shellcode_generator/shellcode_generator.py at main · amitniz/shellcode_generator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
#! /usr/bin/env python3
from binascii import unhexlify
import os,sys
import re
import subprocess
import tempfile
import argparse
WRAPPER_FILE = f'{os.path.dirname(os.path.realpath(__file__))}/wrapper.asm'


banner = '''

   _____ _          _ _               _
  / ____| |        | | |             | |
 | (___ | |__   ___| | | ___ ___   __| | ___
  \___ \| '_ \ / _ \ | |/ __/ _ \ / _` |/ _ \
  ____) | | | |  __/ | | (_| (_) | (_| |  __/
 |_____/|_| |_|\___|_|_|\___\___/ \__,_|\___|
  / ____|                         | |
 | |  __  ___ _ __   ___ _ __ __ _| |_ ___  _ __
 | | |_ |/ _ \ '_ \ / _ \ '__/ _` | __/ _ \| '__|
 | |__| |  __/ | | |  __/ | | (_| | || (_) | |
  \_____|\___|_| |_|\___|_|  \__,_|\__\___/|_|


  ** https://github.com/AmitNiz/shellcode_generator.git **
'''
if len(sys.argv) == 1 or '-h' in sys.argv or '--help' in sys.argv:
	print(banner)


parser = argparse.ArgumentParser()

parser.add_argument('ifile',metavar='IFILE',type=str,help = 'input file')

parser.add_argument('-a','--arch',metavar='ARCH',type=str,default='elf32',
					help = 'shell code architecture: elf32 (default), elf64, \
							macho32, macho64, win32, win64')

parser.add_argument('-f','--format',metavar='FORMAT',type=str,default='hex',
					help = "output format.\nfor example '\\x' -> '\\xde\\xad\\xbe\\xef',\
											'' -> deadbeef. print as hexadecimal as default")

parser.add_argument('-v','--verbose',action='store_true',help='verbose mode')

if __name__ == '__main__':

	args = parser.parse_args()

	with open(WRAPPER_FILE,'r') as wrapper_file:
		wrapper = wrapper_file.read() # read the wrapper

	try:
		with open(args.ifile,'r') as code_file:
			assembly_code = code_file.read() # read the assembly code
	except:
		print(f'[!] ERROR:  can\'t open: {args.ifile}')
		exit(1)

	# create a temporary whole assembly file
	with tempfile.NamedTemporaryFile('w',delete=False) as asm_file:
		asm_file.write(wrapper.format(CODE=assembly_code))


	obj_file = tempfile.NamedTemporaryFile('w+b',delete=False)

	#compile the assembly file
	res = subprocess.run(f'nasm -f {args.arch} -o {obj_file.name} {asm_file.name}',capture_output=True,shell=True)
	if res.returncode:
		print("[!] ERROR: failed to compile. check your code.")
		os.unlink(asm_file.name)
		exit(res.returncode)

	#disassemble
	res = subprocess.run(f'objdump -d -M att {obj_file.name}',capture_output=True,shell=True)
	if res.returncode:
		print('[!] ERROR: failed to disassemble.')
		os.unlink(asm_file.name)
		os.unlink(obj_file.name)
		exit(res.returncode)

	#delete temporary files
	os.unlink(asm_file.name)
	os.unlink(obj_file.name)

	#extract the opcodes
	opcodes = re.findall(r'\b([0-9a-f]{2})\s',res.stdout.decode())

	if args.verbose:
		print(f'[+] shellcode length: {len(opcodes)}')
		print('\n[+] objdump output:')
		print('-'*30)
		print(''.join(re.findall(r'\s+\w+:.*',res.stdout.decode())))
		print('\n[+] shellcode:')
		print('-'*30)
	if args.format == 'hex':
		sys.stdout.buffer.write(unhexlify(''.join(opcodes)))
	else:
		print(f'{args.format}'+f'{args.format}'.join(opcodes))