SvATTT2017 - Shellcap

parse.py

f = open('raw','rb').read()
dic = {}
maxx = 0

for i in range(0,len(f),3):
	offset, data = int(f[i:i+2].encode('hex'),16),f[i+2].encode('hex')
	# print offset, data
	if offset > maxx:
		maxx = offset
	dic[offset] = data

shell = ''
for i in range(maxx):
	try:
		shell += dic[i]
	except:
		shell += '00'

f = open('shell','wb')
f.write(shell.decode('hex'))
f.close()