A shell is a small program that takes input from the user and sends it back to operating system and vice versa. In this writeup I will show you how we can create a custom tcp bind shell shellcode.
So how does TCP Reverse exploit shell work ?
In a TCP Reverse shell exploit shellcode is more effective than bind shell. It might happen the victim firewall may block the incoming connection. So instead of opening the port at the victim side we will open a port at the attacker side. We ask the victim machine to connect back to us on successfull execution of the shellcode. So we on attacker side will listen for an incoming connection and when the attacker connect to the listening port, on the victim side it will open up a shell and transfer the control to the attacker. So the attacker now has a shell access to the victims machine and can run any commands.
So there are few points I need to make clear while I write this post
1. The code that I have written went through lot of debugging and modification and I am still modifying ( to minimize , to remove bad characters like PUSH 0x0 can introduce bad characters so I replaced them with something that had the value NULL and then pushed them to on stack like PUSH ECX )
2. Some code which I have written might look STUPID (for example mov eax,edx followed by mov edx,eax). I just wrote them to remember few things like ( X will always hold Y data before the operation ) and I am optimizing them still to remove them. As I will keep updating my code , I will continue to remove them)
3. I will try to keep the documentation and the details in the code itself , so that I can constantly modify them from the github instead of modifying them twice , i.e here and in the github again.
First we will code the reverse shell with C and later use the same concept using Assembly.
At any point of time we can use man command to look into the API implementation e.g man socket
TCP Reverse Shell Written in NASM , but this has a drawback ( only connect to hardcoded 127.0.0.1 which we will fix in the next code below this code)
We made some changes from the above code so that it can connect to any IP address
Shellcode with configurable IP and Port
This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification:
http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student ID: PA-1191
In a TCP Reverse shell exploit shellcode is more effective than bind shell. It might happen the victim firewall may block the incoming connection. So instead of opening the port at the victim side we will open a port at the attacker side. We ask the victim machine to connect back to us on successfull execution of the shellcode. So we on attacker side will listen for an incoming connection and when the attacker connect to the listening port, on the victim side it will open up a shell and transfer the control to the attacker. So the attacker now has a shell access to the victims machine and can run any commands.
So there are few points I need to make clear while I write this post
1. The code that I have written went through lot of debugging and modification and I am still modifying ( to minimize , to remove bad characters like PUSH 0x0 can introduce bad characters so I replaced them with something that had the value NULL and then pushed them to on stack like PUSH ECX )
2. Some code which I have written might look STUPID (for example mov eax,edx followed by mov edx,eax). I just wrote them to remember few things like ( X will always hold Y data before the operation ) and I am optimizing them still to remove them. As I will keep updating my code , I will continue to remove them)
3. I will try to keep the documentation and the details in the code itself , so that I can constantly modify them from the github instead of modifying them twice , i.e here and in the github again.
First we will code the reverse shell with C and later use the same concept using Assembly.
At any point of time we can use man command to look into the API implementation e.g man socket
TCP Reverse Shell Written in NASM , but this has a drawback ( only connect to hardcoded 127.0.0.1 which we will fix in the next code below this code)
We made some changes from the above code so that it can connect to any IP address
Shellcode with configurable IP and Port
This blog post has been created for completing the requirements of SecurityTube Linux Assembly Expert Certification:
http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student ID: PA-1191