Shellcode is some machine code which, when tricked into running, spawns a shell for you (which lets you enter arbitrary commands). There are all sorts of ways to do it, like for example:
Compact shellcode -- least number of instructions
polymorphic shellcode -- rewrites itself to get around programs that recognize shellcode
visible-character (or even alphanumeric) shellcode -- all machine code instructions are made up of visible characters, or even alphanumeric. That way if a field only permits a-zA-Z0-9, you can put your shellcode in anyway.
There are other sneaky ways to do it, but the main point is that you trick a program (using a stack overflow, heap overflow, format string vulnerability, etc.) into running the code.
