Questions tagged [shellcode]
In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode.
236
questions
2
votes
1
answer
2k
views
Metasploit generating strange shellcode
So I just used metasploit to generate the payload/linux/x86/shell_bind_tcp payload without null bytes (generate -t raw -b '\x00' -f shellcode). Here's the shellcode:
$ xxd -p shellcode
...
- 1,215
3
votes
1
answer
645
views
msfvenom -b flag not working?
When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option
msfvenom -p windows/shell/bind_tcp -b '\x00\...
- 378
1
vote
2
answers
9k
views
Can pipe | shell | nc > pipe achieve remote shell?
In one of the articles I have came across an exploit of Dell devices that said when you trigger the following line of code (executed somewhere in php) you will get a remote root shell :
mkfifo /tmp/...
- 157
1
vote
2
answers
844
views
Detect blocked reverse shell
I am wondering if there is a way to detect if a reverse shell is blocked by egress filtering or an obligatory proxy, or the exploit just failed.
I am asking this question in the context of a SE media ...
- 199
2
votes
3
answers
1k
views
Documentation on Meterpreter Shells
I've been looking for some decent documentation on Meterpreter shells, but I can't seem to find anything useful.
I would like to know when to use what kind of shell for a certain situation. All I ...
- 199
4
votes
4
answers
4k
views
Clamav can't detect encoded virus files
I have a PHP sheller file (like c99 file) but it's encoded with this functions:
eval(gzinflate(base64_decode("7P3rehblahblah"))
The clamav virus scan can't detect it. How can I detect a virus and ...
- 41
1
vote
1
answer
784
views
How to deny shell execution in all sub-directories?
I want nginx to deny users who have folders inside /webroot/uploads
e.g.
/webroot/uploads/user1
/webroot/uploads/user2
/webroot/uploads/user999
to execute any shell (php, pl, py, binary).
The ...
- 1,027
0
votes
1
answer
190
views
How to find malicious images in server?
Recently my Drupal site on a Linux server has been targeted by session hijacking attacks. I guess the attacks were originated from images containing malicious code which where uploaded to the web root ...
- 1,027
11
votes
2
answers
15k
views
NX bit: does it protect the stack?
I once heard the NX bit was a panacea, then that it was not.
One detail I've wondered about though:
Does the NX (no execute) bit protect against code inserted into the stack and executed there?
It ...
- 153
4
votes
2
answers
1k
views
How do arbitrary payloads execute on the remote machine?
I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command ...
- 73
1
vote
1
answer
4k
views
Starting a new shell in a strcpy exploit using buffer overflow
I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from:
#include <string.h>
void myfunction(char *arg);
int main(int argc, char **argv)
{
...
- 11
3
votes
1
answer
11k
views
Stack buffer overflow confusion
I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique.
Reading some articles and watching videos brought me to a confusion which can be ...
- 1,550
19
votes
1
answer
3k
views
Could someone explain parts of the FBI's Firefox 0-day?
Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown.
http://pastebin.mozilla.org/2776374
The ...
- 664
8
votes
3
answers
11k
views
How to determine the size of payloads available in MetaSploit
I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do.
However, ...
- 300
8
votes
3
answers
2k
views
Buffer overflow stack adjustment
I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. The shellcode was not executed until it was padded with NOPs although it's set properly in ...
- 751
4
votes
2
answers
6k
views
How to deal with MySQL's Errcode 13 when trying to write a shell
My attack machine is running Kali and the server is running CentOS 6.4 with DVWA.
I'm trying to write a shell through an SQL injection. The payload is
' UNION SELECT '', '<?PHP system($_GET["cmd"...
user15194
20
votes
3
answers
8k
views
Is it possible to write shellcode in C++?
Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of ...
- 309
4
votes
3
answers
2k
views
Is writing shellcode still a valid skill to have/learn?
Following up from this question: Should I bother teaching buffer overflows any more?
I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
19
votes
1
answer
14k
views
NOPS in Metasploit
Problem
I do not know what a "NOP" is in Metasploit Framework or otherwise.
What I do know
Metasploit Unleashed says, "Nops keep the payload sizes consistent."
A few question posts mention buffer ...
- 659
5
votes
2
answers
3k
views
ASLR and how a program can actually call its functions
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment.
As far as I know ASLR works by randomizing part of the imagebase address when ...
- 169
-1
votes
1
answer
197
views
E-mail with obfuscated code / no trace in e-mail server
I've got a situation where one of my clients sent me an e-mail with what appears to be obfuscated shell code. The really bizarre thing here is that I see no trace of this e-mail showing up in the mail ...
- 9,227
0
votes
1
answer
790
views
Shellcode Segfault mid execution?
In doing a university assignment, we are launching a shell on a remote server. That's all fine, I have connect back shell code, and when I hardcode the hex attack string into the server and jump to it,...
- 385
5
votes
1
answer
3k
views
NX bit causes segfault on NOP slide?
doing an assignment for university.
We have to exec a shell on a remote server. We're told the NX bit is not set, however, when we redirect to our injected code, the server has a segmentation fault. ...
- 385
9
votes
1
answer
1k
views
Better way to import Win32 APIs from injected shellcode
I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped ...
- 135k
8
votes
1
answer
4k
views
SafeSEH and x64
I read here that
/SAFESEH is only valid when linking for x86 targets. /SAFESEH is not
supported for platforms that already have the exception handlers
noted. For example, on x64 and Itanium, ...
- 509
0
votes
1
answer
348
views
Does filtering HTML syntax prevent a web shell from being dropped through a textbox? [closed]
I have an admin panel that is running off a mysql db. On that panel, I have text boxes that allow an "Admin" to input plain text OR HTML Styling that will be displayed on a section of the site that is ...
- 3,186
6
votes
2
answers
3k
views
Stack canaries protection and ROP
As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return.
My question is: if I overwrite both EIP and stack ...
- 509
7
votes
2
answers
5k
views
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
- 509
19
votes
2
answers
24k
views
How "leaking pointers" to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This is ...
- 509
3
votes
1
answer
4k
views
Stack smashing keep getting segmentation fault
I have a homework assignment to do stack smashing,
The exploit code creates a badfile in which the vulnerable file reads and buffer over flow occurs.
I have already did the 2 commands below to ...
- 131
2
votes
1
answer
1k
views
How to achieve interactive shell attack?
Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell.
So when I call FTP interactive client, shell fails.
Is there any way I can do ...
- 53
3
votes
2
answers
5k
views
Shellcode that is smaller than 295 bytes that spawns a shell [closed]
Metasploit payloads produce more than 300-byte shellcodes.
But I want my shell-spawning shellcodes to be less than 295 bytes.
Can anyone show me the links to these shellcodes?
Thanks.
6
votes
3
answers
2k
views
What methodologies are useful when reverse-engineering malware / shellcode?
Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
- 135k
2
votes
1
answer
3k
views
What tricks can be used to prevent debugging?
What tricks can be used to prevent or hinder debugging?
Examples:
IsDebuggerPresent API on Windows
Exception handlers used for program flow.
GetTickCount / rdtsc checks.
Are there any good ...
- 135k
4
votes
3
answers
5k
views
Are there any tools that focus on shellcode analysis?
Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
- 135k
127
votes
2
answers
102k
views
How do ASLR and DEP work?
How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
- 135k