Madmouse

This will make you giggle at how mean it is lol

Jan 29th, 2015
110
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 2.99 KB | None | 0 0
  1. // this encrypted shellcode function takes an encrypted string,
  2. // decrypts it, prints it out, then RE ENCRYPTS IT before exiting
  3. //
  4. // [user@n0 ~]$ nano example.c
  5. // [user@n0 ~]$ gcc example.c -fno-stack-protector -z execstack -o example
  6. // [user@n0 ~]$ ./example
  7. // TELL ME YOU DIDN'T RUN THIS!!!!
  8. //
  9. // GO HOME NOOB, YOU ARE DRUNK xD
  10. // [user@n0 ~]$
  11. // EVIL, huh? lol
  12. // the shellcode:
  13. /*
  14. [bits 64]
  15. section .text
  16. global _start
  17. _start:
  18.         mov rcx, rsi    ; move size argument into rcx for the loop
  19.         mov rsi, rdi    ; move the the text pointer to rsi for printing
  20.         xor rax, rax    ; clear out registers
  21.         xor rdx, rdx
  22.         xor rdi, rdi
  23.         push rsi                ; push the text for decoder
  24.         push rcx                ; push the size for decoder
  25.         push rsi                ; push the text for ecoder
  26.         push rcx                ; push the size for encoder
  27. decode:                         ; decode text
  28.         xor byte [rsi], 0xFF
  29.         inc rsi
  30. loop decode
  31.         pop rcx                 ; pop size
  32.         pop rsi                 ; pop text
  33.         mov al, 0x1             ; write stuff to stdout
  34.         mov dil, al
  35.         mov dl, cl
  36.         syscall
  37.         xor rax, rax
  38.         pop rcx                 ; pop size
  39.         pop rsi                 ; pop text
  40. encode:                         ; encode text
  41.         xor byte [rsi], 0xFF
  42.         inc rsi
  43. loop encode
  44.         ret
  45. */
  46.  
  47. #include <string.h>
  48.  
  49. typedef unsigned char BYTE;
  50.  
  51. // key data
  52. BYTE print_key[] = \
  53.     "\x8a\x28\x32\xae\xad\x81\xc9\x0c\xf3\x6a\x8f\xed"\
  54.     "\x7a\x8e\x15\x6c\xd2\x9b\x08\xa3\xa1\xbb\xbd\x59"\
  55.     "\x5d\x40\xc2\x42\xcc\xc9\x42\x20\x75\x63\xd6\x16"\
  56.     "\x1a\x0c\x46\xc3\xb4\x1f\x1c\x24\x6a\xeb\x7f\x87"\
  57.     "\xb4\xb8\xfa\x4b\xd6\xfa";
  58.  
  59. // encrypted code
  60. BYTE evil_print[] = \
  61.     "\xc2\xa1\xc3\xe6\x24\x7f\x81\x3d\x33\x22\xbe\x3f"\
  62.     "\x32\xbf\xea\x3a\x83\xcd\x59\x23\x97\x44\xf5\xa6"\
  63.     "\x9b\xa2\x3a\x1b\x92\x79\x43\x60\xfd\xa4\x5e\xdc"\
  64.     "\x15\x09\x0e\xf2\x74\x46\x42\xa4\x5c\x14\x37\x78"\
  65.     "\x72\x5a\x02\x88\xd6\xd1";
  66.  
  67.  
  68. // encrypted message
  69. BYTE message[] = \
  70.         "\xab\xba\xb3\xb3\xdf\xb2\xba\xdf\xa6\xb0\xaa\xdf"\
  71.         "\xbb\xb6\xbb\xb1\xd8\xab\xdf\xad\xaa\xb1\xdf\xab"\
  72.         "\xb7\xb6\xac\xde\xde\xde\xde\xf5\xf5\xb8\xb0\xdf"\
  73.         "\xb7\xb0\xb2\xba\xdf\xb1\xb0\xb0\xbd\xd3\xdf\xa6"\
  74.         "\xb0\xaa\xdf\xbe\xad\xba\xdf\xbb\xad\xaa\xb1\xb4"\
  75.         "\xdf\x87\xbb\xf5";
  76.  
  77. // function that decrypts the shellcode
  78. void decode(const BYTE* key, BYTE* code)
  79. {
  80.         int i;
  81.         for(i=0;i<strlen(code);i++)
  82.                 code[i]=0xFF&(key[i]^code[i]);
  83. }
  84.  
  85. main()
  86. {
  87.         decode(print_key, evil_print);                                  // decrypts the shellcode
  88.         ((void(*)(char*,int)) evil_print)(message, strlen(message));    // decrypts the message, prints it, then re-encrypts the message
  89.         decode(print_key, evil_print);                                  // encrypts the shellcode again
  90.         //! ... Profit
  91. }
Advertisement
Add Comment
Please, Sign In to add comment