osirislab / shellcode

#Shellcode This is a repository of Shellcode written by students in NYU-Polytechnic's ISIS lab. This repository came about as a need for trustworthy and reliable 32/64 bit Intel shellcode for CTF style exploitation.

This repository also contains the isis python library that has a handful of useful functions for exploitation.

##Dependencies In order to assemble and link(for testing) you will need to install:

• GCC
• GCC-multilib
• Nasm
• ia32-libs

To install:

sudo apt-get install gcc gcc-multilib nasm ia32-libs

##Usage Each folder containing shellcode has at least two files. A .s file containg the assembly and a makefile. Typing make in a folder will assemble the shellcode as a raw binary file called shellcode and generate an ELF binary for testing called testShellcode. Shellcode that cannot be tested by running testShellcode alone will have other instructions. You can also test the shellcode by incorporating it into a working exploit. If you would like to hardcode the shellcode into your exploit instead of reading it from the shellcode file you can use the shellcode as array python script.

####Configuring The behaviour of most shellcode instances can be configured with %defines. Here are some examples:

• Change the systemcall mechanism. Mechanism Choice. SYSTEM_CALL macro definition.
• Change the shell mechanism after socket or other operations. Modular shellcode.
• Enable/disable debugging or other functionality. Debug. Playfair
• Configure IP/Port for connect back shelcode. IP/htons macro.

##Writing one-off/special purpose shellcode There are many macros in the include folder that make writing new shellcode easier or modifying shellcode for different operating systems possible.

##Contributing Please feel free to contribute by submitting feature requests and bug reports to the issue tracker. Commit bits(for ISIS students only) and pull requests will be handled on a case by case basis.

shellcode's Issues

Socket reuse shellcode

Development on the 64bit socket reuse shellcode is almost done. It needs to be ported to 32bit x86

Organization plan

come up with a plan to logically organize all of the shellcode. I like the system I have now of using make files to generate executables for testing but it is a little tedious. The names for almost all of the shellcode folders is unclear. Come up with a system for testing difficult shellcode like staggers and socket reuse code.

Stage

Come up with an awesome stage and find a way to justify its existence.

Exploit Delivery/Development Framework

Develop throwing framework in python.
Wishlist:
After exploit lands drop into a shell
Have the ability to rewrite portions of a payload on the fly (Example: change the magic number in the socket reuse shellcode transparently to the operator)
Simplify the development of CTF exploits, expose a way to get a connected exploitation friendly socket with one function call etc...

Write A Stage Loader

A stage loader will replace the /bin/sh payload that is included in most of my shellcode.
The stage loader is responsible for reading binary data from a socket and writing it to memory that is executable.

I would like the loader to do the following:
Map(mmap) to a random or fixed low address a fairly large amount of readable writable and executable memory. Use read to take a binary blob of data from the network. The binary blob will be composed of some metadata (first 4-8 bytes or so) and a shared library. After the shared library is in memory your code should read an offset from the metadata, add that offset to the load address and jmp to that memory.

IPv6 connect back shellcode

The repository needs some IPV6 connect back shellcode for both x86 and x86_64 architectures. Should include a make file similar to all other codes.

Research Staging techniques

Experiment with writing a sager. See if you can load statically compiled executables into memory and run them. Research putting this functionality into the thrower.

Hex Dump

Write a hexdumper for ISIS.
should be able to group bytes based on args.

IPv6 connect back shellcode

The repository needs some IPV6 connect back shellcode for both x86 and x86_64 architectures. Should include a make file similar to all other codes.

Stager

Write a stager.
Don't put a lot of effort on this if you're not going to be involved with the development of the thrower.