0

I have been learning about hiding and executing msfvenom created shellcode and came to a technique where we xor the shellcode and when executing we reverse it.Would it be the same if i just encrypt it via AES and then decrypt it before executing.Would the end result be same?Is encoding better than encryption for shellcode obfuscation?

2

Encoding and encrypting are not the same: encoding does not need a key, encrypting does. XOR is not encoding, is a very weak form of encryption. Base64 would be an example of encoding. Uuencode is another example.

The difference between XOR and AES is the difference between a wooden box with nails closing the door, and a bank safe. XOR can be trivially decrypted, but AES does not.

In this specific case of code obfuscation, XOR is astronomically faster than AES. It will defeat most signature-based IDS systems, and will not increase the resulting code too much. AES will create larger code and will be slower.

On both cases, any human inspector will be able to decrypt the contents, as you will have to supply the key to decrypt the code. Otherwise your program would not run at all.

1

No, encoding is not the same thing as encryption.

"Would it be the same if i just encrypt it via AES and then decrypt it before executing." No, the ciphertext on the wire and at rest is less recoverable than encoded payloads.

"Would the end result be same?" Yes, as long as you end up with the same plaintext as you started with, the end result would be the same.

"Is encoding better than encryption for shellcode obfuscation?" Encoding is less computation but less secure. Encryption is more secure and more computation. You also have the problem of key escrow and if not done right, is slightly more secure than encoding (I still have to find the key). So the answer depends on whether you want more secure or faster payload delivery for the shellcode.

  • What difference would a faster and slower payload delivery make? Also xor and aes would provide me same kind of hiding when it comes to antivirus is what you are saying? – Vipul Nair Dec 13 '18 at 19:38

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.