Shell Four ORW — Open-Read-Write Shellcode with Seccomp

Write open-read-write shellcode to exfiltrate /flag.txt when execve is blocked by a seccomp filter.

January 1, 2025 · 3 min · giordii

Shell One — Minimal Shellcode to Set EAX

Write minimal x86 shellcode that sets EAX to 0x13371338 to satisfy the binary’s check and unlock execution flow.

January 1, 2025 · 2 min · giordii

Generatore Poco Casuale — Shellcode Injection via Leaked Stack Address

The binary leaks a runtime stack address disguised as a ‘random number’. Add 6 to land inside the shellcode region, then spray that address 800 times to cover the return target and get a shell.

January 1, 2024 · 2 min · giordii

readdle — Two-Stage Shellcode via Stub Read Gadget

Inject a 4-byte stub shellcode that calls read to pull a full shell payload into the same buffer, then jump to it — bypassing the initial 4-byte size constraint on the first write.

January 1, 2024 · 2 min · giordii

Secret Vault — Heap Address Leak + Shellcode via Stack Overflow

Trigger a heap allocation that the binary prints, compute the shellcode landing address at heap+96, then overflow the stack with that return address followed by shellcode to get a shell.

January 1, 2024 · 2 min · giordii