4

My question is regarding architectural restrictions associated with backdoor/bind/reverse tcp payloads used typically to gain shell through exploitation.

In a situation where the target box architecture(x86, x64, ARM, etc) is unknown.

  1. Would an x64 payload work on a x86 architecture without user intervention? For example, Windows prompting the user to run executable in a capability mode.
  2. Is there a solution for payload delivery that does not have architectural dependencies?
  3. Would encoding a x64 payload with an x86 encoder create compatibility issues when executed?

Any help is appreciated! I appreciate it because I'll save time asking here rather then manually testing.

2

1. Can an x64 payload work on an x86 architecture

64-bit executables can not work on an x86 architectures because there are two many differences between the architectures. Beyond the address space limitations there are 64-bit registers that just do not exist. Parameters for functions are handled entirely differently. Machine instructions operate differently.

Windows 64-bit contains a lot of code to ensure that there is compatibility for x86 programs to run on an x64 architecture, but the executables have to be written to take advantage of this. In this case the exploit would have to be built as a 32-bit application, and utilize the WOW64 subsystem. This subsystem is kind of like a sandbox to run 32-bit applications. It essentially emulates a 32-bit system for the purposes of execution.

2. Is there a solution for payload delivery that does not have architectural dependencies?

Compilers build for a specific architecture. As I stated above architecture independent code requires a some time of emulation. For example, Java uses a virtual machine to run on multiple platforms. This comes at a performance cost.

3. Would encoding a x64 payload with an x86 encoder create compatibility issues when executed?

I don't know what an x86 encoder is. If you mean you're transforming x64 machine code into x86 machine code... you might as well just build for x86 to begin with. Since it's pretty much the same thing.

  • 2
    I think he is talking specifically about Metasploit encoders when he mentioned x86 encoders. This is the same problem the attacker encounters when exploiting a vulnerability in a browser plugin (Java, flash etc) where he won't know the underlying OS to select a proper shellcode. That is why things such as User Agent strings or SMB remote fingerprint etc are used to detect the architecture and select appropriate shellcode. – void_in Feb 11 '15 at 18:11
  • Yes, in my situation the encoding module I'm refering to is: "x86Shitkata_ga_nai" included in metasploit. – Sh1nu11bi Feb 11 '15 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.