Writing Shellcode in C/C++ | Hacker News Reader

Writing Shellcode in C/C++

expdev.byethost7.com

61 pointskiuhnm18 comments

This site redirects to a malware site called "securesignupoffers". It only appears to do so if your User-Agent looks like a browser, and a quick search suggests that that site attempts to exploit your browser.

It's a server-side redirect, not a script redirect, and searches suggest that it's commonly installed on exploited servers via web server configuration. If the person running the site sees this: check your .htaccess and other web server configuration, and see if your server has been compromised. (Check your browser too.) Might also be a problem with the hosting provider.

Meanwhile, could the submitter or an HN admin please take some steps to prevent exploits of HN readers, such as changing the URL to something innocuous (such as example.org) and posting the original URL in a comment?

My account has been suspended. Unfortunately, being it a free host, my hands are tied.

There are many better hosts; you might try Github (via their .github.io mechanism), or if you're willing to pay a very small amount, something like nfshost.

Can I have some kind of forum in Github?

Please public your tutorial anywhere for now.

First I'll move my website to another free host. If I have problems with that too, I'll turn to a paid host.

In a way or another, I'll manage to publish my course. The best articles are yet to come (EMET and IE)! :)

Looks like you got the "HN hug of death".

FYI, having used byethost for free hosting before, I don't believe "securesignupoffers" itself is malware. It's what accounts which have been suspended or don't have a valid index page redirect to by default.

What happened is that someone set up a bunch of accounts on the host for malware/phishing/spamming/etc., and those URLs were used by malware. The host has rightly deleted those accounts, causing malware which forces the user into visiting the original URL to be taken to securesignupoffers instead.

Officially, my account has been suspended because of the cpu limit. I guess that serving too many pages can do just that.

On Archive.org: https://web.archive.org/web/20150522211938/http://expdev.bye...

This is a fantastic writeup. Do any of you know of other great PoC security articles like this one?

The Corelan exploit development (and other infosec-related) articles: https://www.corelan.be/index.php/articles/

there are quite a lot of shellcode tutorials on the internet (or in bookstores)...

This shellcoder handbook is good...

http://www.amazon.com/Shellcoders-Handbook-Discovering-Explo...

And articles such as this one by steve hanna

http://www.vividmachines.com/shellcode/shellcode.html

and this one by Aleph One on phrack,

http://phrack.org/issues/49/14.html

(by the way, many articles on phrack are really good)

Some more recent versions of smashing the stack are,

http://www.mgraziano.info/docs/stsi2010.pdf

https://paulmakowski.wordpress.com/2011/01/25/smashing-the-s...

also check out the ezines by 29A -- although they are old, but you know, some good stuff are still really good today...

just do a little search...there are tons of articles out there on this topic...

Google has a cached page for this article...

To access the cached copy, just search in google with the "cache" keyword prefix

  "cache:" + ${original_URL}

for example:

  cache:expdev.byethost7.com/2015/05/22/shellcode/

This must be 32b windows ABI; pushing arguments on the stack instead of using registers.

Where can I learn the basics about Windows's internals/kernel?

Windows Internals, Parts 1 and 2 by Mark Russinovich. And the leaked source code of NT4.

Got any links to the leaked source code of the NT4?

It is only a partial Win2K and NT4 leak from Mainsoft (not a typo for Microsoft, Mainsoft leaked it). Kind of hard to find. Check normal piracy sites.

Reply on news.ycombinator.com