Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


How to run this code

I have written a small bash script that creates executable file from .asm file, generates shellcode based on this executable and embed this shellcode into 'executor' C-program that calls shellcode like it was exploited with stack-based buffer overflow.

Here is a small usage example:

german@slae-lab:~/slae-shellcoding$ ./ assignment_1/bind_shell.asm 
[+] Assembling with Nasm ...
[+] Linking ...
[+] Removing object file ...
[+] Moving executable into current folder ...
[+] Preparing shellcode ...
[+] Dumping shellcode into executor program ...
[+] Compiling ...
[+] executor file bind_shell.executor ready to rock!

german@slae-lab:~/slae-shellcoding$ ls
assignment_1  bind_shell  bind_shell.executor

'' script will give you two executable ELF-binaries:

  • 'bind_shell' - translated, compiled and linked nasm code (shellcode itself).
  • 'bind_shell.executor' - specially crafted binary that changes its execution flow to run your shellcode.

This will work only for two first assignments (bind_tcp and reverse_tcp shellcodes, also works for assignment #6).

In other cases, please, use custom executors I store in assignments folders.


Assignment 1

Create a Bind TCP Shell shellcode that binds to a port and executes shell on incoming connection. Port number should be easily configurable.

Read more here.

Assignment 2

Create a Shell_Reverse_TCP shellcode that reverse connects to configured IP and Port and execs shell on successful connection. IP and Port should be easily configurable.

Read more here

Assignment 3

Study about the Egg Hunter shellcode and create a working demo of the Egghunter. Should be configurable for different payloads.

Read more here

Assignment 4

Create a custom encoding scheme like the "Insertion Encoder". PoC with using execve-stack as the shellcode to encode with your schema and execute.

Read more here

Assignment 5

Take up at least 3 shellcode samples created using Msfpayload for linux/x86. Use GDB/Ndisasm/Libemu to dissect the functionality of the shellcode. Present your analysis.

Read more here

Assignment 6

Take up 3 shellcodes from Shell-Storm and create polymorphic versions of them to beat pattern matching. The polymorphic versions cannot be larger 150% of the existing shellcode. Bonus points for making it shorter in length than original.

Read more here

Assignment 7

Create a custom crypter like the one shown in the "crypters" video. Free to use any existing encryption schema. Can use any programming language.

Read more here


XOR Encoder

Allow you to perform xor encoding of your shellcode to avoid bad characters. It will find XOR key for you, just run it with this command:

german@slae-lab:~/shellcoding/encoder$ python "\xcc\xcc\x00" "\x00"

Suitable key found: \x01
Encoded: "\xeb\x0d\x5e\x31\xc9\xb1\x03\x80\x36\x01\x46\xe2\xfa\xeb\x05\xe8\xee\xff\xff\xff\xcd\xcd\x01"

Also, there is decoder asm file. You can try to optimize it, but don't forget to change decoder shellcode in the python script.

MBR Shellcode

Source files and generator script for the shellcode that rewrites MBR of /dev/sda to print extorting message.

Read more:



All stuff about my SLAE journey. Shellcodes, assignments, my own dirty hacks, etc.






No releases published


No packages published