exploit - Why not execute shellcode with the inline assembler?

Question

The typical structure of executing shell code is the following-: (The code snippet is taken from here)

char shellcode[] = "";             /* global array */
int
main (int argc, char **argv)
{
        int (*ret)();              /* ret is a function pointer */
        ret = (int(*)())shellcode; /* ret points to our shellcode */
                                   /* shellcode is type caste as a function */
        (int)(*ret)();             /* execute, as a function, shellcode[] */
        exit(0);                   /* exit() */
}

Why not use asm(inline assembler) to execute shellcode ? It is then much more simpler than doing pointer acrobatics such as converting an array to a function pointer and then executing that array as a function ?

Is there any drawbacks of using the assembler ? And are there any particular advantage of using an array to execute shell code ?

Answer 1

This execute-from-array method is used to test shellcodes in bytes format, which is often the way shellcodes are provided (see http://shell-storm.org/shellcode/). It also emulates the usual way shellcodes are being used in an exploit.

Inline assembly is compiler dependent and shellcode developers might use assemblers directly such as nasm or MASM. However if you are developing your own shellcode there is nothing stopping you from using inline assembly, just keep in mind that the shellcode must be position independent.

Answer 2

The article you quote is about writing new shellcode to be used in exploits later. The specific snippet is about testing the shellcode. It does not really matter much how you jump to it in your test rig.

In addition, the method from the article lets you test binary shellcode, which is usually all you have when creating an exploit payload.

Answer 3

Because, this technique would require to rewrite the code of the program...

And, most of the time, you cannot rewrite the .text section... You only have access to the data stored in the stack and/or the heap. That is why we use ROP.