BufferOverflow-Kit
We collect many tools used in buffer overflow development in one place, repeating with new idea is not a shame - thanks China :) If you are a buffer overflow guy, then may you like to contribute and develop with us ALL your tools in ONE place.
What BufferOverflow Kit contain?
- Commandline base.
- pattern create (like metasploit pattern_create script)
- pattern offset (like metasploit pattern_offset script)
- Hex to Little endian chracter (ex. \x41\x\42\x\43\x44 to \x44\x43\x42\x41)
- Convert Hex shellcode to Binary file
- Convert Binary file to Hex raw
- Find jmp,call and pop pop ret address from (exe, dll) files (like msfpescan)
- and more will be added,,
How to use?
Make sure ruby is installed. Tested on Ruby 1.9.3 only
Required gems
gem install colorize
Help
Usage: ruby bofk-cli.rb {OPTIONS} ARGUMENT
Help menu:
-c, --pattern-create LENGTH Create Unique pattern string.
-o, --pattern-offset OFFSET Find Pattern offset string.
-l, --pattern-length LENGTH Only used with 'pattern-offset' if pattern was longer than 20280.
-e, --hex2lend OPCODE Convert Hex to little endian characters.
-b, --hex2bin Convert Hex shellcode to binary file.
-x, --bin2hex BINARY_FILE Convert binary shellcode to Hex string.
-t, --type TYPE Used with 'bin2hex' & 'pattern-create'. Types: ruby, perl, python, c.
-v, --version Display Buffer Overflow Kit version.
-u, --update Update Buffer Overflow Kit.
-h, --help Display help screen
External tools - bin/
[-] hex2bin.rb Hex to Binary file - BoFkit.
[-] nasm.exe Assembler and disassembler.
[-] mona.py Immunity debugger plugin - Corelan team.
Examples:
ruby bofk-cli.rb --pattern-create 500
ruby bofk-cli.rb --pattern-offset Aa4Z
ruby bofk-cli.rb --pattern-offset Zu2Z --pattern-length 40000
ruby bofk-cli.rb --hex2lend 0x41F2E377
ruby bofk-cli.rb --hex2bin
ruby bofk-cli.rb --bin2hex input.bin
Pattern create Without output format
bofk-cli.rb --pattern-create 400
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2A
Support output format (Available formats: Ruby, Perl, Python, C)
bofk-cli.rb --pattern-create 200 --type perl
"Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A" .
"d3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag" .
"6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9" .
"Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2A";
Pattern offset
ruby bofk-cli.rb --pattern-offset GAa0
27
Convert to little endian
ruby bofk-cli.rb -e \x41\x\42\x\43\x44
\x44\x43\x42\x41
Convert Binary file to hex string Without output format
ruby bofk-cli.rb --bin2hex out.bin
# Outputs
\xdb\xc1\xbe\x8e\x0c\xae\x5a\xd9\x74\x24\xf4\x5f\x33\xc9\xb1\x56\x83\xc7\x04\x31\x77\x14\x03\x77\x9a\xee\x5b\xa6\x4a\x67\xa3\x57\x8a\x18\x2d\xb2\xbb\x0a\x49\xb6\xe9\x9a\x19\x9a\x01\x50\x4f\x0f\x92\x14\x58\x20\x13\x92\xbe\x0f\xa4\x12\x7f\xc3\x66\x34\x03\x1e\xba\x96\x3a\xd1\xcf\xd7\x7b\x0c\x3f\x85\xd4\x5a\xed\x3a\x50\x1e\x2d\x3a\xb6\x14\x0d\x44\xb3\xeb\xf9\xfe\xba\x3b\x51\x74\xf4\xa3\xda\xd2\x25\xd5\x0f\x01\x19\x9c\x24\xf2\xe9\x1f\xec\xca\x12\x2e\xd0\x81\x2c\x9e\xdd\xd8\x69\x19\x3d\xaf\x81\x59\xc0\xa8\x51\x23\x1e\x3c\x44\x83\xd5\xe6\xac\x35\x3a\x70\x26\x39\xf7\xf6\x60\x5e\x06\xda\x1a\x5a\x83\xdd\xcc\xea\xd7\xf9\xc8\xb7\x8c\x60\x48\x12\x63\x9c\x8a\xfa\xdc\x38\xc0\xe9\x09\x3a\x8b\x65\xfe\x71\x34\x76\x68\x01\x47\x44\x37\xb9\xcf\xe4\xb0\x67\x17\x0a\xeb\xd0\x87\xf5\x13\x21\x81\x31\x47\x71\xb9\x90\xe7\x1a\x39\x1c\x32\x8c\x69\xb2\xec\x6d\xda\x72\x5c\x06\x30\x7d\x83\x36\x3b\x57\xb2\x70\xf5\x83\x97\x16\xf4\x33\x02\x54\x71\xd5\x46\x8a\xd4\x4d\xfe\x68\x03\x46\x99\x93\x61\xfa\x32\x04\x3d\x14\x84\x2b\xbe\x32\xa7\x80\x16\xd5\x33\xcb\xa2\xc4\x44\xc6\x82\x8f\x7d\x81\x59\xfe\xcc\x33\x5d\x2b\xa6\xd0\xcc\xb0\x36\x9e\xec\x6e\x61\xf7\xc3\x66\xe7\xe5\x7a\xd1\x15\xf4\x1b\x1a\x9d\x23\xd8\xa5\x1c\xa1\x64\x82\x0e\x7f\x64\x8e\x7a\x2f\x33\x58\xd4\x89\xed\x2a\x8e\x43\x41\xe5\x46\x15\xa9\x36\x10\x1a\xe4\xc0\xfc\xab\x51\x95\x03\x03\x36\x11\x7c\x79\xa6\xde\x57\x39\xd6\x94\xf5\x68\x7f\x71\x6c\x29\xe2\x82\x5b\x6e\x1b\x01\x69\x0f\xd8\x19\x18\x0a\xa4\x9d\xf1\x66\xb5\x4b\xf5\xd5\xb6\x59
Support output format (Available formats: Ruby, Perl, Python, C)
ruby bofk-cli.rb --bin2hex out.bin --type ruby
# Outputs
"\xda\xd0\xd9\x74\x24\xf4\x5e\x2b\xc9\xb1\x56\xbf\x9d\x28\xd0" +
"\x22\x83\xee\xfc\x31\x7e\x14\x03\x7e\x89\xca\x25\xde\x59\x83" +
"\xc6\x1f\x99\xf4\x4f\xfa\xa8\x26\x2b\x8e\x98\xf6\x3f\xc2\x10" +
"\x7c\x6d\xf7\xa3\xf0\xba\xf8\x04\xbe\x9c\x37\x95\x0e\x21\x9b" +
"\x55\x10\xdd\xe6\x89\xf2\xdc\x28\xdc\xf3\x19\x54\x2e\xa1\xf2" +
"\x12\x9c\x56\x76\x66\x1c\x56\x58\xec\x1c\x20\xdd\x33\xe8\x9a" +
"\xdc\x63\x40\x90\x97\x9b\xeb\xfe\x07\x9d\x38\x1d\x7b\xd4\x35" +
"\xd6\x0f\xe7\x9f\x26\xef\xd9\xdf\xe5\xce\xd5\xd2\xf4\x17\xd1" +
"\x0c\x83\x63\x21\xb1\x94\xb7\x5b\x6d\x10\x2a\xfb\xe6\x82\x8e" +
"\xfd\x2b\x54\x44\xf1\x80\x12\x02\x16\x17\xf6\x38\x22\x9c\xf9" +
"\xee\xa2\xe6\xdd\x2a\xee\xbd\x7c\x6a\x4a\x10\x80\x6c\x32\xcd" +
"\x24\xe6\xd1\x1a\x5e\xa5\xbd\xef\x6d\x56\x3e\x67\xe5\x25\x0c" +
"\x28\x5d\xa2\x3c\xa1\x7b\x35\x42\x98\x3c\xa9\xbd\x22\x3d\xe3" +
"\x79\x76\x6d\x9b\xa8\xf6\xe6\x5b\x54\x23\xa8\x0b\xfa\x9b\x09" +
"\xfc\xba\x4b\xe2\x16\x35\xb4\x12\x19\x9f\xc3\x14\xd7\xfb\x80" +
"\xf2\x1a\xfc\x33\xb0\x92\x1a\x51\xa6\xf2\xb5\xcd\x04\x21\x0e" +
"\x6a\x76\x03\x22\x23\xe0\x1b\x2c\xf3\x0f\x9c\x7a\x50\xa3\x34" +
"\xed\x22\xaf\x80\x0c\x35\xfa\xa0\x47\x0e\x6d\x3a\x36\xdd\x0f" +
"\x3b\x13\xb5\xac\xae\xf8\x45\xba\xd2\x56\x12\xeb\x25\xaf\xf6" +
"\x01\x1f\x19\xe4\xdb\xf9\x62\xac\x07\x3a\x6c\x2d\xc5\x06\x4a" +
"\x3d\x13\x86\xd6\x69\xcb\xd1\x80\xc7\xad\x8b\x62\xb1\x67\x67" +
"\x2d\x55\xf1\x4b\xee\x23\xfe\x81\x98\xcb\x4f\x7c\xdd\xf4\x60" +
"\xe8\xe9\x8d\x9c\x88\x16\x44\x25\xb8\x5c\xc4\x0c\x51\x39\x9d" +
"\x0c\x3c\xba\x48\x52\x39\x39\x78\x2b\xbe\x21\x09\x2e\xfa\xe5" +
"\xe2\x42\x93\x83\x04\xf0\x94\x81"
Convert Binary file to hex string
You can paste any kind of fromat(Ruby, Perl, Python, C)
ruby bofk-cli.rb --hex2bin
# Outputs
[+] Paste your shellcode then press ctrl+x
[+] Hex string has been saved in file name: .shellcode.txt
[+] Binary file name: shellcode
[+] Binary file size: 368 bytes.