What is the shell code?

Shellcode is a sequence of machine code or executable instructions that are injected into a computer memory with the intention of taking control of the running program. In such an attack, one of the steps is to get control of the program counter that identifies another instruction to be carried out. The program flow can then be redirected to the inserted code. The canceled machine code is called the useful load on the attack and is an element commonly referred to as the term shellcode. This method has often been used to award the attacker's access by opening the shell command of the operating system, so code injections in general have become known as Shellcode.

Using vulnerability usually includes how the program assigns memory, checks the input data and processes memory errors. Software developers can usually avoid this threat strictly by defining input data and rejecting incorrect values. If they are uncontrolled, the values ​​require more storage space than the Allotted memory for this valuecan be accepted. This causes a safety conclusion called the buffer overflow, where part of the data is written to the memory points adjacent to the assigned value space. With careful handling, this anomaly can allow the introduction of a disturbing code.

Shellcode is usually written in a low -level programming language, such as assembly, C or C ++. Depending on targeted vulnerabilities, however, the same result may be implemented by inserting a code for interpreted scripting language such as Perl or Bytecode for a virtual computer like Java. The code can be implanted before or after the program kidnapping. Thus, the canceled code can be included in the file on the target computer or transmitted via a network connection in real time.

Local exploits Shellcode are designed to provide an attacker over the machine on the Wi.ch he or she has a physical approach. The goal in this case may beFor, for example, creating an account with administrator permissions. Similarly, if the operating process has a high level of privileges, successful exploit would temporarily award the same level of access to the intruder.

processes running on a remote computer can be used using standard network protocols to communicate with the target computer. Connect-back Shellcode instructs the target machine to start connecting to an intruder. If the intruder initiates a connection, the code is called BindShell because it attempts to take control of the network connection called a port on a remote computer. The connection method is more used because firewalls rarely prohibit outgoing connections.