Writing and Compiling Shellcode in C
This is a quick lab to get familiar with the process of writing and compiling shellcode in C and is merely a personal conspectus of the paper From a C project, through assembly, to shellcode by hasherezade for vxunderground - go check it out for a deep dive on all the subtleties involved in this process, that will not be covered in these notes.
For the sake of this lab, we are going to turn a simple C program (that is provided by hasherezade in the aforementioned paper) that pops a message box, to shellcode and execute it by manually injecting it into an RWX memory location inside notepad.
Overview
Below is a quick overview of how writing and compiling shellcode in C works:
Shellcode is written in C
C code is compiled to a list of assembly instructions
Assembly instructions are cleaned up and external dependencies removed
Assembly is linked to a binary
Shellcode is extracted from the binary
This shellcode can now be injected/executed by leveraging code injection techniques
Walkthrough
1. Preparing Dev Environment
First of, let's start the Developer Command Prompt for VS 2019, which will set up our dev environment required for compiling and linking the C code used in this lab:

In my case, the said console is located here:
C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\Tools\VsDevCmd.bat
Let's start it like so:
cmd /k "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\Tools\VsDevCmd.bat"

2. Generating Assembly Listing
Below are two C files that make up the program we will be converting to shellcode:
c-shellcode.cpp
- the program that pops a message boxpeb-lookup.h
- header file required by thec-shellcode.cpp
, which contains functions for resolving addresses forLoadLibraryA
andGetProcAddress
#include <Windows.h>
#include "peb-lookup.h"
// It's worth noting that strings can be defined nside the .text section:
#pragma code_seg(".text")
__declspec(allocate(".text"))
wchar_t kernel32_str[] = L"kernel32.dll";
__declspec(allocate(".text"))
char load_lib_str[] = "LoadLibraryA";
int main()
{
// Stack based strings for libraries and functions the shellcode needs
wchar_t kernel32_dll_name[] = { 'k','e','r','n','e','l','3','2','.','d','l','l', 0 };
char load_lib_name[] = { 'L','o','a','d','L','i','b','r','a','r','y','A',0 };
char get_proc_name[] = { 'G','e','t','P','r','o','c','A','d','d','r','e','s','s', 0 };
char user32_dll_name[] = { 'u','s','e','r','3','2','.','d','l','l', 0 };
char message_box_name[] = { 'M','e','s','s','a','g','e','B','o','x','W', 0 };
// stack based strings to be passed to the messagebox win api
wchar_t msg_content[] = { 'H','e','l','l','o', ' ', 'W','o','r','l','d','!', 0 };
wchar_t msg_title[] = { 'D','e','m','o','!', 0 };
// resolve kernel32 image base
LPVOID base = get_module_by_name((const LPWSTR)kernel32_dll_name);
if (!base) {
return 1;
}
// resolve loadlibraryA() address
LPVOID load_lib = get_func_by_name((HMODULE)base, (LPSTR)load_lib_name);
if (!load_lib) {
return 2;
}
// resolve getprocaddress() address
LPVOID get_proc = get_func_by_name((HMODULE)base, (LPSTR)get_proc_name);
if (!get_proc) {
return 3;
}
// loadlibrarya and getprocaddress function definitions
HMODULE(WINAPI * _LoadLibraryA)(LPCSTR lpLibFileName) = (HMODULE(WINAPI*)(LPCSTR))load_lib;
FARPROC(WINAPI * _GetProcAddress)(HMODULE hModule, LPCSTR lpProcName)
= (FARPROC(WINAPI*)(HMODULE, LPCSTR)) get_proc;
// load user32.dll
LPVOID u32_dll = _LoadLibraryA(user32_dll_name);
// messageboxw function definition
int (WINAPI * _MessageBoxW)(
_In_opt_ HWND hWnd,
_In_opt_ LPCWSTR lpText,
_In_opt_ LPCWSTR lpCaption,
_In_ UINT uType) = (int (WINAPI*)(
_In_opt_ HWND,
_In_opt_ LPCWSTR,
_In_opt_ LPCWSTR,
_In_ UINT)) _GetProcAddress((HMODULE)u32_dll, message_box_name);
if (_MessageBoxW == NULL) return 4;
// invoke the message box winapi
_MessageBoxW(0, msg_content, msg_title, MB_OK);
return 0;
}
We can now convert the C code in c-shellcode.cpp
to assembly instructions like so:
"C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\Hostx64\x64\cl.exe" /c /FA /GS- c-shellcode.cpp
The switches' instruct the compiler to:
/c
- Prevent the automatic call to LINK/FA
- Create a listing file containing assembler code for the provided C code/GS-
- Turn off detection of some buffer overruns
Below shows how we compile the c-shellcode.cpp
into c-shellcode.asm
:

3. Massaging Assembly Listing
Now that our C code has been convered to assembly in c-shellcode.asm
, we need to clean up the file a bit, so we can link it to an .exe without errors and to avoid the shellcode from crashing. Specifically, we need to:
Remove dependencies from external libraries
Align stack
Fix a simple syntax issue
3.1 Remove Exteranal Libraries
First off, we need to comment out or remove instructions to link this module with libraries libcmt
and oldnames
:

3.2 Fix Stack Alignment
Add procedure AlignRSP
right at the top of the first _TEXT
segment in our c-shellcode.asm
:
; https://github.com/mattifestation/PIC_Bindshell/blob/master/PIC_Bindshell/AdjustStack.asm
; AlignRSP is a simple call stub that ensures that the stack is 16-byte aligned prior
; to calling the entry point of the payload. This is necessary because 64-bit functions
; in Windows assume that they were called with 16-byte stack alignment. When amd64
; shellcode is executed, you can't be assured that you stack is 16-byte aligned. For example,
; if your shellcode lands with 8-byte stack alignment, any call to a Win32 function will likely
; crash upon calling any ASM instruction that utilizes XMM registers (which require 16-byte)
; alignment.
AlignRSP PROC
push rsi ; Preserve RSI since we're stomping on it
mov rsi, rsp ; Save the value of RSP so it can be restored
and rsp, 0FFFFFFFFFFFFFFF0h ; Align RSP to 16 bytes
sub rsp, 020h ; Allocate homing space for ExecutePayload
call main ; Call the entry point of the payload
mov rsp, rsi ; Restore the original value of RSP
pop rsi ; Restore RSI
ret ; Return to caller
AlignRSP ENDP
Below shows how it should look like in the c-shellcode.asm
:

3.3 Remove PDATA and XDATA Segments
Remove or comment out PDATA
and XDATA
segments as shown below:

3.4 Fix Syntax Issues
We need to change line mov rax, QWORD PTR gs:96
to mov rax, QWORD PTR gs:[96]
:

4. Linking to an EXE
We are now ready to link the assembly listings inside c-shellcode.asm
to get an executable c-shellcode.exe
:
"C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.26.28801\bin\Hostx64\x64\ml64.exe" c-shellcode.asm /link /entry:AlignRSP

5. Testing the EXE
We can now check that if c-shellcode.exe
does what it was meant to - pops a message box:

6. Copying Out Shellcode
Once we have the c-shellcode.exe
binary, we can extract the shellcode and execute it using any code injection technique, but for the sake of this lab, we will copy it out as a list of hex values and simply paste them into an RWX memory slot inside a notepad.exe.
Let's copy out the shellcode from the .text
section, which in our case starts at 0x200 into the raw file:

If you are wondering how we found the shellcode location, look at the .text
section - you can extract if from there too:

7. Testing Shellcode
Once the shellcode is copied, let's paste it to an RWX memory area (you can set any memory location to have permissions RWX with xdbg64) inside notepad, set RIP to that location and resume code execution in that location. If we did all the previous steps correctly, we should see our shellcode execute and pop the message box:

References
Last updated