Questions tagged [shellcode]

In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.

38 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
1answer
3k views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
4
votes
0answers
454 views

C program - exploit program (after seg fault)

The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary As part of learning security - I am trying to buffer overflow this program. I ...
3
votes
0answers
453 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
3
votes
1answer
262 views

Where I am going wrong with Veil? Cannot get a reverse shell?

This is how I am generating the payload in Veil 3 > use XX > set LHOST X.X.X.X > set LPORT 3333 > generate The payload generates successfully and transferred to victim machine Win7 SP1 ...
3
votes
1answer
723 views

Extracting shellcode from Wireshark pcap files

I running a honeypot for the telnet and ssh services (more specifically, I'm running cowrie). When an attacker tries to download a binary file cowrie generally downloads it and saves it to a file, ...
2
votes
0answers
72 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
2
votes
0answers
316 views

Not able to run the injected shellcode

#include <stdio.h> void secret() { printf("Congratulations!\n"); } void echo() { char array[60]; scanf("%s", array); printf("You entered: %s\n", array); } int main() { ...
2
votes
0answers
188 views

Concerns about LaTeX 3 shell escape code

What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape. { cp~-RLf~ \...
2
votes
0answers
434 views

Stack overflow return addr

I'm trying to exploit a standard buffer overflow vulnerability in a program that uses strcpy() to fill a 200 char buffer, without checking boundaries, and compiled with -z execstack and -fno-stack-...
2
votes
1answer
552 views

Shellcode not executing properly

I managed to get shellcode to be pointed to by eip by building my executable without safety measures. However, it does not appear to execute. Here is the C source of my vulnerable program: #include ...
1
vote
1answer
82 views

Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?

I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but ...
1
vote
0answers
50 views

Confusing with the exact location of a shellcode in memory?

When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But most of the time, it crashes saying 'segmentation fault'. I got the same ...
1
vote
0answers
55 views

Why is generated different traffic for the same attack?

I created a scenario in VirtualBox (configured as internal network) with two machines: Windows XP and Kali Linux. I used ms08_067_netapi exploit from Metasploit and the payload windows/meterpreter/...
1
vote
0answers
472 views

Segmentation fault in exercise program

I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end. The idea ...
1
vote
0answers
261 views

Buffer overflow experiment: shell code executed but got “failed to read 0 bytes” error

I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
1
vote
0answers
129 views

Why can't I see my shellcode executing in Immunity Debugger?

I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file. I successfully spawned a reverse shell with metasploit, using a ...
1
vote
0answers
323 views

DoublePulsar shellcode arguments

NSA DoublePulsar --help outputs the following: Doublepulsar 1.3.1 Options: --NetworkTimeout S16 (default: 60) Timeout for blocking network calls (in seconds). Use -1 for no timeout. --TargetIp ...
1
vote
0answers
430 views

Could not load library libcutils.so while injecting shellcode

I am working on my school thesis. I am trying to inject some shellcode into a shared library using Dirty Cow vulnerability on Android x86. My shellcode is written in asembly and only calls ...
1
vote
0answers
958 views

Problem with reverse-shell direction

In an attempt to exploit RFI weakness I am running Apache on my Kali box to host the php reverse-shell and the shell was backconnect to myself (my kali machine). Why am I getting a shell from my ...
1
vote
0answers
233 views

Using .data segment for Code Execution with DEP Enable

Sorry if this seems like a silly question. I am working on practicing backdooring applications for a cert I am working on, and one of the methods is to use existing code caves. The issue is, these ...
1
vote
0answers
89 views

Why makes many copies of the code block in Heap Spray?

I Understand that adding NOP-Sled will increase the possibility of the attack, but why do we need to add more than a copy of NOP-sled + shellcode? if we have one big NOP_sled+shellcode it will be more ...
1
vote
0answers
450 views

Eliminating 0x0a from ShellCode for unlink file

I have written a shellcode to unlink a file from the system, but when I extracted the hexcode off the binary file, it consists of \x0a byte, because the sys call number for unlink function is 10, so ...
1
vote
0answers
277 views

Shellcode Injection/Poisoning on Mobile Networks[GSM/LTE/CDMA-varaints]?

In the previous question(How do APN hacks work?) I have enquired about APN hacks but after reseaching more about cellular networks. I wonder has anybody attempted Remote-code execution/poisoning,etc ...
1
vote
0answers
943 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
1
vote
0answers
247 views

Buffer overflow and register contents?

I am doing an exam practice question, suppose I have a function like; void func(char* arg) { char buf[32]; strcpy(buf, arg); } command break func: -buf begins at 0xbffebfb0 -(gdb) x/2wx $...
1
vote
0answers
1k views

How does Metasploit's payload work with a remote target?

I have some simple questions. I often use Metasploit in my pentest engagements. It works fine when I'm inside a local network. Okay, we know that, when the payload is injected properly, it will give ...
1
vote
1answer
4k views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
0
votes
0answers
50 views

Pwnable: Process has its own home directory

I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /...
0
votes
0answers
43 views

Windows shellcode not working in C

I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works... I know the shellcode below is all right because it does work in the context ...
0
votes
0answers
67 views

permission denied when executing an elf payload

I can examine a payload using libemu (sctest) and ndisasm, like this : msfvenom -p linux/x86/shell_bind_tcp -f raw | ./sctest -vvv -Ss 1000 msfvenom -p linux/x86/shell_bind_tcp -f raw | ndisasm -u -...
0
votes
0answers
56 views

Failure to execute shellcode

I'm trying to understand exploits that hijack the execution flow. Before exploiting a buffer overflow vulnerability, I'm just trying to set an environment variable to my shellcode and jump to it. So, ...
0
votes
0answers
85 views

How to forbid user from executing malicious shell and Python script?

I am designing a online programming website similar to https://repl.it. Users can execute shell and python scripts on the browsers. If users execute malicious commands including but not limited to "...
0
votes
0answers
48 views

x86 shellcode leads to segmentation fault

I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode: global _start _start: xor eax, eax ; set eax = 0 to push a null without using ...
0
votes
0answers
99 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
0
votes
0answers
140 views

Shell injection using only [alphanumeric, dashes, colon, period]

I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following ...
0
votes
0answers
29 views

How to access platform-specific commands in this code, without exposing arbitrary command execution?

I'm writing a DNS-01 extension to the widely used Let's Encrypt acme.sh, that uses a locally running DNS server such as Bind, Unbound, Knot DNS, etc, rather than an API to an external service provider,...
0
votes
1answer
228 views

Problem with shellcode when exploiting Chakra

I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working ...
-4
votes
1answer
384 views

Why is my reverse_https payload running at 0.0.0.0:443?

I created a reverse_https backdoor ( windows/meterpreter/reverse_https ) with msfpayload. Now I want to create a reverse shell from my target with a multi handler. The problem is that when I ...