wetw0rk/sickle-pdkSickle - Payload Development Kit
Sickle 是我最初为帮助自己更高效地开发和理解 shellcode 而开发的一个工具。然而，在开发和使用的过程中，它已演变为一个载荷开发套件。尽管目前的模块主要面向汇编，但该工具并不仅限于 shellcode。
目前 Sickle 可以协助以下工作：
Sickle 通过 Keystone Engine 支持 shellcode 生成。由于这是新添加的功能，支持的载荷有限。然而，目标是针对每种架构和平台添加基本的反向 shell。
Sickle 包含一个“差异对比”模块，最初设计用于分析 shellcode 存根。原始的“asm”模式分别在汇编语言级别和操作码级别执行线性反汇编差异对比。
此外，Sickle 提供多种模式进行差异对比，使其在 shellcode 开发之外也很有用。
你可能经常执行的一个常见任务是测试你的 shellcode。这个过程通常包括以下步骤：
虽然这些步骤看似简单，但重复进行时会变得耗时。Sickle 通过自动包装 shellcode 以快速测试简化了流程，“run”模块目前支持 Windows 和 Unix 系统。
Sickle 还可以将二进制文件转换为提取的操作码（shellcode），然后将这些操作码翻译成机器指令（汇编）。注意，此过程仅适用于原始二进制文件，并且目前通过 Capstone 以线性方式进行反汇编。
在上面显示的示例中，“disassemble”模块将 Stephen Fewer 设计的反向 shell 反汇编为汇编代码。
Shellcode 提取是 Sickle 的第一个模块，更确切地说是核心功能，因为操作码根据所使用的包装程序有不同的解释。例如，JavaScript 存储和解释 shellcode 的方式与 C 程序不同。
也许最大的灵感来自 msfvenom。
虽然在 64 位漏洞利用中不太常见，但有时漏洞利用会限制某些字符的使用。这正是“pinpoint”模块的强项，它直接识别并突出显示导致已识别坏字符的汇编指令。
最初，该工具以一个大型脚本开始。然而，随着它的发展，我发现每次更新都需要重新学习代码。为了解决这个问题，Sickle 现在采用模块化方法，允许在不花费太多时间重新学习工具设计的情况下添加新功能。
$ sickle-pdk -l
Shellcode Ring Description
--------- ---- -----------
windows/x64/virtualalloc_exec_tcp 3 A lightweight stager that connects to a handler via TCP over IPv4 to receive and execute shellcode
windows/x64/egghunter 3 Egghunter based on Hell's Gate and NtProtectVirtualMemory
windows/x64/virtualalloc_exec_https 3 A lightweight stager that connects to a handler over HTTPS to receive and execute shellcode
windows/x64/exec 3 Executes a command on the target host
windows/x64/reflective_pe_loader 3 Stageless Reflective PE Loader that takes an x64 binary and executes it in memory
windows/x64/shell_reverse_tcp 3 Reverse Shell via TCP over IPv4 that provides an interactive cmd.exe session
windows/aarch64/shell_reverse_tcp 3 Reverse Shell via TCP over IPv4 that provides an interactive cmd.exe session
windows/x86/shell_reverse_tcp 3 Reverse shell via TCP over IPv4 that provides an interactive cmd.exe session
windows/x64/kernel_token_stealer 0 Token stealing shellcode for privilege escalation
windows/x64/kernel_sysret 0 Generic method of returning from kernel space to user space
windows/x64/kernel_ace_edit 0 SID entry modifier for process injection
windows/x86/kernel_token_stealer 0 Token stealing shellcode for privilege escalation
linux/x64/memfd_reflective_elf_tcp 3 Staged Reflective ELF Loader via TCP over IPV4 which executes an ELF from a remote server
linux/aarch64/memfd_reflective_elf_tcp 3 Staged Reflective ELF Loader via TCP over IPv4 which executes an ELF from a remote server handler
linux/aarch64/shell_reverse_tcp 3 Reverse Shell via TCP over IPv4 that provides an interactive /bin/sh session
linux/x86/execve 3 Executes a shell session such as /bin/sh
linux/x86/shell_reverse_tcp 3 Reverse shell via TCP over IPV4 that provides an interactive /bin/sh session
Architectures
-------------
aarch64
x64
x86
Modules Description
------- -----------
disassemble Simple linear disassembler for multiple architectures
handler Module for handling payload distribution and session management
asm_shell Interactive assembler and disassembler
diff Bytecode diffing module for comparing two binaries (or shellcode)
pinpoint Highlights opcodes within a disassembly to identify instructions responsible for bad characters
run Wrapper used for executing bytecode (shellcode)
format Converts bytecode into a respective format (activated anytime '-f' is used)
badchar Produces a set of all potential invalid characters for validation purposes
Format Description
------ -----------
perl Format bytecode for Perl
python Format bytecode for Python
hex_space Format bytecode in hex, seperated by a space
nasm Format bytecode for NASM
java Format bytecode for Java
javascript Format bytecode for Javascript (Blob to send via XHR)
escaped Format bytecode for one-liner hex escape paste
rust Format bytecode for a Rust application
uint8array Format bytecode for Javascript as a Uint8Array directly
bash Format bytecode for bash script (UNIX)
powershell Format bytecode for Powershell
cs Format bytecode for C#
dword Format bytecode in dword
c Format bytecode for a C application
raw Format bytecode to be written to stdout in raw form
ruby Format bytecode for Ruby
num Format bytecode in num format
hex Format bytecode in hex
python3 Format bytecode for Python3
这种方法允许每个模块为其功能生成详细文档。
$ sickle-pdk -m run -i
Usage information for run
Name: Shellcode Runner
Module: run
Architecture: Multi
Platform: Multi
Ring: 3
Author(s):
wetw0rk
Tested against:
Linux
Windows
Module Description:
Executes bytecode from a binary file (-r) or a payload module (-p) under the context
of the currently running operating system and architecture. Meaning if you are
running on AARCH64 bytecode will be interpreted as such and if you're on x64 it will
interpret it as x64 respectively.
Example:
/usr/local/bin/sickle-pdk -m run -r shellcode
这种方法还包括 shellcode 存根的文档。
$ sickle-pdk -p windows/x64/egghunter -i
Usage information for windows/x64/egghunter
Name: Windows (x64) Hell's Gate based Egghunter
Module: windows/x64/egghunter
Architecture: x64
Platform: windows
Ring: 3
Author(s):
hvictor
Tested against:
Windows 11 (10.0.26100 N/A Build 26100)
Argument Information:
Name Description Optional
---- ----------- --------
TAG Egg (provide 4 bytes) yes
Module Description:
This egghunter iterates virtual memory addresses and before searching for the egg, it
performs a NtProtectVirtualMemory system call. This system call is similar to
VirtualProtect, and is parameterized to set the memory to be scanned to READ, WRITE,
EXECUTE. This way, when the egg is found, the shellcode after it is guaranteed to be
executable.
Example:
/usr/local/bin/sickle-pdk -p windows/x64/egghunter TAG=w00t