Book Image

Offensive Shellcode from Scratch

By : Rishalin Pillay
5 (1)
Book Image

Offensive Shellcode from Scratch

5 (1)
By: Rishalin Pillay

Overview of this book

Shellcoding is a technique that is executed by many red teams and used in penetration testing and real-world attacks. Books on shellcode can be complex, and writing shellcode is perceived as a kind of "dark art." Offensive Shellcode from Scratch will help you to build a strong foundation of shellcode knowledge and enable you to use it with Linux and Windows. This book helps you to explore simple to more complex examples of shellcode that are used by real advanced persistent threat (APT) groups. You'll get to grips with the components of shellcode and understand which tools are used when building shellcode, along with the automated tools that exist to create shellcode payloads. As you advance through the chapters, you'll become well versed in assembly language and its various components, such as registers, flags, and data types. This shellcode book also teaches you about the compilers and decoders that are used when creating shellcode. Finally, the book takes you through various attacks that entail the use of shellcode in both Windows and Linux environments. By the end of this shellcode book, you'll have gained the knowledge needed to understand the workings of shellcode and build your own exploits by using the concepts explored.
Table of Contents (11 chapters)
1
Section 1: Shellcode
5
Section 2: Writing Shellcode
8
Section 3: Countermeasures and Bypasses

Shellcode techniques

Before we look at the various shellcode techniques within Linux, let's spend some time on system calls (abbreviated as syscalls). Syscalls are the mechanism in which a Linux program calls functions in the kernel. When a program performs a read or a write, it is making use of a syscall, hence syscalls provide an essential interface.

Pro Tip

To view a full list of 64-bit system call numbers, you can run the following command:

cat /usr/include/x86_64-linux-gnu/asm/unistd_64.h

Or if you want to view the 32-bit system call numbers, you can run the following command:

cat /usr/include/x86_64-linux-gnu/asm/unistd_32.h

You can also view this from the tovalds/linux GitHub repository:

https://github.com/torvalds/linux/blob/master/arch/x86/entry/syscalls/syscall_64.tbl

Basic Linux shellcode

To get started with shellcoding in Linux, let's start with the basics. In this section, we will look at shellcode that spawns a bin/bash shell and utilizes...