{"id":109,"date":"2020-08-22T17:00:00","date_gmt":"2020-08-22T17:00:00","guid":{"rendered":"https:\/\/badbit.vc\/?p=109"},"modified":"2020-09-02T21:17:56","modified_gmt":"2020-09-02T21:17:56","slug":"writing-a-linux-bind-shell-in-asm-x86","status":"publish","type":"post","link":"https:\/\/badbit.vc\/index.php\/2020\/08\/22\/writing-a-linux-bind-shell-in-asm-x86\/","title":{"rendered":"Writing a Bind Shell in x86 Assembly Language"},"content":{"rendered":"\n

A bind shell can be simply defined as a connection established from the attacker’s machine to the victim’s machine which presents the attacker with a comamnd line shell access of the victim’s machine.
In this blog post, we will go through the process of the components involved in a bind shell and create our own.<\/p>\n\n\n\n

In a bind shell, the victim machine listens for incoming connection on a particular port as shown below:
<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

For a better understanding of the concept, we will start with programming a bind shell in a higher level language before diving straight into ASM to get a clear understanding of the program flow and the required syscalls<\/a> which we will later convert into x86 Assembly. <\/p>\n\n\n\n

One must be wondering why convert things into ASSEMBLY LANGUAGE in the first place?! There are multiple reasons to it which can’t be described in a single post. My personal favourite being – to evade malware from Antiviruses, EDRs etc. Here are two blogs each from SentinelOne<\/a> and Fireeye<\/a> which explain why attackers write shellcodes.

In this blog post, I will explain a bind shell starting off with with Python and gradually build the same on lower levels. You can choose the language of your preference to begin with or might even straightaway go into ASM code. Ultimately, it all boils down to your level of comfort and understading.<\/p>\n\n\n\n

\n\n\n\n

Here’s a Python equivalent of a Bind shell:<\/p>\n\n\n\n

import socket\n\nbind_ip = \"0.0.0.0\" #Define the IP to bind to\nbind_port = 4444  #Define port to bind to\n\nserver = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #defining socket function \n\nserver.bind((bind_ip, bind_port)) #Defining bind function to bind to our given IP and ports\n\nserver.listen(5)\n\n#Client handling (Can be ignored)\ndef handler(client_socket):\n    request = client_socket.recv(1024)\n    print(\"[*] Received: %s\" % request)\n    client_socket.send(b\"ACK!\")\n    client_socket.close()\n\nwhile True:\n    client, addr = server.accept()\n    handler()\n    \n <\/code><\/pre>\n\n\n\n
\n\n\n\n
Now let’s take the above as a reference and try to get a little closer to our end goal. We will attempt to convert the same in C and later into x86 Assembly language.
Like any other programming language, we first initialize a socket to enable communication between two nodes. In C, we do it with the socket()<\/a> function.<\/p>\n\n\n\n
#include <sys\/socket.h>\nint socket(int domain, int type, int protocol);<\/code><\/pre>\n\n\n\n
The socket function is a part of sys\/socket.h library and as seen above, it takes three arguments – int domain, int type and int protocol<\/em>. Also, another thing worth noticing is that the socket function itself is of type int<\/em>.
Let’s try to understand the arguments.<\/p>\n\n\n\n