Shellcode & RE / Shellcode2Exe

Shellcode2Exe

Overview

Shellcode2Exe is a small PHP script that generates executables on the fly for hex- or %u-encoded shellcode you submit to it through a web form. This provides an easy way to analyze new shellcode buffers in your debugger of choice.

The technique requires that the shellcode you're analyzing does not use any predefined function offsets that would only be valid inside the target process's address space. In today's arena of position-independent shellcodes, this is usually not a problem.

Husk.exe is the base template used for generated executables. The base husk template includes a function call to WSAStartup to load winsock services — necessary for some shellcodes that assume this has already taken place in the target process.

The bytes only option is designed to simply convert hex- or %u-encoded strings into a raw binary file of the shellcode. This file can then be fed into a program like sclog for execution and analysis.

Usage

Place the PHP and EXE files in a web-server directory which supports PHP4, then visit the page in your web browser. This script has been known to work with IIS5 and Apache servers using PHP 4.

Shellcode2Exe web form