String Shellcode |
Shellcode will be cleaned of non-hex bytes using the following algorithm:
s = s.replace(/(0x|0X)/g, ""); s = s.replace(/[^A-Fa-f0-9]/g, "");
See also: Overflow Exploit Pattern Generator - Online Tool.
About this tool
I'm preparing a malware reverse engineering class and building some crackmes for the CTF. I needed to encrypt/obfuscate flags so that they don't just show up with a strings tool. Sure you can crib the assembly and rig this out pretty easily, but the point of these challenges is to instead solve them through behavioral analysis rather than initial assessment. I'm sure this tool will also be good for getting some dirty strings past AV.
Sadly, I'm still not satisfied with the state of C++17 template magic for compile-time string obfuscation or I wouldn't have had to make this. I remember a website that used to do this similar thing for free but at some point it moved to a pay model. I think maybe it had a few extra features?
This instruments pretty nicely though in that an ADD won't be immediately followed by a SUB, which is basically a NOP. Same with XOR, SHIFT, etc. It can also MORPH the output even more by using the current string iteration in the arithmetic to add entropy.
Only ASCII/ANSI is supported because if there's one thing I dislike more than JavaScript it's working with UCS2-LE encodings. And the only language it generates is raw C/C++ because those are the languages you would most likely need something like this for. Post a comment if there's a bug, and feel free to rip the code out if you want to.
awsome
ReplyDeletemight be neat to have an 'srand / rand' pass that uses prng determinism to compute the next value in libc instead (this will make it implementation-dependent). Or encode an 8-bit lfsr directly: https://en.wikipedia.org/wiki/Linear-feedback_shift_register . I guess at some point these all become special cases of using a stream cipher with an embedded obfuscated key :) https://gist.github.com/thoughtpolice/2b36e168d2d7582ad58b
ReplyDeleteYea rand might not be possible to do and have JavaScript spit out the correct result, although most libc I've seen uses the same constants. I think an LFSR would probably be doable.
DeleteIf no option is selected from the error of: 'TypeError: last is not a function'
ReplyDelete