Repository navigation
Expand file tree
/
Copy pathshellcode1.html
More file actions
88 lines (66 loc) · 4.94 KB
/
Copy pathshellcode1.html
File metadata and controls
88 lines (66 loc) · 4.94 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<meta name="resource-type" content="document" />
<meta name="keywords" content="kernel,panic,OpenBSD,Linux,shellcode,x86,IA32,intel,security,docs" />
<meta name="distribution" content="global" />
<meta name="author" content="Daniele Mazzocchio" />
<meta name="copyright" content="This document copyright 2005-2006 by Kernel-Panic.it." />
<title>Writing shellcode for Linux and *BSD - Introduction</title>
<link rel="stylesheet" type="text/css" href="../../css/docs.css" />
<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />
</head>
<body>
<div class="navigation">
<ul>
<li class="prev"><a class="nav-list" href="index.html"><span>Previous</span></a></li>
<li class="up"><a class="nav-list" href="../../security.html"><span>Up</span></a></li>
<li class="next"><a class="nav-list" href="shellcode2.html"><span>Next</span></a></li>
<li class="home"><a class="nav-list" href="../../index.html"><span>Home</span></a></li>
</ul>
<h3>Writing shellcode for Linux and *BSD</h3>
<div>Previous: <a href="index.html">Table of contents</a>
Up: <a href="../../security.html">Security</a>
Next: <a href="shellcode2.html">2. Linux system calls</a>
</div>
</div>
<hr />
<h2>1. Introduction</h2>
<p>A <dfn>shellcode</dfn> is a sequence of machine language instructions which an already-running program can be forced to execute by altering its execution flow through software vulnerabilities (e.g. <dfn>stack overflow</dfn>, <dfn>heap overflow</dfn> or <dfn>format strings</dfn>). In other words, it is the notorious <dfn>arbitrary code</dfn> which can be run on systems affected by specific vulnerabilities. Tipically, a shellcode looks like:</p>
<div class="code">
<pre>
char shellcode[] = "\xeb\x18\x5e\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46"
"\x0c\xb0\x0b\x8d\x1e\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
"\xe8\xe3\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";
</pre>
</div>
<p>that is a sequence of binary bytes (machine language).</p>
<p>The purpose of this document is to introduce some of the most widespread techniques for writing shellcode for Linux and *BSD systems running on the IA-32 (x86) architecture.</p>
<p>You may wonder why you should learn anything about writing shellcode, since you can find a lot of ready-to-use shellcodes on the internet (after all, that's what "copy and paste" is for). Anyway, I think there are at least two good reasons:</p>
<ol>
<li>first of all, it's always a good idea to analyse someone else's shellcode before executing it, just to know what's going to happen and to avoid bad surprises (we will discuss this <a href="shellcode6.html">later</a> in detail);</li>
<li>besides this, keep in mind that the shellcode may have to run in the most diverse environments (input filtering, string manipulation, IDS...) and, therefore, you should be able to modify it accordingly.</li>
</ol>
<p>A good knowledge of IA-32 assembly programming is assumed, since we won't dwell much on strictly programming topics, such as the use of registers, memory addressing or calling conventions.</p>
<p>Anyway, the <a href="shellcode7.html">appendix</a> provides a short bibliography useful to anyone who wants to learn the basics of assembly programming or just to refresh one's memory. Last, a little knowledge of Linux, *BSD and C can be helpful...</p>
<hr />
<div class="navigation">
<ul>
<li class="prev"><a class="nav-list" href="index.html"><span>Previous</span></a></li>
<li class="up"><a class="nav-list" href="../../security.html"><span>Up</span></a></li>
<li class="next"><a class="nav-list" href="shellcode2.html"><span>Next</span></a></li>
<li class="home"><a class="nav-list" href="../../index.html"><span>Home</span></a></li>
</ul>
<h3>Writing shellcode for Linux and *BSD</h3>
<div>Previous: <a href="index.html">Table of contents</a>
Up: <a href="../../security.html">Security</a>
Next: <a href="shellcode2.html">2. Linux system calls</a>
</div>
</div>
<script type="text/javascript">var sc_project=873554, sc_invisible=1, sc_partition=7, sc_security="03daa6ce";</script>
<script type="text/javascript" src="http://www.statcounter.com/counter/counter_xhtml.js"></script>
<noscript><div class="statcounter"><a class="statcounter" href="http://www.statcounter.com/"><img class="statcounter" src="http://c8.statcounter.com/counter.php?sc_project=873554&java=0&security=03daa6ce&invisible=1" alt="counter" /></a></div></noscript>
</body>
</html>