Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Encoder::XorDynamic
7

8
  def initialize
9
    super(
10
      'Name'             => 'Dynamic key XOR Encoder',
11
      'Description'      => 'An x64 XOR encoder with dynamic key size',
12
      'Author'           => [ 'lupman', 'phra' ],
13
      'Arch'             => ARCH_X64,
14
      'License'          => MSF_LICENSE
15
      )
16
  end
17

18
  # Indicate that this module can preserve some registers
19
  # ...which is currently not true. This is a temp fix
20
  # until the full preserve_registers functionality is
21
  # implemented.
22
  def can_preserve_registers?
23
    true
24
  end
25

26
  def stub
27
    "\xeb\x27" +             #        jmp    _call
28
    "\x5b" +                 # _ret:  pop    rbx
29
    "\x53" +                 #        push   rbx
30
    "\x5f" +                 #        pop    rdi
31
    "\xb0\x41" +             #        mov    al, 'A'
32
    "\xfc" +                 #        cld
33
    "\xae" +                 # _lp1:  scas   al, BYTE PTR es:[rdi]
34
    "\x75\xfd" +             #        jne    _lp1
35
    "\x57" +                 #        push   rdi
36
    "\x59" +                 #        pop    rcx
37
    "\x53" +                 # _lp2:  push   rbx
38
    "\x5e" +                 #        pop    rsi
39
    "\x8a\x06" +             # _lp3:  mov    al, BYTE PTR [rsi]
40
    "\x30\x07" +             #        xor    BYTE PTR [rdi], al
41
    "\x48\xff\xc7" +         #        inc    rdi
42
    "\x48\xff\xc6" +         #        inc    rsi
43
    "\x66\x81\x3f\x42\x42" + #        cmp    WORD PTR [rdi], 'BB'
44
    "\x74\x07" +             #        je     _jmp
45
    "\x80\x3e\x41" +         #        cmp    BYTE PTR [rsi], 'A'
46
    "\x75\xea" +             #        jne    _lp3
47
    "\xeb\xe6" +             #        jmp    _lp2
48
    "\xff\xe1" +             # _jmp:  jmp    rcx
49
    "\xe8\xd4\xff\xff\xff"   # _call: call   _ret
50
  end
51

52
  def stub_key_term
53
    /A/
54
  end
55

56
  def stub_payload_term
57
    /BB/
58
  end
59
end
60

61