Questions tagged [shellcode]

In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.

Filter by
Sorted by
Tagged with
0
votes
0answers
40 views

Failure to execute shellcode

I'm trying to understand exploits that hijack the execution flow. Before exploiting a buffer overflow vulnerability, I'm just trying to set an environment variable to my shellcode and jump to it. So, ...
0
votes
0answers
75 views

How to forbid user from executing malicious shell and Python script?

I am designing a online programming website similar to https://repl.it. Users can execute shell and python scripts on the browsers. If users execute malicious commands including but not limited to "...
1
vote
0answers
48 views

Confusing with the exact location of a shellcode in memory?

When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But most of the time, it crashes saying 'segmentation fault'. I got the same ...
3
votes
1answer
189 views

Replace forbidden characters function check python

I have "blackbox" with the following python function code (without permission to change it): def exec_ping(): forbidden = ['&', ';', '-', '`', '||', '|'] command = input('Enter an IP: ') ...
0
votes
2answers
100 views

The most secure way to allow downloading and installing an app on Mac, Windows, or Linux

I have been introduced to the anti-bash-script-piping stuff such as these: Curl Bash Piping Wall of Shame (link broken) Piping curl to s(hell) Don't Pipe to your Shell The hidden dangers of piping ...
0
votes
2answers
125 views

Pickle Shellcode Import Error

I'm trying to execute pickle shell-code through a download function on a website but I get the following error: <html> <h1>ERROR: Cannot load file</h1> <!-- Traceback (most ...
0
votes
0answers
54 views

Why is generated different traffic for the same attack?

I created a scenario in VirtualBox (configured as internal network) with two machines: Windows XP and Kali Linux. I used ms08_067_netapi exploit from Metasploit and the payload windows/meterpreter/...
2
votes
1answer
76 views

Should the shellcode be “reversed” before beeing injected in a simple buffer overflow?

I'm new to buffer overflows and I'm trying to understand exactly what I'm doing before using any premade and easy to go scripts. My goal is to spawn a shell, so I found the asm code to do an execve("/...
0
votes
0answers
36 views

x86 shellcode leads to segmentation fault

I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode: global _start _start: xor eax, eax ; set eax = 0 to push a null without using ...
0
votes
1answer
84 views

Shellcode as part of format string buffer

I'm currently trying out a simple format string vuln exploit. The target program looks like this: int main(int argc, char *argv[]) { char buffer[1024]; strncpy(buffer, argv[1], sizeof(buffer)...
1
vote
1answer
179 views

linux kernel exploit shellcode causes segfault

I'm learning how to write kernel exploits and my shellcode keeps seg faulting. I'm getting the memory address for commit_creds(prepare_kernel_cred(0)); #grep commit_creds /proc/kallsyms c907eea0 T ...
0
votes
0answers
69 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
0
votes
0answers
92 views

Shell injection using only [alphanumeric, dashes, colon, period]

I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following ...
0
votes
0answers
28 views

How to access platform-specific commands in this code, without exposing arbitrary command execution?

I'm writing a DNS-01 extension to the widely used Let's Encrypt acme.sh, that uses a locally running DNS server such as Bind, Unbound, Knot DNS, etc, rather than an API to an external service provider,...
0
votes
1answer
101 views

shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )

I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !! Segmentation fault (core dumped) my shellcode : section .text ...
1
vote
2answers
485 views

Reverse shell refusing/difficulties to establish connection

I've been trying to reverse shell between different devices, however, I'm never able to establish a connection or get a shell prompt . Let's say I have a Mac OSX as victim and use a raspberry Pi ...
1
vote
1answer
368 views

What is the purpose of the instruction fldz on the Aaron Adams shellcode?

I'm studying the Aaron Adams assembly code. You can find the documentation here (section --[ 2.b.i Getting EIP). I understand that the goal is to get the EIP. I know that the FPU environment looks ...
1
vote
2answers
96 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
2
votes
2answers
2k views

A process called ./watchbog is mining crypto currency in our server. How do I stop it? [duplicate]

I have found this question below but I need some more clarification that's why I am writing again. I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is ...
2
votes
0answers
67 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
3
votes
1answer
264 views

Where in a binary can '/bin/sh' be written to get a shell?

I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it. The CTF challenge was the can-you-gets-me challenge in ...
1
vote
1answer
234 views

Shellcode getting segmentation fault on vmware

I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example. When I execute the program I am getting segmentation fault. I'...
2
votes
2answers
3k views

Is it possible to execute a local file or code from cURL?

I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax: curl "local file" I was looking for possible solutions and found that to read the ...
0
votes
2answers
729 views

Privilege Escalation: C functions setuid(0) with system() not working in Linux

Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
1
vote
1answer
1k views

Windows 64-bit Reverse TCP Shell not working

I am sending shellcode to a 64-bit binary running on a Windows machine. This binary, copies the shellcode to an executable region of memory and executes it. I am generating the shellcode using ...
1
vote
0answers
367 views

Segmentation fault in exercise program

I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end. The idea ...
1
vote
1answer
60 views

Buffer Overflow shell question

If a custom library is affected by a buffer overflow and it is linked against an executable running as root. If an attacker gains a remote reverse shell, it will run under the user of the linked ...
0
votes
0answers
248 views

Understanding execve() exploit instructions

There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
2
votes
0answers
270 views

Not able to run the injected shellcode

#include <stdio.h> void secret() { printf("Congratulations!\n"); } void echo() { char array[60]; scanf("%s", array); printf("You entered: %s\n", array); } int main() { ...
2
votes
0answers
166 views

Concerns about LaTeX 3 shell escape code

What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape. { cp~-RLf~ \...
7
votes
1answer
2k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
1
vote
1answer
87 views

Block hex encoded requests using fail2ban

I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
1
vote
1answer
581 views

What does windows meterpreter reverse TCP Shellcode do?

I have just started learning msfconsole and I have used windows/meterpreter/reverse_tcp . I know this establishes a connection from the target system to our attacking system . However I would like ...
1
vote
0answers
242 views

Buffer overflow experiment: shell code executed but got “failed to read 0 bytes” error

I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
1
vote
0answers
114 views

Why can't I see my shellcode executing in Immunity Debugger?

I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file. I successfully spawned a reverse shell with metasploit, using a ...
0
votes
2answers
332 views

Buffer Overflow : segmentation error at 0x90909090

why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ? 0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff040: ...
0
votes
1answer
428 views

What is the use of different types of shellcode? [closed]

I was browsing the shellcode page in exploit-db website. What is the use of all these different shellcode programs and why should we write them?
29
votes
4answers
11k views

I feel like it's impossible to learn reverse engineering [closed]

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, ...
0
votes
1answer
5k views

Generating unicode javascript shellcode

I'm trying to generate shellcode to modify this exploit: https://www.exploit-db.com/exploits/24947/ It says in the basic exploit: {'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); ...
1
vote
2answers
378 views

nmap finger print looks alot like shell code and not what's on nmap.org

my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow ) bash >> nmap -sS -sU -T4 -A -v 192.168.50.1 Nmap scan report ...
3
votes
1answer
462 views

Execute Shellcode embedded into a picture? [duplicate]

Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for ...
3
votes
1answer
631 views

Python - ctypes.cast function call outputs Segmentation Fault error message

Background: Writing a proof of concept of a twitter C&C inspired by Prof Viviek of SPSE similiar to twittor and the project includes a functionality of injecting shellcode and executing it ...
2
votes
2answers
954 views

Why do we need to remove null bytes from shell code?

I'm studying the basics of making shell codes. I have a question about it. In my textbook, the author stores his shell code in an environment variable, and injects the address of it using strcpy() ...
1
vote
2answers
772 views

Shellcode does not execute as the owner

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia) Here is the source code of the vulnerable script "narnia1" I intend to exploit: #include <stdio.h> int ...
3
votes
0answers
400 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
0
votes
1answer
217 views

Problem with shellcode when exploiting Chakra

I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working ...
0
votes
2answers
289 views

How are eggs placed in memory

How is an egg placed in memory before the egg hunter code executes? If a payload is too large for the exploit buffer but an egg hunter can find the payload, is the payload also sent in smaller chunks ...
7
votes
1answer
779 views

Why would legitimate programs have a `jmp esp` instruction?

It appears that a common exploit trick is to use stack overflow to overwrite the instruction pointer such that it points to a jmp esp instruction somewhere in the code segment which then executes the ...
1
vote
0answers
292 views

DoublePulsar shellcode arguments

NSA DoublePulsar --help outputs the following: Doublepulsar 1.3.1 Options: --NetworkTimeout S16 (default: 60) Timeout for blocking network calls (in seconds). Use -1 for no timeout. --TargetIp ...
3
votes
1answer
209 views

Where I am going wrong with Veil? Cannot get a reverse shell?

This is how I am generating the payload in Veil 3 > use XX > set LHOST X.X.X.X > set LPORT 3333 > generate The payload generates successfully and transferred to victim machine Win7 SP1 ...