linux/x86/exec Analyzing

I will analyze this shellcode from msfvenom, and I will keep it simple.

0x4553@kali:~# msfvenom -l payloads | grep linux/x86 
        ...
linux/x86/exec               Execute an arbitrary command
        ...

Keep in mind, that shellcodes use system calls. To interrupt a system call we use instruction int 0x80 , and the skeleton will be something like this:

EAX       <-- System Call Number [it will contain the return value]
EBX       <-- 1st arg
ECX       <-- 2nd arg
EDX       <-- 3rd arg
int 0x80  <-- interrupt

linux/x86/exec

Description: Used to execute an arbitrary command using execve system call.

int execve(const char *filename, char *const argv[], char *const envp[]);

Get Inspiration </>’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To show the shellcode’s options:

0x4553@kali:~# msfvenom -p linux/x86/exec --list-options
Options for payload/linux/x86/exec:
=========================
    ...
Basic options:
Name  Current Setting  Required  Description
----  ---------------  --------  -----------
CMD                    yes       The command string to execute
    ...

CMD option is required, it is the command that will be executed.

• Generate the shellcode and save it in shellcode_raw file:

0x4553@kali:~# msfvenom -p linux/x86/exec CMD=whoami -f raw > shellcode_raw

-p: is the payload we want to use.

CMD: the command to be executed by the exec.

-f: shellcode format, I choose raw to analyze it first.

• Let’s statically analyze the shellcode using ndisasm:

0x4553@kali:~# cat shellcode_raw | ndisasm -u -

-u: Specifies 32-bit mode.

Analyzing the instructions

Now, generate the shellcode in C format and without NULL bytes, it will be more complex to explain but it does the same thing before.

0x4553@kali:~# msfvenom -p linux/x86/exec CMD=whoami -b "\x00" -f c -v shellcode
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 69 (iteration=0)
x86/shikata_ga_nai chosen with final size 69
Payload size: 69 bytes
Final size of c file: 321 bytes
unsigned char shellcode[] = 
"\xd9\xeb\xd9\x74\x24\xf4\xb8\x05\x91\x3a\xf0\x5d\x29\xc9\xb1"
"\x0b\x83\xed\xfc\x31\x45\x15\x03\x45\x15\xe7\x64\x50\xfb\xbf"
"\x1f\xf7\x9d\x57\x0d\x9b\xe8\x40\x25\x74\x98\xe6\xb6\xe2\x71"
"\x94\xdf\x9c\x04\xbb\x72\x89\x10\x3b\x73\x49\x68\x53\x1c\x28"
"\xfb\xca\xe2\xfd\x50\x85\x02\xcc\xd7";

Then paste the shellcode to shellcode.c

Let’s debug the shellcode file using gdb with peda.

0x4553@kali:~# gdb -q shellcode
Reading symbols from shellcode...(no debugging symbols found)...done.
gdb-peda$ break *&shellcode   
Breakpoint 1 at 0x4040
gdb-peda$ r

break *&shellcode: to run the program until shellcode calling.

At the end and before interrupt, the final register values are:

That’s it!

I hope you will find this article useful ❤.