slae32 crypters
1.0.0
Student ID: SLAE-1530
Dieser Shellcode Crypter verwendet RC4 -Cipher, um die Nutzlast direkt im Speicher zu verschlüsseln und zu entschlüsseln.
Der RC4 -Schlüssel ist nicht sowohl von Crypter als auch von Stub bekannt, es wird bei Stub -Laufzeit CRC32(Random(Length=4)) . Fühlen Sie sich frei, die Länge des zufälligen Schlüssels zu erhöhen. Beachten Sie, dass es die Zeit erheblich erhöhen kann, bevor Shellcode entschlüsselt wird.
Wenn die Nutzlast zur Laufzeit entschlüsselt wird, erstellt der Stub eine neue ausführbare Speicherregion und kopiert den entschlüsselten Shellcode vor der Ausführung in diese Region.
Es bedeutet, dass der Stapel nicht ausführbar ist.
Die Nutzlast wird am EOF des generierten Stubs gespeichert.
Um sowohl Stub als auch Crypter zu kompilieren, müssen Sie Lazarus IDE auf Ihrem Linux -Computer installieren.
Auf Ubuntu / Debian können Sie den folgenden Befehl verwenden:
Lokal@Benutzer: $ sudo apt install lazarus
Lokal@Benutzer: $ Crypter/dist/crypter <shellcode> <outputfile>
Lokal@Benutzer: $ Crypter/dist/crypter "x31xc0x50x68x62x61x73x68x68x69x6ex2fx2fx68x2fx2fx2fx62x89xe3x66xb8x2dx63x50x31xc0x89xe2x50x68x73x73x77x64x68x63x2fx70x61x68x20x2fx65x74x68x2fx63x61x74x68x2fx62x69x6ex89xe6x50x56x52x53x89xe1x50x89xe2xb0x0bxcdx80" /tmp/encrypted_payload
Lokal@Benutzer: $ /tmp/encrypted_payload
Build.pyBuild.Py -Skript wurde entwickelt, um sowohl Stub als auch Crypter kompilieren, aber nicht nur.
Wenn eine neue Stub -Programmversion generiert wird, basiert das Skript den Rohstub direkt in den Crypter .
Dies ist erforderlich, da das Crypter -Programm vollständig eigenständig ist und der Stub im Inneren eingebettet ist.
Lokal@Benutzer: $ cd Crypter && python3 build.py
phrozen@ubuntu:~/SLAE32/SLAE-Exam/Level7/git/slae32-crypters$ cd Crypter && python3 build.py
[*] Compile stub project...
Hint: (11030) Start of reading config file /etc/fpc.cfg
Hint: (11031) End of reading config file /etc/fpc.cfg
Free Pascal Compiler version 3.0.4+dfsg-18ubuntu2 [2018/08/29] for i386
Copyright (c) 1993-2017 by Florian Klaempfl and others
(1002) Target OS: Linux for i386
(3104) Compiling stub.dpr
(3104) Compiling ../shared/unteof.pas
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/unteof.pas(92,47) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
(3104) Compiling ../shared/untrc4.pas
(3104) Compiling ../shared/untcrc32.pas
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untcrc32.pas(113,43) Hint: (4055) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untcrc32.pas(113,61) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untcrc32.pas(113,37) Warning: (4056) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untrc4.pas(244,13) Hint: (4055) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untrc4.pas(244,31) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untrc4.pas(244,7) Warning: (4056) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untrc4.pas(244,56) Hint: (4055) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untrc4.pas(244,74) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untrc4.pas(244,50) Warning: (4056) Conversion between ordinals and pointers is not portable
(3104) Compiling ../shared/untfunctions.pas
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untfunctions.pas(30,37) Hint: (4055) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untfunctions.pas(30,55) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/../shared/untfunctions.pas(30,31) Warning: (4056) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/stub.dpr(43,30) Hint: (4079) Converting the operands to "Int64" before doing the add could prevent overflow errors.
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/stub/stub.dpr(31,5) Note: (5025) Local variable "n" not used
(9015) Linking stub
/usr/bin/ld.bfd: warning: link.res contains output sections; did you forget -T?
(1008) 836 lines compiled, 0.2 sec
(1021) 4 warning(s) issued
(1022) 12 hint(s) issued
(1023) 1 note(s) issued
[+] Stub project successfully built.
[*] Patch stub file on crypter project...
[*] Finding tags locations
[+] Tags found. tag_begin=433, tag_end=6263778
[*] Generate stub array...
[*] Patch stub source file...
[+] Stub source file successfully patched.
[*] Compile crypter project...
Hint: (11030) Start of reading config file /etc/fpc.cfg
Hint: (11031) End of reading config file /etc/fpc.cfg
Free Pascal Compiler version 3.0.4+dfsg-18ubuntu2 [2018/08/29] for i386
Copyright (c) 1993-2017 by Florian Klaempfl and others
(1002) Target OS: Linux for i386
(3104) Compiling crypter.dpr
(3104) Compiling /home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untrc4.pas
(3104) Compiling /home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untcrc32.pas
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untcrc32.pas(113,43) Hint: (4055) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untcrc32.pas(113,61) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untcrc32.pas(113,37) Warning: (4056) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untrc4.pas(244,13) Hint: (4055) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untrc4.pas(244,31) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untrc4.pas(244,7) Warning: (4056) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untrc4.pas(244,56) Hint: (4055) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untrc4.pas(244,74) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untrc4.pas(244,50) Warning: (4056) Conversion between ordinals and pointers is not portable
(3104) Compiling /home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untfunctions.pas
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untfunctions.pas(30,37) Hint: (4055) Conversion between ordinals and pointers is not portable
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untfunctions.pas(30,55) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/untfunctions.pas(30,31) Warning: (4056) Conversion between ordinals and pointers is not portable
(3104) Compiling /home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/unttypes.pas
(3104) Compiling /home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/unteof.pas
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/shared/unteof.pas(92,47) Hint: (4035) Mixing signed expressions and longwords gives a 64bit result
(3104) Compiling untlocalfunctions.pas
(3104) Compiling untstub.pas
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/crypter/crypter.dpr(33,61) Hint: (5092) Variable "AShellcode" of a managed type does not seem to be initialized
/home/phrozen/SLAE32/SLAE-Exam/Level7/git/slae32-crypters/Crypter/crypter/crypter.dpr(49,75) Hint: (5058) Variable "ASignature" does not seem to be initialized
(9015) Linking crypter
/usr/bin/ld.bfd: warning: link.res contains output sections; did you forget -T?
(1008) 78238 lines compiled, 0.8 sec
(1021) 4 warning(s) issued
(1022) 13 hint(s) issued
[+] Crypter project successfully built.
[*] copy crypter to "dist" directory...
[*] doing some cleanup...
[+] Crypter successfully compiled and is ready for use!
[*] Have fun :-)
