Hello all in this post I am gonna share one of my experiment with shellcodes with you guys. So, before we begin I wanna warn you guys about one thing that the shellcode I have used in this example is a reverse_tcp shell code. So I will suggest you to use some harmless shell code like WinExec CALC while doing such experiment.
So I started with generating a raw binary of metasploit's windows/shell_reverse_tcp payload. After generating the raw binary I ran a quick anti virus scan of that binary using VirusTotal.com. Here is the output of virustotal.com.
31/42. 31 out of 42 anti viruses detected that binary.As usual result was not so much shocking for me.
So I decided to play with that and trying to reduce the detection rate. To do that I generated the raw shellcode from metasploit with single itaration of default encoder shikata_ga_nai. Here is the generated shell code from metasploit.
Obviously I took the encoded one which is null free shellcode. So after that I quickly wrote a XOR encrypt-er in C and encrypted the generated shellcode with a random key. Here is the code of the encrypter.
C code to Encrypt ShellCode using XOR:
So compiling and running the code gave me one XOR encrypted ShellCode.
So from output I removed the extra bytes and extracted the encrypted shellcode.
Upto this its quite easy enough. But actual challenge is running the shellcode on target properly. So to do that we can do following things on run time of the binary.
So after compiling the code before running I did a quick run time analysis of compiled binary using OllyDBG. Here is few screen shots taken at run time analysis of that binary.
And after that you know what the interesting part is?? Again I ran a quick scan of that new binary using VirusTotal. The detection rate was reduced from 31/42 to 7/42!!!!!
Thank you for reading. Feel free to leave comments for any confusion or question.
So I started with generating a raw binary of metasploit's windows/shell_reverse_tcp payload. After generating the raw binary I ran a quick anti virus scan of that binary using VirusTotal.com. Here is the output of virustotal.com.
31/42. 31 out of 42 anti viruses detected that binary.As usual result was not so much shocking for me.
So I decided to play with that and trying to reduce the detection rate. To do that I generated the raw shellcode from metasploit with single itaration of default encoder shikata_ga_nai. Here is the generated shell code from metasploit.
Obviously I took the encoded one which is null free shellcode. So after that I quickly wrote a XOR encrypt-er in C and encrypted the generated shellcode with a random key. Here is the code of the encrypter.
C code to Encrypt ShellCode using XOR:
So compiling and running the code gave me one XOR encrypted ShellCode.
So from output I removed the extra bytes and extracted the encrypted shellcode.
Upto this its quite easy enough. But actual challenge is running the shellcode on target properly. So to do that we can do following things on run time of the binary.
- Decrypt the encrypted shellcode with the key used to encrypt the shellcode.
- Allocate a enough space on virtual memory for the decrypted shell code using VirtualAlloc()
- Copy decrypted shellcode to the allocated memory using RtlMoveMemory()
- Execute the certain region using CreateThread()
So I did exactly the same.
Here is the C code to Decrypt the shellcode and execute it on run time .
Here is the C code to Decrypt the shellcode and execute it on run time .
So after compiling the code before running I did a quick run time analysis of compiled binary using OllyDBG. Here is few screen shots taken at run time analysis of that binary.
Hi debasish mandal , Nice post !!!
ReplyDeleteCould you share xor1.exe codes ?
the code is already in this post!Check out section "C code to Encrypt ShellCode using XOR" of this post!
ReplyDeleteWell,got it (noscripts blocked it) TKS:D)
Deletevery nice tutorial. But can you change it more to get 0/42? ;)
ReplyDeleteIn this case its bit difficult because of XOR encryption.These AVs detecting this binary on the basis of XOR encryption/decryption signature. Even if you use any harmless shellcode like calc.exe it will get detected. So you can try any the other encryption technique to reduce the detection rate.
DeleteHi,
ReplyDeleteI think it's also about how did you copy/run the process/thread into memory.
hello
ReplyDeletebut in it problem in count every line char any solution for it in ur upper example ur simple shell first line have 15 hex char and after decrpt 18 char in one line so how can know how much char in one line ???
I dint get your question!can you please elaborate!
Deletemy mean after encryption xor how can i know how much hex char in one line
ReplyDeletelike shell first line is
ReplyDelete"\xba\x8f\x22\xc1\xd7\xda\xcf\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
15 hex and after xor
"\xD7\xF6\x5A\xAE\xA5\xB1\xAA\xA0\x34\x15\xC6\x68\x5C\xB0\xC9\x26\x43\x38"
18 hex char
That is not important.TOtal size of shellcode is 317 bytes,before and after encryption.
Deleteyes but if i write after encryption "\xD7\xF6\x5A\xAE\xA5\xB1\xAA\xA0\x34\x15\xC6\x68\x5C\xB0\xC9"
ReplyDelete"\x26\x43\x38\x71\xFA\x83\x35\x31\x60\x7D\x14\xAF\x52\x4D\x93"
like this it will work ???
oh sorry i check its works fine thx for it :)
ReplyDeleteThe Uttarakhand Board will release the UK Board tenth model paper 2020-21 at the side of the question papers quickly on its authentic internet site. Students could be capable of download the Uttarakhand Board Class 10 question papers UBSE 10th Question Paper 2021 As quickly as they may be launched, students who can be acting for UK Board Class 10 examinations should guide them as them in getting familiarized with the UK tenth exam pattern in a higher manner.
ReplyDelete