ShellDetect - Shell Code Detector Tool

Shell Detect is the FREE tool to detect presence of Shell Code within a file or network stream. You can either provide raw binary file (such as generated from Metasploit [Reference 4]) or network stream file as input to this tool.

These days attackers distribute malicious files which contains hidden exploit shell code. On opening such files, exploit shell code get executed silently, leading to complete compromise of your system . This is more dangerous when the exploit is 'Zero Day' as it will not be detected by traditional signature based Anti-virus solutions. In such cases ShellDetect may help you to identify presence of shell code (as long as it is in raw format) and help you to keep your system safe.



New version 1.1 provides support for detecting Unicode Shellcode. Now you can directly feed unicode shellcode without converting it to binary or raw form. For example, %u4141%u4242 can be detected directly from the input file.

We recommend running this tool in Virtual Environment (using VMWare, VirtualBox [Reference 2,3]) as it may cause security issues on your system if the input file is malicious.

Currently ShellDetect tool is in experimentation stage and works on Windows XP (with SP2, SP3) only.




Requirements
ShellDetect requires following components
Python - Install latest version [Reference 1]
Vmware/VirtualBox (optional) [Reference 2,3]


Using ShellDetect
Here is the simple usage instructions [refer to screenshot below]

Usage: ShellDetect.py file_name

You can provide input file as raw binary file or network stream data. Here are the possible examples.
Eg 1: Generate shellcode from Metasploit [Reference 4] in "raw" format and save it in a file. Then feed that file as input to ShellDetect.py.
Eg 2: Send exploit to any server on FTP and capture the traffic using tcpdump/wireshark, save the traffic in binary format and then feed that file to ShellDetect.py
Alternatively you can alsodownload shell detect sample(password: securityxploded) and play around with the tool.

We recommend running it in Virtual Environment (using VMWare, VirtualBox [Reference 2,3]) as it may cause security issues on your system if the input file is malicious.



Screenshots
Here is the screenshot of ShellDetect detecting shell code in raw file as well as network stream file.

Release History
Version 1.1 : 23rd Feb 2012
Added support for detecting unicode shellcode. Now user can directly feed unicode shellcode without converting to binary or raw form. Also includes minor changes in main handler (schandler) program.

Version 1.0 : 14th Jan 2012
First public release of ShellDetect



Disclaimer
ShellDetect tool is released "as is" without any warranty of any kind, neither SecurityXploded nor the author is responsible for any damage due to use or misuse of this tool.

Download

FREE Download ShellDetect 1.1

License : Freeware
Platform : Windows XP
shelldetect.zip
References
Python - http://python.org/
VMWare - http://vmware.com
VirtualBox - http://virtualbox.org
Metasploit - http://metasploit.com