Skip to content

Commit 1b4cfce

Browse files
awghawgh
committed
Added directory-based shellcode repo, removed the "bits" field in favor of just Os/Arch scheme similar to golang.
1 parent c047807 commit 1b4cfce

15 files changed

+221
-67
lines changed

‎api/shellcode.go

+18-14
Original file line numberDiff line numberDiff line change
@@ -32,17 +32,22 @@ const (
3232

3333
// Architecture Options
3434

35-
// Intel flag for Intel/AMD architectures
36-
Intel Arch = "intel"
37-
// Arm flag for Arm architectures
35+
// Intel32 flag for Intel/AMD 32 bit architectures
36+
Intel32 Arch = "x32"
37+
// Intel64 flag for Intel/AMD 64 bit architectures
38+
Intel64 Arch = "x64"
39+
// Intel32y64 flag for Intel/AMD 32+64 bit combo shellcodes
40+
Intel32y64 Arch = "x32x64"
41+
// Arm flag for Arm 32 bit shellcodes
3842
Arm Arch = "arm"
43+
)
3944

40-
// Bits Options
45+
var (
46+
// Arches - list of human readable architecture names
47+
Arches []string = []string{"x32", "x64", "x32x64", "arm"}
4148

42-
// Bits32 flag for 32 bit architectures
43-
Bits32 Bits = "32"
44-
// Bits64 flag for 64 bit architectures
45-
Bits64 Bits = "64"
49+
// Oses - list of human readable OS names
50+
Oses []string = []string{"windows", "linux", "darwin"}
4651
)
4752

4853
// Generator - type for a shellcode generator
@@ -60,27 +65,26 @@ var generators []Generator
6065
func RegisterShellCode(
6166
os Os,
6267
arch Arch,
63-
bit Bits,
6468
name string,
6569
fx func(Parameters) ([]byte, error)) {
6670

67-
generators = append(generators, Generator{Os: os, Arch: arch, Bit: bit, Name: name, Function: fx})
71+
generators = append(generators, Generator{Os: os, Arch: arch, Name: name, Function: fx})
6872
}
6973

7074
// LookupShellCode - looks up shellcode by OS and architecture
71-
func LookupShellCode(os Os, arch Arch, bit Bits) []Generator {
75+
func LookupShellCode(os Os, arch Arch) []Generator {
7276
var ret []Generator
7377
for _, g := range generators {
74-
if g.Os == os && g.Arch == arch && g.Bit == bit {
78+
if g.Os == os && g.Arch == arch {
7579
ret = append(ret, g)
7680
}
7781
}
7882
return ret
7983
}
8084

8185
// PrintShellCodes - looks up shellcode by OS and architecture and prints the output
82-
func PrintShellCodes(os Os, arch Arch, bit Bits) {
83-
gens := LookupShellCode(os, arch, bit)
86+
func PrintShellCodes(os Os, arch Arch) {
87+
gens := LookupShellCode(os, arch)
8488
for _, g := range gens {
8589
log.Printf("%+v\n", g)
8690
}

‎generate.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ import (
66
"github.com/Binject/shellcode/api"
77
)
88

9-
// Generate - makes a shellcode
10-
func Generate(os api.Os, arch api.Arch, bit api.Bits, name string, params api.Parameters) ([]byte, error) {
9+
// Generate - makes a shellcode from a registered template module
10+
func Generate(os api.Os, arch api.Arch, name string, params api.Parameters) ([]byte, error) {
1111

12-
gs := api.LookupShellCode(os, arch, bit)
12+
gs := api.LookupShellCode(os, arch)
1313
for _, g := range gs {
1414
if g.Name == name {
1515
return g.Function(params)

‎govenom/main.go

+3-14
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,9 @@ import (
1111

1212
func main() {
1313

14-
var os, arch, bit string
14+
var os, arch string
1515
flag.StringVar(&os, "o", "linux", "Operating System: linux, windows, or freebsd")
1616
flag.StringVar(&arch, "a", "intel", "Architecture: intel or arm")
17-
flag.StringVar(&bit, "b", "64", "Bits (of the Architecture): 32 or 64")
1817
flag.Parse()
1918

2019
var osFlag api.Os
@@ -44,22 +43,12 @@ func main() {
4443
case "amd64":
4544
fallthrough
4645
case "intel":
47-
archFlag = api.Intel
46+
archFlag = api.Intel32
4847
case "arm":
4948
archFlag = api.Arm
5049
default:
5150
log.Fatal("Unknown Architecture")
5251
}
5352

54-
var bitsFlag api.Bits
55-
switch bit {
56-
case "32":
57-
bitsFlag = api.Bits32
58-
case "64":
59-
bitsFlag = api.Bits64
60-
default:
61-
log.Fatal("Unknown Bits")
62-
}
63-
64-
api.PrintShellCodes(osFlag, archFlag, bitsFlag)
53+
api.PrintShellCodes(osFlag, archFlag)
6554
}

‎modules/darwin_intel_32.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@ package modules
33
import "github.com/Binject/shellcode/api"
44

55
func init() {
6-
api.RegisterShellCode(api.Darwin, api.Intel, api.Bits32,
6+
api.RegisterShellCode(api.Darwin, api.Intel32,
77
"beaconing_reverse_shell_tcp", beaconing_reverse_shell_tcp_darwin_intel_32)
8-
api.RegisterShellCode(api.Darwin, api.Intel, api.Bits32,
8+
api.RegisterShellCode(api.Darwin, api.Intel32,
99
"delay_reverse_tcp_shell", delay_reverse_tcp_shell_darwin_intel_32)
10-
api.RegisterShellCode(api.Darwin, api.Intel, api.Bits32,
10+
api.RegisterShellCode(api.Darwin, api.Intel32,
1111
"reverse_tcp_shell", reverse_tcp_shell_darwin_intel_32)
12-
api.RegisterShellCode(api.Darwin, api.Intel, api.Bits32,
12+
api.RegisterShellCode(api.Darwin, api.Intel32,
1313
"user_shellcode", user_shellcode_darwin_intel_32)
1414
}
1515

‎modules/darwin_intel_64.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@ package modules
33
import "github.com/Binject/shellcode/api"
44

55
func init() {
6-
api.RegisterShellCode(api.Darwin, api.Intel, api.Bits64,
6+
api.RegisterShellCode(api.Darwin, api.Intel64,
77
"beaconing_reverse_shell_tcp", beaconing_reverse_shell_tcp_darwin_intel_64)
8-
api.RegisterShellCode(api.Darwin, api.Intel, api.Bits64,
8+
api.RegisterShellCode(api.Darwin, api.Intel64,
99
"delay_reverse_tcp_shell", delay_reverse_tcp_shell_darwin_intel_64)
10-
api.RegisterShellCode(api.Darwin, api.Intel, api.Bits64,
10+
api.RegisterShellCode(api.Darwin, api.Intel64,
1111
"reverse_tcp_shell", reverse_tcp_shell_darwin_intel_64)
12-
api.RegisterShellCode(api.Darwin, api.Intel, api.Bits64,
12+
api.RegisterShellCode(api.Darwin, api.Intel64,
1313
"user_shellcode", user_shellcode_darwin_intel_64)
1414
}
1515

‎modules/freebsd_intel_32.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ package modules
33
import "github.com/Binject/shellcode/api"
44

55
func init() {
6-
api.RegisterShellCode(api.FreeBSD, api.Intel, api.Bits32,
6+
api.RegisterShellCode(api.FreeBSD, api.Intel32,
77
"reverse_tcp_shell", reverse_tcp_shell_freebsd_intel_32)
8-
api.RegisterShellCode(api.FreeBSD, api.Intel, api.Bits32,
8+
api.RegisterShellCode(api.FreeBSD, api.Intel32,
99
"reverse_tcp_stager", reverse_tcp_stager_freebsd_intel_32)
10-
api.RegisterShellCode(api.FreeBSD, api.Intel, api.Bits32,
10+
api.RegisterShellCode(api.FreeBSD, api.Intel32,
1111
"user_shellcode", user_shellcode_freebsd_intel_32)
1212
}
1313

‎modules/linux_arm_32.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ package modules
33
import "github.com/Binject/shellcode/api"
44

55
func init() {
6-
api.RegisterShellCode(api.Linux, api.Arm, api.Bits32,
6+
api.RegisterShellCode(api.Linux, api.Arm,
77
"reverse_tcp_shell", reverse_tcp_shell_linux_arm_32)
8-
api.RegisterShellCode(api.Linux, api.Arm, api.Bits32,
8+
api.RegisterShellCode(api.Linux, api.Arm,
99
"reverse_tcp_stager", reverse_tcp_stager_linux_arm_32)
10-
api.RegisterShellCode(api.Linux, api.Arm, api.Bits32,
10+
api.RegisterShellCode(api.Linux, api.Arm,
1111
"user_shellcode", user_shellcode_linux_arm_32)
1212
}
1313

‎modules/linux_intel_32.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ package modules
33
import "github.com/Binject/shellcode/api"
44

55
func init() {
6-
api.RegisterShellCode(api.Linux, api.Intel, api.Bits32,
6+
api.RegisterShellCode(api.Linux, api.Intel32,
77
"reverse_tcp_shell", reverse_tcp_shell_linux_intel_32)
8-
api.RegisterShellCode(api.Linux, api.Intel, api.Bits32,
8+
api.RegisterShellCode(api.Linux, api.Intel32,
99
"reverse_tcp_stager", reverse_tcp_stager_linux_intel_32)
10-
api.RegisterShellCode(api.Linux, api.Intel, api.Bits32,
10+
api.RegisterShellCode(api.Linux, api.Intel32,
1111
"user_shellcode", user_shellcode_linux_intel_32)
1212
}
1313

‎modules/linux_intel_64.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ package modules
33
import "github.com/Binject/shellcode/api"
44

55
func init() {
6-
api.RegisterShellCode(api.Linux, api.Intel, api.Bits64,
6+
api.RegisterShellCode(api.Linux, api.Intel64,
77
"reverse_tcp_shell", reverse_tcp_shell_linux_intel_64)
8-
api.RegisterShellCode(api.Linux, api.Intel, api.Bits64,
8+
api.RegisterShellCode(api.Linux, api.Intel64,
99
"reverse_tcp_stager", reverse_tcp_stager_linux_intel_64)
10-
api.RegisterShellCode(api.Linux, api.Intel, api.Bits64,
10+
api.RegisterShellCode(api.Linux, api.Intel64,
1111
"user_shellcode", user_shellcode_linux_intel_64)
1212
}
1313

‎modules/windows_intel_32.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,22 @@ import (
77
)
88

99
func init() {
10-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits32,
10+
api.RegisterShellCode(api.Windows, api.Intel32,
1111
"iat_reverse_tcp_inline", iat_reverse_tcp_inline_win_intel_32)
12-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits32,
12+
api.RegisterShellCode(api.Windows, api.Intel32,
1313
"iat_reverse_tcp_inline_threaded", iat_reverse_tcp_inline_threaded_win_intel_32)
14-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits32,
14+
api.RegisterShellCode(api.Windows, api.Intel32,
1515
"iat_reverse_tcp_stager_threaded", iat_reverse_tcp_stager_threaded_win_intel_32)
16-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits32,
16+
api.RegisterShellCode(api.Windows, api.Intel32,
1717
"iat_user_shellcode_threaded", iat_user_shellcode_threaded_win_intel_32)
1818

19-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits32,
19+
api.RegisterShellCode(api.Windows, api.Intel32,
2020
"meterpreter_reverse_https_threaded", meterpreter_reverse_https_threaded_win_intel_32)
21-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits32,
21+
api.RegisterShellCode(api.Windows, api.Intel32,
2222
"reverse_tcp_shell_inline", reverse_tcp_shell_inline_win_intel_32)
23-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits32,
23+
api.RegisterShellCode(api.Windows, api.Intel32,
2424
"reverse_tcp_stager_threaded", reverse_tcp_stager_threaded_win_intel_32)
25-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits32,
25+
api.RegisterShellCode(api.Windows, api.Intel32,
2626
"user_shellcode_threaded", user_shellcode_threaded_win_intel_32)
2727
}
2828

‎modules/windows_intel_64.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,22 @@ import (
77
)
88

99
func init() {
10-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits64,
10+
api.RegisterShellCode(api.Windows, api.Intel64,
1111
"iat_reverse_tcp_inline", iat_reverse_tcp_inline_win_intel_64)
12-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits64,
12+
api.RegisterShellCode(api.Windows, api.Intel64,
1313
"iat_reverse_tcp_inline_threaded", iat_reverse_tcp_inline_threaded_win_intel_64)
14-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits64,
14+
api.RegisterShellCode(api.Windows, api.Intel64,
1515
"iat_reverse_tcp_stager_threaded", iat_reverse_tcp_stager_threaded_win_intel_64)
16-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits64,
16+
api.RegisterShellCode(api.Windows, api.Intel64,
1717
"iat_user_shellcode_threaded", iat_user_shellcode_threaded_win_intel_64)
1818

19-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits64,
19+
api.RegisterShellCode(api.Windows, api.Intel64,
2020
"meterpreter_reverse_https_threaded", meterpreter_reverse_https_threaded_win_intel_64)
21-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits64,
21+
api.RegisterShellCode(api.Windows, api.Intel64,
2222
"reverse_tcp_shell_inline", reverse_tcp_shell_inline_win_intel_64)
23-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits64,
23+
api.RegisterShellCode(api.Windows, api.Intel64,
2424
"reverse_tcp_stager_threaded", reverse_tcp_stager_threaded_win_intel_64)
25-
api.RegisterShellCode(api.Windows, api.Intel, api.Bits64,
25+
api.RegisterShellCode(api.Windows, api.Intel64,
2626
"user_shellcode_threaded", user_shellcode_threaded_win_intel_64)
2727
}
2828

‎repo.go

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
package shellcode
2+
3+
import (
4+
"errors"
5+
"io/ioutil"
6+
"log"
7+
"os"
8+
"path/filepath"
9+
10+
"github.com/Binject/shellcode/api"
11+
)
12+
13+
// Repo - Shellcode Repository, directory-backed
14+
type Repo struct {
15+
Directory string
16+
}
17+
18+
//NewRepo - create a new Repo object, if dirName is provided, directory structure will be created if it doesn't exist
19+
func NewRepo(dirName string) *Repo {
20+
repo := new(Repo)
21+
if dirName != "" {
22+
repo.Directory = dirName
23+
if err := initShellcodeDir(dirName); err != nil {
24+
log.Fatal(err)
25+
}
26+
}
27+
return repo
28+
}
29+
30+
func initShellcodeDir(dirName string) error {
31+
32+
if !DirExists(dirName) {
33+
if err := os.Mkdir(dirName, os.FileMode(int(0755))); err != nil {
34+
return err
35+
}
36+
}
37+
for _, ose := range api.Oses {
38+
osDir := filepath.Join(dirName, ose)
39+
if !DirExists(osDir) {
40+
if err := os.Mkdir(osDir, os.FileMode(int(0755))); err != nil {
41+
return err
42+
}
43+
}
44+
for _, arch := range api.Arches {
45+
archDir := filepath.Join(osDir, arch)
46+
if !DirExists(archDir) {
47+
if err := os.Mkdir(archDir, os.FileMode(int(0755))); err != nil {
48+
return err
49+
}
50+
}
51+
}
52+
}
53+
return nil
54+
}
55+
56+
// Lookup - fetches a completed shellcode from the filesystem
57+
func (r *Repo) Lookup(os api.Os, arch api.Arch, pattern string) ([]byte, error) {
58+
59+
// check specific directory first
60+
dir := filepath.Join(r.Directory, string(os), string(arch))
61+
if DirExists(dir) {
62+
files, err := WalkMatch(dir, pattern)
63+
if err != nil {
64+
return nil, err
65+
}
66+
if len(files) > 0 {
67+
return ioutil.ReadFile(files[0])
68+
}
69+
}
70+
// todo: fallback from intel32 or 64 to 32y64
71+
return nil, errors.New("No Matching Shellcode Found")
72+
}

‎shellcode_test.go

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package shellcode
2+
3+
import (
4+
"encoding/hex"
5+
"log"
6+
"path/filepath"
7+
"testing"
8+
9+
"github.com/Binject/shellcode/api"
10+
)
11+
12+
func Test_Shellcode_1(t *testing.T) {
13+
repo := NewRepo("shellcodes")
14+
_, err := CopyFile(filepath.Join("test", "win32messagebox.bin"), filepath.Join("shellcodes", "windows", "x32", "win32messagebox.bin"))
15+
if err != nil {
16+
t.Fatal(err)
17+
}
18+
shellcode, err := repo.Lookup(api.Windows, api.Intel32, "*.bin")
19+
log.Println(hex.Dump(shellcode))
20+
if err != nil {
21+
t.Fatal(err)
22+
}
23+
}

‎test/win32messagebox.bin

183 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)