Shellcode is essentially a series of carefully crafted commands that can be performed once the code is injected into a running application. Stack and heap-based buffer overflows are the most common way of doing so. It is little lines of code used as the payload in the exploitation of a software vulnerability. It is named “shellcode” because it typically starts a command shell from which the hacker can control the compromised machine.
The term “shellcode” refers to self-contained binary code that performs a task. The task may vary from issuing an operating system command to providing a shell back to the hacker, as was the primary purpose of shellcode.
There are essentially three methods to write shellcode:
– Directly write the hex opcodes.
– Write a program in a high-level language like C or C++, compile it, and then disassemble it to obtain the assembly instructions and hex opcodes.
– Write an assembly program, compile the program, and then extract the hex opcodes from the binary.
Writing the hex opcodes directly is a little hard. You will begin by learning how to program, but quickly move to writing assembly, then to the extraction of the opcodes. In any case, you will require to understand low-level (kernel) functions such as read, write, and execute. Since these system functions are executed at the kernel level, you will require learning a little about how user processes communicate with the kernel.
