1. 技术文章
  2. Create and test x86-64 ELF executable shellcode on a Linux machine

Create and test x86-64 ELF executable shellcode on a Linux machine

由 守給你的承諾、 提交于 2019-12-05 18:48:22

The problem was that the test program shellprogram.c was not correct for the purposes I wanted to use it for, as mentioned by @Iwillnotexist Idonotexist. You can't get data executed due to memory protection enforced by the OS.

The final result that worked (making the data section containing the char[] shellcode readable & executable) was calling:

mprotect((void*)((intptr_t)code & ~0xFFF), 8192, PROT_READ|PROT_EXEC);

Final result for simple exitcall example:

#include <unistd.h>
#include <sys/mman.h>

unsigned char code[] = {
  0x31, 0xdb, 0xb0, 0x01, 0xcd, 0x80
};

int main(int argc, char **argv) {

    mprotect((void*)((intptr_t)code & ~0xFFF), 8192, PROT_READ|PROT_EXEC);  

    int (*exeshell)();
    exeshell = (int (*)()) code;
    (int)(*exeshell)();

    printf("Failed to execute shellcode");

}

Final result for printing "you win!\r\n" to the console:

#include <unistd.h>
#include <sys/mman.h>

unsigned char code[] = {
  0xeb, 0x19, 0x31, 0xc0, 0x31, 0xdb, 0x31, 0xd2, 0x31, 0xc9, 0xb0, 0x04,
  0xb3, 0x01, 0x59, 0xb2, 0x0a, 0xcd, 0x80, 0x31, 0xc0, 0xb0, 0x01, 0x31,
  0xdb, 0xcd, 0x80, 0xe8, 0xe2, 0xff, 0xff, 0xff, 0x79, 0x6f, 0x75, 0x20,
  0x77, 0x69, 0x6e, 0x21, 0x0d, 0x0a
};


int main(int argc, char **argv) {

    mprotect((void*)((intptr_t)code & ~0xFFF), 8192, PROT_READ|PROT_EXEC);  

    int (*exeshell)();
    exeshell = (int (*)()) code;
    (int)(*exeshell)();

    printf("Failed to execute shellcode");

}

Thanks again for showing the solution!

If it helps you are using the memory register pointers from 32-bit applications - you need to replace EAX and EBX with RAX and RBX for 64-bit.

A year late, I know, and doubtless you've moved on but I thought I'd mention it!

标签
Linux
nasm
x86-64
elf
shellcode
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!