Created
June 18, 2024 10:52
-
-
Save klezVirus/cd1617904f96830f1cae65b350c8109b to your computer and use it in GitHub Desktop.
Script to generate a RPC ProcString as a byte array
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import argparse | |
| import time | |
| from binascii import hexlify | |
| def generate_array(n_params): | |
| # Basic array structure | |
| proc_string = [ | |
| 0x32, # FC_BIND_PRIMITIVE | |
| 0x48, # Old Flags: | |
| 0x0, 0x0, 0x0, 0x0, # 0 (NdrFcLong) | |
| 0x0, 0x0, # 0 (NdrFcShort) | |
| n_params * 8 + 8, 0x0, # X64 Stack size/offset (total size calculated from parameters) | |
| 0x60, 0x0, # 96 | |
| 0x10, 0x0, # 16 | |
| 0x44, # Oi2 Flags: has return, has ext, | |
| n_params + 1, # Number of parameters + 1 for the return value | |
| 0xa, # 10 | |
| 0x1, # Ext Flags: new corr desc, | |
| 0x0, 0x0, # 0 (NdrFcShort) | |
| 0x0, 0x0, # 0 (NdrFcShort) | |
| 0x0, 0x0, # 0 (NdrFcShort) | |
| 0x0, 0x0, # 0 (NdrFcShort) | |
| ] | |
| # Add parameters | |
| for i in range(n_params): | |
| proc_string.extend([ | |
| 0x48, 0x0, # Flags: in, base type, | |
| i * 8, 0x0, # X64 Stack size/offset | |
| 0xb, # FC_HYPER | |
| 0x0, # 0 | |
| ]) | |
| # Add return value | |
| proc_string.extend([ | |
| 0x70, 0x0, # Flags: out, return, base type, | |
| n_params * 8, 0x0, # X64 Stack size/offset | |
| 0xb, # FC_HYPER | |
| 0x0, # 0 | |
| 0x0 # End of array | |
| ]) | |
| return bytearray(proc_string) | |
| def hexdump(buffer): | |
| # Function to print the array in hex format | |
| for i in range(0, len(buffer), 16): | |
| hex_data = ' '.join(f'{byte:02x}' for byte in buffer[i:i + 16]) | |
| print(f'{i:04x} {hex_data}') | |
| def c_array(buffer): | |
| shell_string = shellcode_as_array(buffer) | |
| return f'int length = {len(buffer)};\n' + \ | |
| f'unsigned char stack_proc_string[] = {{\n\t{shell_string}\t}};' | |
| def shellcode_as_array(shellcode: bytes, n=25): | |
| if not isinstance(shellcode, bytes): | |
| shellcode = bytes(shellcode) | |
| hex_shellcode = hexlify(shellcode).decode() | |
| return hex2carray(hex_shellcode, n=n) | |
| def hex2carray(hexs, n=25): | |
| shell_string = '' | |
| shellcode = [hexs[i:i + 2] for i in range(0, len(hexs), 2)] | |
| array_of_arrays = [shellcode[i:i + n] for i in range(0, len(shellcode), n)] | |
| for i in range(len(array_of_arrays)): | |
| if i == len(array_of_arrays) - 1: | |
| shell_string += ", ".join([f"0x{s}" for s in array_of_arrays[i]]) + "\n" | |
| else: | |
| shell_string += ", ".join(f"0x{s}" for s in array_of_arrays[i]) + ",\n\t" | |
| return shell_string | |
| parser = argparse.ArgumentParser(description="RPC ProcString Generator") | |
| parser.add_argument("-n", "--n-params", help="Number of parameters", type=int, default=0) | |
| parser.add_argument("-f", "--out-format", help="Output Format", choices=['hex', 'c'], default='c') | |
| parser.add_argument("--hexdump", help="Print HexDump of the string", default=False, action='store_true') | |
| args = parser.parse_args() | |
| if args.n_params <= 0: | |
| parser.print_help() | |
| exit(1) | |
| array = generate_array(args.n_params) | |
| if args.hexdump: | |
| hexdump(array) | |
| time.sleep(2) | |
| if args.out_format == 'hex': | |
| print(hexlify(array).decode()) | |
| elif args.out_format == 'c': | |
| print(c_array(array)) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment