75,0x7a
;    jne short 0x7b      ; uz     | 0x75,0x7a
;    jbe short 0x7b      ; vz     | 0x76,0x7a
;    jna short 0x7b      ; vz     | 0x76,0x7a
;    jnbe short 0x7b     ; wz     | 0x77,0x7a
;    ja short 0x7b       ; wz     | 0x77,0x7a
;    js short 0x7b       ; xz     | 0x78,0x7a
;    jns short 0x7b      ; yz     | 0x79,0x7a
;    jp short 0x7b       ; zz     | 0x7a,0x7a
;    jpe short 0x7b      ; zz     | 0x7a,0x7a
;    jnp short 0x7b      ; {z     | 0x7b,0x7a
;    jpo short 0x7b      ; {z     | 0x7b,0x7a
;    jl short 0x7b       ; |z     | 0x7c,0x7a
;    jnge short 0x7b     ; |z     | 0x7c,0x7a
;    jnl short 0x7b      ; }z     | 0x7d,0x7a
;    jge short 0x7b      ; }z     | 0x7d,0x7a
;    jle short 0x7b      ; ~z     | 0x7e,0x7a
;    jng short 0x7b      ; ~z     | 0x7e,0x7a

    push 0x6f707030     ; encoded absolute address preamble
    pop rax
    xor rax, 0x6f307030 ; xor the preamble with the fancy key
    xor al, 0x6e        ; special stuff to pull the value 9f out of our ass
    push rax            ; put the resulting absolute address into rcx
    pop rcx
    push 0x41414141     ; syscall code block key
    pop rax
    xor [rcx+48], eax   ; decode the sycall code block using an offset for more ass pulling
    push 0x4e           ; encoded syscall number for exit
    pop rax
    xor al, 0x72        ; xor it with the key
syscall:
    db 0x4e,0x44,0x71,0x71

Comments

Post a Comment

Popular posts from this blog

What is a canary, how does it work, and what does that mean if I want to write a modern exploit.

-
Image
Canaries were  once regularly used  in  coal mining as an early warning system . Toxic gases such as carbon monoxide or asphyxiant gases such as methane  in the mine  would kill the bird before affecting the  miners . Signs of distress from the bird indicated  to  the  miners  that conditions  were  unsafe . Let's start with some history Oh the good old days. I remember a time when hackthissite.org , and  Smash The Stack  were fresh, and BOF's were often as easy as shoving your shellcode where the buffer was supposed to be and overwriting the return pointer with where that buffer was... Then they had to go and ruin the fun by widely adopting ASLR (Address Space Layout Randomization), DEP (Data execution protection), and  canaries  (stack cookies). Now in these dark times not only do we have to ROP with return to libc, we have to chain that with a memory leak vulnerability if we have any hope of  smashing the stack. While I plan to do posts soon covering all of these exciti
Read more

Better visualization of data formats using assembly POC's to better implement them in C

-
Image
Are you tired of staring at hex dumps, white papers and manual pages? Want to feel like you truly know how a data type like a file format, or a disk partition LOOKS like. Well I can't help you with the manual pages and white papers, ( https://staff.washington.edu/dittrich/misc/fatgen103.pdf , http://www.eit.lth.se/fileadmin/eit/courses/eitn50/Projekt1/FAT12Description.pdf ) but here is a great example of implementing a fat12 floppy image in assembly. ;//////////////////////////////////////////////////////////////////////////////// ;// THE SCOTCH-WARE LICENSE (Revision 0): ;// <aaronryool@gmail.com> wrote this file. As long as you retain this notice you ;// can do whatever you want with this stuff. If we meet some day, and you think ;// this stuff is worth it, you can buy me a shot of scotch in return ;//////////////////////////////////////////////////////////////////////////////// ; This assembles to a floppy disk image [bits 16] [org 0x7C00] ;;;;;;;;;;;;;;;;;
Read more

Putting Linux on your Android device using debootstrap and chroot

-
Image
Ok, so first thing first. You will need a few things done BEFORE you attempt this tutorial: A rooted android device of sorts with debugging enabled and busybox installed An sdcard to store the debian image on A Linux machine (or live cd) to prepare the debian system image ADB for remounting the system partition and pushing startup scripts A terminal application installed on your droid and about an hour of free time Lets get right into it open up a terminal, and make a directory that you will be storing all of the files and things we create for easy cleanup later. I called mine linux_on_android. change to that directory, all instructions from here on out will be relative to whatever directory you are currently residing in after this step. Next, we create an empty raw disk image, make a directory to mount it under, create a filesystem on the image, and mount it under our new mount point. Now lets change into our mnt directory, install debootstrap, and use it to install a base system into
Read more