Skip to main content

Custom Encoder x86 - SLAE Assignment 0x4

Before we start , I would like to bring your attention to this SLAE course from securitytube which will help you learn Shellcoding - http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

AGENDA : 
1. Introduction to Insertion Encoder
2. Create a custom encoding scheme similar to the “Insertion Encoder” 
3. Proof of concept using the execve-stack as the shellcode to encode 

1. Introduction to Encoding:
Encoding is the process of converting data from one form to another.
Insertion encoding is used to obfuscate shellcode instructions by adding some extra instructions .This reduces the detection of shellcode.

2. Create a custom encoding scheme similar to the “Insertion Encoder” :

I have written a python encoder which takes every byte of shellcode and do a XOR operation . After the XOR encoding we keep on inserting random bytes in between shellcode. 

3. Proof of Concept using execve-stack as the shellcode to encode :

The address of the shellcode is saved in esi register by using jmp call pop technique .The decoding process involves removal of random bytes and then XORing with same key value to obtain the actual decoded shellcode. 

After extracting the opcodes from object file we can check the shellcode through C file as shown below -

[x] All scripts can be found here - https://github.com/hexachordanu/SLAE/tree/master/Assignment-4
Proof of Concept :



This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ 


Student-ID: SLAE-1219

Comments

  1. Our 바카라 useful find operate enables you to slim down your search, meaning you spend less time shopping and extra time spinning! Once you’re ready to play, our exclusive Welcome Bonus enables you to load up your account from just €! Note that the €1 minimum deposit is simply legitimate in your first ever Caxino deposit. Read on to learn extra about the big number of on-line casino games on supply, developed by some of the the} main recreation suppliers in operation. Take your decide from 3,000 of one of the best casino games, optimised for seamless mobile play on just about any gaming platform.

    ReplyDelete

Post a Comment

Popular posts from this blog

Review of Pentester Academy - Attacking and Defending Active Directory Lab

Few months ago I didn't know what Active Directory is, and why should I care about it and never heard about ACL abuse and all. Although I had attended a BPAD (Breaking and Pwning Active Directory) training which was provided by Nullcon but I was not confident enough to go for this course exam, since my day-today activity involves VAPT stuffs related to Web/Network/Mobile and sometimes basic malware analysis (very basic one :p).  I started doing offshore lab and took help from some friends in understanding few Active Directory concepts. I did many silly mistakes during the lab and learned a lot. Meanwhile I registered for Active Directory Lab Course and got it in a discounted offer for first 50 students of about 11k INR  ( 1 mont lab access) :). Before wasting time any further let's dive into the review. The course -  https://www.pentesteracademy.com/activedirectorylab Certification - Certified Red Team Professional The Course Content  - After paying the course fee,

Backdoring PE files using code caves : OSCE/CTP Module 0x03 (OSCE Preparation)

Hello Readers, This post will cover Backdooring of P.E file by using code caves . There are already good tools to do this for you eg. Backdoor Factory and Shelter which will do the same job and even bypass some static analysis of few antiviruses . I will be covering the manual approach of backdooring a PE file . Let's understand some terms : [x] PE file : The Portable Executable (PE) format is a file format for executables, object code, and DLLs, used in 32-bit and 64-bit versions of Windows operating systems. [x] Code Cave : Wikipedia says - "A code cave is a series of null bytes in a process's memory. The code cave inside a process's memory is often a reference to a section of the code’s script functions that have capacity for the injection of custom instructions. For example, if a script’s memory allows for 5 bytes and only 3 bytes are used, then the remaining 2 bytes can be used to add external code to the script." [x] Shellcode : Wikipedia - &qu

Exit Shellcode x86

Exit in Assembly : For writing exit assembly program we need to check exit syscall reference number . I use this online man page : https://syscalls.kernelgrok.com / From above we can conclude that for exit system call we need 2 registers : [x] EAX => Eax should contain exit sys call number (0x01) [x] EBX => Ebx should contain  error code (0 for normal exit) A good shell-code : [x] Should be Null free [x] Smaller in length [x] Position Independent Below is my code : I wrote a small script to compile and assemble nasm program and extract the shellcode from it then saving the shellcode into a c file and compiling the new c program. Here is my script : Tweaked some instructions :p Next you can debug and check the execution in gdb by setting breakpoints and stepping instructions one by one . Below is my gdb console before calling interrupt int 0x80 showing the value of eax and ebx as expected :)