shellme.py

from commands import getoutput
from argparse import ArgumentParser
from os import system
import sys

"""Lazy mans shellcode maker.  Wraps nasm/objdump stuff.
"""

def check():
	"""i need nasm/objdump"""
	found = True
	if getoutput("which nasm") == '':
		found = False
	elif getoutput("which objdump") == '':
		found = False
	return found

def get_output(inf,arch='elf'):
	"""format into a string of bytes"""
	output = ''
	if '.nasm' in inf:
		tmp = getoutput("nasm -f %s %s"%(arch,inf))
		if 'error' in tmp:
			print '[-] Error in your asm: ', tmp
			sys.exit(1)	
		inf = inf.replace(".nasm", ".o")
	tmp = getoutput("objdump -d %s"%inf)
	
	opcodes = ''
	for line in tmp.split('\n')[7:]:
		tmp = line.split(':',1)
		if len(tmp) > 1 and len(tmp[1]) > 0: tmp = tmp[1]
		else: continue

		# split on tab to get opcodes
		tmp = ''.join(tmp).split('\t')
		if len(tmp) > 1: tmp = tmp[1].strip().replace(' ','')
		if '<' in tmp: continue
		opcodes += tmp
	return opcodes

def encode(lbyte):
	"""Take the opcode string and insert \\x's.  
	   I'll add in fancy encoding and output
	   formatting eventually.
	"""
	formatted_lbyte = ''.join(["\\x"+lbyte[idx]+lbyte[idx+1] for idx in range(0,len(lbyte)-1,2)])
	return formatted_lbyte

def format_output(dmp,width=8):
	"""Input should just be a stream of formatted hex bytes
	   i.e. \\x05\\x06\\x07...
	   Returns this truncated into columns with a width of width 
	"""
	dmp = dmp.split('\\x')[1:]
	return '\\x'+'\n\\x'.join(['\\x'.join(dmp[i:i+width]) for i in range(0,len(dmp),width)])

def compile_instruction(instruction,arch='elf'):
	"""Compile a single instruction and return opcodes"""
	with open('/tmp/tmp-me.nasm', 'w+') as f:
		f.write(instruction.decode('string-escape')+'\n')
	ops = encode(get_output('/tmp/tmp-me.nasm',arch))
	system('rm -f /tmp/tmp-me.nasm /tmp/tmp-me.o')
	return ops

def run(options):
	"""encode/dump"""
	if options.inf:
		dmp = encode(get_output(options.inf,options.arch))
	elif options.instruction:
		dmp = compile_instruction(options.instruction,options.arch)

	print '[+] Encoded:\n', format_output(dmp)
	if options.output:
		with open(options.output, 'w') as f:
			f.write(format_output(dmp))

def arguments():
	"""Handle cli"""
	parser = ArgumentParser()
	parser.add_argument('-n',help='nasm or object file',metavar='FILE',action='store',dest='inf')
	parser.add_argument('-o',help='output file',action='store',dest='output')
	parser.add_argument('-i',help='instruction',action='store',dest='instruction')
	parser.add_argument('-a',help='architecture [elf/elf64]',action='store',dest='arch',default='elf')

	if len(sys.argv) < 2:
		parser.print_help()
		sys.exit(1)

	return parser.parse_args()	

if __name__=="__main__":	
	if not check():
		print '[-] I need objdump and nasm'
		sys.exit(1)
	run(arguments())