Tuesday, April 24, 2012

use Metasploit to generate shell code

This post explains to use metasploit to generate binary shell code:

http://www.backtrack-linux.org/forums/showthread.php?t=35480


msf > use windows/exec
msf payload(exec) > show options

Module options:

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CMD                        yes       The command string to execute
   EXITFUNC  process          yes       Exit technique: seh, thread, process, none

msf payload(exec) > set cmd taskkill /PID 12345
cmd => taskkill /PID 12345
msf payload(exec) > show options

Module options:

   Name      Current Setting      Required  Description
   ----      ---------------      --------  -----------
   CMD       taskkill /PID 12345  yes       The command string to execute
   EXITFUNC  process              yes       Exit technique: seh, thread, process, none

msf payload(exec) > generate -h
Usage: generate [options]

Generates a payload.

OPTIONS:

    -E        Force encoding.
    -b <opt>  The list of characters to avoid: '\x00\xff'
    -e <opt>  The name of the encoder module to use.
    -f <opt>  The output file name (otherwise stdout)
    -h        Help banner.
    -i <opt>  the number of encoding iterations.
    -k        Keep the template executable functional
    -o <opt>  A comma separated list of options in VAR=VAL format.
    -p <opt>  The Platform for output.
    -s <opt>  NOP sled length.
    -t <opt>  The output format: raw,ruby,rb,perl,pl,c,js_be,js_le,java,dll,exe,exe-small,elf,macho,vba,vbs,loop-vbs,asp,war
    -x <opt>  The executable template to use

msf payload(exec) > generate -t exe -f /root/windows-exec-payload.exe
[*] Writing 73802 bytes to /root/windows-exec-payload.exe...
msf payload(exec) > generate -f /root/windows-exec-payload.shellcode
[*] Writing 1013 bytes to /root/windows-exec-payload.shellcode...

No comments: