In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a ...

learn more… | top users | synonyms

1
vote
0answers
6 views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
0
votes
0answers
29 views

Why there is no shell prompt by exploiting this script?

I tried to get a shell prompt in the following vulnerable code, I think that I found the vulnerability, actually it is a simple stack buffer overflow, but now I have a problem with exploiting the ...
0
votes
2answers
103 views

Execute PHP inside PNG using curl

I'm doing some testing on executing remote PHP via PHP hidden inside a PNG file. I've got a PNG file on my server with the following PHP code stored inside the PNG file. ...
2
votes
1answer
52 views

Why are PID suffixed temporary files a vulnerability

Why is this a security issue? > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820331 > > very predictable temporary files (like > /tmp/cronic.out.$$) that depends only on PID: > ...
2
votes
3answers
224 views

Install a vulnerable service for Windows 7

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell. I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
1
vote
1answer
109 views

Is it possible to use the Linux “echo” command maliciously?

While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
0
votes
0answers
31 views

Variant of OSX.pirrit

Today while working with a customer, Someone came in with a peculiar problem. They could only access websites through https, and nothing through http. I tried the regular gauntlet of fixes for network ...
2
votes
1answer
114 views

Is my understanding of buffer overflows correct?

I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
2
votes
1answer
62 views

PHP code in filename located in /tmp folder. How worried should I be?

I recently discovered a hidden file in /tmp owned by proftpd that worries me a bit: -rw-r--r-- 1 proftpd nogroup <timestamp> 86 .<?php eval($_REQUEST[cmd]); ?> I ...
2
votes
2answers
882 views

Program exiting after executing int 0x80 instruction when running shellcode

In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
4
votes
2answers
141 views

Shellcode in a jpg/png

If it's possible to write shellcode in a jpg file, why aren't all the webapps where you can upload an image infected? In a client computer, is it necessary exploit the jpg viewer in order to run the ...
4
votes
2answers
107 views

C shellcode explanation

I've found this shellcode at https://www.exploit-db.com/exploits/39624/: #include <stdio.h> char ...
0
votes
0answers
62 views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...
1
vote
2answers
307 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
3
votes
0answers
82 views

C program - exploit program (after seg fault)

The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary As part of learning security - I am trying to buffer overflow this program. I ...
48
votes
2answers
27k views

How do ASLR and DEP work?

How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
1
vote
1answer
2k views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
3
votes
2answers
46 views

Is there any downside to always declaring some default bad chars when generating exploits?

When setting the bad chars for shell code, is there any downside to just assuming that you should mark \x00 and \x0a as bad?
-5
votes
1answer
91 views

What to do if meterpreter get Caught? [closed]

Well we all have veil and its great really great But, When i run the payload the AV found that meterpreter is running from memory And then my payload is useless. How can i bypass that ? I tried ...
0
votes
0answers
67 views

Put shellcode in writable sections -> .bss & .data

so, I have following issue. Let's say, I have a simple vulnerable program, such as this one: #include <stdio.h> #include <string.h> #include <stdlib.h> void vuln_function(char *); ...
3
votes
1answer
41 views

Reason behind HeapSpray format

I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs ...
1
vote
1answer
38 views

What is the purpose of enclosing process spawning?

This file/script is supposed to scan for outdated Node modules and prompt the developer to update them, however I believe it is malware. The instructions were to download the file, set the executable ...
1
vote
1answer
1k views

msfvenom doesn’t generate raw shellcode output properly

I'm doing the Windows Buffer Overflow Exploitation section of the OSCP course, and the author uses a combination of msfpayload and msfencode to generate a windows/shell_reverse_tcp payload encoded ...
-1
votes
1answer
99 views

Understanding HTTP response from Linux Server

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states In monitoring the network activity ...
0
votes
1answer
82 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
1
vote
3answers
116 views

vulnerable webapp pentest challenge

So I have this challenge in pentesting to get a shell on a vulnerable webapp. I am an authenticated user and I know that the vulnerable app is kcfinder-2.51 which is a plugin for ckeditor_3.6.4. I am ...
2
votes
2answers
182 views

Why do we have to put the shellcode before the return address in the buffer overflow?

I'd like to know why we have to put the shellcode before the return address in a buffer overflow. Logically the return address will point to the shellcode and will be executed, so the return address ...
2
votes
1answer
579 views

Trying to create a reverse bind shell from Windows to Linux

I’m trying to create an encrypted reverse bind shell from my Windows machine to my Linux machine. Being totally new to penetration testing, I’m having a little bit of trouble. First, on my Linux ...
-1
votes
1answer
94 views

What is the language below and where can I learn it? [closed]

As I am subscribed to the Exploit-DB Twitter feed, I see many exploits with code looking like this: \x3c\x68\x74\x6d\x6c\x3e\x0d\x0a\x3c\x6d\x65\x74\x61\x20\x68\x74\x74\x70\x2d\x65\x71\x75\x69\x76 I ...
1
vote
1answer
118 views

What are the privileges of shell spawn by a shellcode?

After I see some examples of shellcodes in various exploit examples they try to spawn a shell. I want to understand why after spawn the shell have privileged access? Doesn't the shell should ...
9
votes
1answer
2k views

NOPS in Metasploit

Problem I do not know what a "NOP" is in Metasploit Framework or otherwise. What I do know Metasploit Unleashed says, "Nops keep the payload sizes consistent." A few question posts mention buffer ...
5
votes
1answer
438 views

Program getting exploited inside gdb, new shell is spawned but terminated immediately

I am trying to exploit a SUID program. The program is: #include <stdlib.h> #include <unistd.h> #include <string.h> #include <stdio.h> #define e(); if(((unsigned int)ptr ...
3
votes
3answers
519 views

Decrypt Java Payload

I found some destructive activity on my JBoss server and after a lot of google searching I found this exploit https://www.exploit-db.com/exploits/36575/ . I know the attacker uses this exploit to ...
3
votes
1answer
477 views

Removing null bytes from shell code

I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example: xor ...
-1
votes
2answers
172 views

webshell on webserver, but what does it contain/do? [closed]

Found this webshell but I can not get the plain text as I have not the secret/password to decode it completely. This is the part where I am missing some information: md5($_POST['_f__f']) Does ...
0
votes
0answers
393 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
6
votes
2answers
2k views

How does getting a remote shell via exploiting a vulnerability really work?

I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
2
votes
1answer
282 views

Prevent shell script inside image file

Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server. I have put server side validation to check file extension + mime type of the image. However, they are ...
1
vote
0answers
125 views

Buffer overflow and register contents?

I am doing an exam practice question, suppose I have a function like; void func(char* arg) { char buf[32]; strcpy(buf, arg); } command break func: -buf begins at 0xbffebfb0 -(gdb) x/2wx ...
-2
votes
1answer
117 views

why the reverse_https payload runned at 0.0.0.0:443?

I created a reverse_https backdoor ( windows/meterpreter/reverse_https ) with msfpayload and then with multi handler want to create a reverse shell from my target , but when I exploited the handler I ...
0
votes
0answers
502 views

How does Metasploit's payload work with a remote target?

I have some simple questions. I often use Metasploit in my pentest engagements. It works fine when I'm inside a local network. Okay, we know that, when the payload is injected properly, it will give ...
1
vote
1answer
213 views

Possible shellcode mailed to me

When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
2
votes
0answers
440 views

What exactly is shellcode? [closed]

What is shellcode and how does it work? I used to think it was just a binary string encoded with hex, but I recently started reading more and it seems it is something completely different. I know it ...
0
votes
1answer
686 views

How does the NOP sled work with MSFVenom? [closed]

I'm generating payloads with MSFVenom and here's a sample output: user@localhost:~ $ msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d\x20' -i 3 -n 200 -f python No platform was selected, choosing ...
1
vote
0answers
37 views

unable to execute shellcode,which is place on stack [duplicate]

I am trying to execute the shellcode to spawn an "sh" shell. I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
0
votes
1answer
184 views

Intercept Android's http/https traffic with shell access [closed]

Assuming you have a shell access on a rooted Android device. Let's say the shell was given upon an exploitation, eg. Android Webview vulnerability. The question is what is the best way to intercept ...
0
votes
2answers
105 views

Safe to use setuid with absolutely no input?

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
3
votes
1answer
224 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b ...
20
votes
8answers
7k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...