Skip to content
This repository was archived by the owner on Mar 26, 2019. It is now read-only.

Commit 5b3f4d1

Browse files
authored
Add files via upload
1 parent 7c3623e commit 5b3f4d1

File tree

8 files changed

+1397
-0
lines changed

8 files changed

+1397
-0
lines changed

OWASP-ZSC/lib/__init__.py

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env python
2+
'''
3+
OWASP ZSC
4+
https://www.owasp.org/index.php/OWASP_ZSC_Tool_Project
5+
https://github.com/zscproject/OWASP-ZSC
6+
http://api.z3r0d4y.com/
7+
https://groups.google.com/d/forum/owasp-zsc [ owasp-zsc[at]googlegroups[dot]com ]
8+
'''
9+
10+
pass

OWASP-ZSC/lib/opcoder/__init__.py

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env python
2+
'''
3+
OWASP ZSC
4+
https://www.owasp.org/index.php/OWASP_ZSC_Tool_Project
5+
https://github.com/zscproject/OWASP-ZSC
6+
http://api.z3r0d4y.com/
7+
https://groups.google.com/d/forum/owasp-zsc [ owasp-zsc[at]googlegroups[dot]com ]
8+
'''
9+
10+
pass

OWASP-ZSC/lib/opcoder/linux_x86.py

+457
Large diffs are not rendered by default.

OWASP-ZSC/lib/opcoder/osx_x86.py

+459
Large diffs are not rendered by default.

OWASP-ZSC/lib/opcoder/windows_x86.py

+184
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
#!/usr/bin/env python
2+
'''
3+
OWASP ZSC
4+
https://www.owasp.org/index.php/OWASP_ZSC_Tool_Project
5+
https://github.com/zscproject/OWASP-ZSC
6+
http://api.z3r0d4y.com/
7+
https://groups.google.com/d/forum/owasp-zsc [ owasp-zsc[at]googlegroups[dot]com ]
8+
'''
9+
import binascii
10+
from core import stack
11+
from core import color
12+
from core.alert import info
13+
from core.compatible import version
14+
_version = version()
15+
replace_values_static = {
16+
'xor %ebx,%ebx':'31 db',
17+
'xor %ecx,%ecx':'31 c9',
18+
'xor %eax,%ebx':'31 c3',
19+
'xor %ecx,%ebx':'31 cb',
20+
'xor %ebx,%eax':'31 d8',
21+
'xor %eax,%eax':'31 c0',
22+
'xor %ebx,%edx':'31 da',
23+
'xor %edx,%edx':'31 d2',
24+
'xor %ebx,%ecx':'31 d9',
25+
'xor %esi,%esi':'31 f6',
26+
'xor %eax,%ecx':'31 c1',
27+
'xor %edi,%edi':'31 ff',
28+
'mov %esp,%ebx':'89 e3',
29+
'mov $0x1,%al':'b0 01',
30+
'mov $0x01,%al':'b0 01',
31+
'mov $0x1,%bl':'b3 01',
32+
'mov $0x01,%bl':'b3 01',
33+
'mov $0xb,%al':'b0 0b',
34+
'mov %eax,%ebx':'89 c3',
35+
'mov %esp,%ecx':'89 e1',
36+
'mov %esp,%esi':'89 e6',
37+
'mov %esp,%edi':'89 e7',
38+
'mov %esp,%edx':'89 e2',
39+
'mov %edx,%esi':'89 d6',
40+
'mov %eax,%edi':'89 c7',
41+
'mov %esi,%edx':'89 f2',
42+
'shr $0x10,%ebx':'c1 eb 10',
43+
'shr $0x08,%ebx':'c1 eb 08',
44+
'shr $0x8,%ebx':'c1 eb 08',
45+
'shr $0x10,%eax':'c1 e8 10',
46+
'shr $0x08,%eax':'c1 e8 08',
47+
'shr $0x8,%eax':'c1 e8 08',
48+
'shr $0x10,%ecx':'c1 e9 10',
49+
'shr $0x8,%ecx':'c1 e9 08',
50+
'shr $0x08,%ecx':'c1 e9 08',
51+
'shr $0x10,%edx':'c1 ea 10',
52+
'shr $0x8,%edx':'c1 ea 08',
53+
'shr $0x08,%edx':'c1 ea 08',
54+
'inc %ecx':'41',
55+
'add %ecx,%ebx':'01 cb',
56+
'add %eax,%ebx':'01 c3',
57+
'add %eax,%ecx':'01 c1',
58+
'add %ebx,%edx':'01 da',
59+
'add %ebx,%eax':'01 d8',
60+
'add %ebx,%ecx':'01 d9',
61+
'sub %eax,%ecx':'29 c1',
62+
'sub %ebx,%ecx':'29 d9',
63+
'push %eax':'50',
64+
'push %ebx':'53',
65+
'push %ecx':'51',
66+
'push %edx':'52',
67+
'push %esi':'56',
68+
'push %edi':'57',
69+
'pop %eax':'58',
70+
'pop %ebx':'5b',
71+
'pop %ecx':'59',
72+
'pop %edx':'5a',
73+
'dec %ecx':'49',
74+
'neg %ecx':'f7 d9',
75+
'neg %eax':'f7 d8',
76+
'subl $0x61,0x3(%esp)':'83 6c 24 03 61',
77+
'lods %ds:(%esi),%eax':'ad',
78+
'add %ebx,%esi':'01 de',
79+
'push %esp':'54',
80+
'call *%edx':'ff d2',
81+
'call *%eax':'ff d0',
82+
'call *%esi':'ff d6',
83+
'xchg %eax,%esi':'96',
84+
'mov %fs:0x30(%ecx),%eax':'64 8b 41 30',
85+
'mov (%esi,%ecx,2),%cx':'66 8b 0c 4e',
86+
'mov (%esi,%ecx,4),%edx':'8b 14 8e',
87+
}
88+
89+
90+
def convert(shellcode):
91+
shellcode = shellcode.replace('\n\n','\n').replace('\n\n','\n').replace(' ',' ').replace(' ',' ').replace(' ',' ')
92+
for data in replace_values_static:
93+
shellcode = shellcode.replace(data,replace_values_static[data])
94+
95+
new_shellcode = shellcode.rsplit('\n')
96+
last = 0
97+
for line in new_shellcode:
98+
if 'push $0x' in line:
99+
if len(line) is 15:
100+
if _version is 2:
101+
rep = str('68') + stack.st(str(binascii.a2b_hex(str('0') + str(line.rsplit('$0x')[1]))))
102+
if _version is 3:
103+
rep = str('68') + stack.st(str(binascii.a2b_hex(str('0') + line.rsplit('$0x')[1].encode('latin-1')).decode('latin-1')))
104+
shellcode = shellcode.replace(line,rep)
105+
if len(line) is 16:
106+
if _version is 2:
107+
rep = str('68') + stack.st(str(binascii.a2b_hex(str(line.rsplit('$0x')[1]))))
108+
if _version is 3:
109+
rep = str('68') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].encode('latin-1')).decode('latin-1')))
110+
shellcode = shellcode.replace(line,rep)
111+
112+
if 'mov $0x' in line:
113+
if '%ecx' in line.rsplit(',')[1]:
114+
if _version is 2:
115+
rep = str('b9') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
116+
if _version is 3:
117+
rep = str('b9') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
118+
shellcode = shellcode.replace(line,rep)
119+
120+
if 'mov 0x' in line:
121+
if '%eax' in line.rsplit(',')[0] and '%eax' in line.rsplit(',')[1]:
122+
rep = str('8b 40') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
123+
shellcode = shellcode.replace(line,rep)
124+
if '%eax' in line.rsplit(',')[0] and '%esi' in line.rsplit(',')[1]:
125+
rep = str('8b 70') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
126+
shellcode = shellcode.replace(line,rep)
127+
if '%eax' in line.rsplit(',')[0] and '%ebx' in line.rsplit(',')[1]:
128+
rep = str('8b 58') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
129+
shellcode = shellcode.replace(line,rep)
130+
if '%ebx' in line.rsplit(',')[0] and '%edx' in line.rsplit(',')[1]:
131+
rep = str('8b 53') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
132+
shellcode = shellcode.replace(line,rep)
133+
if '%edx' in line.rsplit(',')[0] and '%edx' in line.rsplit(',')[1]:
134+
rep = str('8b 52') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
135+
shellcode = shellcode.replace(line,rep)
136+
if '%edx' in line.rsplit(',')[0] and '%esi' in line.rsplit(',')[1]:
137+
rep = str('8b 72') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
138+
shellcode = shellcode.replace(line,rep)
139+
140+
if 'mov $0x' in line and len(line.rsplit('$0x')[1].rsplit(',')[0]) == 4:
141+
if '%cx' in line:
142+
if _version is 2:
143+
rep = str('66 b9') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
144+
if _version is 3:
145+
rep = str('66 b9') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
146+
shellcode = shellcode.replace(line,rep)
147+
if '%dx' in line:
148+
if _version is 2:
149+
rep = str('66 ba') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
150+
if _version is 3:
151+
rep = str('66 ba') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
152+
shellcode = shellcode.replace(line,rep)
153+
154+
if 'add' in line:
155+
if '$0x' in line:
156+
if '%esp' in line.rsplit(',')[1]:
157+
if _version is 2:
158+
rep = str('83 c4') + stack.st(str(binascii.a2b_hex(stack.toHex(line.rsplit('$0x')[1].rsplit(',')[0]))))
159+
if _version is 3:
160+
rep = str('83 c4') + stack.st(str(binascii.a2b_hex(stack.toHex(line.rsplit('$0x')[1].rsplit(',')[0]).encode('latin-1')).decode('latin-1')))
161+
shellcode = shellcode.replace(line,rep)
162+
163+
if 'cmpl' in line:
164+
if '(%eax)' == line.rsplit(',')[1]:
165+
if _version is 2:
166+
rep = str('81 38') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
167+
if _version is 3:
168+
rep = str('81 38') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
169+
shellcode = shellcode.replace(line,rep)
170+
if '0x' in line.rsplit(',')[1]:
171+
if '%eax' in line:
172+
if _version is 2:
173+
rep = str('81 78') + stack.st(str(binascii.a2b_hex(stack.toHex(line.rsplit(',0x')[1].rsplit('(')[0])))) + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
174+
if _version is 3:
175+
rep = str('81 78') + stack.st(str(binascii.a2b_hex(stack.toHex(line.rsplit(',0x')[1].rsplit('(')[0]).encode('latin-1')).decode('latin-1'))) + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
176+
shellcode = shellcode.replace(line,rep)
177+
178+
if 'jne' in line:
179+
rep = str('75') + hex(int('f4', 16) - last*9)[2:]
180+
shellcode = shellcode.replace(line,rep,1)
181+
last += 1
182+
shellcode = stack.shellcoder(shellcode.replace('\n','').replace(' ',''))
183+
return shellcode
184+
+170
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
#!/usr/bin/env python
2+
'''
3+
OWASP ZSC
4+
https://www.owasp.org/index.php/OWASP_ZSC_Tool_Project
5+
https://github.com/zscproject/OWASP-ZSC
6+
http://api.z3r0d4y.com/
7+
https://groups.google.com/d/forum/owasp-zsc [ owasp-zsc[at]googlegroups[dot]com ]
8+
'''
9+
import binascii
10+
from core import stack
11+
from core import color
12+
from core.alert import info
13+
from core.compatible import version
14+
_version = version()
15+
replace_values_static = {"48 83 ec 20 " : "sub $0x20,%rsp"
16+
"48 83 e4 f0 " : "and $0xfffffffffffffff0,%rsp"
17+
,"65 4c 8b 24 25 60 00" : "mov %gs:0x60,%r12"
18+
,"4d 8b 64 24 18 " : "mov 0x18(%r12),%r12"
19+
,"4d 8b 64 24 20 " : "mov 0x20(%r12),%r12"
20+
,"4d 8b 24 24 " : "mov (%r12),%r12"
21+
,"4d 8b 7c 24 20 " : "mov 0x20(%r12),%r15"
22+
,"4d 8b 24 24 " : "mov (%r12),%r12"
23+
,"4d 8b 64 24 20 " : "mov 0x20(%r12),%r12"
24+
,"ba 98 fe 8a 0e " : "mov $0xe8afe98,%edx"
25+
,"4c 89 e1 " : "mov %r12,%rcx"
26+
,"4d 89 e4 " : "mov %r12,%r12"
27+
,"e8 2a 00 00 00 " : "callq 0x401067"
28+
,"eb 1a " : "jmp 0x401059"
29+
,"59 " : "pop %rcx"
30+
,"ba 01 00 00 00 " : "mov $0x1,%edx"
31+
,"ff d0 " : "callq *%rax"
32+
,"ba 70 cd 3f 2d " : "mov $0x2d3fcd70,%edx"
33+
,"4c 89 f9 " : "mov %r15,%rcx"
34+
,"e8 13 00 00 00 " : "callq 0x401067"
35+
,"48 31 c9 " : "xor %rcx,%rcx"
36+
,"ff d0 " : "callq *%rax"
37+
,"e8 e1 ff ff ff " : "callq 0x40103f"
38+
,"63 61 6c " : "movslq 0x6c(%rcx),%esp"
39+
,"63 2e " : "movslq (%rsi),%ebp"
40+
,"65 78 65 " : "gs js 0x4010cb"
41+
,"00 49 89 " : "add %cl,-0x77(%rcx)"
42+
,"cd 67 " : "int $0x67"
43+
,"41 8b 45 3c " : "mov 0x3c(%r13),%eax"
44+
,"67 45 8b b4 05 88 00" : "mov 0x88(%r13d,%eax,1),%r14d"
45+
,"45 01 ee " : "add %r13d,%r14d"
46+
,"67 45 8b 56 18 " : "mov 0x18(%r14d),%r10d"
47+
,"67 41 8b 5e 20 " : "mov 0x20(%r14d),%ebx"
48+
,"44 01 eb " : "add %r13d,%ebx"
49+
,"67 e3 3f " : "jecxz 0x4010ca"
50+
,"41 ff ca " : "dec %r10d"
51+
,"67 42 8b 34 93 " : "mov (%ebx,%r10d,4),%esi"
52+
,"44 01 ee " : "add %r13d,%esi"
53+
,"31 ff " : "xor %edi,%edi"
54+
,"31 c0 " : "xor %eax,%eax"
55+
,"fc " : "cld"
56+
,"ac " : "lods %ds:(%rsi),%al"
57+
,"84 c0 " : "test %al,%al"
58+
,"74 07 " : "je 0x4010a7"
59+
,"c1 cf 0d " : "ror $0xd,%edi"
60+
,"01 c7 " : "add %eax,%edi"
61+
,"eb f4 " : "jmp 0x40109b"
62+
,"39 d7 " : "cmp %edx,%edi"
63+
,"75 dd " : "jne 0x401088"
64+
,"67 41 8b 5e 24 " : "mov 0x24(%r14d),%ebx"
65+
,"44 01 eb " : "add %r13d,%ebx"
66+
,"31 c9 " : "xor %ecx,%ecx"
67+
,"66 67 42 8b 0c 53 " : "mov (%ebx,%r10d,2),%cx"
68+
,"67 41 8b 5e 1c " : "mov 0x1c(%r14d),%ebx"
69+
,"44 01 eb " : "add %r13d,%ebx"
70+
,"67 8b 04 8b " : "mov (%ebx,%ecx,4),%eax"
71+
,"44 01 e8 " : "add %r13d,%eax"
72+
,"c3 " : "retq",
73+
}
74+
75+
76+
def convert(shellcode):
77+
shellcode = shellcode.replace('\n\n','\n').replace('\n\n','\n').replace(' ',' ').replace(' ',' ').replace(' ',' ')
78+
for data in replace_values_static:
79+
shellcode = shellcode.replace(data,replace_values_static[data])
80+
81+
new_shellcode = shellcode.rsplit('\n')
82+
last = 0
83+
for line in new_shellcode:
84+
if 'push $0x' in line:
85+
if len(line) is 15:
86+
if _version is 2:
87+
rep = str('68') + stack.st(str(binascii.a2b_hex(str('0') + str(line.rsplit('$0x')[1]))))
88+
if _version is 3:
89+
rep = str('68') + stack.st(str(binascii.a2b_hex(str('0') + line.rsplit('$0x')[1].encode('latin-1')).decode('latin-1')))
90+
shellcode = shellcode.replace(line,rep)
91+
if len(line) is 16:
92+
if _version is 2:
93+
rep = str('68') + stack.st(str(binascii.a2b_hex(str(line.rsplit('$0x')[1]))))
94+
if _version is 3:
95+
rep = str('68') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].encode('latin-1')).decode('latin-1')))
96+
shellcode = shellcode.replace(line,rep)
97+
98+
if 'mov $0x' in line:
99+
if '%ecx' in line.rsplit(',')[1]:
100+
if _version is 2:
101+
rep = str('b9') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
102+
if _version is 3:
103+
rep = str('b9') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
104+
shellcode = shellcode.replace(line,rep)
105+
106+
if 'mov 0x' in line:
107+
if '%eax' in line.rsplit(',')[0] and '%eax' in line.rsplit(',')[1]:
108+
rep = str('8b 40') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
109+
shellcode = shellcode.replace(line,rep)
110+
if '%eax' in line.rsplit(',')[0] and '%esi' in line.rsplit(',')[1]:
111+
rep = str('8b 70') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
112+
shellcode = shellcode.replace(line,rep)
113+
if '%eax' in line.rsplit(',')[0] and '%ebx' in line.rsplit(',')[1]:
114+
rep = str('8b 58') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
115+
shellcode = shellcode.replace(line,rep)
116+
if '%ebx' in line.rsplit(',')[0] and '%edx' in line.rsplit(',')[1]:
117+
rep = str('8b 53') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
118+
shellcode = shellcode.replace(line,rep)
119+
if '%edx' in line.rsplit(',')[0] and '%edx' in line.rsplit(',')[1]:
120+
rep = str('8b 52') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
121+
shellcode = shellcode.replace(line,rep)
122+
if '%edx' in line.rsplit(',')[0] and '%esi' in line.rsplit(',')[1]:
123+
rep = str('8b 72') + stack.toHex(line.rsplit('0x')[1].rsplit('(')[0])
124+
shellcode = shellcode.replace(line,rep)
125+
126+
if 'mov $0x' in line and len(line.rsplit('$0x')[1].rsplit(',')[0]) == 4:
127+
if '%cx' in line:
128+
if _version is 2:
129+
rep = str('66 b9') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
130+
if _version is 3:
131+
rep = str('66 b9') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
132+
shellcode = shellcode.replace(line,rep)
133+
if '%dx' in line:
134+
if _version is 2:
135+
rep = str('66 ba') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
136+
if _version is 3:
137+
rep = str('66 ba') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
138+
shellcode = shellcode.replace(line,rep)
139+
140+
if 'add' in line:
141+
if '$0x' in line:
142+
if '%esp' in line.rsplit(',')[1]:
143+
if _version is 2:
144+
rep = str('83 c4') + stack.st(str(binascii.a2b_hex(stack.toHex(line.rsplit('$0x')[1].rsplit(',')[0]))))
145+
if _version is 3:
146+
rep = str('83 c4') + stack.st(str(binascii.a2b_hex(stack.toHex(line.rsplit('$0x')[1].rsplit(',')[0]).encode('latin-1')).decode('latin-1')))
147+
shellcode = shellcode.replace(line,rep)
148+
149+
if 'cmpl' in line:
150+
if '(%eax)' == line.rsplit(',')[1]:
151+
if _version is 2:
152+
rep = str('81 38') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
153+
if _version is 3:
154+
rep = str('81 38') + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
155+
shellcode = shellcode.replace(line,rep)
156+
if '0x' in line.rsplit(',')[1]:
157+
if '%eax' in line:
158+
if _version is 2:
159+
rep = str('81 78') + stack.st(str(binascii.a2b_hex(stack.toHex(line.rsplit(',0x')[1].rsplit('(')[0])))) + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0])))
160+
if _version is 3:
161+
rep = str('81 78') + stack.st(str(binascii.a2b_hex(stack.toHex(line.rsplit(',0x')[1].rsplit('(')[0]).encode('latin-1')).decode('latin-1'))) + stack.st(str(binascii.a2b_hex(line.rsplit('$0x')[1].rsplit(',')[0].encode('latin-1')).decode('latin-1')))
162+
shellcode = shellcode.replace(line,rep)
163+
164+
if 'jne' in line:
165+
rep = str('75') + hex(int('f4', 16) - last*9)[2:]
166+
shellcode = shellcode.replace(line,rep,1)
167+
last += 1
168+
shellcode = stack.shellcoder(shellcode.replace('\n','').replace(' ',''))
169+
return shellcode
170+
+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env python
2+
'''
3+
OWASP ZSC
4+
https://www.owasp.org/index.php/OWASP_ZSC_Tool_Project
5+
https://github.com/zscproject/OWASP-ZSC
6+
http://api.z3r0d4y.com/
7+
https://groups.google.com/d/forum/owasp-zsc [ owasp-zsc[at]googlegroups[dot]com ]
8+
'''
9+
10+
pass

0 commit comments

Comments
 (0)