The fourth assignment for SLAE certification is to create a custom encoding scheme and create a weaponized PoC using che execve-stack assembler code.
The assignment was written on an Ubuntu Linux 18.04, with a Linux kernel 4.15 version.
The starting payload
We start our weaponized proof of concept from this assembler code
This assembler code translates after compilation in this shellcode:
First step is to align this payload so to be a 4 multiple. Let’s use x90 as padding.
Second step is to XOR this block with a KEY, that is 0xdeadbeef in our case.
We can swap first half and second half of each word
We prepend the payload with the actual number of byte of the shellcode, XOR-ed with the obfuscation key 0xdeadbeef
We have 24 bytes as payload in our weaponized PoC that turns in x18 as hexdecimal. I’ll fill a 32 byte register with the payload length, this implies that this encoding schema has a limitation for payload with size not longer than 255 bytes.
Filling the register, turn it to “x18x18x18x18”. We then apply the XOR with 0xdeadbeef encoding key and we obtain “xc6xb5xa6xf7”. We then store it swapped: “xf7xa6xb5xc6”
The final encoded payload is:
Given an encoded payload, the decoding route must be in place to make sure to revert our strategy.
take the first dword, and XOR with hardcoded key. An important part here is that we don’t need to revert the swapping action we did in encoding this first value becase on the stack values are stored in a reverse order. So storing into the stack, put the value in the correct order and we have just to XOR it back to calculate the payload length.
divide the value stored in AL with 8 and store on EDX the number of words the payload is length
for each of the n dword(s)
byte swap the words
xor with the encoding key
When we will reach the payload length during iteration we jump to the decoded value in memory and the payload is executed for us.
Here it is the python script I used to create different C programs containing different payloads. Please note that I added also a function to change the EGG value.
The proof of concept
This is the assembly weaponized PoC. It takes an encoded payload, it decodes it and then it passes the execution to the extracted code.
Dumping the shellcode I obtained:
I added this shellcode into the same C program used in previous assignments to test our shellcode and I executed it in order to check the payload is correct.
To prove my encoder on a real test bed, I used VirusTotal portal. Here it is the analysis.
As you may see, only 6 antivirus out of 59 detects the weaponized code as malicious.
Code in action
Here you can find the custom encoder weaponized code in action.
SLAE Exam Statement
This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: