Shellcode is a list of carefully crafted instructions that can be executed once the code is injected into a running application. Due to most of the exploit's circumstances, the shellcode must be position-independent code (which means it doesn't need to run in a specific place in memory or require a base relocation table to fix its addresses). Shellcode also has to operate without a PE header or a system loader. For some exploits, it can't include certain bytes (especially null for the overflows of the string-type of buffers).
Now, let's take a look at what this shellcode looks like in Windows and Linux.
