[]()
## Introduction
Another shellcode [injection]( “injection” ) technique using C++ that attempts to bypass [Windows Defender]( “Windows Defender” ) using XOR [encryption]( “encryption” ) sorcery and UUID strings **madness** :).
# How it works
## Shellcode generation
* Firstly, generate a payload in binary format( using either `CobaltStrike` or `msfvenom` ) for instance, in `msfvenom`, you can do it like so( the payload I’m using is for **illustration** purposes, you can use whatever payload you want ):
msfvenom -p windows/messagebox -f raw -o shellcode.bin
* Then convert the shellcode( in binary/raw format ) into a `UUID` string format using the Python3 script, `bin_to_uuid.py`:
./bin_to_uuid.py -p shellcode.bin > uuid.txt
* `xor` encrypt the `UUID` strings in the `uuid.txt` using the Python3 script, `xor_encryptor.py`.
./xor_encryptor.py uuid.txt > xor_crypted_out.txt
* Copy the `C-style` array in the file, `xor_crypted_out.txt`, and paste it in the C++ file as an array of `unsigned char` i.e. `unsigned char payload[]{your_output_from_xor_crypted_out.txt}`
## Execution
This shellcode injection technique comprises the following subsequent steps:
* First things first, it allocates virtual memory for payload execution and residence via `VirtualAlloc`
* It `xor` decrypts the payload using the `xor` key value
* Uses `UuidFromStringA` to convert `UUID` strings into their binary representation and store them in the previously allocated memory. This is used to avoid the usage of suspicious APIs like `WriteProcessMemory` or `memcpy`.
* Use `EnumChildWindows` to execute the payload previously loaded into memory( in step 1 )
# What makes it unique?
* It doesn’t use standard functions like `memcpy` or `WriteProcessMemory` which are known to raise alarms to AVs/EDRs, this program uses the [Windows API]( “Windows API” ) function called `UuidFromStringA` which can be used to decode data as well as write it to memory( **Isn’t that great folks?** _And please don’t say “NO!”_ 🙂 ).
* It uses the **function call obfuscation** trick to call the Windows API functions
* Lastly, because it looks unique 🙂 ( _Isn’t it?_ 🙂 )
# Important
* You have to change the `xor` key(row 86) to what you wish. This can be done in the `./xor_encryptor.py` python3 script by changing the `KEY` variable.
* You have to change the default `executable filename` value(row 90) to your filename.
* The command for compiling is provided in the C++ file( _around the top_ ). NB: `mingw` was used but you can use whichever [compiler]( “compiler” ) you prefer. 🙂
## Compile
make
# Proof-of-Concept( PoC )
[]( “$ (7)” )[]()
# Static Analysis
[]( “$ (8)” )[]()
# AV Scan results
The binary was scanned using [antiscan.me]( “antiscan.me” ) on 01/08/2022.
[]( “$ (10)” )[]()
# Credits
**[Download FUD-UUID-Shellcode]( “Download FUD-UUID-Shellcode” )**Read More