Tag Archives: x86

Windows Process Injection: EM_GETHANDLE, WM_PASTE and EM_SETWORDBREAKPROC

Introduction Edit Controls Writing CP-1252 Compatible Code Initialization Set RAX to 0 Set RAX to 1 Set RAX to -1 Load and Store Data Two Byte Instructions Prefix Codes Generating Shellcode Injecting and Executing Demonstration Encoding Arbitrary Data Encoding Decoding … Continue reading

Posted in assembly, injection, process injection, programming, redteam, security, shellcode, windows | Tagged , , , , | 3 Comments

Shellcode: In-Memory Execution of JavaScript, VBScript, JScript and XSL

Introduction A DynaCall() Function for Win32 was published in the August 1998 edition of Dr.Dobbs Journal. The author, Ton Plooy, provided a function in C that allows an interpreted language such as VBScript to call external DLL functions via a … Continue reading

Posted in assembly, programming, security, shellcode, windows | Tagged , , , , , , , | Leave a comment

Shellcode: Using the Exception Directory to find GetProcAddress

Introduction Let’s say you want the location of the GetProcAddress API in memory, but you can’t use the Import Address Table (IAT) or the Export Address Table (EAT). What other ways can you do it?. Perhaps there are many ways, … Continue reading

Posted in assembly, programming, security, shellcode, windows | Tagged , , , , , | 3 Comments

Shellcode: Encrypting traffic

Introduction This will be a quick post on using encryption in a Position Independent Code (PIC) that communicates over TCP. I’ll be using the synchronous shells for Linux as examples, so just to recap, read the following posts for more … Continue reading

Posted in arm, assembly, cryptography, linux, programming, security, shellcode | Tagged , , , | 1 Comment

Shellcode: Synchronous shell for Linux in x86 assembly

Introduction Nowadays, most systems running on the x86 architecture take full advantage of AMD64 or INTEL64 extensions to increase performance, so I realize some of you will be disappointed this isn’t written in amd64 assembly. There will be a follow … Continue reading

Posted in assembly, linux, security, shellcode | Tagged , , , | 3 Comments

Shellcode: A Tweetable Reverse Shell for x86 Windows

Introduction Since being granted a 280 character limit, many twitter users have been embedding all kinds of code into a single message. This will be a quick post showing a tweetable reverse shell for x86 windows. You’ll have to forgive … Continue reading

Posted in assembly, programming, security, shellcode, windows | Tagged , , , , , | Leave a comment

Shellcode: x86 optimizations part 1

Introduction What follows are a number of basic ways to compact shellcodes. In a follow up post, I’ll discuss a few ways to obfuscate them which might be useful for evading signature detection algorithms. Some of the examples illustrated here … Continue reading

Posted in assembly, programming, shellcode | Tagged , , , , | Leave a comment

Shellcode: Dual Mode (x86 + amd64) Linux shellcode

Introduction Someone asked me recently what do you mean by “dual mode shellcode”? and it seems the wording is slightly ambiguous to those unfamiliar with the different operating modes of a CPU like x86 so I just wanted to clarify … Continue reading

Posted in assembly, linux, programming, security, shellcode | Tagged , , , , , | Leave a comment

Shellcode: Fido and how it resolves GetProcAddress and LoadLibraryA

Introduction A tool to modify existing metasploit payloads for windows called Fido was recently published by Joshua Pitts, the author of Backdoor Factory. Fido will strip this assembly code responsible for resolving API addresses in the export directory and replace … Continue reading

Posted in assembly, programming, security, shellcode, windows | Tagged , , , , , , , , | 1 Comment

Shellcode: Dual mode PIC for x86 (Reverse and Bind Shells for Windows)

Introduction In a nutshell, we’re mixing 32 and 64-bit x86 opcodes so that regardless of the operating system mode (legacy or long), our Position Independent Code (PIC) will still execute successfully. Although some of the code requires conditional jumps, we … Continue reading

Posted in assembly, programming, security, shellcode, windows | Tagged , , , , , | 1 Comment