Words of Wisdom:

"There is no I in team, but there is a ME and that is what this team is all about. Holla" - Mycochina

Win 32

  • Date Submitted: 02/14/2012 04:50 PM
  • Flesch-Kincaid Score: 74.6 
  • Words: 20989
  • Essay Grade: no grades
  • Report this Essay
http://www.nologin.org

Understanding Windows Shellcode

skape mmiller@hick.org Last modified: 12/06/2003

Contents
1 Foreword 2 Introduction 3 Shellcode Basics 3.1 System Calls . . . . . . . . . . . . . 3.2 Finding kernel32.dll . . . . . . . . . 3.2.1 PEB . . . . . . . . . . . . . . 3.2.2 SEH . . . . . . . . . . . . . . 3.2.3 TOPSTACK . . . . . . . . . 3.3 Resolving Symbol Addresses . . . . . 3.3.1 Export Directory Table . . . 3.3.2 Import Address Table (IAT) 3 4 5 6 6 7 9 10 11 11 13

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

. . . . . . . .

4 Common Shellcode 15 4.1 Connectback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.2 Portbind . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 5 Advanced Shellcode 29 5.1 Download/Execute . . . . . . . . . . . . . . . . . . . . . . . . . . 29 6 Staged Loading Shellcode 6.1 Dynamic File Descriptor Re-use 6.2 Static File Descriptor Re-use . 6.3 Egghunt . . . . . . . . . . . . . 6.4 Egghunt (syscall) . . . . . . . . 6.5 Connectback IAT . . . . . . . . 7 Conclusion 8 Detailed Shellcode Analysis 8.1 Finding kernel32.dll . . . 8.1.1 PEB . . . . . . . . 8.1.2 SEH . . . . . . . . 8.1.3 TOPSTACK . . . 39 39 42 43 44 46 49 50 50 50 51 53

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

1

8.2 8.3

8.4 8.5...

Comments

Express your owns thoughts and ideas on this essay by writing a grade and/or critique.

  1. No comments