You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This program provides you with the utility to generate NASM x86 shellcode corresponding to your provided Shell/Bash command and arguments. The assembly produced pushes the provided command and arguments onto the stack, then uses them as arguments in an execve system call. The assembly generated uses various tricks not to include any null bytes; so that you can use the NASM generated in a buffer overflow attack. Additionally, there are tricks used to allow odd length commands/arguments, which can not be padded.
7
+
This program provides you with the utility to generate NASM x86 shellcode corresponding to your provided Shell/Bash command and arguments.
8
+
The assembly produced pushes the provided command and arguments onto the stack, then uses them as arguments in an execve system call.
9
+
The assembly generated uses various tricks not to include any null bytes; so that you can use the NASM generated in a buffer overflow attack.
10
+
Additionally, there are tricks used to allow odd length commands/arguments, which can not be padded.
8
11
9
-
Embedded into a char * is the hexadecimal representation of the generated assembly in an outputted proof of concept C file `output.c`. Alongside the hexadecimal representation is the NASM assembly equivalent as comments, to allow you to understand the generated code. You can ensure the generated assembly is functional and correct through compiling and executing the proof of concept C file. The Makefile has the utility `make payload` to compile `output.c` with the relevant flags to allow execution on the stack to prove the correctness.
12
+
Embedded into a char * is the hexadecimal representation of the generated assembly in an outputted proof of concept C file `output.c`.
13
+
Alongside the hexadecimal representation is the NASM assembly equivalent as comments, to allow you to understand the generated code.
14
+
You can ensure the generated assembly is functional and correct through compiling and executing the proof of concept C file.
15
+
The Makefile has the utility `make payload` to compile `output.c` with the relevant flags to allow execution on the stack to prove the correctness.
10
16
11
17
12
18
## Content
@@ -23,55 +29,68 @@ Embedded into a char * is the hexadecimal representation of the generated assemb
23
29
* The payload can include Bash commands which can't be called natively through a system call in assembly.
24
30
* Faster and less error-prone than handcrafting shellcode.
25
31
* Generates shellcode for lengthy/complex Bash which would be difficult to do by hand.
26
-
* Through the use of __./shellcode-generator /bin/bash -c "<- commands ->"__ you can execute multiple commands at once. Instead of singular command execution payload shellcode.
32
+
* Through the use of `./shellcode-generator /bin/bash -c "<- commands ->"` you can execute multiple commands at once. Instead of singular command execution payload shellcode.
27
33
28
34
29
35
## Limitations
30
36
* The smallest possible shellcode may not be generated. Especially for specific commands as it embeds it inside an execve call, instead of calling natively through a system call.
31
37
32
38
33
39
## Installation
34
-
* Ubuntu: __apt-get install gcc libc6-dev-i386 make__ - Needed to be able to compile C programs in 32bit architecture.
35
-
* Arch: __pacman -Sy gcc lib32-gcc-libs lib32-glibc make__ - Needed to be able to compile C programs in 32 bit architecture.
36
-
*__make__ - Compiles the generator `shellcode-generator.c` and outputs the binary to `shellcode-generator`.
40
+
* Ubuntu: `apt-get install gcc libc6-dev-i386 make` - Needed to be able to compile C programs in 32bit architecture.
41
+
* Arch: `pacman -Sy gcc lib32-gcc-libs lib32-glibc make` - Needed to be able to compile C programs in 32 bit architecture.
42
+
*`make` - Compiles the generator `shellcode-generator.c` and outputs the binary to `shellcode-generator`.
37
43
38
44
39
45
## CUnit Tests
40
46
In order to execute the unit tests using the CUnit framework you will need to install CUnit.
41
47
42
-
* Ubuntu: __apt-get install libcunit1-dev__ - Needed to be able to compile CUnit framework tests.
43
-
* Arch: __pacman -Sy cunit__ - Needed to be able to compile CUnit framework tests.
44
-
*__make test__ - Compiles the CUnit tests and runs then, printing the results to the terminal.
48
+
* Ubuntu: `apt-get install libcunit1-dev` - Needed to be able to compile CUnit framework tests.
49
+
* Arch: `pacman -Sy cunit` - Needed to be able to compile CUnit framework tests.
50
+
*`make test` - Compiles the CUnit tests and runs then, printing the results to the terminal.
45
51
46
52
47
53
## Usage
48
-
*__./shellcode-generator <- desired command -> <- arguments ->__ Invokes the generator which takes the provide Bash command and arguments and generates the corresponding shellcode, outputting the result to output.c.
49
-
*__make payload__ Compiles output.c with the relevant flags for stack execution of the char * and then executes the outputted binary to prove the functionality of the shellcode.
54
+
*`./shellcode-generator <- desired command -> <- arguments ->` Invokes the generator which takes the provide Bash command and arguments and generates the corresponding shellcode, outputting the result to output.c.
55
+
*`make payload` Compiles output.c with the relevant flags for stack execution of the char * and then executes the outputted binary to prove the functionality of the shellcode.
56
+
50
57
51
58
## Example Usage and Tips
52
-
Because of the techniques used to push strings whose length is not a multiple of four strings with no null bytes, the shellcode to push a non multiple can be larger than the shellcode to push a larger strings which is a multiple of four. Strings can be padded so as to not affect the behavior but make them a multiple of four.
59
+
Because of the techniques used to push strings whose length is not a multiple of four strings with no null bytes, the shellcode to push a non multiple can be larger than the shellcode to push a larger strings which is a multiple of four.
60
+
Strings can be padded so as to not affect the behavior but make them a multiple of four.
53
61
54
-
Below is an example to generate shellcode to call `/usr/bin/whoami`. Running `./build.sh` to build the output.c and execute it we can see the length of the shellcode is 39 bytes. As `/usr/bin/whoami` is 15 characters in length some techniques have to be used to push the non multiple.
62
+
Below is an example to generate shellcode to call `/usr/bin/whoami`.
63
+
Running `./build.sh` to build the output.c and execute it we can see the length of the shellcode is 39 bytes.
64
+
As `/usr/bin/whoami` is 15 characters in length some techniques have to be used to push the non multiple.
However paths can be padded with additional '/'s at any directory interval, without affecting the path. In the example below one addition '/' is added to the beginning to get the length to 16. As we can now see even though the string length has increased the shellcode byte size has reduced by 3 bytes, around an 8% reduction.
70
+
However paths can be padded with additional '/'s at any directory interval, without affecting the path.
71
+
In the example below one addition '/' is added to the beginning to get the length to 16.
72
+
As we can now see even though the string length has increased the shellcode byte size has reduced by 3 bytes, around an 8% reduction.
61
73
62
-
`//usr/bin/whoami` could be `/usr//bin/whoami` or `/usr/bin//whoami`. Also the number of '/'s don't affect the path. But only one was needed in this case to get to the optimal multiple of four, anymore than 1 would start to increase the shellcode size instead of decreasing it.
74
+
`//usr/bin/whoami` could be `/usr//bin/whoami` or `/usr/bin//whoami`.
75
+
Also the number of '/'s don't affect the path.
76
+
But only one was needed in this case to get to the optimal multiple of four, anymore than 1 would start to increase the shellcode size instead of decreasing it.
Below is a more complicated example, the usage of `/bin/bash -c "<cmds>"` allows multiple commands to be executed within one payload and use the functionality of a Bash environment. I.E. usage of $PATH so you don't need a commands full path.
82
+
Below is a more complicated example, the usage of `/bin/bash -c "<cmds>"` allows multiple commands to be executed within one payload and use the functionality of a Bash environment.
83
+
I.E. usage of $PATH so you don't need a commands full path.
69
84
70
85
| Command | Generated output.c |
71
86
|---------|--------------------|
72
87
|`./shellcode-generator /bin/bash -c "echo test > test.txt; ls; cat test.txt"`|http://pastebin.com/nvsd1qq3|
73
88
74
-
The above example can be optimised. `/bin/bash` is 9 characters in length we could pad it with 3 '/'s to 12 a multiple of 4. But doing that produces longer shellcode than leaving it as `/bin/bash`. Spaces inside the command can be removed shortening the string length without affecting the command. Removing the spaces reduce it to 92 bytes in length, instead of the prior length of 97 bytes.
89
+
The above example can be optimised.
90
+
`/bin/bash` is 9 characters in length we could pad it with 3 '/'s to 12 a multiple of 4.
91
+
But doing that produces longer shellcode than leaving it as `/bin/bash`.
92
+
Spaces inside the command can be removed shortening the string length without affecting the command.
93
+
Removing the spaces reduce it to 92 bytes in length, instead of the prior length of 97 bytes.
0 commit comments