Scribd Logo
Upload

Welcome to Scribd!

  • SAS v1.0 Azeria

    Uploaded by

    hombre pocilga
    20 views20 pages
    The document discusses how to write ARM 32-bit shellcode in six minutes. It provides instructions on ARM and Thumb instructions, registers, switching between ARM and Thumb modes, and templates for creating a socket, connecting to it, duplicating file descriptors, and spawning a shell to create a reverse shell. The goal is to generate a reverse shell using just ARM assembly code within a short period of time.

    Original Description:

    Original Title

    SAS-v1.0-Azeria

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document discusses how to write ARM 32-bit shellcode in six minutes. It provides instructions on ARM and Thumb instructions, registers, switching between ARM and Thumb modes, and templates for creating a socket, connecting to it, duplicating file descriptors, and spawning a shell to create a reverse shell. The goal is to generate a reverse shell using just ARM assembly code within a short period of time.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    20 views20 pages

    SAS v1.0 Azeria

    Uploaded by

    hombre pocilga
    The document discusses how to write ARM 32-bit shellcode in six minutes. It provides instructions on ARM and Thumb instructions, registers, switching between ARM and Thumb modes, and templates for creating a socket, connecting to it, duplicating file descriptors, and spawning a shell to create a reverse shell. The goal is to generate a reverse shell using just ARM assembly code within a short period of time.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 20

    EXPLORING NEW DEPTHS OF

    THREAT HUNTING
    ...OR HOW TO WRITE ARM 32-BIT SHELLCODE IN SIX MINUTES

    Maria ‘Azeria’ Markstedter


    Azeria Labs, @Fox0x01
    Security Analyst Summit 2018 2
    INSTRUCTIONS

    ARM instructions = 32-bit

    Thumb instructions = 16-bit

    Security Analyst Summit 2018 3


    INSTRUCTIONS

    Security Analyst Summit 2018 4


    REGISTERS (ARM 32-BIT)

    Security Analyst Summit 2018 5


    DE-NULLIFICATION

    Security Analyst Summit 2018 6


    SWITCH TO THUMB

    Security Analyst Summit 2018 7


    YARA: SWITCHING TO THUMB

    Security Analyst Summit 2018 8


    GOAL: REVERSE SHELL

    Security Analyst Summit 2018 9


    TEMPLATE

    Security Analyst Summit 2018 10


    CREATE SOCKET

    Security Analyst Summit 2018 11


    YARA: SOCKET

    Security Analyst Summit 2018 12


    YARA: SOCKET

    Security Analyst Summit 2018 13


    CONNECT

    Security Analyst Summit 2018 14


    STDIN, STDOUT, STDERR

    Security Analyst Summit 2018 15


    YARA: DUP2

    Security Analyst Summit 2018 16


    SPAWNING SHELL

    Security Analyst Summit 2018 17


    YARA: BINSH

    Security Analyst Summit 2018 18


    Security Analyst Summit 2018 19
    Security Analyst Summit 2018 20

    You might also like