PIC / Shellcode

Position-Independent Code / Shellcode

• https://www.ired.team/offensive-security/code-injection-process-injection/writing-and-compiling-shellcode-in-c

• https://www.codeproject.com/Articles/5304605/Creating-Shellcode-from-any-Code-Using-Visual-Stud

GitHub - silentwarble/PIC-Library: A collection of position independent coding resourcesGitHub

Compile runner with nasm & MinGW (stolen from PIC-Get-Privileges) for testing purposes:

runShellcode.asm

; Compile with:
; nasm -f win64 runShellcode.asm -o runShellcode.o
; x86_64-w64-mingw32-ld runShellcode.o -o runShellcode.exe

Global Start

Start:
    incbin "shellcode.bin"

Automated with Bash (like shcode2exe):

bin2compile.sh

#!/usr/bin/env bash

# Usage:
#   bin2compile.sh {32|64} <INPUT_BIN> [OUTPUT_EXE]
# Examples:
#   msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o calc.bin
#   bin2compile.sh 64 calc.bin calc.exe

ARCH="${1}"
SC_PATH=`realpath "${2}"`
SC_NAME=`basename "${SC_PATH}"`
SC_NAME="${SC_NAME%.*}"
[[ "${#}" -gt 2 ]] && EXE_NAME="${3}" || EXE_NAME="${SC_NAME}.exe"

cat << EOT > "/tmp/${SC_NAME}.asm"
    global _start
    section .text
_start:
    incbin "${SC_PATH}"
EOT

if [[ "${ARCH}" == "32" ]]; then
    NASM_ARCH="win32"
    LD_ARCH="i386pe"
elif [[ "${ARCH}" == "64" ]]; then
    NASM_ARCH="win64"
    LD_ARCH="i386pep"
fi

echo "[*] Compiling x${ARCH}"
echo "[*] Compilation time: `date "+%F %H:%M:%S"`"

nasm -f "${NASM_ARCH}" -o "/tmp/${SC_NAME}.obj" "/tmp/${SC_NAME}.asm"
ld -m "${LD_ARCH}" -o "${EXE_NAME}" "/tmp/${SC_NAME}.obj" #-s --subsystem=windows
#strip "${EXE_NAME}"

if [[ "$?" -ne 1 ]]; then
    echo "[+] Success"
    echo "[+] Output size: `stat -c %s ${EXE_NAME} | numfmt --to=iec`"
else
    echo "[-] Failed"
fi

rm -f /tmp/${SC_NAME}.{asm,obj}

Development Frameworks

• https://github.com/thefLink/C-To-Shellcode-Examples

• https://github.com/rainerzufalldererste/windows_x64_shellcode_template

• https://github.com/oldboy21/SHGenOb

• https://github.com/Print3M/epic

• https://github.com/winterknife/SILVERPICK

Startust-based

• https://5pider.net/blog/2024/01/27/modern-shellcode-implant-design

• https://github.com/Cracked5pider/Stardust

• https://github.com/Octoberfest7/Secure_Stager

• https://github.com/safedv/Rustic64

• https://github.com/NtDallas/Svartalfheim

Tools

Binary Ninja Shellcode Compiler (SCC)

• https://scc.binary.ninja/

• https://github.com/Vector35/scc