Package: shellcrafter
ShellcrafterShellcrafter is a package containing scripts for developing and generating shellcode.It provides a collection of utilities for working with shellcode in various ways, such as generating shellcode from assembly instructions, computing hashes from function names, converting ASCII text to hex stack push instructions, loading DLLs, and finding ROP gadgets.InstallationTo install Shellcrafter, use pip:$pip3installshellcrafterOr clone this repository and run:$pip3install.UsageShellcrafter provides the following command-line utilities:keyst-api: A shellcode generator using the Keystone Engine to assemble assembly instructions into shellcode.shellcode-procedure-generator: A versatile tool for generating assembly instructions for various purposes. It can generate push instructions for ASCII strings, instructions for loading a DLL, write ASCII strings to memory, and compute a hash of an input string using an algorithm similar to the one used in assembly for importing a function by its hash. It also provides an option to avoid NULL bytes in the generated shellcode.find-gadgets: Searches for clean, categorized gadgets from a given list of files.To get help on how to use each utility, run the corresponding command with the-hor--helpflag:$keyst-api--help
$shellcode-procedure-generator--help
$find-gadgets--helpExamplesHere are some examples of how to use the shellcode-procedure-generator tool:To generate push instructions for an ASCII string:$shellcode-procedure-generator--push-for-ascii--ascii-stringshell32.dll
push_str:;# push the 'shell32.dll' onto the stackpush0x006c6c64;# Push the part "lld." of the string "shell32.dll" onto the stackpush0x2e32336c;# Push the part "23ll" of the string "shell32.dll" onto the stackpush0x6c656873;# Push the part "ehs" of the string "shell32.dll" onto the stackTo generate push instructions for an ASCII string and escape the NULL bytes by using the negate approach:$shellcode-procedure-generator--push-for-ascii--ascii-stringshell32.dll--null-free
push_str:;# push the 'shell32.dll' onto the stackmoveax,0xff93939c;# Move the negated value of the part "lld." of the string "shell32.dll" to EAX to avoid NULL bytesnegeax;# Negate EAX to get the original valuepusheax;# Push EAX onto the stackpush0x2e32336c;# Push the part "23ll" of the string "shell32.dll" onto the stackpush0x6c656873;# Push the part "ehs" of the string "shell32.dll" onto the stackTo generate instructions for loading a DLL:$shellcode-procedure-generator--load-library--load-library-addr"[ebp+0x10]"--load-library-dll-nameshell32.dll
load_lib:;# load the shell32.dll DLLxoreax,eax;# NULL EAXpush0x006c6c64;# Push the part "lld." of the string "shell32.dll" onto the stackpush0x2e32336c;# Push the part "23ll" of the string "shell32.dll" onto the stackpush0x6c656873;# Push the part "ehs" of the string "shell32.dll" onto the stackpushesp;# Push ESP to have a pointer to the string that is currently located on the stackcalldwordptr[ebp+0x10];# Call LoadLibraryATo do the same, but escape the NULL byte:$shellcode-procedure-generator--load-library--load-library-addr"[ebp+0x10]"--load-library-dll-nameshell32.dll--null-free
load_lib:;# load the shell32.dll DLLxoreax,eax;# NULL EAXmoveax,0xff93939c;# Move the negated value of the part "lld." of the string "shell32.dll" to EAX to avoid NULL bytesnegeax;# Negate EAX to get the original valuepusheax;# Push EAX onto the stackpush0x2e32336c;# Push the part "23ll" of the string "shell32.dll" onto the stackpush0x6c656873;# Push the part "ehs" of the string "shell32.dll" onto the stackpushesp;# Push ESP to have a pointer to the string that is currently located on the stackcalldwordptr[ebp+0x10];# Call LoadLibraryATo generate instructions for writing an ASCII string to memory:$shellcode-procedure-generator--write--ascii-string"http://kali/met.exe"--write-addr"[ebp-0x50]"write_str:;# write http://kali/met.exe to [ebp-0x50]xoreax,eax;# NULL EAXxorecx,ecx;# NULL ECXleaeax,[ebp-0x50];# Load the address to write to into EAXmovecx,0x70747468;# Move the part "http" of the string "http://kali/met.exe" to ECXmov[eax],ecx;# Write the part "http" of the string "http://kali/met.exe" to memorymovecx,0x6b2f2f3a;# Move the part "://k" of the string "http://kali/met.exe" to ECXmov[eax+0x04],ecx;# Write the part "://k" of the string "http://kali/met.exe" to memorymovecx,0x2f696c61;# Move the part "ali/" of the string "http://kali/met.exe" to ECXmov[eax+0x08],ecx;# Write the part "ali/" of the string "http://kali/met.exe" to memorymovecx,0x2e74656d;# Move the part "met." of the string "http://kali/met.exe" to ECXmov[eax+0x0c],ecx;# Write the part "met." of the string "http://kali/met.exe" to memorymovecx,0x00657865;# Move the part "exe" of the string "http://kali/met.exe" to ECXmov[eax+0x10],ecx;# Write the part "exe" of the string "http://kali/met.exe" to memoryTo do the same, but escape the NULL byte:$shellcode-procedure-generator--write--ascii-string"http://kali/met.exe"--write-addr"[ebp-0x50]"--null-free
write_str:;# write http://kali/met.exe to [ebp-0x50]xoreax,eax;# NULL EAXxorecx,ecx;# NULL ECXleaeax,[ebp-0x50];# Load the address to write to into EAXmovecx,0x70747468;# Move the part "http" of the string "http://kali/met.exe" to ECXmov[eax],ecx;# Write the part "http" of the string "http://kali/met.exe" to memorymovecx,0x6b2f2f3a;# Move the part "://k" of the string "http://kali/met.exe" to ECXmov[eax+0x04],ecx;# Write the part "://k" of the string "http://kali/met.exe" to memorymovecx,0x2f696c61;# Move the part "ali/" of the string "http://kali/met.exe" to ECXmov[eax+0x08],ecx;# Write the part "ali/" of the string "http://kali/met.exe" to memorymovecx,0x2e74656d;# Move the part "met." of the string "http://kali/met.exe" to ECXmov[eax+0x0c],ecx;# Write the part "met." of the string "http://kali/met.exe" to memorymovecx,0xff9a879b;# Move the negated value of the part "exe" of the string "http://kali/met.exe" to ECX to avoid NULL bytesnegecx;# Negate ECX to get the original valuemov[eax+0x10],ecx;# Write the part "exe" of the string "http://kali/met.exe" to memoryCalculate a hash of the given input string:$shellcode-procedure-generator--hashLoadLibraryA
Hash:0xec0e4e8ePrint out the hashing algorithm used to generate the hash value:$shellcode-procedure-generator--hash-algcompute_hash:xoreax,eax;# NULL EAXcdq;# NULL EDXcld;# clear direction (clears the direction flag DF in the EFLAGS register)compute_hash_again:lodsb;# load the next byte from ESI into ALtestal,al;# check if AL contains the NULL terminatorjzcompute_hash_finished;# if the ZF is set, we've hit the NULL terminatorroredx,0x0d;# rotate EDX 13 bits to the rightaddedx,eax;# add the new hashed byte to the accumulatorjmpcompute_hash_again;# next iterationcompute_hash_finished: