RE: Shellcode

["Dave Korn" <dave.korn () artimi com>]

halvar () gmx de wrote:
> On a related note:
>
> why do we care about small bindshells any more ? It's not 2001/2002 (or
> earlier)
> any more, and "read/exec" stubs would make a lot more sense.

  Heh.  Even when it /was/ 2001, ...

http://groups.google.co.uk/group/alt.hackers.malicious/browse_thread/thread/4a
dad768f719457a/f23c5598c93852f0?lnk=st&rnum=5&hl=en#f23c5598c93852f0


[  Interesting features about shellcode: no need to lookup any exports, finds
and reuses existing connection, could have been _vastly_ smaller than it is
but hey it was the first time I'd ever written x86 assembler....  ]

  IIS 'sploitation is a beaut :-)  It could have been *made* for read/exec
techniques!

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....