This is where we left off in the previous video.
Let us exit from here and let's create a new file called Reverse Nash, TCBY, Dot Nazem.
And as usual, let's start with the text section and let's use a global directive to specify our entry
point and let's specify our entry point.
Now, let's close this file and.
Let's run stress once again and let's just copy this output and let's keep it inside our river, slash
Tsipi Darkness and file temporarily, we can use this output to craft our assembly program.
The first thing is to clear all the registers that we are going to use.
So let's write clearing out.
RBA are on.
So let's just clear them that X cosmonautics, Zah RBI, comma, RBI, Tzar, RSI, comma RSI and finally
the RBA comma RDX.
So in each case, ARRIGO'S is going to hold Narcisco.
No, RBI is going to hold in the first argument to the second.
Oddisee is going to hold the second argument to the second and RDX is going to hold.
The third argument to this is Scott.
All right.
So let's begin by writing the circuit, Cisco.
Now, the first step is to find out the Cisco number, so let's open up a new tab and find out our Cisco.
So I'm just going to use look at uni and study and sixty four, 64.
And this is the file which contains our Cisco numbers.
So let's use cat grab socket.
There it is.
41 is the Cisco number for socket.
So let's use add our eggs one.
So this is the Cisco number for socket.
That's the second number.
Now let's set up the first argument for a socket system.
If you remember, the first argument of socket call is if underscore in it, it's a constant value for
IPV for connections and its value is always two.
So we are going to use add RBI Kamata.
So the first argument of socket call is ready.
Now the next argument is going to be Soke underscored stream and Soke underscored streams.
Value is defined to be one.
This is also a constant.
So let's use add autosite comma one.
And finally we will have to set up ADEX.
And if you remember, the RDX value should be zero.
Why is that?
Because if you look at a reverse see program, the third argument always contains zero.
So that's what we are going to place.
And if you notice, X already contains zero, so we don't have to do anything now.
Now all we have to do is we will have to use the line system.
So once this is done, this is called number 41, which is socket is going to be executed with the argument
that we have just set up.
Now, there is one important thing that we need to remember here.
Once as this call is executed, the return value will be stored in Addicks register.
This is the return value when we were executing the program, using estrus.
But now we don't know what the return value is, so we have to capture what we are getting in our X
register.
So let us quickly use move idea at X.
So after executing this Siskel, we are capturing the return value which is stored in our register in
the RBI register.
Why are we storing it in the register?
We can actually use any register, but audio register is being used because in most of the cases this
return value is the first argument and the first argument always goes into audio.
And that's the reason why we are using our data to stay here so we don't have to move it again from
a different register into RBI if we just place it directly into audio register here.
Now let's take a pictorial representation of our next steps.
So I'm opening up my slide area.
If you remember, we are done with this socket called audio register contains the value for any one
idea contains two, RSA contains one and ADEX contains zero.
So we are done with the socket call and it returns some value, which is going to be placed in order
to immediately when we execute the others is called connect and ducktail.
We are going to change this value inside our text register.
So we are just immediately saving it into a different register, which is our idea in this case.
And this value, which is stored in ardia, is going to be used in dupatta calls as well as in the connection.
So the next step after the socket call is to write the connection.
When we write this connect call, Artex register contains the second number and 42 is the second number
for Connect.
We can quickly check that.
Let's grab for Connect this time.
Dirigo, 42, is the second number for Connect.
Similarly, thirty three is the second number for dukedom.
Let's go back to our slides.
Here we are today.
Three is the second number for dukedom.
So when we write this up to call, we are going to place 33 in Artex register.
And when we write this connection, we are going to place the value 42 into our register.
And the first argument is ardia in both the cases.
And the value is already stored here from ADEX.
So we don't have to set up the first arguin.
Anymore, when we write this connect call and do the calls now, the second argument for Connect, which
is Autosite, if you remember, this is the address of a structure.
So first, we will have to prepare the structure.
And in the RSA register, we are going to place the address of that structure.
So to prepare the structure, if you remember, we need three things.
The IP address port and the CINEFAMILY, which is AHF underscore in it, if you remember, that's a
constant with the value too.
So we will have to place them in this order.
First, we are going to push 127.
Not one, not one, not one.
After that, we are going to push a work which is four four, four four.
And after that we are going to push another word, which is two.
So let's do that.
So this prepares our structure and once the entire structure is placed on the stack, Arizpe points
to it like we did in the case of execution code.
We can simply move this arizpe into RSA and that will point to this structure.
And finally, Eyeborgs contains 16.
We got this value from estrus.
All right.
So that's pretty much it.
This is the only complicated part that we are left with.
Once we are done with this connect code, everything will be very straightforward.
So let's go ahead and prepare this structure and write this connection.
So I am switching to my virtual machine and let's start writing our structure, preparing structure
for connect.
All right.
So let's use push.
We want to push 127 dot one dot one, dark one.
So one should be zero zero one and this one is going to be zero one and the next one is going to be
zero one.
And finally, one twenty seven is going to be seven F in hex.
Let me quickly show that.
127 decimal is seven F in X, it is the next step is to push this forward number four four four four.
Let's quickly check the hex equivalent of this four four four four.
It becomes one one five C, so we will have to use the reverse order once again, some just using push
word zero x five, C one one.
And the next one is to use push what the value is going to be two for this AV underscore in it.
So we are just going to push zero x two.
All right.
So that should prepare our structure.
If you remember, this is what is expected on the stack.
So let's quickly debug the program and check if this is placed on the stack.
Let's go back to Rehame and quickly debug the shell code that we have it in so far.
I'm saving this file and let's use nazem reverse dash tsipi dot nazim dash oh reverse dash tsipi dot
o f and 64.
There are some errors here, probably because of these comments, so let's just comment out.
There you go.
Now let's try to assemble once again, yep, everything works fine, reverse dot o f sorry, National
Review's DCB Hillinger.
Now let's see what GDP dot slash, reverse slash TCB and let's set up a breakpoint ad and let's go start
and run the program.
Let's do a site.
What we want to check is whether we are properly placing the structure on the stack or not.
All right, we are here at the corner, and this is where we are storing our written value in our dear
register.
After that, we are using these push instructions.
So after completing this push W. instruction, we should have proper stacks set up.
So let's step aside once again and once again and once again.
If you notice the top of the step after pushing all the three values, this is what we have.
If you go back to the slide, we have exactly the same thing, starting with zero one, ending with
zero two, starting with zero one, ending with zero two.
So there it is.
We have properly placed the structure on the top of the stack.
Now, this top of the stack is being pointed by Arizpe Register.
So now all we have to do is we will just have to move the value of Arizpe register into autosite.
So let's construct our Connect column.
I'm quitting this debugger and let's use them once again.
Let's go down, let's use connect.
And the first step is to move the top of the stack into autosite.
So this is the second argument to connect call.
If you remember, the first argument is idea, which already has the required value.
And finally, the third argument is going to be 16, which is the size of the structure.
So that goes into RDX.
16 is Hexton.
So is going to use zero here.
Once this is done, we will have to prepare the second number in order to register for connect call.
So let's first clear out of X because it contains the return value from the previous call, which is
socket.
Now let's add the value 42, which is the second number for Connect Canacol and let's just type system.
So that finishes our Connect column.
So we are done with socket call and we are done with Connect Code.
Now the next couple of calls are pretty easy to do.
Two is what we are going to do next doob to step in and loop to study out and do a study error.
Let's begin with the study and I'm just going to clear out X register once again and I'll just add this
is called number into our which is 33.
And then I will just clear RSA register idea already contains the socket file descriptor.
The second argument for Esslin is zero.
So we are just making Idrissi zero by using inside instruction.
So astrally in is already done.
All we have to do is invoke the second.
Next is still out.
Once again we will do zah irex atx ag irex comma thirty three.
We will have to do this again because when you execute this call the return value will be placed in
our X register so it won't have 33 anymore.
So we are just setting up 33 once again into ATX register.
Once this is done we can just use add Idrissi comma one because for study out the second argument is
one currently Oddisee contains zero.
So we are just adding one.
And once this is done, we can once again execute this call.
After all of this, let's write Doob to study error call, which is going to be exact.
Our eggs are eggs and our eggs.
Commentary three once again and then add on to say comma one, because currently RSA contains one.
So we are just adding one to that.
So it becomes two, which is the value for Essley error.
And finally, just call Sysco.
That's it.
We are done with writing.
All this is called now.
The last one is exactly.
We are just going to copy it from the previous shell code that we have written.
So let's use
this file, which is exactly not Azem, and let's just copy it from here.
And let's go back to River Shall Schenkkan, and let's start here.
That's it.
So we are done with the rivers.
This official called Let's save the File and let's use.
Nazeem to assemble this and L.E. to link this.
Let's quickly use a net cat listener to check if the same code is working fine and see Basche and Al
Lippy four four four four.
And let's execute, not slash.
It was dash TCAP.
Let's go back to the listener and look at that.
We got a show, so we have completed our reverse distribution code.
Now, obviously, the next step is to quickly verify if it has animal rights.
So let's use object dump should be reverse dash TCBY Dash M for internal syntax.
So looks like there are a bunch of null bytes here.
Here are three null bytes.
That's pretty much it.
This is the only place where we have null bytes.
X register should have the value.
Then let's go back and check what instruction is causing these null rights.
We can actually check that here.
If you see this, it's immediately after these push instructions, so it should be the connect call.
So let's go back to Shakoor.
And let's go to the collect call.
And if you see this, we did not use RDX anywhere, so we can just use add instruction here instead
of.
All right, so let's save the file and let's assemble and link it once again.
There it is.
Let's quickly check by using the net catch listener.
Once again, it worked fine, let's double check if we have removed all the lights.
Looks like we are pretty much done with the shell called, there are no problems and there are no nonwhites.
However, this Shell core has some redundant instructions.
For instance, look at these two instructions.
We have written these two instructions multiple times, ones here, the ones here and ones here.
So we have written it three times so we can optimize this shell code a bit.
So let's see how we can do that in the next video.