ConnectBack shellcode configuration extractor

gistfile1.txt

#!/usr/bin/env python3

# Extract IP address and port from "ConnectBack" shellcode used in Gitlab intrusions
# https://bazaar.abuse.ch/browse/tag/ConnectBack/

import sys
import struct
import socket

with open(sys.argv[1], "rb") as fp:
    data = fp.read()

print("%s:%d" % (socket.inet_ntoa(struct.pack("<L", int.from_bytes(data[0xb2:0xb6], "little"))), socket.htons(int.from_bytes(data[0xb0:0xb2], "little"))))