Hello. Here are my thoughts on this question.
The term 'shellcode' is overloaded but in most cases (such as this) it refers to binary data. Malzilla doesn't generally deal with binary data, so it's not the best tool for the job (but if you keep reading my long response you'll find that malzilla can do interesting things here).
How to understand shellcode is a complicated question because shellcode can essentially be thought of as a 'fragment' of a binary. Shellcode can store anything, including a decryptor stub so technically shellcode can be 'packed' or 'obfuscated' the same way a binary can. Anyway-- i'm not going to give people a history lesson on shellcode, nor am I going to teach you assembly (you can use google for that).
If you want to understand this shellcode, you need to first be comfortable with assembly language for the target platform. In this case the platform is win32. The shellcode here will be injected into the RealPlayer process, and eventually executed. In order to understand what it does you need to first:
1. unescape the shellcode variable
2. convert shellcode to hex
3. reverse the byte order (because Win32/IA32 is little endian)
4. disassemble the hex (you can use ollydbg or ida)
In most cases shellcode will be very tightly written to save space or to operate within the constraints of the vulnerable application. This shellcode is quite large. There are tools out there that will help you generate shellcode, but not too many that help you disassemble it. The best known and most widely used resource (imo) is Metasploit's Shellcode archive and dev kit (
http://www.metasploit.com/shellcode/).
An alternative solution is to simply search the web for a fragment of the shellcode. Most kiddies that write exploits today don't write their own shellcode. The odds that you find documentation or a tutorial about the shellcode in question on the internet is high. As cjeremy pointed out, this exploit is known and documented. By reading the exploit source you'll notice that the shellcode was likely generated by metasploit (obviously the payload on milw0rm is not the same as the one found in the wild).
For those of you that are more interested in malware collection and such, but are still reading-- i can offer another tip: decoding simple shellcode can often lead to payload data. Many times a shellcode will do something like call out to urlmon.dll to download and execute some binary from a URL. If you simply decode the shellcode in malzilla, sometimes you can find the URL surrounded by random garbage (binary data). Keep in mind that this is like doing 'strings' on a binary. The shellcode authors may have put that there to throw you off, when the real payload is obfuscated.
If you want to learn more about shellcode, I suggest that you start with these papers:
-
http://www.nologin.org/Downloads/Papers/win32-shellcode.pdf-
http://www.ngssoftware.com/research/papers/WritingSmallShellcode.pdf-
http://www.symantec.com/avcenter/reference/evolving.shell.code.pdfThis is a very old subject in security and as such it is very well documented.
Good luck!
TJS
Topic: decoding shell codes (Read 8944 times)
