|
|
| (11 intermediate revisions by 3 users not shown) |
| Line 1: |
Line 1: |
| − | Shellcode, bytecode, or [[machine code]] is represented in [http://www.blackhatacademy.org/security101/index.php?title=Assembly_Basics#Binary_.26_Hexadecimal hexadecimal]. Every [[programming language]] eventually becomes [[binary]]. [[Assembly Basics|Assembly]] translates to [[binary]] [[machine code]]. When writing a [[Buffer Overflows|buffer overflow]] there are many obstructions from [[Network Security|network security]], such as [[DEP]], [[ASLR]], [[firewall|firewalls]], or [[SIM|SIMS]].
| + | #REDIRECT [[:Category:Shellcode]] |
| − | | + | [[Category:Indexing]] |
| − | {{info|This is just one of many shellcoding concepts. Ultimately, the most important concepts are [[anti-heuristics]], [[shellcode obfuscation]], and [[IDS]]/[[IPS]]/[[Firewall]] evasion.}}
| + | [[Category:Exploitation]] |
| − | | + | |
| − | '''[[Anti-heuristics]]''':
| + | |
| − | * Evading heuristics - evading debuggers, tricking the [[Programmer|programmers]], attacking debuggers, and evading/attacking virtual machines are all part of this technique. [[Anti-heuristics]] rely on the code's ability to protect itself from user, administrator, or even [[programmer]] and debugger intervention.
| + | |
| − | | + | |
| − | '''[[Shellcode obfuscation |Obfuscation]]''':
| + | |
| − | * "Uglifying" one's code - obfuscation includes utilization of polymorphism and metamorphism, and describes anything that makes the code appear to do one thing or hold certain data when in fact the code does something else or holds different data.
| + | |
| − | | + | |
| − | '''[[IDS]]/[[IPS]]/[[Firewall]] Evasion''':
| + | |
| − | * Evading detection engines is currently best done by using alphanumeric shellcode. Alphanumeric and [[ascii shellcode]] appear within standard user-printable data, making your arbitrary code appear as standard user inputted data in stead of malicious [[machine code]]. Generally it is hard for an admin to detect that this is actually a payload to begin with.
| + | |
| − | | + | |
| − | {{info|[[Machine code]] can be used by a [[programmer]] to write any application with an [[Assembly Basics|assembly]] approach because it is just as powerful as any other [[programming language]]. }}
| + | |
| − | {{cleanup}}
| + | |
| − | {{expand}}
| + | |
