Encode metasploit payload with ContextEncoding?

Question

Using metasploit I generated an exploit exploit/windows/fileformat/ms14_017_rtf for windows 7 with windows/shell_reverse_tcp payload. In show advanced, I use option EnableContextEncoding true and it's working well. Then I create a stand alone module, that generate malicious rtf document. Now I want add encode function in my module. What the module uses the option EnableContextEncoding true? Is this x86/shikata_ga_nai.rb or other? I need standalone code, which encode my buffer (shellcode)? I can't find it.

Answer 1

You probably don't really want Context Encoding. Context Encoding is a technique for generating self-decrypting shellcode that will only work on the intended machine. It is off by default because it requires knowing specific information about the victim that you usually do not have unless you have already compromised that machine.

msfvenom can take shellcode on stdin and output encoded shellcode on stdout like so:

cat payload.bin | msfvenom -p - -a x86 --platform windows -e x86/shikata_ga_nai -f raw > encoded.bin