Sickle - Kit de Desarrollo de Payloads

alt text

Sickle es una herramienta que desarrollé originalmente para ayudarme a ser más eficaz, tanto en el desarrollo como en la comprensión de shellcode. Sin embargo, a lo largo de su desarrollo y uso, ha evolucionado hasta convertirse en un kit de desarrollo de payloads. Aunque los módulos actuales están orientados mayormente al ensamblador, esta herramienta no se limita al shellcode.

Actualmente, Sickle puede ayudar con lo siguiente.

Conversión de instrucciones de ensamblador a código máquina (opcodes)
Ejecución de bytecode, incluidos payloads generados
Formateo de opcodes para un lenguaje de destino
Identificación de caracteres no válidos
Desensamblado lineal
Diffing

Generación de Shellcode

Sickle admite la generación de shellcode mediante el Keystone Engine. Debido a que esta es una funcionalidad recientemente añadida, la compatibilidad de payloads es limitada. Sin embargo, el objetivo es añadir una reverse shell básica para cada arquitectura y plataforma.

alt text

Diffing

Sickle incluye un módulo de "diffing" diseñado inicialmente para analizar stubs de shellcode. El modo "asm" original realiza diffs de desensamblado lineal tanto a nivel de lenguaje ensamblador como de opcodes, por separado.

alt text

Además, Sickle ofrece varios modos para realizar diffs, lo que lo hace útil más allá del desarrollo de shellcode.

$ sickle-pdk -l Shellcode Ring Description --------- ---- ----------- windows/x64/virtualalloc_exec_tcp 3 A lightweight stager that connects to a handler via TCP over IPv4 to receive and execute shellcode windows/x64/egghunter 3 Egghunter based on Hell's Gate and NtProtectVirtualMemory windows/x64/virtualalloc_exec_https 3 A lightweight stager that connects to a handler over HTTPS to receive and execute shellcode windows/x64/exec 3 Executes a command on the target host windows/x64/reflective_pe_loader 3 Stageless Reflective PE Loader that takes an x64 binary and executes it in memory windows/x64/shell_reverse_tcp 3 Reverse Shell via TCP over IPv4 that provides an interactive cmd.exe session windows/aarch64/shell_reverse_tcp 3 Reverse Shell via TCP over IPv4 that provides an interactive cmd.exe session windows/x86/shell_reverse_tcp 3 Reverse shell via TCP over IPv4 that provides an interactive cmd.exe session windows/x64/kernel_token_stealer 0 Token stealing shellcode for privilege escalation windows/x64/kernel_sysret 0 Generic method of returning from kernel space to user space windows/x64/kernel_ace_edit 0 SID entry modifier for process injection windows/x86/kernel_token_stealer 0 Token stealing shellcode for privilege escalation linux/x64/memfd_reflective_elf_tcp 3 Staged Reflective ELF Loader via TCP over IPV4 which executes an ELF from a remote server linux/aarch64/memfd_reflective_elf_tcp 3 Staged Reflective ELF Loader via TCP over IPv4 which executes an ELF from a remote server handler linux/aarch64/shell_reverse_tcp 3 Reverse Shell via TCP over IPv4 that provides an interactive /bin/sh session linux/x86/execve 3 Executes a shell session such as /bin/sh linux/x86/shell_reverse_tcp 3 Reverse shell via TCP over IPV4 that provides an interactive /bin/sh session Architectures ------------- aarch64 x64 x86 Modules Description ------- ----------- disassemble Simple linear disassembler for multiple architectures handler Module for handling payload distribution and session management asm_shell Interactive assembler and disassembler diff Bytecode diffing module for comparing two binaries (or shellcode) pinpoint Highlights opcodes within a disassembly to identify instructions responsible for bad characters run Wrapper used for executing bytecode (shellcode) format Converts bytecode into a respective format (activated anytime '-f' is used) badchar Produces a set of all potential invalid characters for validation purposes Format Description ------ ----------- perl Format bytecode for Perl python Format bytecode for Python hex_space Format bytecode in hex, seperated by a space nasm Format bytecode for NASM java Format bytecode for Java javascript Format bytecode for Javascript (Blob to send via XHR) escaped Format bytecode for one-liner hex escape paste rust Format bytecode for a Rust application uint8array Format bytecode for Javascript as a Uint8Array directly bash Format bytecode for bash script (UNIX) powershell Format bytecode for Powershell cs Format bytecode for C# dword Format bytecode in dword c Format bytecode for a C application raw Format bytecode to be written to stdout in raw form ruby Format bytecode for Ruby num Format bytecode in num format hex Format bytecode in hex python3 Format bytecode for Python3

sickle-pdk

Más Populares

Ejecución de Shellcode

Desensamblado

Extracción de Shellcode

Identificación de caracteres no válidos

Diseño Basado en Módulos