Wednesday 20 July 2016

Shellcode Encoders and code obfuscation modules


So there are lots of things added to tools in last 2-3 weeks. Everyone is actively working for the tool. So in my last post I completed Download to file shellcode and after that I added couple of shellcodes like add admin and disable firewall. All the shellcodes in the tool can be seen here.

Then I started working on code obfuscation modules for some time. I added Reverse hex and reverse base64 modules to the tool. Here is the code for python and javascript. This module was also developed for perl, ruby. I tested the modules with different languages on both python 2 and 3 and it worked correctly.

As the org was selected for DEFCON 2016 we wanted to complete windows shellcode with encoders and also add osx shellcode. So in place of starting some complex obfuscation method I started working on encoders for windows shellcode. I added xor_random, add_random, sub_random and xor_yourvalue. I also have done add_yourvalue but we are trying to fix this issue before I add other encoders to the tool.

All the PR's made by me can be found here : https://github.com/zscproject/OWASP-ZSC/pulls?q=is%3Apr+is%3Aclosed+author%3APratik151 if you want to look at code.

Also zsc tool now has osx shellcode also thanks to Akash Trehan. He added osx shellcode to the tool. Also thanks to Ali, Brian and Johanna for helping me.