What is Shellcode?

I accidentally saw the shellcode information today. It feels good to share with you.

Shellcode is the core of overflow programs and worms. It is naturally associated with vulnerabilities when mentioned. After all, Shellcode only has no patches.
The host is useful. Tens of thousands of servers running with vulnerabilities on the Network give hacker and Vxer a great dinner. The most critical aspect of vulnerability exploitation is
Write Shellcode. Because the vulnerability discoverer does not provide complete Shellcode at the beginning of the vulnerability discovery, it is obvious to master the Shellcode writing technology.
Especially important.
After some time of practice, the younger brother thought he had little experience with Shellcode, so he wrote it here, and bojun smiled. Please be an expert
Don't hesitate to advise.
What is Shellcode
Here I will briefly talk about What Shellcode is. Shellcode is actually a piece of code (or data filling) that is used to send to the server
The code that exploits a specific vulnerability can generally obtain permissions. In addition, Shellcode is generally sent to the attacked service as data.
Shellcode writing considerations
Shellcode is generally used to send data to the server, causing overflow. Different data has different requirements for data. Therefore, Shellcode is not necessarily the same. However
During the Shellcode writing process, some problems are the same:
The programming language of mongoshellcode.
Which language is best for Shellcode writing? This issue is inconclusive. C language is generally used, which is faster, but ASM is easier to control
Shellcode generation. Is it quick writing or full control? It's hard to answer.
Relocate the mongoshellcode Code itself. Shellcode process control, that is, how to place control in Shellcode through Overflow
. Location of the API address used in Shellcode.
Invalid Shellcode encoding.
The detection polymorphism technology avoids IDS detection.
Now we will study the common methods to solve these problems.
Shellcode compilation technology
Mongoshellcode Programming Language
Shellcode can basically use any programming language, but what we need is to extract the machine code. Shellcode is the most written in assembly language
It is controllable, because we can control code generation through commands. The disadvantage is that it takes a lot of time and you need to have a deep understanding of assembly. If you
C is a good choice to pursue speed. C language is easier to write, but Shellcode extraction is more complex. However, once a template is written
Yes. For example, there is a written template:

Void Shellcode ()
{
_ Asm
{
Nop
Nop
Nop
Nop
Nop
Nop
Nop
Nop
}
}
 

Then, use the function pointer in main () and memcmp to locate shellcode. Use a function such as pintf to type shellcode out or save it. Display
The sample code is omitted. Looking at the current shellcode, most of it is done by C. So I want you to make a choice?
Locate the mongoshellcode address and obtain the EIP of the program.
Why is it necessary to obtain an EIP? The reason is that we need our Shellcode to be executed. If we have knowledge of virus technology, we should know how they are.
Location: CALL/POP is used.
Here we have to mention two methods: jmp esp and CALL/pop ebx. This is a method that people are familiar with windows and has a very high success rate.
High. I believe that my friends who have read the tutorial from Brother Wang should be impressed. Here I will give a brief introduction.
In our method, we overwrite the return address through the Shellcode address. After overflow, we can jump to our code to obtain the permission. Shellcode
The address in the memory is not fixed, so we use the jmp esp, call esp, and call ebp in the system dll file to implement the Shellcode address
. There are two advantages: one is that you do not need to accurately locate the Shellcode address; the other is to prevent strcpy from truncating 00 bytes, because the DLL
The address is generally 7 FXXXXXX. For details, we already have something on the internet. Let's take a look.
Locate the API address in mongoshellcode.
The running environment and virus of the Shellcode code are similar in some aspects. Because of different systems, the Api addresses are also different. Therefore
If Shellcode runs in Different Windows systems, you must solve the problem of locating the Api. The key to API positioning is to understand the Windows DLL image file format, that is, PE
File format, and then obtain the API address through the Export table of the search function. The locating methods include the brute-force search method, which obtains and traverses the SEH chain method from the PEB process. Me
You can obtain it from the PEB process. The sample code is as follows:

_ Asm
{
Push ebp;
Sub esp, 0x40;
Mov ebp, esp;

Push ebp;
Mov eax, fs: 0x30; PEB
Mov eax, [eax + 0x0c]; Ldr
Mov esi, [eax + 0x1c]; Flink
Lodsd
Mov edi, [eax + 0x08]; edi is the address of kernel32.dll

& Nb