{"id":2830,"date":"2010-02-25T17:21:00","date_gmt":"2010-02-25T16:21:00","guid":{"rendered":"http:\/\/www.corelan.be:8800\/?p=2830"},"modified":"2010-02-25T17:21:00","modified_gmt":"2010-02-25T16:21:00","slug":"exploit-writing-tutorial-part-9-introduction-to-win32-shellcoding","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2010\/02\/25\/exploit-writing-tutorial-part-9-introduction-to-win32-shellcoding\/","title":{"rendered":"Exploit writing tutorial part 9 : Introduction to Win32 shellcoding"},"content":{"rendered":"

Over the last couple of months, I have written a set of tutorials about building exploits that target the Windows stack. One of the primary goals of anyone writing an exploit is to modify the normal execution flow of the application and trigger the application to run arbitrary code\u2026 code that is injected by the attacker and that could allow the attacker to take control of the computer running the application.<\/p>\n

This type of code is often called "shellcode", because one of the most used targets of running arbitrary code is to allow an attacker to get access to a remote shell \/ command prompt on the host, which will allow him\/her to take further control of the host. <\/p>\n

While this type of shellcode is still used in a lot of cases, tools such as Metasploit have taken this concept one step further and provide frameworks to make this process easier.  Viewing the desktop, sniffing data from the network, dumping password hashes or using the owned device to attack hosts deeper into the network, are just some examples of what can be done with the Metasploit meterpreter payload\/console. People are creative, that\u2019s for sure\u2026 and that leads to some really nice stuff<\/a>.<\/p>\n

The reality is that all of this is \u201cjust\u201d a variation on what you can do with shellcode.  That is, complex shellcode, staged shellcode, but still shellcode.<\/p>\n

Usually, when people are in the process of building an exploit, they tend to try to use some simple\/small shellcode first, just to prove that they can inject code and get it executed.  The most well known and commonly used example is spawning calc.exe or something like that.  Simple code, short, fast and does not require a lot of set up to work. (In fact, every time Windows calculator pops up on my screen, my wife cheers\u2026 even when I launched calc myself \ud83d\ude42 )<\/p>\n

In order to get a \u201cpop calc\u201d shellcode specimen, most people tend to use the already available shellcode generators in Metasploit, or copy ready made code from other exploits on the net\u2026 just because it\u2019s available and it works.  (Well, I don\u2019t recommend using shellcode that was found on the net for obvious<\/a> reasons<\/a>). Frankly, there\u2019s nothing wrong with Metasploit.  In fact the payloads available in Metasploit are the result of hard work and dedication, sheer craftsmanship by a lot of people. These guys deserve all respect and credits for that. Shellcoding is not just applying techniques, but requires a lot of knowledge, creativity and skills. It is not hard to write shellcode, but it is truly an art to write good shellcode.<\/p>\n

In most cases, the Metasploit (and other publicly available) payloads will be able to fulfill your needs and should allow you to prove your point - that you can own a machine because of a vulnerability.<\/p>\n

Nevertheless, today we\u2019ll look at how you can write your own shellcode and how to get around certain restrictions that may stop the execution of your code (null bytes et al).<\/p>\n

A lot of papers and books have been written on this subject, and some really excellent websites are dedicated to the subject. But since I want to make this tutorial series as complete as possible, I decided to combine some of that information, throw in my 2 cents, and write my own \u201cintroduction to win32 shellcoding\u201d. <\/p>\n

I think it is really important for exploit builders to understand what it takes to build good shellcode. The goal is not to tell people to write their own shellcode, but rather to understand how shellcode works (knowledge that may come handy if you need to figure out why certain shellcode does not work) , and write their own if there is a specific need for certain shellcode functionality, or modify existing shellcode if required.<\/p>\n

This paper will only cover existing concepts, allowing you to understand what it takes to build and use custom shellcode\u2026 it does not contain any new techniques or new types of shellcode - but I\u2019m sure you don\u2019t mind at this point.<\/p>\n

If you want to read other papers about shellcoding, check out the following links :<\/p>\n