[Illicit]

0x01 - Introduction
Shellcode is the machine code payload used to perform task's through Buffer Overflow Exploit's.Common shellcode payloads include : the ability to send root commands from a less privileged user (local root)or a remote TCP Netcat shell.
Shellcode takes the following form :



0x02 - Tools
First of all you will need to make sure you have the following programs ready:
• nasm (Assembly Compiler, should be installed by default.Check by typing 'nasm' into the command-line.)
• codetester.c (A small program you can use to test your shellcode.Just replace 'SHELL CODE HERE' with your shellcode and then compile and run it.
Source: (Click to View)

PHP Code


<?php 
char code[] = "SHELL CODE HERE";

int main(int argc, char **argv)
{
  int (*func)();
  func = (int (*)()) code;
  (int)(*func)();
} 


• objdump (You should have this by default)

0x03 - Creating your ASM code
Shellcode is usually compiled from Assembly , and in this tutorial I will explain how to do it with Assembly.
[First of all you should know the basic's of assembly if not check out the Assembly Tutorial in the assembly forum.]
Let's start with something simple.A piece of Hello World ASM.

PHP Code


<?php 
[SECTION .text]

global _start

_start:

  jmp short ender

  starter:

  xor eax, eax    ;Flush the registers
  xor ebx, ebx
  xor edx, edx
  xor ecx, ecx

  mov al, 4
  mov bl, 1
  pop ecx
  mov dl, 30  ;30 is the length of the string
  int 0x80

  xor eax, eax
  mov al, 1
  xor ebx,ebx
  int 0x80

  ender:
  call starter
  db 10, 'Hello World' ,10 


To compile this run the following commands:

nasm -f elf test.asm
ld -o test test.o


And you will have an executable file called 'test' which will output :

Hello World

[Note: The two 10's on either side are merely creating a newline and are not necessary.]

0x04 - Turning ASM to shellcode
The method I use to convert ASM to shellcode is quite tedious but is the only one I got to work.If you would like to use a tool check out the bin2shell program.

First of all after you have compiled you assembly code into an executable run this command:

objdump -d <executable-name>

And you should receive an output similar to this:
Spoiler (Click to View)



Now just extract the code in the middle and add a \x for example:
8048079: cd 80 int $0x80
becomes:
\xcd\x80

Now just do this for each line until you have your shellcode.

0x04 - Testing your Shellcode
To test you shellcode use the previous program like this:

PHP Code


<?php 
char code[] =
"\xeb\x19\x31\xc0\x31\xdb\x31\xd2\x31\xc9\xb0\x04"
"\xb3\x01\x59\xb2\x1e\xcd\x80\x31\xc0\xb0\x01\x31"
"\xdb\xcd\x80\xe8\xe2\xff\xff\xff\x0a\x53\x68\x65"
"\x6c\x63\x6f\x64\x65\x20\x69\x73\x20\x67\x72\x65"
"\x61\x74\x20\x2d\x20\x52\x65\x64\x48\x61\x74\x0a";

int main(int argc, char **argv)
{
  int (*func)();
  func = (int (*)()) code;
  (int)(*func)();
} 


And then compile and run it.If you receive the same output as you assembl program then it worked!

0x05 - Conclusion
Now that you understand the method used to create shellcode start experimenting.
Please remember that the structure used for shellcode in assembly is essential because of the way BoF attacks are exploited.

Enjoy and please leave feedback! 🤝

[maher84]

thank you redhat I just started learning shellcoding

[Illicit]

thank you redhat I just started learning shellcoding

Hope this helped :P And good luck with your shellcoding !

[Kate Libby]

I decided to show this tutorial to a dear friend of mine, Who?.
He provided some comments you may want to hear:

Next time write a tutorial on a subject you can fucking understand, you clearly have no idea on what you are talking about.
For example:

Shellcode is the machine code payload used to perform task's through Buffer Overflow Exploit's.Common shellcode payloads include : the ability to send root commands from a less privileged user (local root)or a remote TCP Netcat shell.

Wait what? No, that is bullshit. What you are talking about in this tutorial is about assembly encoding and that is not at all related to shellcode. And besides, shellcode will not magically give you root or any extra access to a system.

And the rest of this "amazing" tutorial is just copypasted bits of code.

[www_webhead]

Nice bro i am just start to learn shell coding thx mate..

[Illicit]

Good luck with shellcoding then :P & Glad you liked this tutorial.

[Kate Libby]

>Wait what? No, that is bullshit. What you are talking about in this tutorial is about assembly encoding and that is not at all related to shellcode. And besides, shellcode will not magically give you root or any extra access to a system.

Actually I didnt say it magically gave you root at all and this is related to shellcode.As shellcode takes on this form , and it is possible to exploit it using this form.

>And the rest of this "amazing" tutorial is just copypasted bits of code.

Really?Why dont you bother to compile the first piece of shellcode if you really think so.
Here copy & paste this:

PHP Code


<?php 
char code[] =
"\xeb\x19\x31\xc0\x31\xdb\x31\xd2\x31\xc9\xb0\x04"
"\xb3\x01\x59\xb2\x1e\xcd\x80\x31\xc0\xb0\x01\x31"
"\xdb\xcd\x80\xe8\xe2\xff\xff\xff\x0a\x53\x68\x65"
"\x6c\x63\x6f\x64\x65\x20\x69\x73\x20\x67\x72\x65"
"\x61\x74\x20\x2d\x20\x52\x65\x64\x48\x61\x74\x0a";

int main(int argc, char **argv)
{
  int (*func)();
  func = (int (*)()) code;
  (int)(*func)();
} 


Who? would like to point out that you clearly don't even know what shellcode is.

Code

char code[] =
"\xeb\x19\x31\xc0\x31\xdb\x31\xd2\x31\xc9\xb0\x04"
"\xb3\x01\x59\xb2\x1e\xcd\x80\x31\xc0\xb0\x01\x31"
"\xdb\xcd\x80\xe8\xe2\xff\xff\xff\x0a\x53\x68\x65"
"\x6c\x63\x6f\x64\x65\x20\x69\x73\x20\x67\x72\x65"
"\x61\x74\x20\x2d\x20\x52\x65\x64\x48\x61\x74\x0a";

That is just a hexadecimal representation of machine code, nothing special. Now, why do you decide to encode it in such a way is beyond me. It doesn't matter in what form the machine code is and how it is encoded, as long as it can be decoded to an executable format.

[Illicit]

Who? would like to point out that you clearly don't even know what shellcode is.

Code

char code[] =
"\xeb\x19\x31\xc0\x31\xdb\x31\xd2\x31\xc9\xb0\x04"
"\xb3\x01\x59\xb2\x1e\xcd\x80\x31\xc0\xb0\x01\x31"
"\xdb\xcd\x80\xe8\xe2\xff\xff\xff\x0a\x53\x68\x65"
"\x6c\x63\x6f\x64\x65\x20\x69\x73\x20\x67\x72\x65"
"\x61\x74\x20\x2d\x20\x52\x65\x64\x48\x61\x74\x0a";

That is just a hexadecimal representation of machine code, nothing special. Now, why do you decide to encode it in such a way is beyond me. It doesn't matter in what form the machine code is and how it is encoded, as long as it can be decoded to an executable format.

Why did I encode this?In order to create a payload for BoF vulnerabilities.
duh.

[Kate Libby]

Why did I encode this?In order to create a payload for BoF vulnerabilities.
duh.

This just proves that you have no idea on what you are talking about.

[alexlandonflicksss]

Bookmarked this tutorial...will read this when I get time....thanks in advance...

[Illicit]

Bookmarked this tutorial...will read this when I get time....thanks in advance...

Enjoy it later!
:P Thanks for bookmarking it!

[Jae‌]

Didn't you make a thread on how to make shell-code a day before you released this? - https://hackforums.net/showthread.php?tid=3117382
The point of a tutorial is to help people in depth with a certain task. Spend more time learning and then come back and write a detailed tutorial to help others with what you know. 🙂

[Phizo]

You've been asking all these questions so you can write a tutorial on something you lack experience in?
Everything Who? has pointed out is accurate and your method of writing the shellcode is ridiculous; why would you write it out manually?
Someone already wrote a something in C to extract the hex from objdump and write it in the appropriate format.

PHP Code


<?php 
/**
odfhex - objdump hex extractor
by steve hanna v.01
   vividmachines.com
   [email protected]
you are free to modify this code
but please attribute me if you
change the code. bugfixes & additions
are welcome please email me!
to compile:
g++ odfhex.cpp -o odfhex

note: the XOR option works
perfectly, but i haven't implemented
the full x86 payload decoder yet.
so that option is mostly useless.

this program extracts the hex values
from an "objdump -d <binaryname>".
after doing this, it converts the
hex into escaped hex for use in
a c/c++ program.
happy shellcoding!
**/

#include <stdio.h>
#include <unistd.h>
#include <memory.h>
#include <string.h>
#include <stdlib.h>
#include <math.h>

#define HEX_PER_LINE 17
char symbols[37] = "0123456789abcdefghijklmnopqrstuvwxyz";
const int MAX_BASE = 36;
int GetIndex(char * pString, char search);
int BaseToDec(char* number, int base)
{
  if( base < 2 || base > MAX_BASE)
    return 0; //Failed
  int NumLength = strlen(number);
  int PlaceValue, total = 0;

  PlaceValue = (int)pow(base,NumLength-1);

  for(int i=0;i<NumLength;i++)
  {
    total += GetIndex(symbols,*number)*PlaceValue;
    number++;
    PlaceValue /= base; //Next digit's place value (previous/base)
  }
  return total;
}

int GetIndex(char * pString, char search)
{
  int index = 0;
  while(*pString != '0')
  {
  if(*pString==search)
  break;
  pString++;
  index++;
  }
  return index;
}

int main(int argc, char** argv)
{
  FILE* dump = NULL;
  long length = 0;
  char* content;
  int i=0;
  int count =0;
  int total=0;
  int XORvalue=0;
  bool XORit = false;
  char HexNumber[3]={'\0'};

  printf("\nOdfhex - object dump shellcode extractor - by steve hanna - v.01\n");

  if(argc < 2)
  {

  printf("%s: <object file dump> [-x xor offset in decimal] \n",argv[0]);
  return -1;
  }

  dump = fopen(argv[1],"r");
  if(!dump)
  {
    printf("Error: Couldn't open file.\n");
    return -1;
  }

  fseek(dump,0,SEEK_END);

  length = ftell(dump);

  content = new char[length+1];
  memset(content,0,sizeof(content));
  printf("Trying to extract the hex of %s which is %d bytes long\n",argv[1],length);

  if (argc > 3 &&  !strcmp(argv[2],"-x"))
  {
    XORit =true;
    XORvalue = BaseToDec(argv[3],16);
    printf("XORing with 0x%02x\n",XORvalue);
  }
  fseek(dump,0,SEEK_SET);
  for(int i=0; i < length; i++)
  {
    content[i] = fgetc(dump);
  }
  fclose(dump);

  while(count !=4)
  {

    if(content[i] == ':')
  count++;
    i++;
  }
  count = 0;

       printf("\"");
  while(i < length)
  {
            if( (content[i-1] == ' ' || content[i-1]=='\t') &&
    (content[i+2] == ' ' ) &&
    (content[i] != ' ') &&
    (content[i+1] != ' ') &&
    ((content[i]>='0' && content[i]<='9') || (content[i]>='a' && content[i]<='f')) &&
    ((content[i+1]>='0' && content[i+1]<='9') || (content[i+1]>='a' && content[i+1]<='f'))
    )
                {
        if(XORit)
        {
                  HexNumber[0] = content[i];
                  HexNumber[1] = content[i+1];

            printf("\\x%02x",BaseToDec(HexNumber,16) ^ XORvalue);
        }
        else
        printf("\\x%c%c",content[i],content[i+1]);

  count++;
  total++;   
    }

            if(i+1 == length)
            {
                 printf("\";\n");
            }
            else if(count == HEX_PER_LINE) 
            {
                printf("\"\\\n\"");
                count =0;
            }
  i++;
  }

  delete[] content;
  printf("\n%d bytes extracted.\n\n",total);
  return 0;
} 


If you want to be properly educated I suggest reading this.

[puremindd]

Why did I encode this?In order to create a payload for BoF vulnerabilities.
duh.

AHAHHAHAA HOLYFUCK .. you just made my day, you fucking moron <3

---

Didn't you make a thread on how to make shell-code a day before you released this? - https://hackforums.net/showthread.php?tid=3117382
The point of a tutorial is to help people in depth with a certain task. Spend more time learning and then come back and write a detailed tutorial to help others with what you know. 🙂

Shut the fuckup and go post some more botnet sources skrub.