1

I saw this shellcode and when they use the connect function they pass the port number 4444:

set_address:
  push byte 0x05         ; retry counter
  push 0x0100007F        ; host 127.0.0.1
  push 0x5C110002        ; family AF_INET and port 4444
  mov esi, esp           ; save pointer to sockaddr struct

Or in other website like that:

0000001A      push dword 0x5c110002   ; [0x5c110002, 0x81caa8c0, 0x1, 0x0] // sin_port and sin_family (4444, 0x0002)

But they push 0x5C110002, how they extract 4444 from 0x5C110002?

2

The connect syscall takes a sockaddr structure as an argument, which looks something like this:

struct sockaddr_in {
        short   sin_family;
        u_short sin_port;
        struct  in_addr sin_addr;
        char    sin_zero[8];
};

They aren't extracting 4444, it's simply passed on the stack as a two-byte short. You are passing to connect, in little-endian order:

  • sin_family: 0x0002 (AF_INET)
  • sin_port: 0x5c11 (4444 in hex, little endian)
  • sin_addr: 0x0100007F ([127] [0] [0] [1], little endian)
0

I found here how to convert it with python.

import socket
port = 4444
hex(socket.htons(port))
Result : 0x5c11 

The opposite is like that:

socket.htons(0x5c11)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.