Generate or download common shellcodes. Usage: MYNAME generate [arch/]platform type [port] [host] MYNAME search keyword (use % for any character wildcard) MYNAME display shellcodeId (shellcodeId as appears in search results) MYNAME zsc [gener
(self, *arg)
| 5684 | skeleton.options = ["argv", "stdin", "env", "remote"] |
| 5685 | |
| 5686 | def shellcode(self, *arg): |
| 5687 | """ |
| 5688 | Generate or download common shellcodes. |
| 5689 | Usage: |
| 5690 | MYNAME generate [arch/]platform type [port] [host] |
| 5691 | MYNAME search keyword (use % for any character wildcard) |
| 5692 | MYNAME display shellcodeId (shellcodeId as appears in search results) |
| 5693 | MYNAME zsc [generate customize shellcode] |
| 5694 | |
| 5695 | For generate option: |
| 5696 | default port for bindport shellcode: 16706 (0x4142) |
| 5697 | default host/port for connect back shellcode: 127.127.127.127/16706 |
| 5698 | supported arch: x86 |
| 5699 | """ |
| 5700 | def list_shellcode(): |
| 5701 | """ |
| 5702 | List available shellcodes |
| 5703 | """ |
| 5704 | text = "Available shellcodes:\n" |
| 5705 | for arch in SHELLCODES: |
| 5706 | for platform in SHELLCODES[arch]: |
| 5707 | for sctype in SHELLCODES[arch][platform]: |
| 5708 | text += " %s/%s %s\n" % (arch, platform, sctype) |
| 5709 | msg(text) |
| 5710 | |
| 5711 | """ Multiple variable name for different modes """ |
| 5712 | (mode, platform, sctype, port, host) = normalize_argv(arg, 5) |
| 5713 | (mode, keyword) = normalize_argv(arg, 2) |
| 5714 | (mode, shellcodeId) = normalize_argv(arg, 2) |
| 5715 | |
| 5716 | if mode == "generate": |
| 5717 | arch = "x86" |
| 5718 | if platform and "/" in platform: |
| 5719 | (arch, platform) = platform.split("/") |
| 5720 | |
| 5721 | if platform not in SHELLCODES[arch] or not sctype: |
| 5722 | list_shellcode() |
| 5723 | return |
| 5724 | #dbg_print_vars(arch, platform, sctype, port, host) |
| 5725 | try: |
| 5726 | sc = Shellcode(arch, platform).shellcode(sctype, port, host) |
| 5727 | except Exception as e: |
| 5728 | self._missing_argument() |
| 5729 | |
| 5730 | if not sc: |
| 5731 | msg("Unknown shellcode") |
| 5732 | return |
| 5733 | |
| 5734 | hexstr = to_hexstr(sc) |
| 5735 | linelen = 16 # display 16-bytes per line |
| 5736 | i = 0 |
| 5737 | text = "# %s/%s/%s: %d bytes\n" % (arch, platform, sctype, len(sc)) |
| 5738 | if sctype in ["bindport", "connect"]: |
| 5739 | text += "# port=%s, host=%s\n" % (port if port else '16706', host if host else '127.127.127.127') |
| 5740 | text += "shellcode = (\n" |
| 5741 | while hexstr: |
| 5742 | text += ' "%s"\n' % (hexstr[:linelen*4]) |
| 5743 | hexstr = hexstr[linelen*4:] |
nothing calls this directly
no test coverage detected