import subprocess import os import pefile import shutil print("Super Mega") use_compile = True use_test = False use_sgn = False use_append = True def main(): if use_compile: print("--[ Compile C source to ASM ]") path_cl = r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\cl.exe' subprocess.run([ path_cl, "/c", "/FA", "/GS-", "source/main.c" ]) if not os.path.isfile("main.asm"): print("Error") return else: print(" Generated main.asm") print("--[ Cleanup ASM ]") path_masmshc = r'C:\Users\hacker\Source\Repos\masm_shc\out\build\x64-Debug\masm_shc\masm_shc.exe' subprocess.run([ path_masmshc, "main.asm", "main-clean.asm", ]) clean_asm_file("main-clean.asm") if not os.path.isfile("main-clean.asm"): print("Error") return else: print(" Generated main-clean.asm") print("--[ Compile to exe ]") path_ml64 = r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\ml64.exe' subprocess.run([ path_ml64, "main-clean.asm", "/link", "/entry:AlignRSP" ]) if not os.path.isfile("main-clean.exe"): print("Error") return else: print(" Generated main-clean.exe") print("--[ Get code section from exe ]") code = get_code_section("main-clean.exe") with open("main-clean.bin", 'wb') as f: f.write(code) print("--[ Shellcode written to: main-clean.bin size: {} ]".format(len(code))) if use_test: print("--[ Test it with runshc ]") path_runshc = r'C:\Users\hacker\Source\Repos\masm_shc\out\build\x64-Debug\runshc\runshc.exe' subprocess.run([ path_runshc, "main-clean.bin", ]) if use_sgn: print("--[ Convert with SGN ]") path_sgn = r'C:\training\tools\sgn\sgn.exe' subprocess.run([ path_sgn, "--arch=64", "-i", "{}".format("main-clean.bin"), "-o", "{}".format("main-clean-sgn.bin"), ]) if not os.path.isfile("main-clean-sgn.bin"): print("Error") return else: print(" Generated main-clean-sgn.bin") print("--[ Test SGN shellcode ]") path_shexec = r'C:\Research\hasherezade\exec_fiber\sh-exec-fiber.exe' subprocess.run([ path_shexec, "{}".format("main-clean-sgn.bin"), ]) else: shutil.copyfile("main-clean.bin", "main-clean-sgn.bin") if use_append: with open("main-clean.bin", 'rb') as input1: data_stager = remove_trailing_null_bytes(input1.read()) with open("shellcodes/calc64.bin", 'rb') as input2: data_payload = input2.read() with open("main-clean-append.bin", 'wb') as output: output.write(data_stager) output.write(data_payload) print("--[ Test Append shellcode ]") path_shexec = r'C:\Research\hasherezade\exec_fiber\sh-exec-fiber.exe' subprocess.run([ path_shexec, "{}".format("main-clean-append.bin"), ]) def clean_asm_file(filename): with open(filename, 'r') as asmfile: lines = asmfile.readlines() # $LN1@main: # ; Line 82 # add rsp, 2392 ; 00000958H # ret 0 # main ENDP # _TEXT ENDS # # ; Line 81 # xor eax, eax # jmp testing # $LN1@main: # ; Line 82 # ; add rsp, 2392 ; 00000958H # ; ret 0 # main ENDP # _TEXT ENDS for idx, line in enumerate(lines): if lines[idx].startswith("main\tENDP"): print("--( Fix main-end jmp at line: {}) ".format(idx)) lines[idx-1] = "; " + lines[idx-1] lines[idx-2] = "; " + lines[idx-2] lines.insert(idx-4, "\tjmp shcstart\r\n") break # _TEXT ENDS # END # -> # testing: # nop # _TEXT ENDS # END # for idx, line in enumerate(lines): if lines[idx].startswith("END"): print("--( Add end of code label at: {})".format(idx)) lines.insert(idx-1, "shcstart:\r\n") lines.insert(idx, "\tnop\r\n") break with open(filename, 'w') as asmfile: asmfile.writelines(lines) def remove_trailing_null_bytes(data): for i in range(len(data) - 1, -1, -1): if data[i] != b'\x00'[0]: # Check for a non-null byte return data[:i + 1] return b'' # If the entire sequence is null bytes # $env:INCLUDE="C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\ATLMFC\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt;C:\Program Files (x86)\Windows Kits\NETFXSDK\4.8\include\um" # $env:LIB=C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\ATLMFC\lib\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\lib\x64;C:\Program Files (x86)\Windows Kits\NETFXSDK\4.8\lib\um\x64;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x64;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x64 # $env:LIBPATH=C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\ATLMFC\lib\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\lib\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319 def get_code_section(pe_file): try: # Load the PE file pe = pefile.PE(pe_file) # Iterate over the sections for section in pe.sections: # Check if this is the code section if '.text' in section.Name.decode().rstrip('\x00'): print("--> Size: {}".format(section.SizeOfRawData)) return section.get_data() else: print("Code section not found.") except FileNotFoundError: print(f"File not found: {pe_file}") except pefile.PEFormatError: print(f"Invalid PE file: {pe_file}") main()