mirror of
https://github.com/winterknife/EVENSTAR
synced 2026-06-21 14:13:51 +00:00
winterknife
60 lines
1.7 KiB
Python
60 lines
1.7 KiB
Python
#!/usr/bin/env python
|
|
|
|
|
|
"""
|
|
[+] Usage: python.exe merge_shellcode.py [x86-32 shellcode input filename] [x86-64 shellcode input filename] [multi-bitness x86 shellcode output filename]
|
|
|
|
[x86-32 shellcode input filename] - Path to 32-bit x86 PIC file which is to be combined into a single-shot dual-mode payload
|
|
[x86-64 shellcode input filename] - Path to 64-bit x86 PIC file which is to be combined into a single-shot dual-mode payload
|
|
[multi-bitness x86 shellcode output filename] - Path to multi-bitness x86 PIC file which will be saved to disk after merging (can be executed in both IA-32 and IA-32e mode)
|
|
|
|
Example: python.exe merge_shellcode.py shellcode_x86.bin shellcode_x64.bin shellcode_multi.bin
|
|
"""
|
|
|
|
|
|
import sys
|
|
import struct
|
|
|
|
|
|
def main():
|
|
try:
|
|
if len(sys.argv) == 4:
|
|
x86shellcodeinputfilename = sys.argv[1]
|
|
x64shellcodeinputfilename = sys.argv[2]
|
|
outputfilename = sys.argv[3]
|
|
else:
|
|
raise
|
|
except:
|
|
print("[-] Invalid args.")
|
|
print(__doc__)
|
|
sys.exit(0)
|
|
|
|
x86shellcode = open(x86shellcodeinputfilename, "rb").read()
|
|
x64shellcode = open(x64shellcodeinputfilename, "rb").read()
|
|
file = open(outputfilename, "wb+")
|
|
|
|
"""
|
|
mode detection stub
|
|
|
|
(32-bit)
|
|
xor ecx, ecx ; set EFLAGS.ZF
|
|
arpl cx, cx ; clear EFLAGS.ZF
|
|
jz rel32
|
|
|
|
(64-bit)
|
|
xor ecx, ecx ; set EFLAGS.ZF
|
|
movsxd ecx, ecx
|
|
jz rel32
|
|
"""
|
|
file.write(b'\x31\xC9\x63\xC9\x0F\x84')
|
|
file.write(struct.pack('<I', len(x86shellcode)))
|
|
file.write(x86shellcode)
|
|
file.write(x64shellcode)
|
|
|
|
file.close()
|
|
|
|
print("[+] Merged x86-32 and x86-64 shellcode into multi-bitness x86 shellcode.")
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main() |