Getting the Kernel32.dll's ImageBase

Kernel32.dll is the main DLL that's used by shellcodes. It has APIs such as LoadLibrary, that allows you to load other libraries, and GetProcAddress, which gets the address of any API inside a library that's loaded in memory.

To access any API inside any DLL, the shellcode must get the address of the kernel32.dll and parse its export table.

When an application is being loaded into memory, the Windows OS loads its core libraries, such as kernel32.dll and ntdll.dll, and saves the addresses and other information of these libraries inside the Process Environment Block (PEB). The shellcode can retrieve the address of kernel32.dll from the PEB as follows:

mov eax,dword ptr fs:[30h]
mov eax,dword ptr [eax+0Ch]
mov ebx,dword ptr [eax+1Ch]
mov ebx,dword ptr [ebx]
mov esi,dword ptr [ebx+8h]

The first line gets the PEB address from the FS segment register (in x64, it will be the GS register). Then, the second and the third lines get the PEB->LoaderData...