Kali Linux

FUD-UUID-Shellcode : Another Shellcode Bypass Windows Defender

FUD-UUID-Shellcode is another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness.

How it works?

Shellcode Generation

Firstly, generate a payload in binary format( using either CobaltStrike or msfvenom ) for instance, in msfvenom, you can do it like so( the payload I’m using is for illustration purposes, you can use whatever payload you want ):

msfvenom -p windows/messagebox -f raw -o shellcode.bin

Then convert the shellcode( in binary/raw format ) into a UUID string format using the Python3 script, bin_to_uuid.py:

./bin_to_uuid.py -p shellcode.bin > uuid.txt

xor encrypt the UUID strings in the uuid.txt using the Python3 script, xor_encryptor.py.

./xor_encryptor.py uuid.txt > xor_crypted_out.txt

Copy the C-style array in the file, xor_crypted_out.txt, and paste it in the C++ file as an array of unsigned char i.e. unsigned char payload[]{your_output_from_xor_crypted_out.txt}

Execution

This shellcode injection technique comprises the following subsequent steps:

  • First things first, it allocates virtual memory for payload execution and residence via VirtualAlloc
  • It xor decrypts the payload using the xor key value
  • Uses UuidFromStringA to convert UUID strings into their binary representation and store them in the previously allocated memory. This is used to avoid the usage of suspicious APIs like WriteProcessMemory or memcpy.
  • Use EnumChildWindows to execute the payload previously loaded into memory( in step 1 )

What makes it unique?

  • It doesn’t use standard functions like memcpy or WriteProcessMemory which are known to raise alarms to AVs/EDRs, this program uses the Windows API function called UuidFromStringA which can be used to decode data as well as write it to memory( Isn’t that great folks? And please don’t say “NO!” 🙂 ).
  • It uses the function call obfuscation trick to call the Windows API functions
  • Lastly, because it looks unique 🙂 ( Isn’t it? 🙂 )

Important

  • You have to change the xor key(line 85) to what you wish. This also has to be done in the ./xor_encryptor.py python3 script by changing the KEY variable. The keys have to match!
  • You have to change the default executable filename value(row 90) to your filename.
  • mingw was used but you can use whichever compiler you prefer. 🙂

Compile

  • Simply run this at your terminal/shell:
make

Proof-of-Concept( PoC )

Static Analysis

AV Scan results

The binary was scanned using antiscan.me on 01/08/2022.

R K

Recent Posts

Understanding the Model Context Protocol (MCP) and How It Works

Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…

2 days ago

The file Command – Quickly Identify File Contents in Linux

While file extensions in Linux are optional and often misleading, the file command helps decode what a…

2 days ago

How to Use the touch Command in Linux

The touch command is one of the quickest ways to create new empty files or update timestamps…

2 days ago

How to Search Files and Folders in Linux Using the find Command

Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…

2 days ago

How to Move and Rename Files in Linux with the mv Command

Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…

2 days ago

How to Create Directories in Linux with the mkdir Command

Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…

2 days ago