476 bytes small Windows/x64 PIC null-free TCP reverse shell shellcode.
bba5751e922713bc181d1684a80fe65ee53eab2de87b3bbaf9cb5fc3fdccc945
170 bytes small Linux/x64 memfd_create ELF Loader shellcode.
2dc407857824c17594024902be962b49ce532aee8e9d3c302790295cd4d64e3c
169 bytes small Windows/x64 PIC NULL-free calc.exec shellcode.
4d8ef778b3fa4d33d047bc1cf28b30c55e64f1c18779fd433649fe60f5ea0bef
326 bytes small Windows/x64 add administrative user dynamic PEB and EDT method shellcode.
ce836880761cfda2559a206f8a4eddd7cafbcbfe3f946cceb11b3d189d914798
This Windows/x64 shellcode is an implementation of the DeleteFileA Windows API to delete a file in the C:/Windows/Temp/ directory.
5aec26b7e7e54f4fd6d0132a04967aea1827335f4327596bf01678300a0e46bb
71 bytes small Linux/x86_64 bash shellcode with XOR encoding.
801d1c974de1f03b559e03ce6feeaff70b28545726389af5b9766890611a1dc5
92 bytes small Linux/x86 polymorphic nc -lvve/bin/sh -p13377 shellcode.
05c38fb813c23c380d6dd1aa3c46be607e0be4322b049a9a2b1ada74e5f3ebc6
146 bytes small FlipRotation version 1.0 decoder shellcode.
caaf753479490907a0b5aab043a31cea50405595c33d8f36d7b099eb3ca98baa
373 bytes small Windows/x86 create administrator user dynamic PEB and EDT method null-free shellcode.
bc0be9163bb975df26f17d6f2ca0289dfedc8e8f35a9bd95e0682e7123f4061e
286 bytes small macOS/x64 execve Caesar cipher string null-free shellcode.
aa23ac4a240ae6871b72d0723b1c8d4ebded5889ad862b0dd0455f86699c05a2
253 bytes small macOS/x64 execve null-free shellcode.
8b589116ca43d93bd39b3f0f87c1530ec372e055ebb8ddff6b021bf288966dd7
This tool is a 3DES shellcode crypter.
9e6475d7e02bb5bcc0b7670b1ca005b4e4ecb987abc3fd2dcd7a5d44af829d04
X0R Cryptor with DEC/N0T/R0R encoder plus random byte insertion.
79b9b9a6dd757b66b2e94d3630b76899ed2e53218846c0933182d8877820babb
64 bytes small Solaris/SPARC setuid(0) + chmod (/bin/ksh) + exit(0) shellcode.
ac0a8ce6fdd207649a67626e1818a1afd680783d1a46fb94677718a1d1994210
60 bytes small Solaris/SPARC setuid(0) + execve (/bin/ksh) shellcode.
d785c150823ddd32cb42d29580182ea9055608bea403fff7662eca6bf006f946
Linux/MIPS N32 MSB reverse shell shellcode that showcases various techniques to avoid badchars.
b1b0100dc2ab1910886ea650ac52df457851a4b14a3d07a98e33678c077b6d6e
Solaris/SPARC chmod() shellcode with a max size of 36 bytes.
844bef47108ea6b399c1949416ca0526422e2fc8ce504d583c3f36aaa4144470
171 bytes small Windows/x86 shellcode with a new method to find the kernel32 base address by walking down the stack and look for a possible Kernel32 address using a custom SEH handler. Each address found on the stack will be tested using the Exception handling function. If it's valid and starts with 7, then it's a possible kernel32 address.
e7941faf4a7799cf5e35fcf962b075b17a9570e4f37e959633b2962f8d3bf53d
133 bytes small Windows/x86 kernel32 base address / memory sieve method shellcode.
02598a837cdf14b2aa15f8aa989595e031da15dac8d7e4835e2d041eda455355
458 bytes small Windows/x86 download file and execute dynamic PEB and EDT method shellcode.
373527dc3abce798f323c157f33b7e37a9ae39642431558cc7be8a6423eec576
Windows/x86 bind TCP shellcode / dynamic PEB and EDT method null-free shellcode. This a bind tcp shellcode that open a listen socket on 0.0.0.0 and port 1337. In order to accomplish this task the shellcode uses the PEB method to locate the baseAddress of the required module and the Export Directory Table to locate symbols. Also the shellcode uses a hash function to gather dynamically the required symbols without worry about the length.
7dd9706d9d60f259d8e6ef790111d2ef99c07abddaae6debfdc64b5c0856ce2f
178 bytes small Windows/x86 shellcode that pops calc.exe. The shellcode uses the PEB method to locate the baseAddress of the required module and the Export Directory Table to locate symbols. It also uses a hash function to dynamically gather the required symbols without worry about the length. Finally, the shellcode pops the calc.exe using WinExec and exits gracefully using TerminateProcess.
9b19277190c962885d3585247da068c374f5db74bbb693ce9cb6fe906a1118a8
330 bytes small Windows/x86 reverse TCP shellcode that connects to 192.168.201.11:4444.
12149f06ca22bb6ea072202a3c3d714fb9e0922026292c67e2fc3c768fa2b30f
Linux/x86 egghunter reverse TCP shell shellcode generator with dynamic IP and port.
f381e9e627457c622f41f2e0f02fd7275a109fbf7c64277852a12fa68a12f383
86 bytes small Linux/x86 reverse TCP shell with dynamic IP and port binding shellcode.
098ad2f853874de86f3c54be8fe5f0603e48dcd1deaae5ff49d0f3c6ecd04c34