-: Introduction to Shellcode. 2 2
\\\So in this lecture, we're gonna discuss 3 3
what shellcode is and why that's important to us 4 4
in our Gaining Access phase. 5 5
So, what is shellcode? 6 6
Well, shellcode is a small piece of code 7 7
that's used as a payload in the exploitation 8 8
of a software vulnerability. 9 9
So this is that exploit piece we talked about 10 10
during our gaining access lecture. 11 11
It's easily reused in other exploits as well, 12 12
so we can use this over and over and over again. 13 13
There's lots of different kinds of shellcode, 14 14
and there's several common ones, 15 15
such as bind and reverse shells. 16 16
So what does a shellcode do? 17 17
Well, it typically is going to start a command shell for us, 18 18
which is why we call it shellcode. 19 19
We want that command shell, so in Windows, 20 20
that would be the Command prompt. 21 21
In Linux, that would be something like the Terminal. 22 22
And this is gonna allow the attacker 23 23
to use interactive command execution on this 24 24
remote target machine. 25 25
How do we make shellcode? 26 26
Well, shellcode is commonly written in machine code, 27 27
so it's usually written in an assembly language. 28 28
But any piece of code that performs 29 29
a similar task can be categorized as shellcode. 30 30
So it could be written in something like C as well. 31 31
But most commonly, it's gonna be written in 32 32
something like assembly or machine code. 33 33
Now, why is this important? 34 34
Well, writing in machine code is pretty darn difficult. 35 35
Now, most of us are not gonna be writing 36 36
our own shellcode. 37 37
Now, if you're gonna be a really good hacker 38 38
and a really good attacker, you're gonna need 39 39
to learn how to do that. 40 40
And there's books out there with lots 41 41
of different examples of shellcode and how to learn 42 42
how to do the shellcoding. 43 43
We're not gonna cover that in this class. 44 44
That's way beyond the scope. 45 45
So for us though, we just want to be able 46 46
to talk about shellcode and understand what it is 47 47
and how it works, and we're gonna show you 48 48
some examples of that. 49 49
So there's two examples of shellcode, 50 50
bind shell and reverse shell. 51 51
We're gonna talk about these two. 52 52
In our lab, we're gonna use a reverse shell, 53 53
and the reason why is because we want that 54 54
interactive command prompt, we want it to go ahead, 55 55
we're gonna run the attack and then 56 56
get ourself back a C prompt when we're attacking Windows, 57 57
or a terminal prompt in Linux for us to attack with. 58 58
So let's talk about bind works first. 59 59
So with bind, the attacker sends an exploit 60 60
to a vulnerable service. 61 61
So let's say you're running something vulnerable, 62 62
like VSFTP. 63 63
And if you're running that, the attacker sends 64 64
the exploit to the vulnerable service, 65 65
the shellcode is gonna bind itself to that port, 66 66
that port 21 for FTP, and then the attacker 67 67
will be able to make a connection, 68 68
a separate connection, to port 21. 69 69
That's how bind works, it binds itself to a port. 70 70
Now, the problem with this is that you have to have 71 71
those ports open in the firewall for this to work. 72 72
So, if we are the attacker, we're now requiring 73 73
that the firewall is running FTP and 74 74
that those ports are open. 75 75
Now if we're running an FTP service that's vulnerable, 76 76
there's a high likelihood that that will be open. 77 77
But if we're trying to attack something 78 78
like a web server and you're running something 79 79
like a Windows desktop, the chances are, 80 80
you're not running port 80 or port 443 81 81
on your Windows desktop. 82 82
You're gonna use that for outbound ports, 83 83
not for inbound ports. 84 84
So that's why bind shells don't work all the time, 85 85
but they do work well in a lot of cases. 86 86
Now, let's talk about how a revere shell works, 87 87
on the other hand. 88 88
So, a reverse shell is still gonna send 89 89
that exploit to the service. 90 90
But when it gets to that target, the shell code itself 91 91
spawns a connection and calls back to the attacker. 92 92
You're gonna see that in our lab. 93 93
We're gonna set up a listening port on our 94 94
Kali Linux machine so that when we 95 95
attack the Windows machine, 96 96
it will call back to our Linux machine 97 97
and say hey, I'm ready to talk to you. 98 98
And the great thing about this is 99 99
you don't have to pre-open 100 100
those ports in the firewall. 101 101
Firewalls are designed so that 102 102
things from the inside the network 103 103
can reach out and call out, 104 104
because, for instance when you 105 105
go to a web server, you call out on port 80, 106 106
but you also open a port to come back in 107 107
on a higher-numbered random port. 108 108
Now we're going to do the same thing here 109 109
to try to hide in traffic. 110 110
Now once we do this, the attacker machine, 111 111
our Kali box, is going to listen 112 112
for that call-back, 113 113
and once it receives that call-back 114 114
we get that two-way communication. 115 115
And that's when we can start doing this 116 116
executable reverse shell that gives us 117 117
full interactive communication. 118 118
Now, there's another type of payload out there 119 119
that we talk about that's called 120 120
a staged payload. 121 121
Now what this is usually it's going to be 122 122
the shellcode itself is too large to pass 123 123
fully through a single stage. 124 124
It would be caught too easily. 125 125
So instead what we do is we break 126 126
up that shellcode into many smaller stages, 127 127
sometimes one or two or three, or even four. 128 128
And what happens, this happens 129 129
to make the attack quieter. 130 130
So what happens is I can launch the exploit. 131 131
The original stage one payload goes 132 132
and gets loaded on the victim machine. 133 133
It then reaches out and gets stage two's payload. 134 134
Stage two then gets stage three, 135 135
and it keeps building until it gets 136 136
the entire payload we want to make the full 137 137
connection for us to be able to do our attack. 138 138
And that's what a staged payload is. 139 139
You may hear that come up. 140 140
So how do staged payloads work? 141 141
Just like we said, stage one is going to happen. 142 142
The attacker is going to pass a small piece 143 143
of code to the target, then stage two 144 144
is going to reach out, grab the larger portion 145 145
of that payload, and then it will have the full 146 146
executable two-way communication once 147 147
the stage two has been loaded. 148 148
So in our lab, what are we going to do? 149 149
We're going to use a reverse shell. 150 150
So we're going to send out that 151 151
exploit on the service. 152 152
It's going to spawn the connection 153 153
back to the attacker on a given port. 154 154
In our case, we're going to use 4444, 155 155
which is the default for Kali Lenux. 156 156
If we wanted to hide, we could try 157 157
to make it a random high port, 158 158
or we could do like 443 so it looks like 159 159
a secure web tunnel. 160 160
And then the attacker can listen for 161 161
a connection back on that port. 162 162
We're going to use Windows/shell/reversetcp. 163 163
This is a staged payload, 164 164
it's a two-staged payload. 165 165
So you're going to see that 166 166
we're going to send it, 167 167
it's going to say stage one received, 168 168
stage two has done, 169 169
and then once we get stage two 170 170
we'll have that two-way communication 171 171
for us to be able to talk. 172 172
So all this is going to be occurring again. 173 173
Once again, we're talking in this 174 174
gaining-access stage. 175 175
Once we are in and we have the interactive 176 176
two-way communication, 177 177
that's when we can then move on to other stages, 178 178
such as escalating our privileges, 179 179
maintaining our access, 180 180
and covering our tracks.