1

I have generated an alphanumeric shellcode with this command:

msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python

I am targeting a 32 bits x86 architecture on Linux.

Here is the shell code (i've converted it into a string):

IIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI0jTK68mIcbCVrHDmsSOyywSXfO2SsXgpe86OSRSY2NOyYs1Byxc8s0WpUPDo0b2I2NVOCCSXs0V7RsK9yq8Mk0AA

Here is a very basic c program which runs the shellcode:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>

typedef void (*shellcode_t)();
// unsigned char code[] = "\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
unsigned char code[] = "IIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI0jTK68mIcbCVrHDmsSOyywSXfO2SsXgpe86OSRSY2NOyYs1Byxc8s0WpUPDo0b2I2NVOCCSXs0V7RsK9yq8Mk0AA";


int main (int argc, char * argv[])
{
  shellcode_t appel = (shellcode_t)code;
  appel();

  return 0;
}

Here is how i compile it:

$ cc -Wall -m32 -z execstack -fno-stack-protector -O0 test.c -o test

When i run the program i get a segfault.

Please note the classical shellcode i've commented in the c program works perfectly. So it is not a c program compilation issue.

Thanks

  • Are you sure of your crafted alphanumeric shellcode ? Because, I tried to read it and it seems just non sense to me... Have you tried to understand this shellcode in-depth? – perror Feb 19 at 9:04
  • no in fact i want first to first get a working alphanumeric shellcode. And then i want to understand how it works. This is why i am testing it first – Bob5421 Feb 19 at 9:32
  • Well, as this one is obviously not working I think you should do the other way around. First understand and, then, make it work! :-) – perror Feb 19 at 9:59
  • My goal is to understand how it works but i need a sample first. What i am looking for is how make an int 80 instruction with only alpha numeric... – Bob5421 Feb 19 at 10:06
  • Read this phrack article. It explains everything in details. – perror Feb 19 at 12:36
5

Alphanumeric shellcode expects the location of the shellcode to be stored in a register, since the usual technique of call/pop can't be performed with the limited character set.

In your example above this is set using BufferRegister=ECX, your C program doesn't take this into account though, which is why it crashes. Taking out the BufferRegister directive will give you a shellcode blob that determines the location manually, but isn't pure alphanumeric. This should run in your program though.

An alternative would be to use something that runs shellcode from a file, since these often have a jmp/call reg32, which you can then use with BufferRegister.

  • Thanks, can you tell me more about jmp/call i do not understand what it changes to be from a file – Bob5421 Feb 19 at 14:20
  • The jmp/call technique is just a technique used to find the address of the string whatever you are located in memory (it's a PIC method). The first jmp goes to the call which is just before the string "/bin/sh" and the call send the eip to the instruction just after the original jmp. Meanwhile, the call has pushed the return address on the stack, which is in fact the address of the string. This technique is fully documented on Internet in several articles. – perror Feb 19 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.