Welcome back to another video.
In this video, we are going to talk about how to write reverse this special called while writing this
reverse deception code.
It is essential that we follow a seven step process once again.
First, we need to have a C program that can make a reverse DCP connection, and we will stress this
program to identify the required size calls and their respective arguments.
After that, we will translate that functionality into assembly code.
And finally, we will extract the code as usual.
We will have to make sure that null bytes are avoided.
All right, let's begin.
Let me first switch to my virtual machine and let's create a directly called reverse shell.
And let's navigate to that territory and within this directly, I'm going to create a file called Reverse
Nazi with this content.
So here is my program.
I'm going to explain what it does.
But before that, let's first check if it works.
So what I'll do is I will open up a new tab.
And I will start a listener on PT. four four four four using Basche and LCP using that cat once this
is done.
Let's go back to our previous show and let's compile this reverse Nazi and let's produce the output
file, which is reverse, and let's quickly execute this reverse program and let's render.
And if you go back to the listener, we should receive a connection from this program.
This confirms that our program just works fine and it is giving a revolution.
Now, let's try to understand the code written in this reverse Nazi file.
The first line is to create a socket, and it has three arguments if underscoring it soke underscore
stream and a zero.
As you can see, this is returning some file descriptor which will be kept in the variable SOC.
So we basically created a socket in this line and the return value is an integer, which is saved in
the variable sock.
This is the socket file descriptor which will be used throughout the remaining program.
If you notice, this sock is referred here, here, here and here.
So it is important to take note of this return value.
Now, let's move on.
In the next few lines, we are preparing a structure.
And this structure has three members.
The first one is seen underscore family, the second one is seen underscore port, and the third one
is seen underscore address.
The members in underscore family holds the value, which is defined by an underscore in it and the member
in underscore port holes, the port number, which is four four four four.
Finally, the member underscored address holds the address 127.
Not one, not one.
Not one.
The reason why we chose this address 127.
Not one, not one.
Not one is that when we write this address in assembly, this will not produce any null bytes.
If you choose 127, not zero zero, not one that will produce nonwhites in the code.
So we decided to go for this address.
You can choose any address for Canek back, but make sure that it doesn't have any lights.
Now let's move on to the next line, which is connect.
Now that we have a socket file descriptor and we have a structure defined, now we are making a connection.
If you know the first argument of this connect function call it is the return value of the socket call
the file descriptor retained by the socket call is being used in this connection.
So that's the first argument.
The second argument is an address to the structure.
If you see this, this is an address to the structure.
So basically we will have to provide the address of the structure we prepared earlier as the second
argument.
Next, we have the third argument, which is the size of this structure, we can get some of these values
by running straight against this binary and we can use them directly in our assembly code.
So we will get to that soon.
For instance, this size of the structure, you can get that by running a stress against this binary.
Now, let's move on to the next few lines of the code.
If you notice, we have three W calls with the first argument being the socket file descriptor once
again.
And this is the return value of socket called.
The second argument in all these three calls is an integer value, the first loop to call has the argument
zero and this loop to call is for in.
And the second call has the argument one, and this is for study out.
And the third loop to call has the argument to which is for study error.
Once these calls are done, we are finally calling.
Exactly.
Business is the first argument, which is basically the program to be executed by Xixi and the next
two arguments are null.
So essentially, once a reverse connection is made, exactly, it provides the shell so we can execute
commands remotely.
Now, it is important for us to know what some of these arguments here, because we will need them when
writing the assembly code before we move on to the assembly code.
Let's quickly run this program through stress and observe the schools and their associated arguments.
So I'm just reading the screen and I'm going to start this listener once again and I'll run as trace.
And like we did earlier, we are going to use Dash F and dash E.
This time we are going to use Xixi socket, connect dukedom and let's execute our binary.
If you look at the socket call, it has afine it sock string and IP Proteau underscore IP in the C program.
This value was zero and finally the return value is three in this case and this three is used in connection
as well as the W cards.
Now if you look at the second one, which is connect, the first argument is three, which is the return
value of this socket call, and the second one is the address of the structure.
In this case, you are seeing the structure itself.
And finally, the third argument is the size of the structure.
If you notice the sizes, 16 here.
So we can directly use this in our assembly program.
And after that, we have three dupatta calls, first argument in all the three to two guards is going
to be the return value coming from this socket call.
And the second argument in all due to calls is going to be an integer.
So that's pretty much it for the exact value.
We can use the same code that we have written earlier.
So essentially to complete this reverse shell code, we will have to craft the assembly code with these
six calls.
Let's do that in the next real.