Overview

Shellcode 2 exe is a small php script used to generate executables on the fly for hex or %u encoded shellcode you submit to it through a web form. This technique provides an easy way to analyze new shellcode buffers in your debugger of choice.

This techniques demands that the shellcode you are analyzing does not use any predefined function offsets that would only be valid if executing within the target processes address space. In todays arena of modern position independent shellcodes this limitation is usually not a problem.

Husk.exe is the base template used for generated executables. The base husk template includes a function call to WSAStartup to load winsock services. This is necessary with some shellcodes that assume this has already taken place in the target process.

The bytes only option is designed to just simply convert hex or %u encoded strings into a raw binary file of the shellcode. This file can then be fed into a program such as sclog.exe for execution and analysis.

Usage

Place the php and exe files in a web server directory which supports php4 and visit the page in your web browser. This script has been known to work with IIS5 and Apache servers using PHP 4.