Forums: Windows Shellcode - Forums

Jump to content

  • (2 Pages)
  • +
  • 1
  • 2
  • You cannot start a new topic
  • You cannot reply to this topic

Windows Shellcode

#1 User is offline   Codecfault 

  • Private
  • Icon
  • Group: Members
  • Posts: 18
  • Joined: 13-September 03

Posted 22 October 2003 - 11:19 PM

Does anyone know the whereabouts of any info on how to write shellcode for windows. I am looking to understand how various exploits work and hopefully to write my own.

Thank you for your time

Codecfault
0

#2 User is offline   pr0t0type 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 104
  • Joined: 21-October 03

Posted 23 October 2003 - 04:16 AM

Been trying to learn myself. I posted a good into into into buffer overflows in the sticky above and I've found this article to be really helpfull. I'd be interested if anyones got anmy good asm tuts :)
0

#3 User is offline   Codecfault 

  • Private
  • Icon
  • Group: Members
  • Posts: 18
  • Joined: 13-September 03

Posted 23 October 2003 - 10:09 PM

great link thanks pr0t0type
0

#4 User is offline   SLiM577 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 83
  • Joined: 30-November 03

Posted 06 December 2003 - 11:20 AM

thanks alot guys im also trying to learn to code /etc
0

#5 User is offline   nazinofix 

  • Private
  • Icon
  • Group: Members
  • Posts: 4
  • Joined: 19-December 03

Posted 19 December 2003 - 10:03 PM

http://www.hick.org/...2-shellcode.pdf
0

#6 User is offline   Buluemoon 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 116
  • Joined: 18-December 03

Posted 25 December 2003 - 01:53 PM

Thanks to all who posted links on this subject, the last 2 look very useful, and have to go and read them, been looking around but never saw these.
0

#7 User is offline   Codecfault 

  • Private
  • Icon
  • Group: Members
  • Posts: 18
  • Joined: 13-September 03

Posted 27 December 2003 - 09:28 PM

thanks a lot nazinofix great link
0

#8 User is offline   skorpio 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 47
  • Joined: 15-December 03

Posted 28 December 2003 - 04:55 AM

thx nazinofix
very interesting link :)

byee
0

#9 Guest_[_0z_]_*

  • Group: Guests

Posted 07 January 2004 - 08:15 AM

great work.
0

#10 Guest_Hexboy_*

  • Group: Guests

Posted 07 January 2004 - 05:49 PM

http://www.shellcode.com.ar has some windows shell code. I've learned a few sweet tricks from code available there.
0

#11 User is offline   BillyJawz 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 31
  • Joined: 03-January 04

Posted 09 January 2004 - 12:30 PM

http://www.cs.fit.ed.../cs-2002-12.pdf

W32 buffer overflow froma A to Z .
0

#12 User is offline   nipagini 

  • Private
  • Icon
  • Group: Members
  • Posts: 11
  • Joined: 16-August 03

Posted 08 February 2004 - 11:22 AM

wow thx m8!!! that's a realy good documentation about buffer overflows!!
0

#13 User is offline   riotz 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 116
  • Joined: 03-February 04

Posted 10 February 2004 - 08:30 AM

these 2 pdfs are a real nice reading..
thnx for shaing :)
0

#14 Guest_archphase_*

  • Group: Guests

Posted 10 February 2004 - 02:11 PM

Windows shellcode is a bitch too write. All of those win32 shellcode papers show how to get it by SEH or you can get it by using the TEB block i think or whatever is at fs:[30]..but i think the more code efficent way is like this..or atleast i think it is.

mov ebx, ebp
mov eax, esp
sub eax, ebx; eax = amount of bytes on stack
mov ecx, [esp+eax]; ecx = somewhere in k32..search

loopme:
cmp word ptr [ecx], 'M' + 'Z'
jz foundMZ
dec ecx
jmp loopme

foundMZ:
nop; found if we find mz header.


I think that'll work on a typicall vc++ app which builds the stack frame..just an idea.
0

#15 User is offline   nazinofix 

  • Private
  • Icon
  • Group: Members
  • Posts: 4
  • Joined: 19-December 03

Posted 11 February 2004 - 06:20 PM

The 'Understanding Windows Shellcode' paper cited earlier in this thread covers the technique of walking down in increments of 16 pages (64KB) to locate the MZ header associated with kernel32 by taking an address that is known to be inside kernel32. It applies this technique with both walking the SEH list to the last handler as well as using a known offset from the top of the stack which is in the TEB. The latter ends up being about 25 bytes all told. Is this what you're describing?
0
  • (2 Pages)
  • +
  • 1
  • 2
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users

  • Share



Our Sponsors:


SwiftLayer Affiliate Web Hosting