Editing Shellcode (section)

=== Download and execute ===
''Download and execute'' is a type of remote shellcode that ''[[downloads]] and [[Execution (computers)|executes]]'' some form of malware on the target system. This type of shellcode does not spawn a shell, but rather instructs the machine to download a certain executable file off the network, save it to disk and execute it. Nowadays, it is commonly used in [[drive-by download]] attacks, where a victim visits a malicious webpage that in turn attempts to run such a download and execute shellcode in order to install software on the victim's machine. A variation of this type of shellcode downloads and [[Dynamic loading|loads]] a [[Library (computing)|library]].<ref>{{cite web |url=http://skypher.com/index.php/2010/01/11/download-and-loadlibrary-shellcode-released/ |title=Download and LoadLibrary shellcode released |author=SkyLined |date=2010-01-11 |access-date=2010-01-19 |url-status=dead |archive-url=https://web.archive.org/web/20100123014637/http://skypher.com/index.php/2010/01/11/download-and-loadlibrary-shellcode-released/ |archive-date=2010-01-23}}</ref><ref>{{cite web |url=http://code.google.com/p/w32-dl-loadlib-shellcode/ |title=Download and LoadLibrary shellcode for x86 Windows |date=2010-01-11 |access-date=2010-01-19}}</ref> Advantages of this technique are that the code can be smaller, that it does not require the shellcode to spawn a new process on the target system, and that the shellcode does not need code to clean up the targeted process as this can be done by the library loaded into the process.