3

I'm trying to write some custom shellcode to obtain a shell from a program. Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new socket, connect back and spawn a shell.

I am able to to get a connection back, but unfortunately when I call CreateProcessA, I don't get any shell.

After the call to socket() I have the socket descriptor in EAX:

enter image description here

And then, after connect() (which works, I get the connection back on my netcat listener), I call CreateProcessA() and this are the parameters:

enter image description here

InheritHandles is correctly set to TRUE. On the left panel I have dumped the StartUpInfo structure and as you can see the file descriptor is correctly added for all handles (first 3 bytes of the structure are all set to 200). Also the flag STARTF_USESTDHANDLES is correctly set.

Unfortunately, this doesn't work. What surprises me is that if instead of using the address of the intermodular call to socket(), I use the address of WSASocketA (found using arwin), and without changing anything else (apart from adding the extra null arguments required for WSASocketA), I can get my shell.

I don't understand why this is not happening with socket(), in fact, according to the documentation for the flag WSA_FLAG_NO_HANDLE_INHERIT of the WSASocketA:

Create a socket that is non-inheritable.

A socket handle created by the WSASocket or the socket function is inheritable by default. When this flag is set, the socket handle is non-inheritable.

So I assumed that by default it should work with both functions.

I don't know if this is relevant, but I'm testing it against a Windows 7 machine.

Improve this question
1
  • This isn't really a reverse engineering question. My guess would be that - given you compare WinSock with the socket implementation inherited from BSD - that's your answer right there ... Commented Nov 28, 2019 at 14:36

1 Answer 1

Reset to default
2

Windows socket() creates a socket with WSA_FLAG_OVERLAPPED flag set and inheritable by default.

Windows WSASocket() allows you to specify WSA_FLAG_OVERLAPPED and WSA_FLAG_NO_HANDLE_INHERIT. If you omit both flags to WSASocket(), then the resulting socket will be inheritable and will not have WSA_FLAG_OVERLAPPED flag set.

Unlike on Unix, Windows SOCKET is different from file descriptors or pipes. If you pass a socket to Windows CreateProcess using STARTF_USESTDHANDLES, the socket must not have WSA_FLAG_OVERLAPPED flag set.

You managed to (accidentally) use WSASocket() without flags, so created an inheritable socket without WSA_FLAG_OVERLAPPED, so it worked for you!

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.