In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a ...

learn more… | top users | synonyms

-1
votes
1answer
74 views

What is the language below and where can I learn it? [closed]

As I am subscribed to the Exploit-DB Twitter feed, I see many exploits with code looking like this: \x3c\x68\x74\x6d\x6c\x3e\x0d\x0a\x3c\x6d\x65\x74\x61\x20\x68\x74\x74\x70\x2d\x65\x71\x75\x69\x76 I ...
1
vote
1answer
34 views

What are the privileges of shell spawn by a shellcode?

After I see some examples of shellcodes in various exploit examples they try to spawn a shell. I want to understand why after spawn the shell have privileged access? Doesn't the shell should ...
3
votes
3answers
263 views

Decrypt Java Payload

I found some destructive activity on my JBoss server and after a lot of google searching I found this exploit https://www.exploit-db.com/exploits/36575/ . I know the attacker uses this exploit to ...
4
votes
1answer
105 views

Program getting exploited inside gdb, new shell is spawned but terminated immediately

I am trying to exploit a SUID program. The program is: #include <stdlib.h> #include <unistd.h> #include <string.h> #include <stdio.h> #define e(); if(((unsigned int)ptr ...
2
votes
1answer
79 views

Removing null bytes from shell code

I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example: xor ...
-1
votes
2answers
67 views

webshell on webserver, but what does it contain/do? [closed]

Found this webshell but I can not get the plain text as I have not the secret/password to decode it completely. This is the part where I am missing some information: md5($_POST['_f__f']) Does ...
0
votes
0answers
153 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
6
votes
2answers
515 views

How does getting a remote shell via exploiting a vulnerability really work?

I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
2
votes
1answer
138 views

Prevent shell script inside image file

Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server. I have put server side validation to check file extension + mime type of the image. However, they are ...
1
vote
2answers
118 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
0
votes
0answers
84 views

Buffer overflow and register contents?

I am doing an exam practice question, suppose I have a function like; void func(char* arg) { char buf[32]; strcpy(buf, arg); } command break func: -buf begins at 0xbffebfb0 -(gdb) x/2wx ...
-2
votes
1answer
65 views

why the reverse_https payload runned at 0.0.0.0:443?

I created a reverse_https backdoor ( windows/meterpreter/reverse_https ) with msfpayload and then with multi handler want to create a reverse shell from my target , but when I exploited the handler I ...
0
votes
0answers
205 views

How does Metasploit's payload work with a remote target?

I have some simple questions. I often use Metasploit in my pentest engagements. It works fine when I'm inside a local network. Okay, we know that, when the payload is injected properly, it will give ...
1
vote
1answer
172 views

Possible shellcode mailed to me

When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
1
vote
0answers
142 views

What exactly is shellcode? [closed]

What is shellcode and how does it work? I used to think it was just a binary string encoded with hex, but I recently started reading more and it seems it is something completely different. I know it ...
0
votes
1answer
334 views

How does the NOP sled work with MSFVenom? [closed]

I'm generating payloads with MSFVenom and here's a sample output: user@localhost:~ $ msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d\x20' -i 3 -n 200 -f python No platform was selected, choosing ...
1
vote
0answers
35 views

unable to execute shellcode,which is place on stack [duplicate]

I am trying to execute the shellcode to spawn an "sh" shell. I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
0
votes
1answer
86 views

Intercept Android's http/https traffic with shell access [closed]

Assuming you have a shell access on a rooted Android device. Let's say the shell was given upon an exploitation, eg. Android Webview vulnerability. The question is what is the best way to intercept ...
20
votes
8answers
3k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
0
votes
0answers
34 views

Execute form environmental variable while stack is not executable

Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG; I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this ...
1
vote
1answer
189 views

MySQL vs MSSQL injection to shell uploading

What is the difference between uploading a shell via sqli in mysql vs mssql?
0
votes
2answers
96 views

Safe to use setuid with absolutely no input?

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
-2
votes
2answers
150 views

Cannot get simple shellcode runner to work [closed]

I'm just trying to execute shellcode directly from the command line. I send a simple 0x90 NOP and get a segmentation fault? root@server:~# gcc shellcode.c -o shellrun -fno-stack-protector -z ...
1
vote
1answer
301 views

Program exiting after executing int 0x80 instruction when running shellcode

In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
0
votes
1answer
308 views

Backdoor under Akismet wordpress plugin

my site recently got hacked or my users leaked out their passwords. The hacker install this plugin with a shell or backdoor in it. The file name is the "honda.zip" and inside is some Akismet plugin's ...
-1
votes
1answer
113 views

Why should I use ROP for exploit dev? [closed]

Return Oriented Programming is a technique for bypassing DEP which based on ret2libc.. ROP is used for formatting the API function parameters in order to make a reliable shellcode.. I dont get ...
2
votes
1answer
99 views

Are stack buffer overflows even possible in this instance?

Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, ...
0
votes
1answer
192 views

Are shell scripts / bash inherently less secure than other (script) languages such as python?

Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts? Or are shell scripts / bash less advisable for some tasks such as parsing ...
0
votes
1answer
223 views

Execute a remote PHP shell which is inside a file I dont have permission to access

Hi need some help here. I am trying to exploit an unsanitized file upload with a PHP backdoor. Basically the file uploads successfully and I can see my backdoor inside the web applications /images/ ...
0
votes
1answer
240 views

Which shell is more secure, mksh or bash?

Which shell is more secure, mksh or bash? There has been some discussion pointing into the direction, that mksh is more secure. How to come to that conclusion? By looking which code was more audited ...
2
votes
2answers
467 views

PHP shellcode inside /tmp. Is the server compromised?

I have a Debian 7 VPS that runs Nginx, PHP5-FPM and MariaDB. This server runs a couple of WordPress installations, phpMyAdmin and Roundcube Webmail. One is my personal blog running WP 3.9.1 and ...
1
vote
1answer
403 views

Metasploit generating strange shellcode

So I just used metasploit to generate the payload/linux/x86/shell_bind_tcp payload without null bytes (generate -t raw -b '\x00' -f shellcode). Here's the shellcode: $ xxd -p shellcode ...
3
votes
1answer
154 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b ...
0
votes
2answers
899 views

Can pipe | shell | nc > pipe achieve remote shell?

In one of the articles I have came across an exploit of Dell devices that said when you trigger the following line of code (executed somewhere in php) you will get a remote root shell : mkfifo ...
1
vote
2answers
107 views

Detect blocked reverse shell

I am wondering if there is a way to detect if a reverse shell is blocked by egress filtering or an obligatory proxy, or the exploit just failed. I am asking this question in the context of a SE media ...
1
vote
3answers
467 views

Documentation on Meterpreter Shells

I've been looking for some decent documentation on Meterpreter shells, but I can't seem to find anything useful. I would like to know when to use what kind of shell for a certain situation. All I ...
2
votes
1answer
806 views

Clamav can't detect encoded virus files

I have a PHP sheller file (like c99 file) but it's Encoded ( with this functions: eval(gzinflate(base64_decode("7P3rehblahblah)) ) and the clamav virus scan can't detect it. How i can detect virus ...
1
vote
1answer
348 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user999 to execute any shell (php, pl, py, binary). The ...
0
votes
1answer
112 views

How to find malicious images in server?

Recently my Drupal site on a Linux server has been targeted by session hijacking attacks. I guess the attacks were originated from images containing malicious code which where uploaded to the web root ...
2
votes
2answers
1k views

NX bit: does it protect the stack?

I once heard the NX bit was a panacea, then that it was not. One detail I've wondered about though: Does the NX (no execute) bit protect against code inserted into the stack and executed there? It ...
1
vote
2answers
281 views

How do arbitrary payloads execute on the remote machine?

I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command ...
1
vote
1answer
1k views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
0
votes
1answer
1k views

Stack buffer overflow confusion

I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique. Reading some articles and watching videos brought me to a confusion which can be ...
18
votes
1answer
2k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
3
votes
3answers
1k views

How to determine the size of payloads available in MetaSploit

I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do. However, ...
6
votes
3answers
365 views

Buffer overflow stack adjustment

I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. the shellcode was not executed until it was padded with NOPs although its set properly in ...
2
votes
2answers
3k views

How to deal with MySQL's Errcode 13 when trying to write a shell

My attack machine is running Kali and the server is running CentOS 6.4 with DVWA. I'm trying to write a shell through an SQL injection. The payload is ' UNION SELECT '', '<?PHP ...
21
votes
2answers
3k views

Is it possible to write shellcode in C++?

Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of ...
4
votes
3answers
798 views

Is writing shellcode still a valid skill to have/learn?

Following up from this question: Should I bother teaching buffer overflows any more? I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
9
votes
1answer
1k views

NOPS in Metasploit

Problem I do not know what a "NOP" is in Metasploit Framework or otherwise. What I do know Metasploit Unleashed says, "Nops keep the payload sizes consistent." A few question posts mention buffer ...