/* * Title: Linux/x86 - Custom Shellcode ASCII And-Sub Encoder * Date: 29.03.2021 * Author: Xenofon Vassilakopoulos * github : https://github.com/xen0vas/ASCII-AND-SUB-Encoder * * * gcc -m32 sub.c -o sub * * Usage : ./sub -s \x41\xff\x41\x41 -b \x0a\x0d\x2f\x3a\x3f\x40\x80\x81\x82 * * */ #include #include #include #include #include #include #include #include #include #include #define KNRM "\x1B[0m" #define KRED "\x1B[31m" #define KGRN "\x1B[32m" #define KYEL "\x1B[33m" #define KBLU "\x1B[34m" #define KMAG "\x1B[35m" #define KCYN "\x1B[36m" #define KWHT "\x1B[37m" #define RESET "\x1B[0m" #define ZEROVAL 0x0 char *hexToStrip(char *shellcode, size_t si) { size_t s = strlen(shellcode); char *buf = (char*)malloc((s + 1) * sizeof(shellcode)*2); char *stringToStrip = (char*)malloc((s + 1) * sizeof(shellcode)*2); strcpy(stringToStrip,shellcode); size_t stringLen = strlen(stringToStrip); unsigned int i,j = 0; char currentChar; for (j = 0; j j) { ch = str[i]; str[i] = str[j]; str[j] = ch; i--; j++; } return str; } unsigned char* toCharByte(char *byte, size_t bytelen) { if (byte == NULL || !strcmp(byte, "")) { return NULL; } size_t k,len = bytelen; char cbyte[len]; strcpy(cbyte, byte); // allocate the 1/3 of the total char size unsigned char* str = (unsigned char*)calloc(len / 3, sizeof(str)); unsigned char* chr = (unsigned char*)calloc(len / 3 , sizeof(chr)); char* alpha = (char*)malloc((len / 3) * sizeof(alpha)); char *ch = strtok(cbyte, "\\x"); while(ch != NULL) { sprintf(alpha + strlen(alpha), "%s", ch ); ch = strtok(NULL, "\\x"); } for(k=0; alpha[k]!='\0'; k+=2) { sprintf(str + strlen(str), "%c%c ", alpha[k], alpha[k+1]); } chr = hexTochar(str); free(str); free(alpha); return chr; } char *charTohex(char *shellcode, size_t si) { char *chr = (char*)calloc(si+1 , sizeof(shellcode)*2); int l; for (l=0; l -b "); printf("%s", RESET); printf("\n\nArgs: \n\t [-s] The shellcode to encode \n\t [-j] Encode a long jump \n\t [-b] The bad characters to filter out \n\n"); return 1; } if ( ( ( strncmp(argv[1],"-s",2) != 0) && (strncmp(argv[1], "-j",2) != 0) ) || strncmp(argv[3],"-b",2) != 0 ) { banner(); printf("\n\n"); printf("%s", KRED); printf("\n\n[x] Error: Provide a valid option. \n\n[!] Usage: ./and-sub -s -b \n\nArgs: \n\t [-s] The shellcode to encoded \n\t [-j] encode a long jump \n\t [-b] The bad characters to filter out \n\n"); printf("%s", RESET); return 1; } /********************************************************* --- Check if the provided shellcode is divisible by 4 --- *********************************************************/ unsigned char *divisible = toCharByte(argv[2], strlen(argv[2])*2); size_t si = strlen(divisible); char *chr = charTohex(divisible, si); size_t calc = strlen(chr) / 4; int divres = calc % 4; if ( divres != 0) { banner(); printf("%s",KRED); printf("\n[x] The shellcode is not divisible by 4. PLease add extra padding and try again\n\n"); printf("%s", RESET); return 0; } //--------------------------------------------------- nasm_banner(); unsigned char *badchars = toCharByte(argv[4], strlen(argv[4])); srand((unsigned int)time(NULL)); /********************************************** ---Find bytes zeroing out the registers--- **********************************************/ unsigned char *subres = "\xbb\xbb\xbb\xbb" ; unsigned char *buff = (char*)malloc(sizeof(subres)*2); unsigned char *b = (char*)malloc(sizeof(subres)*2); unsigned char *b2 = (char*)malloc(sizeof(subres)*2); unsigned char *buf_bytes = (char*)malloc(sizeof(char*)); char *push = (char*)malloc(sizeof(push)*2); char *pop_esp = (char*)malloc(sizeof(pop_esp)*2); char *pop = (char*)malloc(sizeof(pop)*2); char *sub_ = (char*)malloc(sizeof(char)); char *and = (char*)malloc(sizeof(and)*2); for ( int h = 0; h < 4; h++) { // These are some good chars - change this to make it relevant to your environment // Provide only bytes used to zero out the register in the AND process unsigned char nobadchars[] = "\x25\x2a\x2d\x31\x32\x35\x4a\x4d\x4e\x50\x51\x52\x53\x55\x5c"; int co = 0; for (int i = 0; i < strlen(nobadchars)+1; i++) { for ( int j=0; j SIZE_MAX / sizeof(char) ) { errno = ENOMEM; printf("Allocation Error", errno); return 0; } for (tokens = 1; token; ++tokens) { ptr = realloc(res, tokens * sizeof(*res)); res = ptr; res[tokens - 1] = malloc(strlen(token) + 1); strncpy(res[tokens - 1], token, strlen(token) + 1); token = strtok(NULL, ","); } printf("global _start\n"); printf("section .text\n\n"); printf("_start:\n\n"); size_t counter=strlen(*res)-1; if( ( (shellsize/4)-2) < 32 ) { counter = (strlen(*res)/2)-1; } for ( int k=0; k SIZE_MAX / sizeof(char) ) { errno = ENOMEM; printf("Allocation Error", errno); return 0; } unsigned char *tohex = toCharByte(res[k], ressize); /*-------------------------------------------------------*/ unsigned char *shellcode4=(unsigned char*)malloc(sizeof(shellcode)*2); memset( shellcode4, '\0', sizeof(shellcode4)*2); unsigned char *shellcode5=(unsigned char*)malloc(sizeof(shellcode)*2); memset( shellcode5, '\0', sizeof(shellcode5)*2); unsigned char *ffff=(unsigned char*)malloc(sizeof(shellcode)*2); memset(ffff , '\0', sizeof(ffff)*2); for (int i=0; i (int)rp[0]) || ((int)ffff[i] == 0) && bad == false) { sub[0] = rp[0] & 0xff; start1: buffer[1] = rand() & 0xff; for (int o = 0; o<=strlen(badchars); o++) { if ( buffer[1] == badchars[o] ) { count = count + 1; goto start1; } } if (count != 0) { bad = false; memcpy(&rp[0],(unsigned char*)&buffer[1],sizeof(buffer[1])); } else { bad = true; count = 0; } if ( ( ((int)ffff[i] == 0) || ( (int)sub[0] != 0 ) && bad == false) ) { sub[1] = rp[0] & 0xff ; start2: buffer[2] = rand() & 0xff; for (int o = 0; o<=strlen(badchars); o++) { if ( buffer[2] == badchars[o] ) { count = count + 1; goto start2; } } if (count != 0) { bad = false; memcpy(&rp[0],(unsigned char*)&buffer[2],sizeof(buffer[2])); } else { bad = true; count = 0; } if ( ((int)ffff[i] == 0 ) || ((int)sub[1] > (int)rp[0]) && ((int)sub[1] != 0 ) && bad == false ) { sub[2] = rp[0] & 0xff ; if ( (int)ffff[i] == 1 ) sub[3] = sub[0]; else if ( (int)ffff[i+1] == 1 ) sub[3] = (ffff[i]-1) - sub[0]; else if ( (int)ffff[i] == 0 ) sub[3] = sub[0]; else if ( (int)ffff[i+1] == 0 ) sub[3] = (ffff[i]-1) - sub[0]; else sub[3] = ffff[i] - sub[0]; if ( ( (int)sub[3] > (int)sub[1] ) ) sub[4] = sub[3] - sub[1]; if ( ((int)sub[4] == (int)sub[2] ) ) { if ( (int)ffff[i+1] == 1 ) { sub[5] = (ffff[i]-1) - sub[0] - sub[1] - sub[2]; } else if ( (int)ffff[i]==1) { sub[5] = 257 - (int)sub[0] - (int)sub[1] - (int)sub[2]; } else if ( (int)ffff[i+1] == 0 ) { sub[5] = (ffff[i]-1) - sub[0] - sub[1] - sub[2]; } else if ( (int)ffff[i]==0 ) { sub[5] = 256 - (int)sub[0] - (int)sub[1] - (int)sub[2]; } else { sub[5] = ffff[i] - sub[0] - sub[1] - sub[2]; } // long jump encoding if ( strncmp(argv[1],"-j",2) == 0 ) { if ( (int)ffff[i] == 0 ) { if( ( (int)sub[2] + (int)sub[1] + (int)sub[0] ) == 255 ) { memcpy(&third[i], (unsigned char*)&sub[2], sizeof(sub[2])); memcpy(&second[i], (unsigned char*)&sub[1], sizeof(sub[1])); memcpy(&first[i], (unsigned char*)&sub[0], sizeof(sub[0])); l=0; break; } else { l=1; } } else { if ( (int)sub[5] == 0 ) { memcpy(&third[i] , (unsigned char*)&sub[2], sizeof(sub[2])); memcpy(&second[i], (unsigned char*)&sub[1], sizeof(sub[1])); memcpy(&first[i] , (unsigned char*)&sub[0], sizeof(sub[0])); l=0; break; } else l=1; } } else if ( strncmp(argv[1],"-j",2) != 0 ) { if ( (int)sub[5] == 0 ) { memcpy(&third[i] , (unsigned char*)&sub[2], sizeof(sub[2])); memcpy(&second[i], (unsigned char*)&sub[1], sizeof(sub[1])); memcpy(&first[i] , (unsigned char*)&sub[0], sizeof(sub[0])); l=0; break; } else l=1; } } } } } if ( l==0 ) { j++; } else if (l==1) { j = 0; } } // while } // for char *ptx = hexToStrip(res[k], sizeof(res[k])); ptx = hexToStrip(res[k], strlen(res[k])); char *tochar = charTohex(ffff, sizeof(ffff)); char *strip = hexToStrip(tochar, strlen(tochar)); printf(";-------------------------------------------"); printf("\n"); printf("\n\n; Token : %s\n\n",res[k]); printf("; 0x0 - 0x%.8s = 0x%.8s\n\n",ptx, strip); printf("\n"); printf("%s, 0x%s\n",and, chrstrip ); printf("%s, 0x%s\n",and, chrstrip2 ); char *revres1 = charTohex(first, sizeof(first)); char *revstrip1 = hexToStrip(revres1, strlen(revres1)); printf("sub %s, 0x%s\n",sub_, revstrip1); char *revres2 = charTohex(second, sizeof(second)); char *revstrip2 = hexToStrip(revres2, strlen(revres2)); printf("sub %s, 0x%s\n",sub_, revstrip2); char *revres3 = charTohex(third, sizeof(third)); char *revstrip3 = hexToStrip(revres3, strlen(revres3)); printf("sub %s, 0x%s\n",sub_, revstrip3); printf("%s\n",push); printf("\n"); free(tohex); if ( shellcode5 != NULL ) memset( shellcode5, '\0', sizeof(shellcode5)*2); if ( shellcode4 != NULL ) memset( shellcode4, '\0', sizeof(shellcode4)*2); if ( ffff != NULL ) memset( ffff, '\0', sizeof(ffff)*2); } free(res); printf("\n\n"); return 0; } //@xvass