SGN : A Polymorphic Binary Encoder For Offensive Security Purposes

SGN is a polymorphic binary encoder for offensive security purposes such as generating statically undetecable binary payloads. It uses a additive feedback loop to encode given binary instructions similar to LSFR.

This project is the reimplementation of the original Shikata ga nai in golang with many improvements.

How? & Why?

For offensive security community, the original implementation of shikata ga nai encoder is considered to be the best shellcode encoder(until now). But over the years security researchers found several pitfalls for statically detecing the encoder(related work FireEye article). The main motive for this project was to create a better encoder that encodes the given binary to the point it is identical with totally random data and not possible to detect the presence of a decoder. With the help of keystone assembler library following improvments are implemented.

  • 64 bit support. Finally properly encoded x64 shellcodes !
  • New smaller decoder stub. LFSR key reduced to 1 byte
  • Encoded stub with pseudo random schema. Decoder stub is also encoded with a psudo random schema
  • No visible loop condition Stub decodes itself WITHOUT using any loop conditions !!
  • Decoder stub obfuscation. Random garbage instruction generator added with keystone
  • Safe register option. Non of the registers are clobbered (optional preable, may reduce polimorphism)

Install

  • Dependencies:

Only dependencies required is keystone and capstone libraries. For easily installing capstone and keystone libararies check the table below;

OSInstall Command
Ubuntu/Debiansudo apt-get install libcapstone-dev
Arch Linuxsudo pacman -S capstone keystone
Macbrew install keystone capstone
Fedorasudo yum install keystone capstone
Windows/All Other…CHECK HERE

Installation of keystone library can be little tricky in some cases. Check here if you have any problem with yor packet manager.

Then just go get it ツ

go get github.com/egebalci/sgn

Usage

-h is pretty self explanatory use -v if you want to see what’s going on behind the scenes ( ͡° ͜ʖ ͡°)_/¯

Usage: sgn [OPTIONS]
-a int
Binary architecture (32/64) (default 32)
-asci
Generates a full ASCI printable payload (takes very long time to bruteforce)
-badchars string
Don’t use specified bad characters given in hex format (\x00\x01\x02…)
-c int
Number of times to encode the binary (increases overall size) (default 1)
-h Print help
-max int
Maximum number of bytes for obfuscation (default 20)
-o string
Encoded output binary name
-plain-decoder
Do not encode the decoder stub
-safe
Do not modify and register values
-v More verbose output

Using As Library

Warning !! SGN package is still under development for better performance and several improvements. Most of the functions are subject to change.

package main

import (
 "encoding/hex"
 "fmt"
 "io/ioutil"

 sgn "github.com/egebalci/sgn/lib"
)

func main() {
 // First open some file
 file, err := ioutil.ReadFile("myfile.bin")
 if err != nil { // check error
  fmt.Println(err)
  return
 }
 // Create a new SGN encoder
 encoder := sgn.NewEncoder()
 // Set the proper architecture
 encoder.SetArchitecture(64)
 // Encode the binary
 encodedBinary, err := encoder.Encode(file)
 if err != nil {
  fmt.Println(err)
  return
 }
 // Print out the hex dump of the encoded binary
 fmt.Println(hex.Dump(encodedBinary))

}

Execution Flow

The following image is a basic workflow diagram for the encoder. But keep in mind that the sizes, locations and orders will change for garbage instructions, decoders and schema decoders on each iteration.

LFSR itself is pretty powerful in terms of probability space. For even more polimorphism garbage instructions are appended at the begining of the unencoded raw payload. Below image shows the the companion matrix of the characteristic polynomial of the LFSR and denoting the seed as a column vector, the state of the register in Fibonacci configuration after k steps.

R K

Recent Posts

Shadow-rs : Harnessing Rust’s Power For Kernel-Level Security Research

shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation…

1 week ago

ExecutePeFromPngViaLNK – Advanced Execution Of Embedded PE Files via PNG And LNK

Extract and execute a PE embedded within a PNG file using an LNK file. The…

2 weeks ago

Red Team Certification – A Comprehensive Guide To Advancing In Cybersecurity Operations

Embark on the journey of becoming a certified Red Team professional with our definitive guide.…

2 weeks ago

CVE-2024-5836 / CVE-2024-6778 : Chromium Sandbox Escape via Extension Exploits

This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within…

3 weeks ago

Rust BOFs – Unlocking New Potentials In Cobalt Strike

This took me like 4 days (+2 days for an update), but I got it…

3 weeks ago

MaLDAPtive – Pioneering LDAP SearchFilter Parsing And Security Framework

MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection. Its foundation is…

3 weeks ago