Questions tagged [shellcode]

A `shellcode` or `eggshell` is a small program represented as a string of instructions in their hexadecimal encoding.

Filter by
Sorted by
Tagged with
1
vote
1answer
56 views

How to pass param to execve to execute cat a file in x64 Asm? [closed]

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL). Here is my asm xor %rdx, %rdx push %rdx sub $0x16, %rsp movb $0x2f, 7(%rsp) movl $0x2f6e6962, 8(%rsp) movl $0x746163, 12(%rsp) leaq 7(%rsp)...
1
vote
0answers
50 views

Determine what architecture a piece of shellcode targets

After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
3
votes
1answer
80 views

x86 shellcode leads to segmentation fault

I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode: global _start _start: xor eax, eax ; set eax = 0 to push a null without using ...
1
vote
2answers
108 views

segmentation fault at `mov byte [esi+7], al`

Section .text global _start _start: jmp short GoToCall shellcode: pop esi xor eax, eax mov byte [esi+7], al lea ...
0
votes
1answer
82 views

exit() syscall within shellcode not working

int main() { char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80"; int *ret; ret = (int *)&ret + 2; (*ret) = (int)shellcode; } I tried to run the above shellcode ...
0
votes
1answer
175 views

x86-64 CALL opcode + disassembly

Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as: e8 6b fe ff ...
6
votes
1answer
144 views

Returning to usermode shellcode from windows kernel (Win10)

I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland. The ...
1
vote
1answer
194 views

alphanumeric shellcode

I have generated an alphanumeric shellcode with this command: msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python I am targeting a 32 bits ...
-2
votes
1answer
104 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
0
votes
1answer
175 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
0
votes
1answer
73 views

Linux Assembly Syscall

I'm learning how to write shellcode by using Linux system call "execve" to spawn a shell with root access privilege. Here i found a shellcode online: http://shell-storm.org/shellcode/files/shellcode-...
3
votes
2answers
339 views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
4
votes
1answer
321 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
0answers
153 views

random address in call instruction

I am trying to use write system call shellcode in assembly but when i run it i am getting a segmentation fault. I did debug it and its because of the call instruction which is having a random address ...
2
votes
1answer
97 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
6
votes
1answer
354 views

Shellcode challenge - shellcode works in test program, segfaults in actual binary

Currently working through an introductory shellcoding challenge, and having trouble getting the shellcode to work consistently. I'm working on a 32bit Linux binary. I found this shellcode: http://...
2
votes
1answer
262 views

Meaning of code used to find kernel32.dll in shellcode

I'm attempting to reverse some shellcode created by metasploit to increase my understanding of shellcode. I understand the overall point of the code is attempting to locate kernel32.dll in the list of ...
1
vote
1answer
85 views

How to find a fuction hash when manually resolving in shellcode?

I'm disassembling a shellcode and I found that it resolves adress of some function manually using the hash to find function in kernel32.dll. example : call findKernel32Base .... push 0EC0E4E8Eh call ...
2
votes
1answer
234 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
0
votes
1answer
195 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
1
vote
1answer
553 views

how to find memory objects using immunity debugger

I am trying to exploit a program where I have to reuse a socket. recv looks like this: int recv( _In_ SOCKET s, // socket ID _Out_ char *buf, _In_ int len, _In_ int flags ); I want to ...
1
vote
1answer
872 views

Basic shellcode doesn't work when read from stdin

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using: xor %eax,%eax push %eax push $0x68732f2f push $...
5
votes
1answer
536 views

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue ...
0
votes
2answers
717 views

Working Linux assembly XOR Encoder/Decoder Failing on Windows

Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect ...
1
vote
1answer
395 views

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this. gdb -q ./...
4
votes
2answers
474 views

ASM working as is, but not in a C program

I have this piece of ASM: section .text global _start _start: xor eax, eax push eax ; 0 to finish the /bin//sh string push 0x68732f2f ; //sh push 0x6e69622f ; /bin ...
2
votes
1answer
5k views

A buffer overflow exercise using a shellcode

I have been doing an exercise about a buffer overload on a C program, the goal of this problem is to get the root shell once I have inserted a shellcode into the program. This is what I have until now:...
1
vote
0answers
179 views

X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows

After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
1
vote
0answers
132 views

Is it feasible to try write mips unicode shellcode

I am doing a bit off research on exploiting mips embedded applications and I am in a situation where I am able to trigger a buffer overflow, effectively being able redirect execution to any location ...
2
votes
1answer
550 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
0
votes
1answer
268 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
1
vote
1answer
441 views

Unable to call function with CreateRemoteThread

I am messing around with some dll injection/code injection. Therefore I made a little program which does nothing, but it has a function in it, which never get called and I wrote another program which ...
0
votes
1answer
670 views

Reverse a BFLT file

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open. I have obtained the file that is responsible for managing ...
0
votes
1answer
246 views

buffer overflow-seg fault

I am trying to overflow a buffer, which has a size of 0x201 bytes, and get a shellcode. The program that contains the buffer,there is a call to ptrace() (on itself), therefore the shellcode I'm using ...
2
votes
1answer
1k views

IDA Pro: Program parameters

I am currently playing around with simple buffer overflows in a C program and I am trying to understand the program by stepping through it in IDA Pro. The program takes an argument and writes it ...
1
vote
1answer
286 views

ARM shellcode using r0 without null characters

I’m trying to write some basic ARM shell code that loads up the r0 register with 0. I cannot use null characters. I can see that subs r2, r2, r2 sets r2 to 0 without using any null bytes. However, ...
1
vote
1answer
971 views

How to dynamically load address of USER32.DLL in shellcode?

Assuming I'm injecting a shellcode into a Windows GUI application, I know I could: Gets kernel32.dll base address through the PEB (Process Environment Block); Finds address of LoadLibrary; Call ...
0
votes
1answer
3k views

Strcpy BufferOverflow get shellcode location for EIP

I am trying to get a shellcode, exploiting a C program with a strcpy() function. I have found out that I need 68 bytes to start writing on the EIP. So, if I write 72's by EIP register is 0x41414141. ...
-1
votes
2answers
307 views

Why do we have to put shellcode before return address [closed]

I'd like to know why we have to put the shellcode before the return address in a buffer overflow. Logically the return address will point to the shellcode and will be executed. So, the return address ...
4
votes
1answer
2k views

Injecting shellcode in ELF binary

I am trying to inject a piece of shellcode inside a 32-bit ELF executable. I am running Ubuntu 14.04 64-bit. Hence, all the commands I have run require explicit switches to produce 32-bit code. I am ...
0
votes
0answers
481 views

How to get a shell on a remote server?

Hello guys, I explain my problem, i recently learn about socket programming and i want to do a simple "exploit" maybe the easiest shellcode exercise. In order to be precise i'll put below the source ...
1
vote
1answer
826 views

One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm. However, I'm having trouble with the ...
4
votes
1answer
2k views

Illegal Instruction on sample Buffer Overflow exploit

I have followed the example here. Here is my sample program, "oldskool.c": #include <string.h> void go(char *data) { char name[64]; strcpy(name, data); } int main (int argc, char **...
5
votes
2answers
2k views

Need advice : Reverse engineering a pdf with shellcode

Problem : I try to find the plaintext which was hidden at pdf inbuilt with shellcode What i tried : I received a pdf which contains javascript with it ,i dig the pdf as follows : Exploring ...
0
votes
1answer
1k views

Beginner buffer overflow - why isn't my shellcode executing?

I'm following the video here: https://www.youtube.com/watch?v=N0DBu3TGejI ExploitMe.c #include<stdio.h> #include<string.h> main(int argc, char **argv) { char buffer[80]; ...
1
vote
1answer
1k views

How does this version of `rm -rf /` work?

On this website, I found the following code: char esp[] __attribute__ ((section(”.text”))) /* e.s.p release */ = “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68\" “\xff\xff\xff\xff\x68\xdf\xd0\xdf\...
1
vote
0answers
664 views

Shellcode alignment problem

I am trying some CTF style challenges where I have to write shellcode in x86_64 targeting Linux. In the later challenges, the code grows a lot. I now have a large array of bytes I cannot use directly ...
2
votes
3answers
2k views

exploit - Why not execute shellcode with the inline assembler?

The typical structure of executing shell code is the following-: (The code snippet is taken from here) char shellcode[] = ""; /* global array */ int main (int argc, char **argv) { ...
5
votes
1answer
4k views

ARM shellcode for linux - svc 0 vs svc 1

Checking out Linux ARM shellcode I see that the system call is made by using the svc 1 instruction. However, I have also seen examples where they use svc 0 as the instruction that calls the system ...
3
votes
1answer
4k views

Is there an online service which provides the same functionalities as the Metasploit NASM shell?

Does anyone know if there exists an online service which provides the same functionalities as the Metasploit NASM shell ? Probably the above script can be ported to a standalone tool but I'm not very ...