Welcome to Scribd, the world's digital library. Read, publish, and share books and documents. See more
Download
Standard view
Full view
of .
Look up keyword
Like this
2Activity
0 of .
Results for:
No results containing your search query
P. 1
win32-shellcode

win32-shellcode

Ratings: (0)|Views: 96 |Likes:
Published by Lee Gao

More info:

Published by: Lee Gao on Aug 08, 2011
Copyright:Attribution Non-commercial

Availability:

Read on Scribd mobile: iPhone, iPad and Android.
download as PDF, TXT or read online from Scribd
See more
See less

07/28/2012

pdf

text

original

 
Understanding Windows Shellcode
skapemmiller@hick.org
Last modified: 12/06/2003 
 
Contents
3.1 System Calls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63.2 Finding kernel32.dll. . . . . . . . . . . . . . . . . . . . . . . . . 63.2.1 PEB. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73.2.2 SEH. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83.2.3 TOPSTACK. . . . . . . . . . . . . . . . . . . . . . . . . 103.3 Resolving Symbol Addresses. . . . . . . . . . . . . . . . . . . . . 113.3.1 Export Directory Table. . . . . . . . . . . . . . . . . . . 113.3.2 Import Address Table (IAT). . . . . . . . . . . . . . . . 13
4.1 Connectback. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144.2 Portbind. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.1 Download/Execute. . . . . . . . . . . . . . . . . . . . . . . . . . 27
6.1 Dynamic File Descriptor Re-use. . . . . . . . . . . . . . . . . . . 376.2 Static File Descriptor Re-use. . . . . . . . . . . . . . . . . . . . 406.3 Egghunt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406.4 Egghunt (syscall). . . . . . . . . . . . . . . . . . . . . . . . . . . 426.5 Connectback IAT. . . . . . . . . . . . . . . . . . . . . . . . . . . 44
8.1 Finding kernel32.dll. . . . . . . . . . . . . . . . . . . . . . . . . 488.1.1 PEB. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488.1.2 SEH. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498.1.3 TOPSTACK. . . . . . . . . . . . . . . . . . . . . . . . . 501
 
8.2 Resolving Symbol Addresses. . . . . . . . . . . . . . . . . . . . . 518.2.1 Export Table Enumeration. . . . . . . . . . . . . . . . . 518.3 Common Shellcode. . . . . . . . . . . . . . . . . . . . . . . . . . 548.3.1 Connectback. . . . . . . . . . . . . . . . . . . . . . . . . 548.3.2 Portbind. . . . . . . . . . . . . . . . . . . . . . . . . . . . 618.4 Advanced Shellcode. . . . . . . . . . . . . . . . . . . . . . . . . 698.4.1 Download/Execute. . . . . . . . . . . . . . . . . . . . . . 698.5 Staged Loading Shellcode. . . . . . . . . . . . . . . . . . . . . . 798.5.1 Dynamic File Descriptor Re-use. . . . . . . . . . . . . . 798.5.2 Egghunt. . . . . . . . . . . . . . . . . . . . . . . . . . . . 838.5.3 Egghunt (syscall). . . . . . . . . . . . . . . . . . . . . . . 868.5.4 Connectback IAT. . . . . . . . . . . . . . . . . . . . . . . 872

You're Reading a Free Preview

Download
scribd
/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->