Creating shellcode (Two ways) - System Security

chroniccommand

Decided to write up a very simple guide on creating(NOT writing) shellcode. Just so you guys know how to create some next time you wanna smuggle some shellcode in a program or something.

Method 1:
The first method of creating shellcode is using msfpayload that comes with Metasploit. This is a very useful program that can generate shellcode in a couple different languages(Including C, Perl and Ruby). Now this works on windows and *nix, but I'm assuming you're running *nix in this. First, CD to

/opt/metasploit3/bin

Then type this:

&#46;/msfpayload &lt;payload&gt; &lt;options&gt; &lt;language&gt;

Now for payload, you can see them using the -h option. Here is a list of them:
[spoiler]


    Usage&#58; /opt/metasploit3/msf3/msfpayload &lt;payload&gt; &#91;var=val&#93; &lt;&#91;S&#93;ummary|C|&#91;P&#93;erl|Rub&#91;y&#93;|&#91;R&#93;aw|&#91;J&#93;avascript|e&#91;X&#93;ecutable|&#91;D&#93;ll|&#91;V&#93;BA|&#91;W&#93;ar&gt;

Framework Payloads (216 total)
==============================

    Name                                             Description
    ----                                             -----------
    aix/ppc/shell_bind_tcp                           Listen for a connection and spawn a command shell
    aix/ppc/shell_find_port                          Spawn a shell on an established connection
    aix/ppc/shell_interact                           Simply execve /bin/sh (for inetd programs)
    aix/ppc/shell_reverse_tcp                        Connect back to attacker and spawn a command shell
    bsd/sparc/shell_bind_tcp                         Listen for a connection and spawn a command shell
    bsd/sparc/shell_reverse_tcp                      Connect back to attacker and spawn a command shell
    bsd/x86/exec                                     Execute an arbitrary command
    bsd/x86/metsvc_bind_tcp                          Stub payload for interacting with a Meterpreter Service
    bsd/x86/metsvc_reverse_tcp                       Stub payload for interacting with a Meterpreter Service
    bsd/x86/shell/bind_tcp                           Listen for a connection, Spawn a command shell (staged)
    bsd/x86/shell/find_tag                           Use an established connection, Spawn a command shell (staged)
    bsd/x86/shell/reverse_tcp                        Connect back to the attacker, Spawn a command shell (staged)
    bsd/x86/shell_bind_tcp                           Listen for a connection and spawn a command shell
    bsd/x86/shell_find_port                          Spawn a shell on an established connection
    bsd/x86/shell_find_tag                           Spawn a shell on an established connection (proxy/nat safe)
    bsd/x86/shell_reverse_tcp                        Connect back to attacker and spawn a command shell
    bsdi/x86/shell/bind_tcp                          Listen for a connection, Spawn a command shell (staged)
    bsdi/x86/shell/reverse_tcp                       Connect back to the attacker, Spawn a command shell (staged)
    bsdi/x86/shell_bind_tcp                          Listen for a connection and spawn a command shell
    bsdi/x86/shell_find_port                         Spawn a shell on an established connection
    bsdi/x86/shell_reverse_tcp                       Connect back to attacker and spawn a command shell
    cmd/unix/bind_inetd                              Listen for a connection and spawn a command shell (persistent)
    cmd/unix/bind_netcat                             Listen for a connection and spawn a command shell via netcat
    cmd/unix/bind_perl                               Listen for a connection and spawn a command shell via perl
    cmd/unix/bind_ruby                               Continually listen for a connection and spawn a command shell via Ruby
    cmd/unix/generic                                 Executes the supplied command
    cmd/unix/interact                                Interacts with a shell on an established socket connection
    cmd/unix/reverse                                 Creates an interactive shell through two inbound connections
    cmd/unix/reverse_bash                            
				Creates an interactive shell via bash's builtin /dev/tcp&#46;
				This will not work on most Debian-based Linux distributions
				(including Ubuntu) because they compile bash without the
				/dev/tcp feature&#46;
				
    cmd/unix/reverse_netcat                          Creates an interactive shell via netcat
    cmd/unix/reverse_perl                            Creates an interactive shell via perl
    cmd/unix/reverse_ruby                            Connect back and create a command shell via Ruby
    cmd/windows/adduser                              Create a new user and add them to local administration group
    cmd/windows/bind_perl                            Listen for a connection and spawn a command shell via perl (persistent)
    cmd/windows/bind_ruby                            Continually listen for a connection and spawn a command shell via Ruby
    cmd/windows/download_exec_vbs                    Download an EXE from an HTTP(S) URL and execute it
    cmd/windows/reverse_perl                         Creates an interactive shell via perl
    cmd/windows/reverse_ruby                         Connect back and create a command shell via Ruby
    generic/debug_trap                               Generate a debug trap in the target process
    generic/shell_bind_tcp                           Listen for a connection and spawn a command shell
    generic/shell_reverse_tcp                        Connect back to attacker and spawn a command shell
    generic/tight_loop                               Generate a tight loop in the target process
    java/jsp_shell_bind_tcp                          Listen for a connection and spawn a command shell
    java/jsp_shell_reverse_tcp                       Connect back to attacker and spawn a command shell
    java/meterpreter/bind_tcp                        Listen for a connection, Run a meterpreter server in Java
    java/meterpreter/reverse_tcp                     Connect back stager, Run a meterpreter server in Java
    java/shell/bind_tcp                              Listen for a connection, Spawn a piped command shell (cmd&#46;exe on Windows, /bin/sh everywhere else)
    java/shell/reverse_tcp                           Connect back stager, Spawn a piped command shell (cmd&#46;exe on Windows, /bin/sh everywhere else)
    linux/armle/exec                                 Execute an arbitrary command
    linux/armle/shell_reverse_tcp                    Connect back to attacker and spawn a command shell
    linux/mipsbe/shell_reverse_tcp                   Connect back to attacker and spawn a command shell
    linux/mipsle/shell_reverse_tcp                   Connect back to attacker and spawn a command shell
    linux/ppc/shell_bind_tcp                         Listen for a connection and spawn a command shell
    linux/ppc/shell_find_port                        Spawn a shell on an established connection
    linux/ppc/shell_reverse_tcp                      Connect back to attacker and spawn a command shell
    linux/ppc64/shell_bind_tcp                       Listen for a connection and spawn a command shell
    linux/ppc64/shell_find_port                      Spawn a shell on an established connection
    linux/ppc64/shell_reverse_tcp                    Connect back to attacker and spawn a command shell
    linux/x86/adduser                                Create a new user with UID 0
    linux/x86/chmod                                  Runs chmod on specified file with specified mode
    linux/x86/exec                                   Execute an arbitrary command
    linux/x86/meterpreter/bind_ipv6_tcp              Listen for a connection over IPv6, Staged meterpreter server
    linux/x86/meterpreter/bind_tcp                   Listen for a connection, Staged meterpreter server
    linux/x86/meterpreter/find_tag                   Use an established connection, Staged meterpreter server
    linux/x86/meterpreter/reverse_ipv6_tcp           Connect back to attacker over IPv6, Staged meterpreter server
    linux/x86/meterpreter/reverse_tcp                Connect back to the attacker, Staged meterpreter server
    linux/x86/metsvc_bind_tcp                        Stub payload for interacting with a Meterpreter Service
    linux/x86/metsvc_reverse_tcp                     Stub payload for interacting with a Meterpreter Service
    linux/x86/shell/bind_ipv6_tcp                    Listen for a connection over IPv6, Spawn a command shell (staged)
    linux/x86/shell/bind_tcp                         Listen for a connection, Spawn a command shell (staged)
    linux/x86/shell/find_tag                         Use an established connection, Spawn a command shell (staged)
    linux/x86/shell/reverse_ipv6_tcp                 Connect back to attacker over IPv6, Spawn a command shell (staged)
    linux/x86/shell/reverse_tcp                      Connect back to the attacker, Spawn a command shell (staged)
    linux/x86/shell_bind_ipv6_tcp                    Listen for a connection over IPv6 and spawn a command shell
    linux/x86/shell_bind_tcp                         Listen for a connection and spawn a command shell
    linux/x86/shell_find_port                        Spawn a shell on an established connection
    linux/x86/shell_find_tag                         Spawn a shell on an established connection (proxy/nat safe)
    linux/x86/shell_reverse_tcp                      Connect back to attacker and spawn a command shell
    linux/x86/shell_reverse_tcp2                     Connect back to attacker and spawn a command shell
    netware/shell/reverse_tcp                        Connect back to the attacker, Connect to the NetWare console (staged)
    osx/armle/execute/bind_tcp                       Listen for a connection, Spawn a command shell (staged)
    osx/armle/execute/reverse_tcp                    Connect back to the attacker, Spawn a command shell (staged)
    osx/armle/shell/bind_tcp                         Listen for a connection, Spawn a command shell (staged)
    osx/armle/shell/reverse_tcp                      Connect back to the attacker, Spawn a command shell (staged)
    osx/armle/shell_bind_tcp                         Listen for a connection and spawn a command shell
    osx/armle/shell_reverse_tcp                      Connect back to attacker and spawn a command shell
    osx/armle/vibrate                                
				Causes the iPhone to vibrate, only works when the AudioToolkit library has been loaded&#46;
				Based on work by Charlie Miller &lt;cmiller&#91;at&#93;securityevaluators&#46;com&gt;&#46;
			
    osx/ppc/shell/bind_tcp                           Listen for a connection, Spawn a command shell (staged)
    osx/ppc/shell/find_tag                           Use an established connection, Spawn a command shell (staged)
    osx/ppc/shell/reverse_tcp                        Connect back to the attacker, Spawn a command shell (staged)
    osx/ppc/shell_bind_tcp                           Listen for a connection and spawn a command shell
    osx/ppc/shell_reverse_tcp                        Connect back to attacker and spawn a command shell
    osx/x86/bundleinject/bind_tcp                    Listen, read length, read buffer, execute, Inject a custom Mach-O bundle into the exploited process
    osx/x86/bundleinject/reverse_tcp                 Connect, read length, read buffer, execute, Inject a custom Mach-O bundle into the exploited process
    osx/x86/exec                                     Execute an arbitrary command
    osx/x86/isight/bind_tcp                          Listen, read length, read buffer, execute, Inject a Mach-O bundle to capture a photo from the iSight (staged)
    osx/x86/isight/reverse_tcp                       Connect, read length, read buffer, execute, Inject a Mach-O bundle to capture a photo from the iSight (staged)
    osx/x86/shell_bind_tcp                           Listen for a connection and spawn a command shell
    osx/x86/shell_find_port                          Spawn a shell on an established connection
    osx/x86/shell_reverse_tcp                        Connect back to attacker and spawn a command shell
    osx/x86/vforkshell/bind_tcp                      Listen, read length, read buffer, execute, Call vfork() if necessary and spawn a command shell (staged)
    osx/x86/vforkshell/reverse_tcp                   Connect, read length, read buffer, execute, Call vfork() if necessary and spawn a command shell (staged)
    osx/x86/vforkshell_bind_tcp                      Listen for a connection, vfork if necessary, and spawn a command shell
    osx/x86/vforkshell_reverse_tcp                   Connect back to attacker, vfork if necessary, and spawn a command shell
    php/bind_perl                                    Listen for a connection and spawn a command shell via perl (persistent)
    php/bind_php                                     Listen for a connection and spawn a command shell via php
    php/download_exec                                Download an EXE from an HTTP URL and execute it
    php/exec                                         Execute a single system command
    php/meterpreter/bind_tcp                         Listen for a connection, Run a meterpreter server in PHP
    php/meterpreter/reverse_tcp                      Reverse PHP connect back stager with checks for disabled functions, Run a meterpreter server in PHP
    php/meterpreter_reverse_tcp                      Connect back to attacker and spawn a Meterpreter server (PHP)
    php/reverse_perl                                 Creates an interactive shell via perl
    php/reverse_php                                  Reverse PHP connect back shell with checks for disabled functions
    php/shell_findsock                               
				Spawn a shell on the established connection to
				the webserver&#46;  Unfortunately, this payload
				can leave conspicuous evil-looking entries in the
				apache error logs, so it is probably a good idea
				to use a bind or reverse shell unless firewalls
				prevent them from working&#46;  The issue this
				payload takes advantage of (CLOEXEC flag not set
				on sockets) appears to have been patched on the
				Ubuntu version of Apache and may not work on
				other Debian-based distributions&#46;  Only tested on
				Apache but it might work on other web servers
				that leak file descriptors to child processes&#46;
				
    solaris/sparc/shell_bind_tcp                     Listen for a connection and spawn a command shell
    solaris/sparc/shell_find_port                    Spawn a shell on an established connection
    solaris/sparc/shell_reverse_tcp                  Connect back to attacker and spawn a command shell
    solaris/x86/shell_bind_tcp                       Listen for a connection and spawn a command shell
    solaris/x86/shell_find_port                      Spawn a shell on an established connection
    solaris/x86/shell_reverse_tcp                    Connect back to attacker and spawn a command shell
    tty/unix/interact                                Interacts with a TTY on an established socket connection
    windows/adduser                                  Create a new user and add them to local administration group
    windows/dllinject/bind_ipv6_tcp                  Listen for a connection over IPv6, Inject a Dll via a reflective loader
    windows/dllinject/bind_nonx_tcp                  Listen for a connection (No NX), Inject a Dll via a reflective loader
    windows/dllinject/bind_tcp                       Listen for a connection, Inject a Dll via a reflective loader
    windows/dllinject/find_tag                       Use an established connection, Inject a Dll via a reflective loader
    windows/dllinject/reverse_http                   Tunnel communication over HTTP using IE 6, Inject a Dll via a reflective loader
    windows/dllinject/reverse_ipv6_tcp               Connect back to the attacker over IPv6, Inject a Dll via a reflective loader
    windows/dllinject/reverse_nonx_tcp               Connect back to the attacker (No NX), Inject a Dll via a reflective loader
    windows/dllinject/reverse_ord_tcp                Connect back to the attacker, Inject a Dll via a reflective loader
    windows/dllinject/reverse_tcp                    Connect back to the attacker, Inject a Dll via a reflective loader
    windows/dllinject/reverse_tcp_allports           Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject a Dll via a reflective loader
    windows/dllinject/reverse_tcp_dns                Connect back to the attacker, Inject a Dll via a reflective loader
    windows/download_exec                            Download an EXE from an HTTP URL and execute it
    windows/exec                                     Execute an arbitrary command
    windows/messagebox                               Spawns a dialog via MessageBox using a customizable title, text & icon
    windows/meterpreter/bind_ipv6_tcp                Listen for a connection over IPv6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/bind_nonx_tcp                Listen for a connection (No NX), Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/bind_tcp                     Listen for a connection, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/find_tag                     Use an established connection, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/reverse_http                 Tunnel communication over HTTP using IE 6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/reverse_https                Tunnel communication over HTTP using SSL, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/reverse_ipv6_tcp             Connect back to the attacker over IPv6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/reverse_nonx_tcp             Connect back to the attacker (No NX), Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/reverse_ord_tcp              Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/reverse_tcp                  Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/reverse_tcp_allports         Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/meterpreter/reverse_tcp_dns              Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)
    windows/metsvc_bind_tcp                          Stub payload for interacting with a Meterpreter Service
    windows/metsvc_reverse_tcp                       Stub payload for interacting with a Meterpreter Service
    windows/patchupdllinject/bind_ipv6_tcp           Listen for a connection over IPv6, Inject a custom DLL into the exploited process
    windows/patchupdllinject/bind_nonx_tcp           Listen for a connection (No NX), Inject a custom DLL into the exploited process
    windows/patchupdllinject/bind_tcp                Listen for a connection, Inject a custom DLL into the exploited process
    windows/patchupdllinject/find_tag                Use an established connection, Inject a custom DLL into the exploited process
    windows/patchupdllinject/reverse_ipv6_tcp        Connect back to the attacker over IPv6, Inject a custom DLL into the exploited process
    windows/patchupdllinject/reverse_nonx_tcp        Connect back to the attacker (No NX), Inject a custom DLL into the exploited process
    windows/patchupdllinject/reverse_ord_tcp         Connect back to the attacker, Inject a custom DLL into the exploited process
    windows/patchupdllinject/reverse_tcp             Connect back to the attacker, Inject a custom DLL into the exploited process
    windows/patchupdllinject/reverse_tcp_allports    Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject a custom DLL into the exploited process
    windows/patchupdllinject/reverse_tcp_dns         Connect back to the attacker, Inject a custom DLL into the exploited process
    windows/patchupmeterpreter/bind_ipv6_tcp         Listen for a connection over IPv6, Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/bind_nonx_tcp         Listen for a connection (No NX), Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/bind_tcp              Listen for a connection, Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/find_tag              Use an established connection, Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/reverse_ipv6_tcp      Connect back to the attacker over IPv6, Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/reverse_nonx_tcp      Connect back to the attacker (No NX), Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/reverse_ord_tcp       Connect back to the attacker, Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/reverse_tcp           Connect back to the attacker, Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/reverse_tcp_allports  Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject the meterpreter server DLL (staged)
    windows/patchupmeterpreter/reverse_tcp_dns       Connect back to the attacker, Inject the meterpreter server DLL (staged)
    windows/shell/bind_ipv6_tcp                      Listen for a connection over IPv6, Spawn a piped command shell (staged)
    windows/shell/bind_nonx_tcp                      Listen for a connection (No NX), Spawn a piped command shell (staged)
    windows/shell/bind_tcp                           Listen for a connection, Spawn a piped command shell (staged)
    windows/shell/find_tag                           Use an established connection, Spawn a piped command shell (staged)
    windows/shell/reverse_http                       Tunnel communication over HTTP using IE 6, Spawn a piped command shell (staged)
    windows/shell/reverse_ipv6_tcp                   Connect back to the attacker over IPv6, Spawn a piped command shell (staged)
    windows/shell/reverse_nonx_tcp                   Connect back to the attacker (No NX), Spawn a piped command shell (staged)
    windows/shell/reverse_ord_tcp                    Connect back to the attacker, Spawn a piped command shell (staged)
    windows/shell/reverse_tcp                        Connect back to the attacker, Spawn a piped command shell (staged)
    windows/shell/reverse_tcp_allports               Try to connect back to the attacker, on all possible ports (1-65535, slowly), Spawn a piped command shell (staged)
    windows/shell/reverse_tcp_dns                    Connect back to the attacker, Spawn a piped command shell (staged)
    windows/shell_bind_tcp                           Listen for a connection and spawn a command shell
    windows/shell_bind_tcp_xpfw                      Disable the Windows ICF, then listen for a connection and spawn a command shell
    windows/shell_reverse_tcp                        Connect back to attacker and spawn a command shell
    windows/speak_pwned                              Causes the target to say \"You Got Pwned\" via the Windows Speech API
    windows/upexec/bind_ipv6_tcp                     Listen for a connection over IPv6, Uploads an executable and runs it (staged)
    windows/upexec/bind_nonx_tcp                     Listen for a connection (No NX), Uploads an executable and runs it (staged)
    windows/upexec/bind_tcp                          Listen for a connection, Uploads an executable and runs it (staged)
    windows/upexec/find_tag                          Use an established connection, Uploads an executable and runs it (staged)
    windows/upexec/reverse_http                      Tunnel communication over HTTP using IE 6, Uploads an executable and runs it (staged)
    windows/upexec/reverse_ipv6_tcp                  Connect back to the attacker over IPv6, Uploads an executable and runs it (staged)
    windows/upexec/reverse_nonx_tcp                  Connect back to the attacker (No NX), Uploads an executable and runs it (staged)
    windows/upexec/reverse_ord_tcp                   Connect back to the attacker, Uploads an executable and runs it (staged)
    windows/upexec/reverse_tcp                       Connect back to the attacker, Uploads an executable and runs it (staged)
    windows/upexec/reverse_tcp_allports              Try to connect back to the attacker, on all possible ports (1-65535, slowly), Uploads an executable and runs it (staged)
    windows/upexec/reverse_tcp_dns                   Connect back to the attacker, Uploads an executable and runs it (staged)
    windows/vncinject/bind_ipv6_tcp                  Listen for a connection over IPv6, Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/bind_nonx_tcp                  Listen for a connection (No NX), Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/bind_tcp                       Listen for a connection, Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/find_tag                       Use an established connection, Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/reverse_http                   Tunnel communication over HTTP using IE 6, Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/reverse_ipv6_tcp               Connect back to the attacker over IPv6, Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/reverse_nonx_tcp               Connect back to the attacker (No NX), Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/reverse_ord_tcp                Connect back to the attacker, Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/reverse_tcp                    Connect back to the attacker, Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/reverse_tcp_allports           Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject a VNC Dll via a reflective loader (staged)
    windows/vncinject/reverse_tcp_dns                Connect back to the attacker, Inject a VNC Dll via a reflective loader (staged)
    windows/x64/exec                                 Execute an arbitrary command (Windows x64)
    windows/x64/meterpreter/bind_tcp                 Listen for a connection (Windows x64), Inject the meterpreter server DLL via the Reflective Dll Injection payload (Windows x64) (staged)
    windows/x64/meterpreter/reverse_tcp              Connect back to the attacker (Windows x64), Inject the meterpreter server DLL via the Reflective Dll Injection payload (Windows x64) (staged)
    windows/x64/shell/bind_tcp                       Listen for a connection (Windows x64), Spawn a piped command shell (Windows x64) (staged)
    windows/x64/shell/reverse_tcp                    Connect back to the attacker (Windows x64), Spawn a piped command shell (Windows x64) (staged)
    windows/x64/shell_bind_tcp                       Listen for a connection and spawn a command shell (Windows x64)
    windows/x64/shell_reverse_tcp                    Connect back to attacker and spawn a command shell (Windows x64)
    windows/x64/vncinject/bind_tcp                   Listen for a connection (Windows x64), Inject a VNC Dll via a reflective loader (Windows x64) (staged)
    windows/x64/vncinject/reverse_tcp                Connect back to the attacker (Windows x64), Inject a VNC Dll via a reflective loader (Windows x64) (staged)

[/spoiler]
As you can see, there are a lot of payloads that can be used. In this tutorial we will be using

linux/x86/exec

This will simply execute a command. For the language we will use C. So here is an example:

&#46;/msfpayload linux/x86/exec CMD=\"ls -la\" C

This is the output we will get:

/*
 * linux/x86/exec - 42 bytes
 * http&#58;//www&#46;metasploit&#46;com
 * PrependSetresuid=false, PrependSetreuid=false, 
 * PrependSetuid=false, PrependChrootBreak=false, 
 * AppendExit=false, CMD=ls -la
 */
unsigned char buf&#91;&#93; = 
\"\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73\x68\"
\"\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x07\x00\x00\x00\x6c\"
\"\x73\x20\x2d\x6c\x61\x00\x57\x53\x89\xe1\xcd\x80\";

This particular shellcode is 42 bytes and shows you the options that were set. So if we want to incorporate this in C code you just copy that and now the unsigned character "buf" is the shellcode.
NOTE: For using in Python, use the ruby option (y) this should be compatible.

Method two:
This method is a bit less reliable and isn't as good. It's just for creating trivial shellcode that can be executed easily. Plus, it's easily decoded.
This method uses a perl code(not written by me). Here is the perl code:


#!/usr/bin/perl

# shellcode generator

print \"shellcode&#58; \";

$x1=&lt;&gt;;

my $data = \"$x1\";

chomp($data);

my @values = split(undef,$data);


foreach my $val (@values) {


chomp($val);

print '\x';

print unpack(H8,\"$val\");


}


print \"\n\";

exit 0;

Just paste this into a .pl file and type this:

perl shellcode&#46;pl

Now just type what you want(in this case, /bin/sh), and you will get the shellcode. Example:


chronic@vandal&#58;~$ perl shellcode&#46;pl
shellcode&#58; /bin/sh
\x2f\x62\x69\x6e\x2f\x73\x68

Sh3llc0d3

I saw the perl shellcode gen a while back and i'd rather stick with the metasploit method :)

chroniccommand

said:

I saw the perl shellcode gen a while back and i'd rather stick with the metasploit method :)

Yea the perl shellcode kinda sucks. It's technically not even shellcode lol. It's great for encoding things though. Like what I did in the troll thread encoding the rm -rf /

Sh3llc0d3

Yeah it has it's uses ;)

Howdy, Stranger!

Top Posters

Who's Online (0)