Questions tagged [shellcode]

A `shellcode` or `eggshell` is a small program represented as a string of instructions in their hexadecimal encoding.

Filter by
Sorted by
Tagged with
2 votes
1 answer
55 views

Am I missing symbols when RE'ing shellcode?

I have a question about reversing a tutorial (https://blog.nviso.eu/2021/09/02/anatomy-and-disruption-of-metasploit-shellcode/) which shows how to reverse engineering shellcode. My question is simple: ...
1 vote
2 answers
262 views

ShellCode not running as expected - showing segmentation fault core dump

I have already run this command. But my shellcode is not working for me: gcc -fno-stack-protector -z execstack test.c -o test ./test Segmentation fault (core dumped) Here is my shellcode #include &...
3 votes
2 answers
457 views

How to load shellcode into Ghidra

I'm trying to learn more about reverse engineering, and I've found some shellcode embedded in a C program: unsigned char shellcode[] = "\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\...
1 vote
0 answers
34 views

Send file or non-printable character in Immunity Debugger arguments

I am a beginner in Reverse Engineering. I am on Windows and using Immunity Debugger. I would like to send my payload on the .exe file. The payload contains non-printable characters. How I can launch ...
1 vote
0 answers
71 views

Trying to call the Exit Shellcode in a c program

#include<stdio.h> #include<stdint.h> char shellcode[] = "\xb8\x3c\x00\x00\x00" "\xbf\x14\x00\x00\x00" "\x0f\x05"; int ...
0 votes
1 answer
62 views

Program goes to suspend when buffer overflow occurs

Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer. I need to exploit it to get a ...
5 votes
1 answer
341 views

WinDBG Hung on Shellcode Execution

I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
1 vote
1 answer
244 views

Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
  • 13
1 vote
1 answer
665 views

Statically Reverse Engineering Shellcode - IDA to Ghidra

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/ Hash: ...
  • 13
1 vote
2 answers
139 views

How to extract port number from shellcode

I saw this shellcode and when they use the connect function they pass the port number 4444: set_address: push byte 0x05 ; retry counter push 0x0100007F ; host 127.0.0.1 push ...
  • 483
1 vote
1 answer
580 views

How can I get my shellcode to work outside of GDB?

I'm working inside a Warzone VM with no ALSR or NX bit. The program I'm trying to exploit is really simple: #include <stdlib.h> #include <stdio.h> #include <string.h> /* * ...
  • 113
1 vote
0 answers
121 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
  • 11
0 votes
1 answer
57 views

NULL character (same code) different locations

I'd like to know why NASM generates different opcodes for the same code, when it's in the begin or end of the program? This question is important because I found NULL characters when I compile the ...
  • 3
0 votes
0 answers
265 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
1 vote
1 answer
173 views

Shellcode not working correctly

I wrote a small program in assembly which is supposed to print "AAAA". It works fine when I run it directly, but when I run it as a shellcode in a c program, it doesn't work. Please help. Here is the ...
  • 23
1 vote
1 answer
221 views

ELF file crashing after executing shellcode

So after changing the entry point via the e_entry field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it: // write string and jump to OEP, ...
  • 367
1 vote
0 answers
139 views

Why can I inherit handles from WSASocketA and not from socket?

I'm trying to write some custom shellcode to obtain a shell from a program. Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
  • 111
1 vote
1 answer
2k views

How to pass param to execve to execute cat a file in x64 Asm? [closed]

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL). Here is my asm xor %rdx, %rdx push %rdx sub $0x16, %rsp movb $0x2f, 7(%rsp) movl $0x2f6e6962, 8(%rsp) movl $0x746163, 12(%rsp) leaq 7(%rsp)...
  • 111
2 votes
0 answers
123 views

Determine what architecture a piece of shellcode targets

After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
  • 121
3 votes
2 answers
1k views

x86 shellcode leads to segmentation fault

I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode: global _start _start: xor eax, eax ; set eax = 0 to push a null without using ...
  • 151
3 votes
4 answers
1k views

segmentation fault at `mov byte [esi+7], al`

Section .text global _start _start: jmp short GoToCall shellcode: pop esi xor eax, eax mov byte [esi+7], al lea ...
  • 101
0 votes
2 answers
437 views

exit() syscall within shellcode not working

int main() { char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80"; int *ret; ret = (int *)&ret + 2; (*ret) = (int)shellcode; } I tried to run the above shellcode ...
  • 101
2 votes
1 answer
3k views

x86-64 CALL opcode + disassembly

Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as: e8 6b fe ff ...
  • 205
6 votes
1 answer
409 views

Returning to usermode shellcode from windows kernel (Win10)

I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland. The ...
1 vote
1 answer
1k views

alphanumeric shellcode

I have generated an alphanumeric shellcode with this command: msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python I am targeting a 32 bits ...
  • 613
-2 votes
1 answer
281 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
2 votes
2 answers
782 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
0 votes
1 answer
416 views

Linux Assembly Syscall

I'm learning how to write shellcode by using Linux system call "execve" to spawn a shell with root access privilege. Here i found a shellcode online: http://shell-storm.org/shellcode/files/shellcode-...
  • 27
3 votes
2 answers
1k views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
4 votes
1 answer
956 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
  • 143
1 vote
0 answers
356 views

random address in call instruction

I am trying to use write system call shellcode in assembly but when i run it i am getting a segmentation fault. I did debug it and its because of the call instruction which is having a random address ...
  • 19
2 votes
1 answer
689 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
7 votes
1 answer
845 views

Shellcode challenge - shellcode works in test program, segfaults in actual binary

Currently working through an introductory shellcoding challenge, and having trouble getting the shellcode to work consistently. I'm working on a 32bit Linux binary. I found this shellcode: http://...
2 votes
1 answer
491 views

Meaning of code used to find kernel32.dll in shellcode

I'm attempting to reverse some shellcode created by metasploit to increase my understanding of shellcode. I understand the overall point of the code is attempting to locate kernel32.dll in the list of ...
  • 21
1 vote
1 answer
345 views

How to find a fuction hash when manually resolving in shellcode?

I'm disassembling a shellcode and I found that it resolves adress of some function manually using the hash to find function in kernel32.dll. example : call findKernel32Base .... push 0EC0E4E8Eh call ...
  • 225
2 votes
1 answer
531 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
  • 2,287
0 votes
1 answer
263 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
2 votes
1 answer
2k views

how to find memory objects using immunity debugger

I am trying to exploit a program where I have to reuse a socket. recv looks like this: int recv( _In_ SOCKET s, // socket ID _Out_ char *buf, _In_ int len, _In_ int flags ); I want to ...
  • 123
1 vote
2 answers
2k views

Basic shellcode doesn't work when read from stdin

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using: xor %eax,%eax push %eax push $0x68732f2f push $...
  • 13
6 votes
1 answer
894 views

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue ...
0 votes
2 answers
1k views

Working Linux assembly XOR Encoder/Decoder Failing on Windows

Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect ...
2 votes
1 answer
779 views

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this. gdb -q ./...
4 votes
2 answers
643 views

ASM working as is, but not in a C program

I have this piece of ASM: section .text global _start _start: xor eax, eax push eax ; 0 to finish the /bin//sh string push 0x68732f2f ; //sh push 0x6e69622f ; /bin ...
  • 199
2 votes
1 answer
7k views

A buffer overflow exercise using a shellcode

I have been doing an exercise about a buffer overload on a C program, the goal of this problem is to get the root shell once I have inserted a shellcode into the program. This is what I have until now:...
  • 21
1 vote
0 answers
295 views

X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows

After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
  • 11
1 vote
0 answers
221 views

Is it feasible to try write mips unicode shellcode

I am doing a bit off research on exploiting mips embedded applications and I am in a situation where I am able to trigger a buffer overflow, effectively being able redirect execution to any location ...
  • 66
1 vote
1 answer
762 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
0 votes
1 answer
378 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
1 vote
1 answer
621 views

Unable to call function with CreateRemoteThread

I am messing around with some dll injection/code injection. Therefore I made a little program which does nothing, but it has a function in it, which never get called and I wrote another program which ...
  • 11
1 vote
1 answer
2k views

Reverse a BFLT file

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open. I have obtained the file that is responsible for managing ...