Questions about this topic? Sign up to ask in the talk tab.

Shellcode

From NetSec
Revision as of 04:49, 23 March 2012 by MargeryLeddy (Talk | contribs) (adding link for shellcode obfuscation)

Jump to: navigation, search

Shellcode, bytecode, or machine code is represented in hexadecimal. Every programming language eventually becomes binary. Assembly translates to binary machine code. When writing a buffer overflow there are many obstructions from network security, such as DEP, ASLR, firewalls, or SIMS.

c3el4.png This is just one of many shellcoding concepts. Ultimately, the most important concepts are anti-heuristics, shellcode obfuscation, and IDS/IPS/Firewall evasion.

Anti-heuristics:

  • Evading heuristics - evading debuggers, tricking the programmers, attacking debuggers, and evading/attacking virtual machines are all part of this technique. Anti-heuristics rely on the code's ability to protect itself from user, administrator, or even programmer and debugger intervention.

Obfuscation:

  • "Uglifying" one's code - obfuscation includes utilization of polymorphism and metamorphism, and describes anything that makes the code appear to do one thing or hold certain data when in fact the code does something else or holds different data.

IDS/IPS/Firewall Evasion:

  • Evading detection engines is currently best done by using alphanumeric shellcode. Alphanumeric and ascii shellcode appear within standard user-printable data, making your arbitrary code appear as standard user inputted data in stead of malicious machine code. Generally it is hard for an admin to detect that this is actually a payload to begin with.
c3el4.png Machine code can be used by a programmer to write any application with an assembly approach because it is just as powerful as any other programming language.
This article contains too little information, it should be expanded or updated.
Things you can do to help:
  • add more content.
  • update current content.