Jump to content
  • Advertisement

Archived

This topic is now archived and is closed to further replies.

logout

What is shellcode ?

This topic is 5360 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

If you intended to correct an error in the post then please contact us.

Recommended Posts

Okay i have heard and seen these shellcodes .. like: "\x55" "\x89\xE5\x53\xC6\x45\xFC\x63\xC6\x45\xFD\x6D\xC6\x45\xFE\x64\xC6\x45\xFF\x00\x68" "\x05\x00\x00\x00\x8D\x45\xFC\x50\xB8\xC6\x84\xE6\x77\xFF\xD0\x68\x01\x00\x00\x00" "\xB8\xB5\x5C\xE7\x77\xFF\xD0"; Now I wonder wtf is shellcode ?

Share this post


Link to post
Share on other sites
Advertisement
I didn't know either, so a quick google turns up that shell code is a potential security exploit. That code you've turned up is actually assembler encoded as a C string. If you write that string to a file and disassemble it you get:


PUSH BP
MOV BP,SP
PUSH BX
MOV BYTE PTR [DI-04],63
MOV BYTE PTR [DI-03],6D
MOV BYTE PTR [DI-02],64
MOV BYTE PTR [DI-01],00
DB 68
ADD AX,0000
ADD [DI+FC45],CL
PUSH AX
MOV AX,84C6
OUT 77,AL
CALL AX


(assuming 16bit prefix of course, otherwise the registers will be eax etc.)

What it will actually do depends on the context of where you found it. It could be malicious.

EDIT: Actually the 32bit version makes more sense:


00000000 55 push ebp
00000001 89E5 mov ebp,esp
00000003 53 push ebx
00000004 C645FC63 mov byte [ebp-0x4],0x63
00000008 C645FD6D mov byte [ebp-0x3],0x6d
0000000C C645FE64 mov byte [ebp-0x2],0x64
00000010 C645FF00 mov byte [ebp-0x1],0x0
00000014 6805000000 push dword 0x5
00000019 8D45FC lea eax,[ebp-0x4]
0000001C 50 push eax
0000001D B8C684E677 mov eax,0x77e684c6
00000022 FFD0 call eax
00000024 6801000000 push dword 0x1
00000029 B8B55CE777 mov eax,0x77e75cb5
0000002E FFD0 call eax
00000030 00 db 0x00


[edited by - JuNC on April 10, 2004 11:27:17 AM]

Share this post


Link to post
Share on other sites
Well if you knew assembly youd know that woudlnt you? :-D so go learn it.... and then teach me... please... lol
-Dan

Share this post


Link to post
Share on other sites
Shellcode is exactly what the name says...code to open a shell on the operating system. If someone were trying to gain unauthorized access to a system by using an exploit to execute arbitrary code on that system, what they would most likely want to open is a command shell...hence the shell code.

Share this post


Link to post
Share on other sites
On windows a shell is also known as a command prompt or console window - also colloquially known as a "DOS Box".

Share this post


Link to post
Share on other sites

  • Advertisement
×

Important Information

By using GameDev.net, you agree to our community Guidelines, Terms of Use, and Privacy Policy.

GameDev.net is your game development community. Create an account for your GameDev Portfolio and participate in the largest developer community in the games industry.

Sign me up!