Shellcode in C program
In Demystifying the Execve Shellcode is explained a way to write an execve shellcode:
#include<stdio.h>
#include<string.h>
unsigned char code[] =
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}
What does the line int (*ret)() = (int(*)())code;
do?
Solution 1:
int (*ret)() = (int(*)())code;
~~~~~~~~~~~~ ~~~~~~~~~~~~~~
1 2
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3
It defines
ret
as a pointer to a function which has no parameter()
and returnsint
. So, Those()
indicates the definition of parameters of a function.It's for casting
code
to a pointer to a function which has no parameter()
and returnsint
.Casts
code
as a function and assigns it toret
. After that you can callret();
.
unsigned char code[] = "\x31\xc0\x50\x68\x6e\x2f\...
It is a sequence of machine instructions represented by hex values. It will be injected to the code as a function.
Solution 2:
(*(void(*)())shellcode)()
==
p = (void(*)()) shellcode;
(*p)();