2

Is the hex code at the top of this source file the same as the assembly at the bottom, as in they do the same thing?

How can I convert assembly into hex like in this source code file? I frequently see it being used in payloads. I understand it is done to preserve space, bypass IDS among other reasons.

Example file from the shell storm website

4

Yes, they are the same thing.

To be more technical, the hex code at the top is "machine code" and what you see at the bottom is a human-readable representation of the machine code which you know to be called "assembly code". The machine code format isn't there to hide the payload - it is the payload. It is literally the the 1s and 0s that a computer would process to run this shellcode. It is just written as hex for convenience.

A shellcode author would typically write the shellcode in assembly and assemble it into machine code using an assembler program like nasm on linux. Although assembly code corresponds to machine code directly (more or less), your computer's processor only runs machine code.

If you want to learn more about using shellcode I recommend Hacking the Art of Exploitation as a good place to start.

There are encoders that can be used to obfuscate shellcode. Many are included in the Metasploit suite. A popular one is Shikata Ga Nai.

2
  • I wish I could also mark yours as accepted! Would it be possible to perform an attack by using 1s and 0s instead of converting it into hex, despite it being a little messy and big? Nov 6 '19 at 13:35
  • 2
    Yes definitely can. You should know though that the reason hex is often used is because in C, strings support writing hex bytes directly as you see on the shellstorm page you linked. To do the same with binary (1s and 0s) in C you should use the syntax char shellcode[] = { 0b11101011, 0b00001101, 0b01011111, 0b00000000}; with each 8-bit chunk separated by a comma and starting with 0b to designate it as binary. Also make sure to end with a byte (8 bits) of all 0s (0b00000000) to indicate to the C compiler that it is the end of the string of bytes.
    – chillsauce
    Nov 6 '19 at 17:21
2

This is to add on to chillisauce.

I frequently see it being used in payloads. I understand it is done to preserve space, bypass IDS among other reasons.

Shellcodes are normally written in hex and then when executed, they get decoded. They're not written like that for any of the reasons you mentioned though. Shellcode is often injected into the application during runtime, so it can't be written in some high level language bceause there's nothing to compile or interpret this code. When working with shellcode, we're working at lower levels in the application stack -- we're working with assembly, registers and what not.

Payloads are often encoded, which is probably what you were referring to. Encoding is done for many reasons - to remove bad characters that would hamper execution of the shellcode, creating signatures that would bypass AVs and a few others. You also have packers and cryptors which help in hiding malicious code. As mentioned, Shikata Ga Nai is a commonly known encoder which can be used to encode your payload. But then again, commonly known means it can't bypass most AVs, and can handle only certain sequences of bad characters, which is why experts often resort to writing their own encoders.

Converting assembly into Hex? nasm shell is your friend. Kali linux comes with this inbuilt. More specifically, I think it comes along with the metasploit framework. Nasm can help you do this

nasm> push eax
50                       push eax
nasm> push eax ; retn 4
50                       push eax
C20400                   ret 0x4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.