In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a ...

learn more… | top users | synonyms

46
votes
2answers
26k views

How do ASLR and DEP work?

How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
21
votes
2answers
3k views

Is it possible to write shellcode in C++?

Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of ...
20
votes
8answers
7k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
18
votes
1answer
2k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
11
votes
2answers
10k views

How “leaking pointers” to bypass DEP/ASLR works

I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here: The only way to reliably bypass DEP and ASLR is through an pointer leak. This ...
9
votes
1answer
2k views

NOPS in Metasploit

Problem I do not know what a "NOP" is in Metasploit Framework or otherwise. What I do know Metasploit Unleashed says, "Nops keep the payload sizes consistent." A few question posts mention buffer ...
8
votes
1answer
758 views

Better way to import Win32 APIs from injected shellcode

I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped ...
7
votes
3answers
445 views

Buffer overflow stack adjustment

I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. the shellcode was not executed until it was padded with NOPs although its set properly in ...
6
votes
2answers
2k views

How does getting a remote shell via exploiting a vulnerability really work?

I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
6
votes
3answers
1k views

What methodologies are useful when reverse-engineering malware / shellcode?

Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
5
votes
2answers
2k views

Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?

Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
5
votes
1answer
501 views

Stack canaries protection and ROP

As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return. My question is: if I overwrite both EIP and stack ...
5
votes
1answer
396 views

Program getting exploited inside gdb, new shell is spawned but terminated immediately

I am trying to exploit a SUID program. The program is: #include <stdlib.h> #include <unistd.h> #include <string.h> #include <stdio.h> #define e(); if(((unsigned int)ptr ...
4
votes
2answers
1k views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
4
votes
2answers
114 views

Shellcode in a jpg/png

If it's possible to write shellcode in a jpg file, why aren't all the webapps where you can upload an image infected? In a client computer, is it necessary exploit the jpg viewer in order to run the ...
4
votes
3answers
982 views

Is writing shellcode still a valid skill to have/learn?

Following up from this question: Should I bother teaching buffer overflows any more? I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
4
votes
1answer
738 views

NX bit causes segfault on NOP slide?

doing an assignment for university. We have to exec a shell on a remote server. We're told the NX bit is not set, however, when we redirect to our injected code, the server has a segmentation fault. ...
4
votes
3answers
2k views

Are there any tools that focus on shellcode analysis?

Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
4
votes
2answers
97 views

C shellcode explanation

I've found this shellcode at https://www.exploit-db.com/exploits/39624/: #include <stdio.h> char ...
4
votes
3answers
2k views

How to determine the size of payloads available in MetaSploit

I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do. However, ...
3
votes
2answers
44 views

Is there any downside to always declaring some default bad chars when generating exploits?

When setting the bad chars for shell code, is there any downside to just assuming that you should mark \x00 and \x0a as bad?
3
votes
3answers
496 views

Decrypt Java Payload

I found some destructive activity on my JBoss server and after a lot of google searching I found this exploit https://www.exploit-db.com/exploits/36575/ . I know the attacker uses this exploit to ...
3
votes
1answer
40 views

Reason behind HeapSpray format

I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs ...
3
votes
1answer
1k views

SafeSEH and x64

I read here that /SAFESEH is only valid when linking for x86 targets. /SAFESEH is not supported for platforms that already have the exception handlers noted. For example, on x64 and Itanium, ...
3
votes
1answer
215 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b ...
3
votes
1answer
2k views

Stack smashing keep getting segmentation fault

I have a homework assignment to do stack smashing, The exploit code creates a badfile in which the vulnerable file reads and buffer over flow occurs. I have already did the 2 commands below to ...
3
votes
2answers
2k views

Shellcode that is smaller than 295 bytes that spawns a shell [closed]

Metasploit payloads produce more than 300-byte shellcodes. But I want my shell-spawning shellcodes to be less than 295 bytes. Can anyone show me the links to these shellcodes? Thanks.
3
votes
1answer
427 views

Removing null bytes from shell code

I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example: xor ...
3
votes
1answer
1k views

Clamav can't detect encoded virus files

I have a PHP sheller file (like c99 file) but it's Encoded ( with this functions: eval(gzinflate(base64_decode("7P3rehblahblah)) ) and the clamav virus scan can't detect it. How i can detect virus ...
3
votes
0answers
74 views

C program - exploit program (after seg fault)

The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary As part of learning security - I am trying to buffer overflow this program. I ...
2
votes
2answers
2k views

NX bit: does it protect the stack?

I once heard the NX bit was a panacea, then that it was not. One detail I've wondered about though: Does the NX (no execute) bit protect against code inserted into the stack and executed there? It ...
2
votes
1answer
264 views

Prevent shell script inside image file

Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server. I have put server side validation to check file extension + mime type of the image. However, they are ...
2
votes
2answers
699 views

PHP shellcode inside /tmp. Is the server compromised?

I have a Debian 7 VPS that runs Nginx, PHP5-FPM and MariaDB. This server runs a couple of WordPress installations, phpMyAdmin and Roundcube Webmail. One is my personal blog running WP 3.9.1 and ...
2
votes
1answer
947 views

What tricks can be used to prevent debugging?

What tricks can be used to prevent or hinder debugging? Examples: IsDebuggerPresent API on Windows Exception handlers used for program flow. GetTickCount / rdtsc checks. Are there any good ...
2
votes
2answers
134 views

Install a vulnerable service for Windows 7

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell. I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
2
votes
1answer
111 views

Is my understanding of buffer overflows correct?

I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
2
votes
3answers
745 views

Documentation on Meterpreter Shells

I've been looking for some decent documentation on Meterpreter shells, but I can't seem to find anything useful. I would like to know when to use what kind of shell for a certain situation. All I ...
2
votes
2answers
4k views

How to deal with MySQL's Errcode 13 when trying to write a shell

My attack machine is running Kali and the server is running CentOS 6.4 with DVWA. I'm trying to write a shell through an SQL injection. The payload is ' UNION SELECT '', '<?PHP ...
2
votes
1answer
410 views

How to achieve interactive shell attack?

Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell. So when I call FTP interactive client, shell fails. Is there any way I can do ...
2
votes
1answer
43 views

PHP code in filename located in /tmp folder. How worried should I be?

I recently discovered a hidden file in /tmp owned by proftpd that worries me a bit: -rw-r--r-- 1 proftpd nogroup <timestamp> 86 .<?php eval($_REQUEST[cmd]); ?> I ...
2
votes
1answer
492 views

Trying to create a reverse bind shell from Windows to Linux

I’m trying to create an encrypted reverse bind shell from my Windows machine to my Linux machine. Being totally new to penetration testing, I’m having a little bit of trouble. First, on my Linux ...
2
votes
1answer
124 views

Are stack buffer overflows even possible in this instance?

Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, ...
2
votes
2answers
148 views

Why do we have to put the shellcode before the return address in the buffer overflow?

I'd like to know why we have to put the shellcode before the return address in a buffer overflow. Logically the return address will point to the shellcode and will be executed, so the return address ...
2
votes
0answers
394 views

What exactly is shellcode? [closed]

What is shellcode and how does it work? I used to think it was just a binary string encoded with hex, but I recently started reading more and it seems it is something completely different. I know it ...
1
vote
2answers
154 views

Detect blocked reverse shell

I am wondering if there is a way to detect if a reverse shell is blocked by egress filtering or an obligatory proxy, or the exploit just failed. I am asking this question in the context of a SE media ...
1
vote
2answers
299 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
1
vote
2answers
392 views

How do arbitrary payloads execute on the remote machine?

I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command ...
1
vote
1answer
35 views

Why are PID suffixed temporary files a vulnerability

Why is this a security issue? > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820331 > > very predictable temporary files (like > /tmp/cronic.out.$$) that depends only on PID: > ...
1
vote
1answer
110 views

What are the privileges of shell spawn by a shellcode?

After I see some examples of shellcodes in various exploit examples they try to spawn a shell. I want to understand why after spawn the shell have privileged access? Doesn't the shell should ...
1
vote
1answer
423 views

Execute a remote PHP shell which is inside a file I dont have permission to access

Hi need some help here. I am trying to exploit an unsanitized file upload with a PHP backdoor. Basically the file uploads successfully and I can see my backdoor inside the web applications /images/ ...