Converting shellcode to executable files using InlineEgg

Today I found this through Twitter: a web service to convert shellcode to executable files. Here’s the link to it: http://sandsprite.com/shellcode_2_exe.php.

Then I thought: hey, why do we have to send our beautiful shellcodes to someone else on the Internet when we can do it all locally? 🙂

So I whipped up this quick Python script using CORE’s InlineEgg package. It was coded in a few minutes so don’t blame me if it’s got bugs 😉 instead let me know about it and I’ll try to fix it.

Enjoy! 🙂

Updates

• Anand Sastry has tweaked the script to accept not only shellcode in binary form, but also shellcode encoded as a ‘\x’ ASCII string. Check it out!

• Moved the source code to Github

Download

shellcode2exe.py

Source code

Ouroboros.py

This is a little nonsense I just wrote after reading the Wikipedia entry for Ouroboros. Turns out this kind of programs already have a name too, Quine.

In this case it’s a Python script that uses InlineEgg to generate an ELF32 binary that generates a Python script that uses InlineEgg to generate an ELF32 binary that generates a Python script that uses InlineEgg to… well, you get the point. 🙂

Yeah, I know this is not really about computer security, but what the hell. It’s got Python and shellcode somewhere anyway.

A real Ouroboros!

Ouroboros.py

#!/usr/bin/python from sys import argv, stdout from inlineegg.inlineegg import InlineEgg, Linuxx86Syscall from inlineegg.exelib import Elf32Program script = open(argv[0], 'r').read() egg = InlineEgg(Linuxx86Syscall) egg.write(1, script, len(script)) egg.exit(0) prg = Elf32Program() prg.arch = prg.ARCH_I386 prg.addCode(str(egg)) stdout.write(prg.bytes())

Hello world!

Hello there, welcome to my blog. I’ll begin with some useless welcome post, like most blogs do 🙂 and make it worse with an incredibly nerdy thing to do:

31 db 43 68 21 0a 00 00 68 6f 72 6c 64 68 6f 2c 20 77 68 48 65 6c 6c 89 e1 6a 0e 5a 6a 04 58 cd 80 31 db 31 c0 40 cd 80

Nope, it’s not a Cthulhu chant in some strange and ancient Unicode encoding. I admit it might have been though – we all know Unicode is evil.

No… It’s nothing but a… green-and-black Matrix themed “Hello World” Linux shellcode! 😀