Buffer Overflow

Question 1

Local Shellcode

Answer 1

• used to exploit local processes in order to privesc

Question 2

Remote Shellcode

Answer 2

• sent through the network along with an exploit
• the exploit will allow the shellcode to be injected into the process and executed
• goal is to provide remote access to the exploited machine

Question 3

What are the types of Remote Shellcode?

Answer 3

• connect back
• bind shell
• socket reuse

Question 4

Connect Back

Answer 4

• shellcode initiates a connection back to the attacker’s machine

Question 5

Bind Shell

Answer 5

• shellcode binds a shell (or command prompt) to a certain port on which the attacker can connect

Question 6

Socket Reuse

Answer 6

• establishes a connection to a vulnerable process that does not close before the shellcode is run
• the shellcode can then re-use this connection to communicate with the attacker
• generally not used due to complexity

Question 7

Staged Shellcode

Answer 7

• used when the shellcode size is bigger than the space that an attacker can use for injections (within the process)
• small piece of shellcode (stage 1) is executed
• this code then fetches a larger piece of shellcode (stage 2) into the process memory and executes it

Question 8

Egg-hunt Shellcode

Answer 8

• used when a larger shellcode can be injected into the process but, it is unknown where in the process this shellcode will be actually injected
• divided into 2 pieces:
  1. a small shellcode (egg-hunter)
  2. bigger shellcode (egg)
• the only thing the egg-hunter has to do is search for the Egg within the process address space
• at that point, the execution of the bigger shellcode (Egg) begins

Question 9

Omelet Shellcode

Answer 9

• similar to Egg-hunt, but we do not have one larger shellcode (the egg)
• instead we have smaller eggs (shellcodes)
• they are combined together and executed
• used to avoid shellcode detectors

Question 10

NULL characters

Answer 10

• C language string functions work until a NULL (0 byte) is found
• if shellcode contains a NULL character, it will fail
• shellcode should be Null-free to guarantee the execution

Question 11

Encoding Shellcode

Answer 11

• replacing machine instructions containing zeroes, with instructions that do not contain the zeroes, but achieve the same tasks
• results in machine code that is NULL free