Shellcode

"Shell code" redirects here. For code written in a shell's command language, see Shell script.
"Alphanumeric executable" redirects here. For executable code presented in hexadecimal format, see Hex file (disambiguation).

In hacking, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode. Because the function of a payload is not limited to merely spawning a shell, some have suggested that the name shellcode is insufficient.[1] However, attempts at replacing the term have not gained wide acceptance. Shellcode is commonly written in machine code.

When creating shellcode, it is generally desirable to make it both small and executable, which allows it to be used in as wide a variety of situations as possible.[2] In assembly code, the same function can be performed in a multitude of ways and there is some variety in the lengths of opcodes that can be used for this purpose; good shellcode writers can put these small opcodes to use to create more compact shellcode.[3] Some have reached the smallest possible size while maintaining stability.[4]

  1. ^ Foster, James C.; Price, Mike (2005-04-12). Sockets, Shellcode, Porting, & Coding: Reverse Engineering Exploits and Tool Coding for Security Professionals. Elsevier Science & Technology Books. ISBN 1-59749-005-9.
  2. ^ Anley, Chris; Koziol, Jack (2007). The shellcoder's handbook: discovering and exploiting security holes (2 ed.). Indianapolis, Indiana, UA: Wiley. ISBN 978-0-470-19882-7. OCLC 173682537.
  3. ^ Foster, James C. (2005). Buffer overflow attacks: detect, exploit, prevent. Rockland, MA, USA: Syngress. ISBN 1-59749-022-9. OCLC 57566682.
  4. ^ "Tiny Execve sh - Assembly Language - Linux/x86". GitHub. Retrieved 2021-02-01.