Writing Shellcode in C/C++

http://expdev.byethost7.com/2015/05/22/shellcode/

by kiuhnm • 11 years ago

61 18 11 years ago

expdev.byethost7.com

jaytaylor• 11 years ago

This is a fantastic writeup. Do any of you know of other great PoC security articles like this one?

vezzy-fnord• 11 years ago

The Corelan exploit development (and other infosec-related) articles: https://www.corelan.be/index.php/articles/

2510c39011c52• 11 years ago

there are quite a lot of shellcode tutorials on the internet (or in bookstores)...

This shellcoder handbook is good...

http://www.amazon.com/Shellcoders-Handbook-Discovering-Explo...

And articles such as this one by steve hanna

http://www.vividmachines.com/shellcode/shellcode.html

and this one by Aleph One on phrack,

http://phrack.org/issues/49/14.html

(by the way, many articles on phrack are really good)

Some more recent versions of smashing the stack are,

http://www.mgraziano.info/docs/stsi2010.pdf

https://paulmakowski.wordpress.com/2011/01/25/smashing-the-s...

also check out the ezines by 29A -- although they are old, but you know, some good stuff are still really good today...

just do a little search...there are tons of articles out there on this topic...

pizza• 11 years ago

Where can I learn the basics about Windows's internals/kernel?

conductor• 11 years ago

Windows Internals, Parts 1 and 2 by Mark Russinovich. And the leaked source code of NT4.

JamalSmalls• 11 years ago

Got any links to the leaked source code of the NT4?

ndesaulniers• 11 years ago

This must be 32b windows ABI; pushing arguments on the stack instead of using registers.

JoshTriplett2• 11 years ago

This site redirects to a malware site called "securesignupoffers". It only appears to do so if your User-Agent looks like a browser, and a quick search suggests that that site attempts to exploit your browser.

It's a server-side redirect, not a script redirect, and searches suggest that it's commonly installed on exploited servers via web server configuration. If the person running the site sees this: check your .htaccess and other web server configuration, and see if your server has been compromised. (Check your browser too.) Might also be a problem with the hosting provider.

Meanwhile, could the submitter or an HN admin please take some steps to prevent exploits of HN readers, such as changing the URL to something innocuous (such as example.org) and posting the original URL in a comment?

kiuhnm4• 11 years ago

My account has been suspended. Unfortunately, being it a free host, my hands are tied.

JoshTriplett2• 11 years ago

There are many better hosts; you might try Github (via their .github.io mechanism), or if you're willing to pay a very small amount, something like nfshost.

AlexNeoNomad• 11 years ago

Please public your tutorial anywhere for now.

userbinator• 11 years ago

Looks like you got the "HN hug of death".

FYI, having used byethost for free hosting before, I don't believe "securesignupoffers" itself is malware. It's what accounts which have been suspended or don't have a valid index page redirect to by default.

What happened is that someone set up a bunch of accounts on the host for malware/phishing/spamming/etc., and those URLs were used by malware. The host has rightly deleted those accounts, causing malware which forces the user into visiting the original URL to be taken to securesignupoffers instead.

2510c39011c52• 11 years ago

Google has a cached page for this article...

To access the cached copy, just search in google with the "cache" keyword prefix

  "cache:" + ${original_URL}

for example:

  cache:expdev.byethost7.com/2015/05/22/shellcode/

yoha• 11 years ago

On Archive.org: https://web.archive.org/web/20150522211938/http://expdev.bye...

Writing Shellcode in C/C++

Related Stories