Questions tagged [shellcode]
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.
235
questions
0
votes
0
answers
233
views
Is JIT-compiler required for JIT-ROP attack?
I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
- 1
1
vote
0
answers
468
views
Shell injection using only [alphanumeric, dashes, colon, period]
I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server.
When submitting the form, the following ...
- 111
1
vote
1
answer
666
views
shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )
I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!
Segmentation fault (core dumped)
my shellcode :
section .text
...
- 83
1
vote
2
answers
11k
views
Reverse shell refusing/difficulties to establish connection
I've been trying to reverse shell between different devices, however,
I'm never able to establish a connection or get a shell prompt
.
Let's say I have a Mac OSX as victim and use a raspberry Pi ...
- 167
1
vote
1
answer
2k
views
What is the purpose of the instruction fldz on the Aaron Adams shellcode?
I'm studying the Aaron Adams assembly code. You can find the documentation here (section --[ 2.b.i Getting EIP).
I understand that the goal is to get the EIP.
I know that the FPU environment looks ...
- 259
1
vote
2
answers
364
views
How is executable shellcode inserted?
How is shellcode (the payload) added to an executable file? Assume it is close source.
How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
- 715
3
votes
2
answers
3k
views
A process called ./watchbog is mining crypto currency in our server. How do I stop it? [duplicate]
I have found this question below but I need some more clarification that's why I am writing again.
I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is
...
- 139
2
votes
0
answers
193
views
Shellcode different on guide
I followed a guide to do narnia2 of overthewire and the shellcode generated by them was:
h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80
...
- 123
4
votes
1
answer
2k
views
Where in a binary can '/bin/sh' be written to get a shell?
I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it.
The CTF challenge was the can-you-gets-me challenge in ...
- 143
1
vote
1
answer
773
views
Shellcode getting segmentation fault on vmware
I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example.
When I execute the program I am getting segmentation fault.
I'...
user192960
5
votes
4
answers
20k
views
Is it possible to execute a local file or code from cURL?
I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax:
curl "local file"
I was looking for possible solutions and found that to read the ...
- 249
0
votes
2
answers
6k
views
Privilege Escalation: C functions setuid(0) with system() not working in Linux
Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
- 437
1
vote
1
answer
5k
views
Windows 64-bit Reverse TCP Shell not working
I am sending shellcode to a 64-bit binary running on a Windows machine. This binary, copies the shellcode to an executable region of memory and executes it.
I am generating the shellcode using ...
- 919
1
vote
0
answers
1k
views
Segmentation fault in exercise program
I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end.
The idea ...
- 147
1
vote
1
answer
125
views
Buffer Overflow shell question
If a custom library is affected by a buffer overflow and it is linked against an executable running as root. If an attacker gains a remote reverse shell, it will run under the user of the linked ...
- 1,840
4
votes
1
answer
1k
views
Not able to run the injected shellcode
#include <stdio.h>
void secret()
{
printf("Congratulations!\n");
}
void echo()
{
char array[60];
scanf("%s", array);
printf("You entered: %s\n", array);
}
int main()
{
...
2
votes
0
answers
348
views
Concerns about LaTeX 3 shell escape code
What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape.
{ cp~-RLf~ \...
- 121
7
votes
1
answer
7k
views
Why does my x86 shellcode test program segfault?
I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
- 79
1
vote
1
answer
374
views
Block hex encoded requests using fail2ban
I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
- 11
1
vote
1
answer
2k
views
What does windows meterpreter reverse TCP Shellcode do?
I have just started learning msfconsole and I have used windows/meterpreter/reverse_tcp . I know this establishes a connection from the target system to our attacking system .
However I would like ...
- 11
1
vote
0
answers
560
views
Buffer overflow experiment: shell code executed but got "failed to read 0 bytes" error
I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
- 145
1
vote
0
answers
348
views
Why can't I see my shellcode executing in Immunity Debugger?
I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file.
I successfully spawned a reverse shell with metasploit, using a ...
- 11
0
votes
2
answers
1k
views
Buffer Overflow : segmentation error at 0x90909090
why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ?
0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff040: ...
0
votes
1
answer
919
views
What is the use of different types of shellcode? [closed]
I was browsing the shellcode page in exploit-db website. What is the use of all these different shellcode programs and why should we write them?
31
votes
4
answers
19k
views
I feel like it's impossible to learn reverse engineering [closed]
I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie.
I learned the basics of C# and that helps me understand some of the things in C, ...
- 461
7
votes
1
answer
17k
views
Generating unicode javascript shellcode
I'm trying to generate shellcode to modify this exploit:
https://www.exploit-db.com/exploits/24947/
It says in the basic exploit:
{'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE");
...
- 171
1
vote
2
answers
983
views
nmap finger print looks alot like shell code and not what's on nmap.org
my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow )
bash >> nmap -sS -sU -T4 -A -v 192.168.50.1
Nmap scan report ...
- 27
4
votes
1
answer
2k
views
Execute Shellcode embedded into a picture? [duplicate]
Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for ...
- 57
3
votes
1
answer
1k
views
Python - ctypes.cast function call outputs Segmentation Fault error message
Background:
Writing a proof of concept of a twitter C&C inspired by Prof Viviek of SPSE similiar to twittor and the project includes a functionality of injecting shellcode and executing it ...
- 345
4
votes
2
answers
4k
views
Why do we need to remove null bytes from shell code?
I'm studying the basics of making shell codes. I have a question about it.
In my textbook, the author stores his shell code in an environment variable, and injects the address of it using strcpy() ...
- 41
1
vote
2
answers
2k
views
Shellcode does not execute as the owner
(This is a question regarding a challenge in a wargame on overthewire.org called Narnia)
Here is the source code of the vulnerable script "narnia1" I intend to exploit:
#include <stdio.h>
int ...
- 11
0
votes
1
answer
408
views
Problem with shellcode when exploiting Chakra
I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working ...
- 11
0
votes
2
answers
444
views
How are eggs placed in memory
How is an egg placed in memory before the egg hunter code executes?
If a payload is too large for the exploit buffer but an egg hunter can find the payload, is the payload also sent in smaller chunks ...
- 385
7
votes
1
answer
2k
views
Why would legitimate programs have a `jmp esp` instruction?
It appears that a common exploit trick is to use stack overflow to overwrite the instruction pointer such that it points to a jmp esp instruction somewhere in the code segment which then executes the ...
- 251
3
votes
1
answer
860
views
Where I am going wrong with Veil? Cannot get a reverse shell? [duplicate]
This is how I am generating the payload in Veil 3
> use XX
> set LHOST X.X.X.X
> set LPORT 3333
> generate
The payload generates successfully and transferred to victim machine Win7 SP1 ...
- 195
1
vote
0
answers
839
views
Could not load library libcutils.so while injecting shellcode
I am working on my school thesis.
I am trying to inject some shellcode into a shared library using Dirty Cow vulnerability on Android x86.
My shellcode is written in asembly and only calls ...
- 133
1
vote
1
answer
510
views
Is it possible to "encode" a bash sentence?
I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
- 249
1
vote
0
answers
2k
views
Problem with reverse-shell direction
In an attempt to exploit RFI weakness I am running Apache on my Kali box to host the php reverse-shell and the shell was backconnect to myself (my kali machine).
Why am I getting a shell from my ...
- 31
1
vote
2
answers
778
views
Why is this shellcode execution considered an exploit?
I found the following "exploit" on Twitter: https://www.exploit-db.com/exploits/43550/?rss
Blogpost about it: https://pentesterslife.blog/2018/01/13/polymorphic-and-smaller-versions-of-three-shell-...
- 267
6
votes
2
answers
1k
views
Linux Kernel ROP - Returning to userland from kernel context?
I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to ...
- 220
3
votes
1
answer
263
views
Can you start a shell with a service account in Windows?
In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (...
- 239
1
vote
1
answer
1k
views
What is a reverse WWW shell?
I'm having a hard time finding a good definition for a Reverse WWW Shell through regular Google searching.
So far, I've gathered:
Reverse shell is a technique of establishing a remote connection
...
- 239
3
votes
2
answers
1k
views
How does ASLR protect libc entry points?
ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple ...
- 95
4
votes
1
answer
14k
views
Executing a msfvenom shellcode in C program
This is obviously for educational purposes. I've been interested in learning more about malware and how it works.
I'm trying to get a meterpreter reverse tcp shell working on windows 10 but more ...
- 143
4
votes
1
answer
605
views
Can change flow of the program yet can't execute shellcode
I've created a small vulnerable C program, which normally won't call function overflowed.
void overflowed(){
printf("%s\n","Hijacked");
}
void normally(char * st){
char buffer[80];
...
20
votes
1
answer
9k
views
How does shellcode really run?
I read the book "The Shellcoders Handbook", and in it there is some C code which will execute shellcode (it will only call exit syscall).
char shellcode[] = “\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\...
3
votes
1
answer
2k
views
Does it matter in which programming language you write the shellcode?
I have been searching a lot and I didn't find anything. I still wonder: does it matter in which language you write shellcode? Will shellcode in Assembly, C, etc. work everywhere they can be used and ...
0
votes
3
answers
2k
views
MSFvenom payload with dynamic options
I am using MSFvenom to export meterpreter's reverse TCP payload. While this works with msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.6.131 LPORT=4444 -f -exe > ~/Desktop/...
- 1,290
2
votes
1
answer
1k
views
Challenge: Shellcode with unique bytes
Is it possible to have a (small) shellcode with unique bytes only?
So far I noticed the smallest shellcode I can find online is 19 bytes for Linux x86, but it does repeat bytes, especially the "/" ...
- 131
0
votes
1
answer
116
views
Implications of running script as argument to shell
Context for the question is the following comment on one of my answers:
@SergiyKolodyazhnyy Prefacing a script name with /bin/bash or even just bash is also a common way to solve the lack of ...
