工具介绍
https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/shikata_ga_nai.rb怎么样？＆ 为什么？
https://cloud.google.com/blog/topics/threat-intelligence/shikata-ga-nai-encoder-still-going-strong/在 keystone 汇编程序库的帮助下，实现了以下改进。
64位支持。Finally properly encoded x64 shellcodes !新的更小的解码器存根。LFSR key reduced to 1 byte具有伪随机模式的编码存根。Decoder stub is also encoded with a psudo random schema没有可见的循环条件Stub decodes itself WITHOUT using any loop conditions !!解码器存根混淆。Random garbage instruction generator added with keystone安全注册选项。Non of the registers are clobbered (optional preable, may reduce polimorphism)
工具使用
__ _ __ __ ____ / / (_) /_____ _/ /____ _ ___ ____ _ ___ ___ _(_)(_-</ _ / / '_/ _ `/ __/ _ `/ / _ `/ _ `/ / _ / _ `/ //___/_//_/_/_/_\_,_/__/_,_/ _, /_,_/ /_//_/_,_/_/========[Author:-Ege-Balcı-]====/___/=======v2.0.1=========┻━┻ ︵ヽ(`Д´)ﾉ︵ ┻━┻ (ノ ゜Д゜)ノ ︵ 仕方がないUsage: sgnFlags:-h, --help Show context-sensitive help.-i, --input=STRING Input binary path-o, --out=STRING Encoded output binary name-a, --arch=64 Binary architecture (32/64)-c, --enc=1 Number of times to encode the binary (increases overall size)-M, --max=50 Maximum number of bytes for decoder obfuscation--plain Do not encode the decoder stub--ascii Generates a full ASCI printable payload (may take very long time to bruteforce)-S, --safe Preserve all register values (a.k.a. no clobber)--badchars=STRING Don't use specified bad characters given in hex format (x00x01x02...)-v, --verbose Verbose mode--version
项目地址
原文始发于微信公众号（昊天信安）：最好的shellcode免杀编码器
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论