Shellcode Decoding - HeapOverflow Computer Security Community & Forums : Heap Overflow.com

HeapOverflow Computer Security Community & Forums : Heap Overflow.com

		HeapOverflow Computer Security Community & Forums : Heap Overflow.com > Computer Security: Discussions > Programming
Shellcode Decoding

Mark Forums Read

Notices

Welcome to you visitor! This community is mainly dedicated to the computer and security, if you're looking for DFind scanner or others exploits codes you will find them into the Projects section, feel free to start Blogging and remember to always keep an eye and start talking about security Advisories & public Exploits.

Programming Discuss about the various programming languages (HTLM/PHP/ASP/C#/C++/Java etc..)

Shellcode Decoding

This is a discussion on "Shellcode Decoding" within the Programming part of the Computer Security: Discussions section; Dudes, I need your hand. I'd like to know some more infos about Shellcode decoding (tools, websites, papers) because I found out that I dunno much about it. If you could point me out to links or tools regarding ...

Reply

Page 1 of 2

1

#1 (permalink)

Old

19-12-05

Yog-Sotho is offline

Member

Join Date: Jul 2005

Location: Italy

Posts: 62

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 17

Yog-Sotho is on a distinguished road

Default

Shellcode Decoding

Dudes, I need your hand.

I'd like to know some more infos about Shellcode decoding (tools, websites, papers) because I found out that I dunno much about it.

If you could point me out to links or tools regarding this subject, I'would be very grateful.

Tnx in advance!

Yog

Reply With Quote

Sponsor

Advertiser

#2 (permalink)

Old

19-12-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

I have some nice resource here helping to understand how to quickly test shellcodes in a C code, how to build shellcodes from a C code , etc , very interesting work which I thank all respective owner. Follow links section dude..

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#3 (permalink)

Old

19-12-05

Yog-Sotho is offline

Member

Join Date: Jul 2005

Location: Italy

Posts: 62

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 17

Yog-Sotho is on a distinguished road

Default

Tnx

Yep, I've already tried to look into the recent submissions but I couldnt find a tool nor a paper describing exactly Shellcode decoding.

That's why I asked in a new topic.

If you could be so kind to just point me a couple of links.....

Tnx classy boy!

Yog

Reply With Quote

#4 (permalink)

Old

19-12-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

best way I think is to compile the shellcode into an executable binary (win32) , then with a debugger and vmware , you follow the execution steps at steps. This is the best approach I think when you do not remember all asm hardcoded functions (wich is normal)

my shellcode collection

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#5 (permalink)

Old

19-12-05

Yog-Sotho is offline

Member

Join Date: Jul 2005

Location: Italy

Posts: 62

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 17

Yog-Sotho is on a distinguished road

Default

You're the man!

Tnx dear friend!

The Links you provides are nice and I'm eating (reading) stuff like I was starving!!

ehhehehe

One last thing:

I remember there was a nice website which was decoding a shellcode into ASCII characters. Is this a good way to "translate" a shellcode?

Tnx
Yog

Reply With Quote

#6 (permalink)

Old

19-12-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

dont think nop , maybe to recognize quickly how his or by who is wrote the shellcode , as the metasploit ones you can recognize them cos they start often with the same header but else dont think nop

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#7 (permalink)

Old

08-02-06

touk

Guest

Posts: n/a

Default

Quote:

Originally Posted by class101

best way I think is to compile the shellcode into an executable binary (win32) , then with a debugger and vmware , you follow the execution steps at steps. This is the best approach I think when you do not remember all asm hardcoded functions (wich is normal)

my shellcode collection

I agree, the best way to see what is doing a sc is to execute it

but how do you turn an HEX string into something compilable ? Or maybe should i ask, with what do you compile a SC ?

Reply With Quote

#8 (permalink)

Old

08-02-06

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

Code:

char shellcode[] = 
"\x29\xC9\x83\xE9\xDA\xD9\xEE\xD9\x74\x24\xF4\x5B\x81\x73\x13\xD0"
"\x8A\x32\xF3\x83\xEB\xFC\xE2\xF4\x2C\x62\x76\xF3\xD0\x8A\xB9\xB6"
"\xEC\x01\x4E\xF6\xA8\x8B\xDD\x78\x9F\x92\xB9\xAC\xF0\x8B\xD9\xBA"
"\x5B\xBE\xB9\xF2\x3E\xBB\xF2\x6A\x7C\x0E\xF2\x87\xD7\x4B\xF8\xFE"
"\xD1\x48\xD9\x07\xEB\xDE\x16\xF7\xA5\x6F\xB9\xAC\xF4\x8B\xD9\x95"
"\x5B\x86\x79\x78\x8F\x96\x33\x18\x5B\x96\xB9\xF2\x3B\x03\x6E\xD7"
"\xD4\x49\x03\x33\xB4\x01\x72\xC3\x55\x4A\x4A\xFF\x5B\xCA\x3E\x78"
"\xA0\x96\x9F\x78\xB8\x82\xD9\xFA\x5B\x0A\x82\xF3\xD0\x8A\xB9\x9B"
"\xEC\xD5\x03\x05\xB0\xDC\xBB\x0B\x53\x4A\x49\xA3\xB8\xF4\xEA\x11"
"\xA3\xE2\xAA\x0D\x5A\x84\x65\x0C\x37\xE9\x5F\x97\xFE\xEF\x4A\x96"
"\xF0\xA5\x51\xD3\xA2\xEF\x55\x96\xB4\xE3\x46\xDD\xB5\xF2\x57\xF3";

void main() 
{ 
    int (*exec)()=(int(*)())&shellcode;
    exec();
}

the exe will run regedit.exe

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#9 (permalink)

Old

09-02-06

touk

Guest

Posts: n/a

Default

Quote:

Originally Posted by class101

Code:

char shellcode[] = 
"\x29\xC9\x83\xE9\xDA\xD9\xEE\xD9\x74\x24\xF4\x5B\x81\x73\x13\xD0"
"\x8A\x32\xF3\x83\xEB\xFC\xE2\xF4\x2C\x62\x76\xF3\xD0\x8A\xB9\xB6"
"\xEC\x01\x4E\xF6\xA8\x8B\xDD\x78\x9F\x92\xB9\xAC\xF0\x8B\xD9\xBA"
"\x5B\xBE\xB9\xF2\x3E\xBB\xF2\x6A\x7C\x0E\xF2\x87\xD7\x4B\xF8\xFE"
"\xD1\x48\xD9\x07\xEB\xDE\x16\xF7\xA5\x6F\xB9\xAC\xF4\x8B\xD9\x95"
"\x5B\x86\x79\x78\x8F\x96\x33\x18\x5B\x96\xB9\xF2\x3B\x03\x6E\xD7"
"\xD4\x49\x03\x33\xB4\x01\x72\xC3\x55\x4A\x4A\xFF\x5B\xCA\x3E\x78"
"\xA0\x96\x9F\x78\xB8\x82\xD9\xFA\x5B\x0A\x82\xF3\xD0\x8A\xB9\x9B"
"\xEC\xD5\x03\x05\xB0\xDC\xBB\x0B\x53\x4A\x49\xA3\xB8\xF4\xEA\x11"
"\xA3\xE2\xAA\x0D\x5A\x84\x65\x0C\x37\xE9\x5F\x97\xFE\xEF\x4A\x96"
"\xF0\xA5\x51\xD3\xA2\xEF\x55\x96\xB4\xE3\x46\xDD\xB5\xF2\x57\xF3";

void main() 
{ 
    int (*exec)()=(int(*)())&shellcode;
    exec();
}

the exe will run regedit.exe

OK !! So basically I can execute any char* with the exec function and attach my process to a debugger like ollydbg or another one to see what is going on. Fine, thanks for your fast reply Im gonna play a bit

Reply With Quote

#10 (permalink)

Old

09-02-06

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 6 Times in 6 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

btw you can read these papers so helping to understand shellcoding.

my papers collection
my shellcode collection

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

Sponsor

Advertiser

Reply

Page 1 of 2

1

Tags
decoding, shellcode

« how to add an exploit in metasploit? | some functions[C/C++] »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
linux shellcode	fl0 fl0w	Programming	0	27-12-07 11:59
IIS 5.0 WebDAV ntdll.dll Overflow Exploit	touk	Public	9	20-03-06 11:03
my shellcode collection	class101	Shared Links	0	19-12-05 10:19
generating shellcode	h3llfyr3	Hacking	4	30-10-05 07:24
GetPC shellcode for WinXPSP1?	w4terlime	Hacking	2	26-07-05 05:48

heapoverflow.com - SEOmeter SEO tools

Locations of visitors to this page

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37