Question

I am writing shellcode on Ubuntu 11.10 x86 and the registers prior to the int 0x80 syscall look like this:

    eax 0x66
    ecx 0x8e60558
    edx 0x0
    ebx 0x3

which is set up for the connect() syscall. The value in the ecx register is an argument array that contains:

    0x8e60558: 0x00000009 0x8e60583 0x00000010

where 0x00000009 is the file descriptor, 0x8e60583 is the server struct pointer that points to:

    0x8e60583: 0x00000002 0x0000115c 0x7f000001

which is:

    [address]: [AF_INET=2] [PORT=4444] [IP=127.0.0.1]

I know that the file descriptor is correct and all of the constant values set up in the registers like storing 0x66 in eax (socketcall is syscall #102) are correct to the best of my knowledge yet when I run the code, which should return the connected socket FD in the eax register, it returns:

    eax: 0xffffff9b

which is obviously wrong. What I have I done incorrectly?

EDIT: Changed endianess of inet_address.

Answer 1

Your problem is that you are encoding the parameters to the connect syscall as little endian while some of them should be big-endian, additionally both the sin_family and sin_port members are encoded as 32bit, they should be 16 bit and that struct appears to require padding to 16 bytes.

PS You may want to use an assembler, you can always use objdump -x -D $binary to get the opcodes. Additionally I compile with gcc -c -x assembler-with-cpp -o hello-net.o hello-net.S && ld -o hello-net hello-net.o to be able to use the preprocessor as well.

PS2: You may want to try executing your code with strace, that shows the actual syscalls that you’re making.

E.g. this test-program works for me (x86_64):

#include <asm/unistd.h>

#define AF_INET         2
#define SOCK_STREAM     1

hellostr:
    .ascii "Hello world!\n"           # 'Hello world!' plus a linefeed character
.equ helloLen, . - hellostr               # Length of the 'Hello world!' string

.align 8
home_addr:
    # AF_INET (native-endian)
    .short AF_INET
    # big-endian port 4444
    .byte 0x11, 0x5c
    # big-endian 127.0.0.1
    .byte 0x7f, 0x00, 0x00, 0x01
    # required padding to 16 bytes
    .space 16 - (. - home_addr)
.equ home_len, . - home_addr

.globl _start
_start:
    # syscall(SYS_socket, AF_INET, SOCK_STREAM, 0)
    mov $__NR_socket, %rax
    mov $AF_INET, %rdi
    mov $SOCK_STREAM, %rsi
    mov $0, %rdx
    syscall

    # syscall(SYS_connect, socket, [127.0.0.1:4444], sizeof(addr))
    mov %rax, %rdi
    mov $__NR_connect, %rax
    mov $home_addr, %rsi
    mov $home_len, %rdx
    syscall

    # syscall(SYS_write, socket, hellostr, strlen(hellostr))
    mov $__NR_write, %rax
    mov $hellostr, %rsi # Put the offset of hello in ecx
    mov $helloLen, %rdx # helloLen is a constant, so we don't need to say
                        #  mov edx,[helloLen] to get it's actual value
    syscall             # Call the kernel (syscall num in %rax)

    mov $__NR_exit, %rax
    xor %rdi, %rdi      # Exit with return code of 0 (no error)
    syscall

The same thing, but modified to get it working on x86 (32bit):

#include <asm/unistd.h>

#define AF_INET         2
#define SOCK_STREAM     1

#define SYS_SOCKET  1       /* sys_socket(2)        */
#define SYS_CONNECT 3       /* sys_connect(2)       */

hellostr:
    .ascii "Hello world!\n"           # 'Hello world!' plus a linefeed character
.equ helloLen, . - hellostr               # Length of the 'Hello world!' string

.align 8
home_addr:
    # AF_INET (native-endian)
    .short AF_INET
    # big-endian port 4444
    .byte 0x11, 0x5c
    # big-endian 127.0.0.1
    .byte 0x7f, 0x00, 0x00, 0x01
    # required padding to 16 bytes
    .space 16 - (. - home_addr)
.equ home_len, . - home_addr

.align 8
sys_socket_args:
    .int AF_INET
    .int SOCK_STREAM
    .int 0

.globl _start
_start:
    # syscall(SYS_socketcall, SYS_SOCKET, {AF_INET, SOCK_STREAM, 0})
    mov $__NR_socketcall, %eax
    mov $SYS_SOCKET, %ebx
    mov $sys_socket_args, %ecx
    int $0x80

    # syscall(SYS_socketcall, SYS_CONNECT, {socket, [127.0.0.1:4444], sizeof(addr)})

    # Allocate 12 bytes of stack space (required for arguments to connect(2))
    sub $12, %esp

    mov %eax, (%esp)         # sys_connect_args.fd      = return-value
    movl $home_addr, 4(%esp) # sys_connect_args.addr    = &home_addr
    movl $home_len, 8(%esp)  # sys_connect_args.addrlen = sizeof(home_addr)
    mov $__NR_socketcall, %eax
    mov $SYS_CONNECT, %ebx
    mov %esp, %ecx
    int $0x80

    # syscall(SYS_write, socket, hellostr, strlen(hellostr))
    mov $__NR_write, %eax
    mov (%esp), %ebx    # socket-param = sys_connect_args.fd
    mov $hellostr, %ecx # Put the offset of hello in ecx
    mov $helloLen, %edx # helloLen is a constant, so we don't need to say
                        #  mov edx,[helloLen] to get it's actual value
    int $0x80           # Call the kernel (syscall num in %eax)

    # restore stack
    add $12, %esp

    mov $__NR_exit, %eax
    xor %ebx, %ebx      # Exit with return code of 0 (no error)
    int $0x80

Edit: Expanded the first paragraph to mention two other possible errors and added a 32 bit (x86) sample that works for me.