Created
December 20, 2018 17:05
-
-
Save AWilliams17/1705513b4d2a7e278449d4820db5c4b9 to your computer and use it in GitHub Desktop.
Quickly thrown together shellcode parsing script
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
""" | |
Usage: | |
-First assemble the .asm file eg (nasm -f elf test.asm) | |
-Then objdump the object file eg (objdump -d -M intel test.o) | |
-Execute the script with the bytecode you want parsed eg: | |
--------------------------------- | |
python3.7 'ShellParse.py' "31 c0 | |
50 | |
68 2f 2f 73 68 | |
68 2f 62 69 6e | |
89 e3 | |
50 | |
89 e2 | |
53 | |
89 e1 | |
b0 0b | |
cd 80" | |
--------------------------------- | |
This outputs the following: | |
--ShellParse-- | |
Parsed: "\31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" | |
""" | |
import argparse | |
import colorama | |
parser = argparse.ArgumentParser() | |
parser.add_argument("shellcode", help="the shellcode to be parsed") | |
args = None | |
def parse(shellcode): | |
inc = 0 | |
formatted = shellcode.replace("\n", " ") | |
parsed = "\\" | |
ignored = [] | |
while inc < len(formatted): | |
if formatted[inc] == " " and formatted[inc + 1] == " ": | |
ignored.append(inc) | |
if inc not in ignored: | |
if formatted[inc] == " ": | |
parsed += "\\x" | |
inc += 1 | |
parsed += formatted[inc] | |
inc += 1 | |
print(colorama.Fore.YELLOW + "Parsed: " + colorama.Fore.RED + '\"' + colorama.Fore.MAGENTA + parsed + colorama.Fore.RED + "\"") | |
def main(): | |
print(colorama.Fore.BLUE + "--ShellParse--" + colorama.Fore.GREEN) | |
parse(args.shellcode) | |
if __name__ == '__main__': | |
args = parser.parse_args() | |
colorama.init() | |
main() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment