How can I learn to form strings in shellcodes?

[yogi4you]

I am completely new to shellcode development. I am fairly good with assembly and C. It contains character string like,

char shellcode[] =
“\x31\xc0\xeb\x13\x5e\x6a\x0f\x56\x6a\x01\xb0\x04\x50\xcd\x80”
“\x31\xc0\x50\x50\xb0\x01\xcd\x80\xe8\xe8\xff\xff\xff\x48\x65”
“\x6c\x6c\x6f\x2c\x20\x77\x6f\x72\x6c\x64\x20\x21\x0a”;

What is it? I don’t seem to understand it. And how can I learn to create it for use. Can you throw some light?

[0x00pf (pico)]

Hi @yogi4you

Check for instance this post:

Remote Exploit. Shellcode without Sockets

In this paper I will present an elegant technique (it’s my opinion, indeed) to get shell access to a vulnerable remote machine. It is not my own technique but I found it very interesting. The focus of this paper is on this technique and not in the way to exploit the vulnerability. Setting your environment So, in order to focus on the remote shell code and not on how to circumvent ASLR, non-executable stacks and so on (that will require lots of writing) we will disable most of these features for…

And this

Linux Shellcoding (Part 1.0)

As promised, here is the shellcode tutorial once again Requirements Alright so this isn’t going to be msfvenom tutorial. (shellcodes are payloads). This tutorial will focus on writing shellcodes using Assembly. Knowledge of C and Assembly is highly recommend. Also knowing how the stack works is a big plus. Memory Segments When a program is run it is loaded in the RAM. Normally 5 segments are used in programs: The stack segment (For function calls (dynamic)). The heap segment (For dynamicly …

The links in this page may also help to understand that string

Books and Sources for Beginners

You certainly seem like somebody who has a realistic view of learning, and will probably go far with your apt attitude. This isn’t a book, but it is very well written and perfect for beginners. Pico’s wannabe articles are perfect. By following these articles, and taking the direction, you can get pretty good pretty fast as long as you have a fairly decent understanding of basic hardware. Good luck! Remember, the IRC has usually always got somebody on, solving problems, or solving…

[yogi4you]

Thanks for the above links. And I’ve read your “Programming for Wannabes” series. It’s brilliant. Please continue that series, it’s been a long time since your last post.

[0x00pf (pico)]

Thanks @yogi4you!. I’m glad to hear you liked the series. I’ve been very busy lately, I’ll try my best to continue the series whenever things calm down.

Also regarding your initial question, there are many different ways to generate the asm out of an hex sequence. rasm2 tool included in radare2 is a powerful solution as it support many differnt architectures (for intel you can also use ndisasm for instance).

Something like this:

echo -e "\x31\xc0\xeb\x13\x5e\x6a\x0f\x56\x6a\x01\xb0\x04\x50\xcd\x80\x31\xc0\x50\x50\xb0\x01\xcd\x80\xe8\xe8\xff\xff\xff\x48\x65\x6c\x6c\x6f\x2c\x20\x77\x6f\x72\x6c\x64\x20\x21\x0a" | rasm2 -d -B -f -
xor eax, eax
jmp 0x17
pop esi
push 0xf
push esi
push 1
mov al, 4
push eax
int 0x80
xor eax, eax
push eax
push eax
mov al, 1
int 0x80
call 4
dec eax
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
sub al, 0x20
ja 0x94
jb 0x93
and byte fs:[ecx], ah
or cl, byte [edx]

The strange opcodes at the end, after call 4 is the Hello World! string