Linux shellcode is generally arranged much simpler than Windows shellcode. Once the instruction pointer is pointing to the shellcode, the shellcode can execute consecutive system calls to spawn a shell, listen on a port, or connect back to the attacker (check Chapter 10, Dissecting Linux and IoT Malware, for more information about system calls in Linux). The main challenges that attackers face are as follows:
- Getting the absolute address of the shellcode (to be able to access data)
- Removing any null byte that can be produced from the shellcode (optional)
Now, we will take a look at how it is possible to overcome these challenges. After this, we will take a look at different types of shellcode.
