Skip to content

Instantly share code, notes, and snippets.

@AWilliams17
Created December 20, 2018 17:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save AWilliams17/1705513b4d2a7e278449d4820db5c4b9 to your computer and use it in GitHub Desktop.
Save AWilliams17/1705513b4d2a7e278449d4820db5c4b9 to your computer and use it in GitHub Desktop.
Quickly thrown together shellcode parsing script
"""
Usage:
-First assemble the .asm file eg (nasm -f elf test.asm)
-Then objdump the object file eg (objdump -d -M intel test.o)
-Execute the script with the bytecode you want parsed eg:
---------------------------------
python3.7 'ShellParse.py' "31 c0
50
68 2f 2f 73 68
68 2f 62 69 6e
89 e3
50
89 e2
53
89 e1
b0 0b
cd 80"
---------------------------------
This outputs the following:
--ShellParse--
Parsed: "\31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"
"""
import argparse
import colorama
parser = argparse.ArgumentParser()
parser.add_argument("shellcode", help="the shellcode to be parsed")
args = None
def parse(shellcode):
inc = 0
formatted = shellcode.replace("\n", " ")
parsed = "\\"
ignored = []
while inc < len(formatted):
if formatted[inc] == " " and formatted[inc + 1] == " ":
ignored.append(inc)
if inc not in ignored:
if formatted[inc] == " ":
parsed += "\\x"
inc += 1
parsed += formatted[inc]
inc += 1
print(colorama.Fore.YELLOW + "Parsed: " + colorama.Fore.RED + '\"' + colorama.Fore.MAGENTA + parsed + colorama.Fore.RED + "\"")
def main():
print(colorama.Fore.BLUE + "--ShellParse--" + colorama.Fore.GREEN)
parse(args.shellcode)
if __name__ == '__main__':
args = parser.parse_args()
colorama.init()
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment