51
votes
Accepted
I feel like it's impossible to learn reverse engineering
So let me preface this with "I'm not implying you're a child"
Often when I teach kids about CIS and they hear what I do for a living, the first question is
"How do I hack?"
I'll tell you the same ...
- 1,471
42
votes
Accepted
How does shellcode really run?
TL;DR This is a way to execute shellcode which no longer works.
What is a function?
Shellcode is just machine code in places where it is not normally found, such as a variable of type char. In C, ...
- 67.1k
21
votes
Why does my x86 shellcode test program segfault?
I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80)
[-----...
- 1,964
13
votes
What is the difference between a payload and shellcode?
When exploiting an application, the payload is the code that the attacker actually wants to execute. It's the part that not just serves the purpose of leveraging the vulnerability itself, but does ...
- 45k
12
votes
I feel like it's impossible to learn reverse engineering
Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
- 3,012
10
votes
Accepted
What does the NSA's Recently Leaked "The Equation Group" Files do?
There's been four top-notch analyses so far regarding incident with the free files (40 percent of what is claimed to be released). Nobody has the password to the auction files yet, which represent ...
- 19.1k
7
votes
Accepted
Difference between Code Injection, Command Injection and Remote Code Execution
Hmm let me try:
Code injection consists of modifying an executable / compilation unit / script so that it contains malicious code on top of it´s intended functions. Code can be injected locally into ...
- 547
7
votes
Accepted
Is it possible to execute a local file or code from cURL?
Not sure if this is against the spirit of what you are asking but you can pipe the output of a shell script to bash. e.g. curl "file:///root/script.sh" | bash
Also take a look at a list of known curl ...
- 2,711
6
votes
Serving a php webshell without running it locally
Use the following setting in your apache config or in a .htaccess file:
php_flag engine off
See also Disable PHP in directory (including all sub-directories) with .htaccess.
- 32.9k
6
votes
Accepted
Why would legitimate programs have a `jmp esp` instruction?
The instruction jmp esp is encoded as FF E4. It’s not necessary to find an actual jmp instruction, just those bytes in the middle of any other code or data.
This is the basis for return oriented ...
- 744
5
votes
Accepted
Do NOP sleds expose shellcode?
IDSs will look for nop sleds, but they can also be masked. Consider that any instruction that is:
Valid and executable
Will continue execution somewhere in the nop sled between itself and the ...
- 118
5
votes
Accepted
Buffer overflow - Print "hello world"
If you want to get shellcode quick and dirty, use msfvenom. If you want to learn something and become a wizard, I suggest the following:
1. Write a small assembler program for your platform.
You ...
- 3,026
5
votes
Accepted
Does it matter in which programming language you write the shellcode?
The term "shellcode" comes from the fact that it is typically used to gain shell access on the machine. In most cases, shellcode is used when there is a memory corruption-based vulnerability (e.g. ...
- 13.1k
5
votes
Accepted
Generating unicode javascript shellcode
As hinted at in the comment above, you want to use msfvenom to generate your payload.
Start by finding which payload works best for you by using:
msfvenom -l payloads
This will show you a list of ...
- 1,471
5
votes
A process called ./watchbog is mining crypto currency in our server. How do I stop it?
From my point of view, there is no way to tell if the rest of the server is safe or not.
If I were you, I'd handpick files to save and recreate a fresh server to ensure that it isn't compromised.
...
- 301
5
votes
Accepted
Replace forbidden characters function check python
$(whoami) should bypass the filter and executes whoami.
- 14.7k
5
votes
Accepted
Find Buffer Overflows at a target you want to gain access
As schroeder has already pointed out, to identify buffer overflow vulnerabilities, you'd need to test the application locally with a debugger. It seems to me that you haven't actually gone through the ...
- 295
4
votes
Accepted
What lies behind this complicated shellcode on linux?
If you have tried shellcode before which relies on absolute addresses, then that
could explain the crashes. This shellcode survives because it uses call to
obtain the absolute stack pointer address ...
- 6,088
4
votes
Accepted
Mov byte to addres inside a register
rdi points to rri_shellcode+1. This is located in the .text segment which is not writable by default, thus causing the segmentation fault.
You can link it using the ld -N option if you really need ....
- 544
4
votes
Accepted
Reverse Bash Shell one liner
Can someone please explain to me the significance of the number "196"?
196 is a randomly chosen number for a file descriptor that you're opening for reading from and writing to via exec. You can ...
- 45k
4
votes
Shellcode parameter passing
Not every character in your payload can be sent through the argv of your binary. There are some "bad characters" which you can't have in your shellcode. An example is "\x00" as you're using strcpy to ...
- 248
4
votes
What is the difference between a payload and shellcode?
Exploit - An exploit is the means by which an attacker, or penetration tester for that matter, takes advantage of a vulnerability
within a system, an application, or a service. An attacker uses an
...
- 141
4
votes
Accepted
Executing a msfvenom shellcode in C program
As was mentioned in the comments, you have a couple of different problems:
You're using 32-bit shellcode in a 64-bit binary. This will have problems because it is likely to refer to the stack ...
- 16.1k
4
votes
Accepted
Linux Kernel ROP - Returning to userland from kernel context?
I ended up writing my shellcode in a different way. As I could not figure out how to return, I let the kernel do the heavy lifting for me, in returning to userland. The idea was to execute my ...
- 220
4
votes
Is it possible to "encode" a bash sentence?
I don't know what that chain of characters is, but it's clearly not a shell command. What's happening is that bash is trying to interpret and act on various shell metacharacters in the string, but ...
- 2,611
4
votes
I feel like it's impossible to learn reverse engineering
Stop wasting your time with books and videos. Get some program you want to reverse (like a game you want to hack), get your tools for static/dynamic analysis (cheat engine is great for starting if you'...
- 41
4
votes
Accepted
Privilege Escalation: C functions setuid(0) with system() not working in Linux
./pingSys 127.0.0.1; /bin/sh
The semicolon will be interpreted as a command delimiter by the current shell. This means it will first execute ./pingSys 127.0.0.1 in the current shell and then /bin/sh ...
- 205k
4
votes
Privilege Escalation: C functions setuid(0) with system() not working in Linux
So, because you haven't quoted the parameter, you are passing two separate commands to your non-elevated shell. One of them runs as root, and calls ping. The other runs as user and spawns a sub-shell. ...
- 50.3k
4
votes
Accepted
Basic questions about shellcode
Yes, they are the same thing.
To be more technical, the hex code at the top is "machine code" and what you see at the bottom is a human-readable representation of the machine code which you know to ...
- 355
Only top scored, non community-wiki answers of a minimum length are eligible