Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
#!/usr/bin/env python3
2

3
#=============================================================================#
4
# A simple python build script to build the singles/stages/stagers and
5
# some usefull information such as offsets and a hex dump. The binary output
6
# will be placed in the bin directory. A hex string and usefull comments will
7
# be printed to screen.
8
#
9
# Example:
10
#     >python build.py stager_reverse_tcp_nx
11
#
12
# Example, to build everything:
13
#     >python build.py all > build_output.txt
14
#
15
# Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
16
#=============================================================================#
17

18
import os
19
import sys
20
import time
21
from subprocess import Popen
22
from struct import pack
23

24
def clean(dir='./bin/'):
25
    for root, dirs, files in os.walk(dir):
26
        for name in files:
27
            if name[-4:] == '.bin':
28
                os.remove(os.path.join(root, name))
29

30
def locate(src_file, dir='./src/'):
31
    for root, dirs, files in os.walk(dir):
32
        for name in files:
33
            if src_file == name:
34
                return root
35
    return None
36

37
def build(name):
38
    location = locate('%s.asm' % name)
39
    if location:
40
        input = os.path.normpath(os.path.join(location, name))
41
        output = os.path.normpath(os.path.join('./bin/', name))
42
        p = Popen(['nasm', '-f bin', '-O3', '-o %s.bin' %
43
                   output, '%s.asm' % input])
44
        p.wait()
45
        xmit(name)
46
    else:
47
        print("[-] Unable to locate '%s.asm' in the src directory" % name)
48

49
def xmit_dump_ruby(data, length=16):
50
    dump = ''
51
    for i in range(0, len(data), length):
52
        bytes = data[i: i+length]
53
        hex = "\"%s\"" % (''.join(['\\x%02X' % x for x in bytes]))
54
        if i+length <= len(data):
55
            hex += ' +'
56
        dump += '%s\n' % (hex)
57
    print(dump)
58

59
def xmit_offset(data, name, value):
60
    offset = data.find(value)
61
    if offset != -1:
62
        print('# %s Offset: %d' % (name, offset))
63

64
def xmit(name, dump_ruby=True):
65
    bin = os.path.normpath(os.path.join('./bin/', '%s.bin' % name))
66
    f = open(bin, 'rb')
67
    data = f.read()
68
    print('# Name: %s\n# Length: %d bytes' % (name, len(data)))
69
    xmit_offset(data, 'Port', pack('>H', 4444))           # 4444
70
    xmit_offset(data, 'Host', pack('>L', 0x7F000001))     # 127.0.0.1
71
    # kernel32.dll!ExitThread
72
    xmit_offset(data, 'ExitFunk', pack('<L', 0x0A2A1DE0))
73
    # kernel32.dll!ExitProcess
74
    xmit_offset(data, 'ExitFunk', pack('<L', 0x56A2B5F0))
75
    # kernel32.dll!SetUnhandledExceptionFilter
76
    xmit_offset(data, 'ExitFunk', pack('<L', 0xEA320EFE))
77
    xmit_offset(data, 'ExitFunk', pack('<L', 0xE035F044))  # kernel32.dll!Sleep
78
    if dump_ruby:
79
        xmit_dump_ruby(data)
80

81
def main(argv=None):
82
    if not argv:
83
        argv = sys.argv
84
    if len(argv) == 1:
85
        print('Usage: build.py [clean|all|<name>]')
86
    else:
87
        print('# Built on %s\n' % (time.asctime(time.localtime())))
88
        if argv[1] == 'clean':
89
            clean()
90
        elif argv[1] == 'all':
91
            for root, dirs, files in os.walk('./src/migrate/'):
92
                for name in files:
93
                    if name[-4:] == '.asm':
94
                        build(name[:-4])
95
            for root, dirs, files in os.walk('./src/single/'):
96
                for name in files:
97
                    if name[-4:] == '.asm':
98
                        build(name[:-4])
99
            for root, dirs, files in os.walk('./src/stage/'):
100
                for name in files:
101
                    if name[-4:] == '.asm':
102
                        build(name[:-4])
103
            for root, dirs, files in os.walk('./src/stager/'):
104
                for name in files:
105
                    if name[-4:] == '.asm':
106
                        build(name[:-4])
107
        else:
108
            build(argv[1])
109

110
if __name__ == '__main__':
111
    main()
112

113