pe2shc-to-cdb
This tool will convert shellcode generated using pe_to_shellcode to cdb format. Cdb.exe is a LOLBIN which can help evade detection & application whitelisting. More information can be found about it in my blog post.
Requirements
- pe_to_shellcode
- xxd
Usage
Step 1
# Generates executable.shc.exe
pe2shc.exe <executable>
Step 2
xxd -i executable.shc.exe > temp.out
Step 3
# Generates out.wds
python cdb.py -f temp.out
Step 4
cdb.exe -pd -cf out.wds -o notepad.exe
Example
Step 1
# Generates executable.shc.exe
pe2shc.exe <executable>
Step 2
xxd -i executable.shc.exe > temp.out
Step 3
# Generates out.wds
python cdb.py -f temp.out
Step 4
cdb.exe -pd -cf out.wds -o notepad.exe
Example
The test.exe binary launches calc.exe.
