first udpate tools

Author: desword

patternLocOffset.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env python
+#####################################################################################
+## Create pattern strings & location offset 
+## Tested against Ubuntu 12.04 & Windows # #
+##
+## Example:
+## C:\Users\Lenov\Desktop> patterLocOffset.py -c -l 260 -f output.txt
+### [*] Create pattern string contains 260 characters ok!
+### [+] output to output.txt ok!
+##
+## C:\Users\Lenov\Desktop> patternLocOffset.py -s 0x41613141 -l 260
+### [*] Create pattern string contains 260 characters ok!
+### [*] Exact match at offset 3
+#
+## Nimdakey # 09-10-2013
+#####################################################################################
+
+import argparse
+import struct
+import binascii
+import string
+import time
+import sys
+import re
+
+a = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+b = "abcdefghijklmnopqrstuvwxyz"
+c = "0123456789"
+
+def generate(count,output):
+    #
+    # pattern create
+    codeStr = ''
+    print '[*] Create pattern string contains %d characters'%count,
+    timeStart = time.time()
+    for i in range(0,count):
+        codeStr += a[i/(26*10)]+b[(i%(26*10))/10]+c[i%(26*10)%10]
+    print 'ok!'
+    if output:
+        print '[+] output to %s'%output,
+        fw = open(output,'w')
+        fw.write(codeStr)
+        fw.close() 
+        print 'ok!'
+    else:
+        return codeStr
+    print "[+] take time: %.4f s"%(time.time()-timeStart)
+    
+def patternMatch(searchCode, length=1024):
+    #
+    # pattern search
+    offset = 0
+    pattern = None
+
+    timeStart = time.time()
+    is0xHex = re.match('^0x[0-9a-fA-F]{8}',searchCode)
+    isHex = re.match('^[0-9a-fA-F]{8}',searchCode)
+    
+    if is0xHex:
+        #0x41613141
+        pattern = binascii.a2b_hex(searchCode[2:])
+    elif isHex:
+        #41613141
+        pattern = binascii.a2b_hex(searchCode)
+    else:
+        print '[-] seach Pattern eg:0x41613141'
+        sys.exit(1)
+        
+    source = generate(length,None)
+    offset = source.find(pattern)
+    
+    if offset != -1:
+        print "[*] Exact match at offset %d"%offset
+    else:
+        print "[*] No exact matches, looking for likely candidates..."
+        reverse = list(pattern)
+        reverse.reverse()
+        pattern = "".join(reverse)
+        offset = source.find(pattern)
+        if offset != -1:
+            print "[+] Possible match at offset %d (adjusted another-endian)"%offset
+    print "[+] take time: %.4f s"%(time.time()-timeStart)
+    
+def main():
+    ## parse argument
+    parser = argparse.ArgumentParser()
+    parser.add_argument('-s', '--search', help='search for pattern')
+    parser.add_argument('-c', '--create', help='create a pattern',\
+                        action='store_true')
+    parser.add_argument('-f', '--file', help='output file name',\
+                        default='patternShell.txt')
+    parser.add_argument('-l', '--length',help='length of pattern code',\
+                        type=int,default=1024)
+    #parser.add_argument('-v', dest='verbose', action='store_true')
+    args = parser.parse_args()
+
+    ## save all argument
+    length = args.length
+    output = args.file
+    #verbose = args.verbose
+    createCode = args.create
+    searchCode = args.search
+
+    if createCode and (0 < args.length <= 26*26*10):
+        #eg:  -c -l 90
+        generate(length,output)
+    elif searchCode and (0 < args.length <= 26*26*10):
+        #eg: -s 0x474230141
+        patternMatch(searchCode,length)
+    else:
+        print '[-] You shoud chices from [-c -s]'
+        print '[-] Pattern length must be less than 6760'
+        print 'more help: pattern.py -h'
+    # ...
+
+if __name__ == "__main__":
+    main()

shell_extractor.py

@@ -0,0 +1,134 @@
+#!/usr/bin/env python
+#####################################################################################
+## extract shellcode binarys for c or python
+## Tested against Ubuntu 12.04 & Windows # #
+##
+## Example:
+# $ python shell_extractor.py execve c
+# char shellcode[] = {
+# "\x24\x06\x06\x66"
+# "\x04\xd0\xff\xff"
+# "\x28\x06\xff\xff"
+# "\x27\xbd\xff\xe0"
+# "\x27\xe4\x10\x01"
+# "\x24\x84\xf0\x1f"
+# "\xaf\xa4\xff\xe8"
+# "\xaf\xa0\xff\xec"
+# "\x27\xa5\xff\xe8"
+# "\x24\x02\x0f\xab"
+# "\x00\x00\x00\x0c"
+# "\x2f\x62\x69\x6e"
+# "\x2f\x73\x68\x00"
+# };
+## desword # 2018-8-2
+#####################################################################################
+
+
+
+import os
+import sys
+
+def ExtractOffset(line):    
+    sp = line.split(' ')
+    while '' in sp:
+        sp.remove('')
+    # print sp
+
+    try:
+        section = sp[2]
+    except:
+        section = -1
+    try:
+        offset = int(sp[5], 16)
+    except:
+        offset = -1
+    try:
+        size = int(sp[6], 16)
+    except:
+        size = -1
+    return [section, offset, size]
+
+def usage():
+    print "[+] Usage: python shell_extractor.py [filename] [format]"
+    print "[*] Where format can be c or py"
+    
+
+
+try:
+    fileName = sys.argv[1]
+    printformat = sys.argv[2]
+except:
+    usage()
+    exit(1)
+
+
+extractionCmd = "readelf -S " + fileName
+
+
+result = os.popen(extractionCmd)
+res = result.read()
+lines = res.splitlines()
+
+section = 0; offset = 0; size = 0;
+
+for line in lines:
+    [section, offset, size] = ExtractOffset(line)
+    if section == ".text":
+        # print line
+        # print "find, offset", offset, "size", size
+        break;
+
+
+
+f = open(fileName,"rb")
+outfile = []
+i = 0
+while 1:
+    c = f.read(1)
+    i = i + 1
+    if not c:
+        break
+    if ord(c) <= 15:
+        outfile.append("0x0"+hex(ord(c))[2:])
+    else:
+        outfile.append(hex(ord(c)))
+
+f.close()
+
+
+### extract shell code
+
+extracted = outfile[offset:offset+size]
+
+
+
+### print for  shellcode book.
+
+if printformat == "py":
+    shellOutput = ["shellcode = \"\""]
+    shellHeader = "shellcode +="
+    for i in range(0, len(extracted), 4):
+        shelltmp = ""
+        for eachByte in extracted[i:i+4]:
+            shelltmp += ("\\x" + eachByte[2:])
+        shellOutput.append("%s \"%s\"" % (shellHeader, shelltmp))
+
+    shellOutputStr = "\n".join(shellOutput)
+    print shellOutputStr
+elif printformat == "c":
+
+    ### print for c source code test
+
+    shellOutput = ["char shellcode[] = {"]
+    for i in range(0, len(extracted), 4):
+        shelltmp = ""
+        for eachByte in extracted[i:i+4]:
+            shelltmp += ("\\x" + eachByte[2:])
+        shellOutput.append("\"%s\"" % (shelltmp))
+    shellOutput.append("};")
+
+    shellOutputStr = "\n".join(shellOutput)
+    print shellOutputStr
+
+
+