704 questions
2
votes
2
answers
222
views
Why do we cast char* to int(*)() when executing shellcode in C?
I'm learning about shellcode execution in C and I've seen two different approaches. I understand the first one is for exploitation, but I'm confused about the type casting.
Approach 1: Stack Overflow ...
4
votes
1
answer
191
views
How can I exploit Buffer Overflow on x86-64 Linux?
I made a simple vulnerable program greet.c:
#include <stdio.h>
#include <string.h>
int main (int argc, char **argv) {
char buf[32];
strcpy(buf, argv[1]);
printf("%s\n"...
- 65
1
vote
1
answer
169
views
Shellcode to pop a shell without containing the sequence "sh" or "hs"
I am doing a cybersecurity challenge and need to open a shell using shellcode.
The usual shellcode is \x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\x50\x52\x51\...
- 21
-4
votes
1
answer
110
views
CreateRemoteThread failed 5
CreateRemoteThread() fails with error 5 when calling inject_param->allocate() in inject_begin(). Comment it and CreateRemoteThread() is OK. I dont know why. The target platform is 64-bit.
#include &...
- 1
3
votes
2
answers
224
views
Segfault shellcode in main C
I'm trying to create a main. I compiled my code with:
$ gcc -g3 -o shellcode shellcode.c
But I always get a Segmentation fault (core dumped)
Using GDB, I see that the first instruction is executed ...
- 485
2
votes
0
answers
154
views
Call dlopen by executing shellcode in linux x86_64
I'm trying to play around with asm and shellcode, my target is to manage to dlopen a custom library. I've created a code in C that calls a fake dlopen method, compiled it and used objdump to extract ...
- 81
2
votes
0
answers
68
views
How to reference data added to the end of position independent shellcode in Windows x86
I have a C program that parses the PEB and gets kernel32.dll and then with a custom GetProcAddress it gets the address to LoadLibrary. After that I get the address of MessageBoxA. My goal is to ...
- 21
0
votes
0
answers
188
views
I am trying to create a reverse shell using ROP chains by injecting the objdump from the .obj but it does not connect
So basically the problem is as follows:
I have written a ROP chain that calls shellcode from the stack. The ROP chain has also been tested with simple shellcode to call a calculator and it works. This ...
- 1
2
votes
1
answer
519
views
How does msfvenom shellcode actually work to execve sh -c ls
MOV RAX, 0x68732f6e69622f
CDQ
PUSH RAX
PUSH RSP
POP RDI
PUSH RDX
PUSH 0x632d
PUSH RSP
POP RSI
PUSH RDX
CALL FUN_0000001e
INSB RDI, DX
JNC FUN_0000001e
FUN_0000001e:
PUSH ...
- 21
3
votes
0
answers
70
views
How to write inside string stored in executable .text section of ASM code?
I'm trying to write a shellcode to play with a strcpy vulnerability, trying to understand a bit more about how that stuff works.
So far i've managed to inject a sort of "hello world" written ...
- 31
0
votes
1
answer
180
views
Assembly x86-64Bit shellcode gets segfault in shellcode tester
When I compile my shellcode and run it, Strace does not show an error.
When I use my shellcode tester, I get a segmentation fault. I don't know why, maybe there's a smarter guy than me who can help me ...
2
votes
1
answer
1k
views
ROP - The use of the jmp esp
I was playing some picoCTF challenges today and I found myself stuck in a challenge.
Digging around the internet, I found a solution online which I cannot fully grasp.
The challenge (whose name I won'...
1
vote
1
answer
202
views
WinExec throws EXCEPTION_ACCESS_VIOLATION
I tried to modify this shellcode and make it run notepad.exe instead of calc.exe. I'm pushing notepad.exe onto the stack with this code snippet:
mov r9, 0x0000000000657865
push r9
mov r9, ...
- 47
2
votes
1
answer
225
views
WinDBG under VMware Workstation Pro 16.2.3 zeros x87 FPUInstructionPointer when single-stepping
Objective
I am learning exploit development and one of the topics is on writing shellcode.
Typically, msfvenom would do the job well with shikata ga nai encoding. The shellcode generated will also ...
- 66
0
votes
1
answer
3k
views
Receiving EOF while reading in interactive after executing /bin/sh
Im have been doing a course on writting pwntools based exploits. While trying a challenge, after all my attemps I recieve the error "Got EOF while reading in iteractive". My shellcode in ...
3
votes
1
answer
464
views
Hello World direct Assembly Code execution in VBA - so close but Access Violation on Return
Context:
I know it is possible to execute assembly code in vba. A simple method is to overwrite the entry of a COM object's virtual table (vtable) with a function pointer to some place in memory that ...
- 5,625
1
vote
2
answers
144
views
Getting null bytes out of Windows shellcode
The code in question:
mov ebx, fs:30h
Consequent shellcode:
648b1d30000000
I can't seem to figure out how to write this without null bytes.
- 447
-7
votes
1
answer
301
views
MiniDumpWriteDump callback does not return to calling function
I am using MiniDumpWriteDump callbacks to read the dump into memory and encrypt it before storing to a file. It is being executed as a part of shellcode that is being written over EventAggregation.dll ...
- 1
1
vote
0
answers
60
views
Why the final Windows 32-bit executable not be working?
This Python code is a simple script that encrypts a shellcode using XOR with a secret key, creates a decoder stub in assembly language, assembles the decoder stub, and then compiles it into a Windows ...
- 11
1
vote
1
answer
566
views
Getting absolute address of data in shellcode
Here's my shellcode:
xor rax, rax
xor rdi, rdi
xor rsi, rsi
xor rdx, rdx
; getting address of `pathname`
mov rdi, [something]
mov al, 59
mov rdi, rsp
syscall
...
- 447
0
votes
0
answers
45
views
Shellcode doesn't work whatsoever. Could it be a hardware/software problem?
I'm trying to learn how to create shellcode. I've followed several tutorials online and I still can't get it to work. I start by writing clean assembly x86 code to spawn a shell, extract the opcode, ...
0
votes
0
answers
143
views
The problem is based on linux/x64 asm wget+chmod+exec [duplicate]
The problem is based on linux/x64 asm wget+chmod+exec
I have some questions to ask
I am using pwntool for buffer overflow attack, I want to stuff the shellcode in the stack for him to run, I tested ...
0
votes
1
answer
100
views
How to convert a hexstring to shellcode format?
I have a bytes key define as:
KEY = b'\xb5\x89\xd5\x03\x03\x96`\x9dq\xa7\x81\xed\xb2gYR'
I want this to be formatted like shellcode, i.e two hexa characters like: \x41\x42\x43...
So I tried to do it ...
- 309
0
votes
1
answer
288
views
Using mprotect() to set main() as writeable
Using mprotect to set main() as writeable correctly works using this code.
https://godbolt.org/z/68vfrTq8z
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <...
- 2,467
0
votes
1
answer
626
views
Powershell read shellcode from file
I have a powershell script which execute the shellcode.
$code = 0xe8,0x3b,0x3d,0x03,0x00,0x3b,0x3d,0x03
$code.GetType()
[Byte[]] $buf = $code
$buf.Length
The output of above command is
IsPublic ...
- 3