shellcode_to_exe/shellcode_to_exe.py at main · TheEnergyStory/shellcode_to_exe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
"""
Author: Dominik Reichel (2022)

shellcode_to_exe - Create a Windows executable (x86/64) from a shellcode file
"""

__version__ = 0.2

import os
import argparse

from enum import Enum, IntEnum
from typing import Optional

HEADER_32 = '4D5A00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '00000000000000000000040000000504500004C010100000000000000000000000000E0000F010B010000DEADC0DE000000' \
            '000000000000100000001000000000000000004000001000000002000004000000000000000400000000000000FACEFEED0' \
            '002000000000000020000000000100000000100000010000010000000000000100000000000000000000000000000000000' \
            '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '0000000000000000000000000000002E7368656C6C0000DEADBEEF00100000CAFEBABE00020000000000000000000000000' \
            '000200000E00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '0000000000000000000000000000000000'

HEADER_64 = '4D5A00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '000000000000000000000400000005045000064860100000000000000000000000000F0002F000B020000DEADC0DE000000' \
            '000000000000100000001000000000400000000000001000000002000005000200000000000500020000000000FACEFEED0' \
            '002000000000000020000000000100000000000000001000000000000001000000000000010000000000000000000001000' \
            '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '000000000000000000000000000000000000000000000000000000000000002E7368656C6C0000DEADBEEF00100000CAFEB' \
            'ABE00020000000000000000000000000000200000E000000000000000000000000000000000000000000000000000000000' \
            '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' \
            '0000000000000000000000000000000000'


class HeaderFields(IntEnum):
    VIRTUALSIZE = 16
    RAWSIZE = 512
    SIZEOFIMAGE = 4096


class HeaderFieldMarkers(Enum):
    VIRTUALSIZE = b'\xDE\xAD\xBE\xEF'
    RAWSIZE = b'\xCA\xFE\xBA\xBE'
    SIZEOFCODE = b'\xDE\xAD\xC0\xDE'
    SIZEOFIMAGE = b'\xFA\xCE\xFE\xED'


class ShellcodeToExe:
    def __init__(self, bitness: str, shellcode_path: str, exe_path: str):
        self.bitness = bitness
        self.shellcode_path = shellcode_path
        self.exe_path = exe_path
        if bitness == '32':
            self.exe_header = bytes.fromhex(HEADER_32)
        elif bitness == '64':
            self.exe_header = bytes.fromhex(HEADER_64)

    @staticmethod
    def _calculate_field_size(field_name: str, size: int) -> int:
        result = size

        if size % HeaderFields[field_name.upper()].value != 0:
            result = size + (HeaderFields[field_name.upper()].value - (size % HeaderFields[field_name.upper()].value))

        return result

    def _update_header_field(self, field_name: str, size: int) -> bool:
        try:
            size_hex = size.to_bytes(4, byteorder='little')
            self.exe_header = self.exe_header.replace(HeaderFieldMarkers[field_name.upper()].value, size_hex)
            return True
        except Exception as e:
            print(f'[-] Could not update EXE header template field "{field_name}" - {e}.')
            return False

    def _get_shellcode(self) -> Optional[bytes]:
        if not os.path.exists(self.shellcode_path):
            print(f'[-] Shellcode file "{self.shellcode_path}" does not exist.')
            return

        with open(self.shellcode_path, 'rb') as f:
            return f.read()

    def _create_exe(self, file_bytes: bytes) -> None:
        if self.exe_path == 'shellcode.exe':
            self.exe_path = f'{os.path.join(os.path.dirname(self.shellcode_path), self.exe_path)}'

        with open(self.exe_path, 'wb') as f:
            f.write(file_bytes)
        print(f'[+] Created {self.bitness}-bit executable: {self.exe_path}')

    def run(self) -> None:
        shellcode = self._get_shellcode()

        if shellcode:
            shellcode_len = len(shellcode)

            virtual_size = self._calculate_field_size('VirtualSize', shellcode_len)
            raw_size = self._calculate_field_size('RawSize', shellcode_len)

            if shellcode_len != raw_size:
                # Fill shellcode section with 0 bytes according to alignment
                shellcode += bytes(raw_size - shellcode_len)

            if self._update_header_field('VirtualSize', virtual_size) and \
                    self._update_header_field('RawSize', raw_size) and \
                    self._update_header_field('SizeOfCode', raw_size) and \
                    self._update_header_field('SizeOfImage',
                                              self._calculate_field_size('SizeOfImage', virtual_size + 0x1000)):
                self._create_exe(self.exe_header + shellcode)


def main():
    parser = argparse.ArgumentParser(prog='shellcode_to_exe.py',
                                     description='Create a Windows executable (x86/64) from a shellcode file')
    parser.add_argument('-b', '--bitness', dest='bitness', type=str, required=True, help='"32" or "64" (bitness)')
    parser.add_argument('-s', '--shellcode', dest='shellcode', type=str, required=True, help='Shellcode file path')
    parser.add_argument('-e', '--executable', dest='executable', type=str, default='shellcode.exe',
                        help='Executable output path')
    args = parser.parse_args()

    s2e = ShellcodeToExe(args.bitness, args.shellcode, args.executable)
    s2e.run()


if __name__ == '__main__':
    main()