3

I'm trying to write some custom shellcode to obtain a shell from a program. Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new socket, connect back and spawn a shell.

I am able to to get a connection back, but unfortunately when I call CreateProcessA, I don't get any shell.

After the call to socket() I have the socket descriptor in EAX:

enter image description here

And then, after connect() (which works, I get the connection back on my netcat listener), I call CreateProcessA() and this are the parameters:

enter image description here

InheritHandles is correctly set to TRUE. On the left panel I have dumped the StartUpInfo structure and as you can see the file descriptor is correctly added for all handles (first 3 bytes of the structure are all set to 200). Also the flag STARTF_USESTDHANDLES is correctly set.

Unfortunately, this doesn't work. What surprises me is that if instead of using the address of the intermodular call to socket(), I use the address of WSASocketA (found using arwin), and without changing anything else (apart from adding the extra null arguments required for WSASocketA), I can get my shell.

I don't understand why this is not happening with socket(), in fact, according to the documentation for the flag WSA_FLAG_NO_HANDLE_INHERIT of the WSASocketA:

Create a socket that is non-inheritable.

A socket handle created by the WSASocket or the socket function is inheritable by default. When this flag is set, the socket handle is non-inheritable.

So I assumed that by default it should work with both functions.

I don't know if this is relevant, but I'm testing it against a Windows 7 machine.

1
  • This isn't really a reverse engineering question. My guess would be that - given you compare WinSock with the socket implementation inherited from BSD - that's your answer right there ...
    – 0xC0000022L
    Commented Nov 28, 2019 at 14:36

1 Answer 1

2

Windows socket() creates a socket with WSA_FLAG_OVERLAPPED flag set and inheritable by default.

Windows WSASocket() allows you to specify WSA_FLAG_OVERLAPPED and WSA_FLAG_NO_HANDLE_INHERIT. If you omit both flags to WSASocket(), then the resulting socket will be inheritable and will not have WSA_FLAG_OVERLAPPED flag set.

Unlike on Unix, Windows SOCKET is different from file descriptors or pipes. If you pass a socket to Windows CreateProcess using STARTF_USESTDHANDLES, the socket must not have WSA_FLAG_OVERLAPPED flag set.

You managed to (accidentally) use WSASocket() without flags, so created an inheritable socket without WSA_FLAG_OVERLAPPED, so it worked for you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.