Using MSFvenom to generate shellcode

We already read about MSFvenom and now we will use it again, but this time to generate custom shellcode that we can safely use in a PoC exploit. PoC exploits found online often use a bind shell, have hardcoded IP addresses, or simply open a calculator to prove code execution, which means that they may not fit your needs during a penetration test. For this reason, most of the time we need to replace the shellcode with our own code.

Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called shellcode because most of the time it is used to launch a shell so that the attacker can control the compromised target.

Getting ready

We will start by downloading a PoC I created a while back, which exploits a stack-based buffer overflow vulnerability in the web interface of Disk Sorter Enterprise v9.5.12, caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server...