Encrypting the C# Shellcode Runner
The key to bypassing antivirus signature detections is custom code,
and since we want to encrypt the shellcode,
we must also create a custom decryption routine to avoid detection.
When we tried to use encryption with msfvenom,
we took advantage of the highly secure and complex aes256 encryption algorithm,
but implementing an aes256 decryption routine is not straightforward
so we will opt for the much less secure, but easier-to-use Caesar Cipher.
The Caesar Cipher was one of the earliest encryption schemes and is very simple.
It is categorized as a substitution cipher since it substitutes a letter or number
by shifting it to the right by a number specified in the key.
As an example, we’ll encrypt the word “Caesar”
with a Caesar cipher and a substitution key of 1.
This is a very simple routine and its reverse is just as simple.
We can rotate the same number of letters to the left to regain the original text.
Obviously, this encryption scheme is inherently flawed from a
communication security standpoint since it is very easy to break.
However, it will work well for our purposes, since we can easily implement it
without using external libraries
and it will remove static signatures from the shellcode.
The first step is to create an application that can encrypt our shellcode.
We’ll create a new C# Console App project in Visual Studio called “Helper”
We’ll generate Meterpreter shellcode,
embed it in the C# code, and implement the encryption routine.
We chose a substitution key of 2,
iterated through each byte value in the shellcode, and simply added 2 to its value
We performed a bitwise AND operation with 0xFF to keep the modified value
within the 0-255 range, in case the increased byte value exceeds 0xFF.
For us to be able to use the encrypted shellcode, we must print it to the console
which we can do by converting the byte array
into a string with the StringBuilder class,
and its associated AppendFormat method.
To obtain a string that has the same format as that generated by msfvenom,
we’ll use a format string.
Each substring starts with 0x followed by the formatted byte value
In the format string, we are specifying a two-digit number in hexadecimal format
Specifically, the first value of the format string specifies the first argument
that is to be formatted, which is the byte value.
The second part is the format specification
in which “x” indicates hexadecimal output
and “2” indicates the number of digits in the formatted result.
Compiling the C# project,
and executing it from the command line,
outputs our encrypted shellcode.
Now we can modify our existing C# shellcode runner project,
by copying the encrypted shellcode into it and adding the decrypting routine.
Since the decryption sequence reverses the encryption sequence,
we’ll use the substitution key of 2 and perform a subtraction instead.
Now, let’s test the effectiveness of this bypass technique.
Since this unencrypted project bypassed both Avira and ClamAV,
we’ll scan it with AntiScan.Me:
The result is impressive. Only 7 out of 26 antivirus programs flagged our code.
This is an improvement over our previous attempt, which flagged 11 times.
This prooves that a custom encryption or obfuscation approach
s well-suited to this task.
At this point, we have had relative success bypassing signature detection.
In the next section, we will attempt to bypass heuristics detection techniques.