Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [shellcode]

In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.

0
votes
0answers
27 views

why does my simple 0x86 shellcode execve not do anything? [on hold]

I'm just starting to learn execve command, so I'm sure this is a very easy mistake, but I've stuck on this for hours, so any help or hints would really be appreciated, my code is as follows: section ...
0
votes
0answers
59 views

Shell injection using only [alphanumeric, dashes, colon, period]

I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following ...
0
votes
0answers
22 views

How to access platform-specific commands in this code, without exposing arbitrary command execution?

I'm writing a DNS-01 extension to the widely used Let's Encrypt acme.sh, that uses a locally running DNS server such as Bind, Unbound, Knot DNS, etc, rather than an API to an external service provider,...
0
votes
1answer
50 views

shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )

I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !! Segmentation fault (core dumped) my shellcode : section .text ...
1
vote
2answers
42 views

Reverse shell refusing/difficulties to establish connection

I've been trying to reverse shell between different devices, however, I'm never able to establish a connection or get a shell prompt . Let's say I have a Mac OSX as victim and use a raspberry Pi ...
1
vote
1answer
64 views

What is the purpose of the instruction fldz on the Aaron Adams shellcode?

I'm studying the Aaron Adams assembly code. You can find the documentation here (section --[ 2.b.i Getting EIP). I understand that the goal is to get the EIP. I know that the FPU environment looks ...
1
vote
2answers
70 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
0
votes
2answers
656 views

A process called ./watchbog is mining crypto currency in our server. How do I stop it? [duplicate]

I have found this question below but I need some more clarification that's why I am writing again. I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is ...
2
votes
0answers
51 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
3
votes
1answer
151 views

Where in a binary can '/bin/sh' be written to get a shell?

I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it. The CTF challenge was the can-you-gets-me challenge in ...
1
vote
1answer
126 views

Shellcode getting segmentation fault on vmware

I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example. When I execute the program I am getting segmentation fault. I'...
2
votes
2answers
962 views

Is it possible to execute a local file or code from cURL?

I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax: curl "local file" I was looking for possible solutions and found that to read the ...
0
votes
2answers
227 views

Privilege Escalation: C functions setuid(0) with system() not working in Linux

Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
1
vote
1answer
577 views

Windows 64-bit Reverse TCP Shell not working

I am sending shellcode to a 64-bit binary running on a Windows machine. This binary, copies the shellcode to an executable region of memory and executes it. I am generating the shellcode using ...
1
vote
0answers
171 views

Segmentation fault in exercise program

I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end. The idea ...
1
vote
1answer
39 views

Buffer Overflow shell question

If a custom library is affected by a buffer overflow and it is linked against an executable running as root. If an attacker gains a remote reverse shell, it will run under the user of the linked ...
0
votes
0answers
92 views

Understanding execve() exploit instructions

There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
2
votes
0answers
227 views

Not able to run the injected shellcode

#include <stdio.h> void secret() { printf("Congratulations!\n"); } void echo() { char array[60]; scanf("%s", array); printf("You entered: %s\n", array); } int main() { ...
2
votes
0answers
139 views

Concerns about LaTeX 3 shell escape code

What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape. { cp~-RLf~ \...
7
votes
1answer
2k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
1
vote
1answer
63 views

Block hex encoded requests using fail2ban

I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
1
vote
1answer
326 views

What does windows meterpreter reverse TCP Shellcode do?

I have just started learning msfconsole and I have used windows/meterpreter/reverse_tcp . I know this establishes a connection from the target system to our attacking system . However I would like ...
1
vote
0answers
178 views

Buffer overflow experiment: shell code executed but got “failed to read 0 bytes” error

I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
1
vote
0answers
71 views

Why can't I see my shellcode executing in Immunity Debugger?

I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file. I successfully spawned a reverse shell with metasploit, using a ...
0
votes
2answers
220 views

Buffer Overflow : segmentation error at 0x90909090

why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ? 0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff040: ...
0
votes
1answer
302 views

What is the use of different types of shellcode? [closed]

I was browsing the shellcode page in exploit-db website. What is the use of all these different shellcode programs and why should we write them?
29
votes
4answers
8k views

I feel like it's impossible to learn reverse engineering [closed]

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, ...
0
votes
1answer
3k views

Generating unicode javascript shellcode

I'm trying to generate shellcode to modify this exploit: https://www.exploit-db.com/exploits/24947/ It says in the basic exploit: {'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); ...
1
vote
2answers
255 views

nmap finger print looks alot like shell code and not what's on nmap.org

my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow ) bash >> nmap -sS -sU -T4 -A -v 192.168.50.1 Nmap scan report ...
2
votes
1answer
315 views

Execute Shellcode embedded into a picture? [duplicate]

Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for ...
3
votes
1answer
530 views

Python - ctypes.cast function call outputs Segmentation Fault error message

Background: Writing a proof of concept of a twitter C&C inspired by Prof Viviek of SPSE similiar to twittor and the project includes a functionality of injecting shellcode and executing it ...
2
votes
2answers
623 views

Why do we need to remove null bytes from shell code?

I'm studying the basics of making shell codes. I have a question about it. In my textbook, the author stores his shell code in an environment variable, and injects the address of it using strcpy() ...
1
vote
2answers
472 views

Shellcode does not execute as the owner

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia) Here is the source code of the vulnerable script "narnia1" I intend to exploit: #include <stdio.h> int ...
3
votes
0answers
243 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
0
votes
1answer
179 views

Problem with shellcode when exploiting Chakra

I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working ...
0
votes
2answers
238 views

How are eggs placed in memory

How is an egg placed in memory before the egg hunter code executes? If a payload is too large for the exploit buffer but an egg hunter can find the payload, is the payload also sent in smaller chunks ...
7
votes
1answer
597 views

Why would legitimate programs have a `jmp esp` instruction?

It appears that a common exploit trick is to use stack overflow to overwrite the instruction pointer such that it points to a jmp esp instruction somewhere in the code segment which then executes the ...
1
vote
0answers
236 views

DoublePulsar shellcode arguments

NSA DoublePulsar --help outputs the following: Doublepulsar 1.3.1 Options: --NetworkTimeout S16 (default: 60) Timeout for blocking network calls (in seconds). Use -1 for no timeout. --TargetIp ...
3
votes
1answer
119 views

Where I am going wrong with Veil? Cannot get a reverse shell?

This is how I am generating the payload in Veil 3 > use XX > set LHOST X.X.X.X > set LPORT 3333 > generate The payload generates successfully and transferred to victim machine Win7 SP1 ...
1
vote
0answers
272 views

Could not load library libcutils.so while injecting shellcode

I am working on my school thesis. I am trying to inject some shellcode into a shared library using Dirty Cow vulnerability on Android x86. My shellcode is written in asembly and only calls ...
0
votes
1answer
286 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
1
vote
0answers
504 views

Problem with reverse-shell direction

In an attempt to exploit RFI weakness I am running Apache on my Kali box to host the php reverse-shell and the shell was backconnect to myself (my kali machine). Why am I getting a shell from my ...
1
vote
2answers
223 views

Why is this shellcode execution considered an exploit?

I found the following "exploit" on Twitter: https://www.exploit-db.com/exploits/43550/?rss Blogpost about it: https://pentesterslife.blog/2018/01/13/polymorphic-and-smaller-versions-of-three-shell-...
5
votes
2answers
517 views

Linux Kernel ROP - Returning to userland from kernel context?

I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to ...
3
votes
0answers
51 views

Can you start a shell with a service account in Windows?

In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (...
1
vote
1answer
295 views

What is a reverse WWW shell?

I'm having a hard time finding a good definition for a Reverse WWW Shell through regular Google searching. So far, I've gathered: Reverse shell is a technique of establishing a remote connection ...
3
votes
2answers
616 views

How does ASLR protect libc entry points?

ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple ...
2
votes
1answer
3k views

Executing a msfvenom shellcode in C program

This is obviously for educational purposes. I've been interested in learning more about malware and how it works. I'm trying to get a meterpreter reverse tcp shell working on windows 10 but more ...
4
votes
1answer
202 views

Can change flow of the program yet can't execute shellcode

I've created a small vulnerable C program, which normally won't call function overflowed. void overflowed(){ printf("%s\n","Hijacked"); } void normally(char * st){ char buffer[80]; ...
18
votes
1answer
4k views

How does shellcode really run?

I read the book "The Shellcoders Handbook", and in it there is some C code which will execute shellcode (it will only call exit syscall). char shellcode[] = “\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\...