10 votes
Accepted

Need advice : Reverse engineering a pdf with shellcode

The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script. from binascii import unhexlify as unhx encoded = open('encoded.txt').read() # The ...
user avatar
  • 5,850
9 votes
Accepted

How does this version of `rm -rf /` work?

It's not run in the example. It's a shellcode, it has to be somehow injected (for example using a buffer overflow vulnerability). To understand how it works, let's first put some addresses on the ...
user avatar
9 votes
Accepted

Shellcode challenge - shellcode works in test program, segfaults in actual binary

It looks like you have two issues. 1) You are overwriting your input buffer with those push-es so that why you have some junk on the stack and that's why our application crashes. See those two ...
user avatar
9 votes
Accepted

Heap Chunk Structure Does Not Contain Previous Section Info

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap ...
user avatar
  • 5,850
6 votes
Accepted

ASM working as is, but not in a C program

The problem with you shellcode and the why it differs if you run from C program or not is the initial values. The registers that are used when executing execv (second page) are: eax = 0x0b ebx = ptr ...
user avatar
6 votes
Accepted

IDA Pro: Program parameters

Try using IDC function StartDebugger. You can pass a C-style string (e.g. "\x55\x89\xe5")for program arguments: *********************************************** ** Launch the debugger arguments: ...
user avatar
  • 34.8k
5 votes
Accepted

Strcpy BufferOverflow get shellcode location for EIP

68 A bytes - 23 shellcode bytes: 45 NOPs. NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by ...
user avatar
  • 176
5 votes
Accepted

alphanumeric shellcode

Alphanumeric shellcode expects the location of the shellcode to be stored in a register, since the usual technique of call/pop can't be performed with the limited character set. In your example above ...
user avatar
  • 258
5 votes
Accepted

Shellcode not working correctly

You're showing x86 (32bit) shellcode, but are not compiling your program for that architecture, so gcc most likely creates an amd64 (64bit) executable instead. This can be fixed by adding the -m32 ...
user avatar
  • 166
4 votes
Accepted

ARM shellcode using r0 without null characters

Copy/pasted from the online disassembler: .data :00000000 e0522002 subs r2, r2, r2 .data :00000004 e92d0104 push {r2, r8} .data :00000008 e8bd0101 pop {r0, r8} Or, in thumb mode (the push/...
user avatar
4 votes

exploit - Why not execute shellcode with the inline assembler?

This execute-from-array method is used to test shellcodes in bytes format, which is often the way shellcodes are provided (see http://shell-storm.org/shellcode/). It also emulates the usual way ...
user avatar
  • 2,168
4 votes
Accepted

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First thing that comes to mind when you have non-executable stack is Return-oriented programming which, as the name implies, uses return to execute a code you want. When using ROP, you will want to ...
user avatar
  • 693
4 votes
Accepted

x86-64 CALL opcode + disassembly

relative address can be forward or backward from end of current instruction or start of next instruction that e8 00 00 00 00 will be call to the next immediate instruction forward can be e8 ( ...
user avatar
  • 14.9k
3 votes
Accepted

how to find memory objects using immunity debugger

Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the ...
user avatar
3 votes

Meaning of code used to find kernel32.dll in shellcode

In WinDbg: 0:000> dt ntdll!_TEB -y ProcessEnvironmentBlock->Ldr->InM +0x030 ProcessEnvironmentBlock : +0x00c Ldr : +0x014 ...
user avatar
  • 14.9k
3 votes
Accepted

Working Linux assembly XOR Encoder/Decoder Failing on Windows

There are few issues with your code. 1st is what Igor mentioned - .text section is RO. This was solved in this answer. The 2nd is that you did not copy correctly the bytes or lost some of them in ...
user avatar
3 votes
Accepted

Basic shellcode doesn't work when read from stdin

With the shellcode given I was not able to get a shell. If you strace the binary when getting input from the stack execve("/bin//sh", ["/bin//sh"], [/* 0 vars */]) = -1 EFAULT (Bad address) char *...
user avatar
  • 2,389
3 votes

ARM shellcode for linux - svc 0 vs svc 1

I suppose you should check this part of the ARM documentation, and this description of svc and its parameters. By cross referencing the two links you'll find an answer to your question. From the ...
user avatar
  • 2,603
3 votes

ASM working as is, but not in a C program

Okay, so according to gdb the shellcode does run, so it's probably placed into .text. You should try to step through the shellcode (e.g. using stepi) to see on what instruction it faults.
user avatar
  • 34.8k
3 votes

A buffer overflow exercise using a shellcode

Okay, so I will try to answer to all your questions and add a few remarks. Do not disable ASLR system-wide, prefer to disable it within the current process. In fact, echoing 0 in randomize_va_space ...
user avatar
  • 18.1k
3 votes
Accepted

Buffer overflow on server

We have two major stack protection for buffer overflows: Stack canaries Non-executable stack You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
user avatar
3 votes
Accepted

How to dynamically load address of USER32.DLL in shellcode?

If user32.dll is already loaded in the process's address space (and I assume it is given that you said it's a Windows GUI application), you can walk the PEB_LDR_DATA structure in order to find the ...
user avatar
3 votes
Accepted

WinDBG Hung on Shellcode Execution

can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ? if that is the case then it means you allocate memory etc ...
user avatar
  • 14.9k
3 votes

How to load shellcode into Ghidra

Compile and load: #include <stdio.h> char shellcode[] = "\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\x00\x00\x00" "\x48\x8D\x0D\x52\x00\x00\x00\xE8\x9E\x00\...
user avatar
3 votes
Accepted

How to load shellcode into Ghidra

you have a string you cant load a string as is into a disassembler you may need to un-escape them into binary for example "\x48" is "H" if you have a compiler compile and call it ...
user avatar
  • 14.9k
2 votes
Accepted

Reverse a BFLT file

bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls: Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC ...
user avatar
  • 34.8k
2 votes
Accepted

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that. link /SUBSYSTEM:...
user avatar
2 votes

Working Linux assembly XOR Encoder/Decoder Failing on Windows

I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
user avatar
  • 34.8k
2 votes
Accepted

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.
user avatar
  • 34.8k
2 votes
Accepted

How to find a fuction hash when manually resolving in shellcode?

iirc you cant go from a constant hash to name but hash an exported name compare the generated hash with the constant you can see a discussion and an implementation here a ripped python ...
user avatar
  • 14.9k

Only top scored, non community-wiki answers of a minimum length are eligible