Manually embedding shellcode into executables

[irongeek at irongeek.com (Adrian Crenshaw)]

I've been looking into this as well. From the recent release notes:


   - Win32 payloads can now be embedded into arbitrary executables using
   'msfencode -t exe -x MYFILE.exe -o MYNEWFILE.exe'.

I assume they mean for you to pipe in the output of msfpayload? I'd also be
interested in seeing how to use msfencode to obfuscate and exe without
adding a payload, so I can get some of my current binaries past AV. I tried:

echo | msfencode -t exe -x notepad.exe -o MYNEWFILE.exe

to try to put nothing in, and that did not work. Is there a noop payload?


Thanks,
Adrian


On Tue, Dec 1, 2009 at 3:12 PM, Dimitrios Kapsalis <dimitrios at gmail.com>wrote:

> I'd be interested in this topic as well.
>
> On Tue, Dec 1, 2009 at 10:13 AM, Matthew Raspberry <
> matt.raspberry at gmail.com> wrote:
>
> > Hey all,
> >
> > I was listening to Pauldotcom episode 176 when Relic was talking about
> > manually embedding payloads into executables and I was wondering if someone
> > could point me to a book or website with more information on doing that? I
> > realize Metasploit has automated the process, I would just like to know how
> > it is done. I just recently got into IT Security, coming from a Sys Admin
> > job previously, and don't know too much about the more advanced topics. Any
> > help on this is appreciated.
> >
> > --
> > Matt Raspberry
> >
> > _______________________________________________
> > Pauldotcom mailing list
> > Pauldotcom at mail.pauldotcom.com
> > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> > Main Web Site: http://pauldotcom.com
>
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20091201/8effabf3/attachment.htm