Writing my first shellcode
0day.work
Writing my first shellcode
1–10 of 21 posts
Re: Writing my first shellcode
#2So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see
(*(void(*)()) shellcode)();
Aside, is there any using HN syntax to write that code inline (i.e. not in its own paragraph) without the asterisks insisting that I mean italics?
Re: Writing my first shellcode
#3So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see (*(void(*)()) shellcode)(); and suddenly this looks way more interesting. Is it really possible to literally just execute random bytes stored in a string like that? I mean, sure, you'd have to guarantee that it's running on the right platform with the right type of assembly, but sti…
> So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see
(*(void(*)()) shellcode)();
Well it's just a sequence of bytes somewhere in-memory, no? If the C compiler allows the cast, then it'd compile fine, and the CPU wouldn't know the difference; it'd just execute whatever instructions the sequence of bytes listed.
Re: Writing my first shellcode
#4So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see (*(void(*)()) shellcode)(); and suddenly this looks way more interesting. Is it really possible to literally just execute random bytes stored in a string like that? I mean, sure, you'd have to guarantee that it's running on the right platform with the right type of assembly, but sti…
Correct. Once you successfully cast to a function pointer, the compiled code will do all of the various register bookkeeping for stack management, then jump to the instruction specified. If it's legit assembly, then you're in business. If it's not, then you probably crash. It doesn't matter whether the instructions are the garden variety compiler-generated kind or some hand-crafted artisanal limited edition bytes. Instructions are instructions at that point.
Re: Writing my first shellcode
#5Here are 2 great courses to learn assembly and shellcoding:
http://www.pentesteracademy.com/course?id=3 http://www.pentesteracademy.com/course?id=7
There are many free videos in this collection.
Re: Writing my first shellcode
#6So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see (*(void(*)()) shellcode)(); and suddenly this looks way more interesting. Is it really possible to literally just execute random bytes stored in a string like that? I mean, sure, you'd have to guarantee that it's running on the right platform with the right type of assembly, but sti…
Every single program that your computer runs is nothing but a 'pile of bytes' that is carefully set up by your compiler. There is no technical reason that you cannot manually set up said byte piles and execute them, and it is actually not hard at all. (The only 'gotcha' is that some parts of memory are not marked as executable, but this can be changed at runtime or compile-time).
execve does nothing more than swap out which bytes are loaded into the address space of a program (okay, it does some other book-keeping too, but from 100 feet...). It is not necessary for continuing execution outside of what the program has set up at compile-time. In fact, you can dynamically generate code on the fly, as JIT compilers do.
Re: Writing my first shellcode
#7So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see (*(void(*)()) shellcode)(); and suddenly this looks way more interesting. Is it really possible to literally just execute random bytes stored in a string like that? I mean, sure, you'd have to guarantee that it's running on the right platform with the right type of assembly, but sti…
Take a look at Microcorruption [0]. If this post intrigued you, I think you'd really enjoy it.
It's a series of challenges by tptacek that task you with exploiting the firmware for a digital smart lock. It starts out by assuming no knowledge, with the first level literally just requiring that you read a memory dump, but by the last level you'll be reverse engineering custom heap implementations, injecting shellcode into ASLR'd binaries, and bypassing memory protections.
It really is the best introduction to this sort of material that I've ever come across.
Re: Writing my first shellcode
#8So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see (*(void(*)()) shellcode)(); and suddenly this looks way more interesting. Is it really possible to literally just execute random bytes stored in a string like that? I mean, sure, you'd have to guarantee that it's running on the right platform with the right type of assembly, but sti…
> So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see (*(void(*)()) shellcode)(); > and suddenly this looks way more interesting. Is it really possible to literally just execute random bytes stored in a string like that? Well it's just a sequence of bytes somewhere in-memory, no? If the C compiler allows the cast, then it'd compile f…
It actually probably won't work.
Because DEP aka W^X will mark the section of memory containing the string as non-executable, so it will segfault when the instruction pointer hits that address. You can disable that security feature though with a compiler option.
Re: Writing my first shellcode
#9Earlier quoted context omitted.
> So, having never heard of shellcode before, I assumed it was just another way of saying shell script. But I scroll to the bottom and see (*(void(*)()) shellcode)(); > and suddenly this looks way more interesting. Is it really possible to literally just execute random bytes stored in a string like that? Well it's just a sequence of bytes somewhere in-memory, no? If the C compiler allows the cast, then it'd compile f…
It actually probably won't work. Because DEP aka W^X will mark the section of memory containing the string as non-executable, so it will segfault when the instruction pointer hits that address. You can disable that security feature though with a compiler option.
> Because DEP aka W^X will mark the section of memory containing the string as non-executable, so it will segfault when the instruction pointer hits that address. You can disable that security feature though with a compiler option.
DEP is a kernel-level security feature no? Since the kernel is what sets up the .text and .data sections.
Re: Writing my first shellcode
#10Thank your for the article! Really helpful and easy to read. As a novice in assembly, got a few tricks.