In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a ...
17
votes
2answers
780 views
Is it posible to make shellcode with C++?
Usualy I write assembly programs and thens dump their contents to get the shellcode. What I was wondering instead of assembly can I write a c++ program, then dump that and then use it instead of the ...
4
votes
3answers
208 views
Is writing shellcode still a valid skill to have/learn?
Following up from this question: Should I bother teaching buffer overflows any more?
I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
7
votes
1answer
303 views
Better way to import Win32 APIs from injected shellcode
I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped ...
9
votes
1answer
148 views
NOPS in Metasploit
Problem
I do not know what a "NOP" is in Metasploit Framework or otherwise.
What I do know
MS Unleashed says, "Nops keep the payload sizes consistent."
A few question posts mention buffer ...
3
votes
2answers
230 views
ASLR and how a program can actually call its functions
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment.
As far as I know ASLR works by randomizing part of the imagebase address when ...
-1
votes
1answer
101 views
E-mail with obfuscated code / no trace in e-mail server
I've got a situation where one of my clients sent me an e-mail with what appears to be obfuscated shell code. The really bizarre thing here is that I see no trace of this e-mail showing up in the mail ...
0
votes
1answer
53 views
Shellcode Segfault mid execution?
In doing a university assignment, we are launching a shell on a remote server. That's all fine, I have connect back shell code, and when I hardcode the hex attack string into the server and jump to ...
5
votes
1answer
175 views
NX bit causes segfault on NOP slide?
doing an assignment for university.
We have to exec a shell on a remote server. We're told the NX bit is not set, however, when we redirect to our injected code, the server has a segmentation fault. ...
4
votes
3answers
614 views
Are there any tools that focus on shellcode analysis?
Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
1
vote
1answer
183 views
SafeSEH and x64
I read here that
/SAFESEH is only valid when linking for x86 targets. /SAFESEH is not
supported for platforms that already have the exception handlers
noted. For example, on x64 and Itanium, ...
0
votes
1answer
133 views
Does filtering HTML syntax prevent a web shell from being dropped through a textbox? [closed]
I have an admin panel that is running off a mysql db. On that panel, I have text boxes that allow an "Admin" to input plain text OR HTML Styling that will be displayed on a section of the site that is ...
3
votes
1answer
134 views
Stack canaries protection and ROP
As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return.
My question is: if I overwrite both EIP and stack ...
2
votes
1answer
677 views
Stack smashing keep getting segmentation fault
I have a homework assignment to do stack smashing,
The exploit code creates a badfile in which the vulnerable file reads and buffer over flow occurs.
I have already did the 2 commands below to ...
3
votes
2answers
223 views
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
9
votes
2answers
896 views
How “leaking pointers” to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This ...
2
votes
1answer
147 views
How to achieve interactive shell attack?
Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell.
So when I call FTP interactive client, shell fails.
Is there any way I can do ...
5
votes
3answers
312 views
What methodologies are useful when reverse-engineering malware / shellcode?
Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
2
votes
2answers
212 views
Shellcode that is smaller than 295 bytes that spawns a shell [closed]
Metasploit payloads produce more than 300-byte shellcodes.
But I want my shell-spawning shellcodes to be less than 295 bytes.
Can anyone show me the links to these shellcodes?
Thanks.
2
votes
1answer
186 views
What tricks can be used to prevent debugging?
What tricks can be used to prevent or hinder debugging?
Examples:
IsDebuggerPresent API on Windows
Exception handlers used for program flow.
GetTickCount / rdtsc checks.
Are there any good ...
21
votes
2answers
3k views
How do ASLR and DEP work?
How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
