UUID-Shellcode – Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness

Shellcode generation

• Firstly, generate a payload in binary format( using either CobaltStrike or msfvenom ) for instance, in msfvenom, you can do it like so( the payload I’m using is for illustration purposes, you can use whatever payload you want ):

  msfvenom -p windows/messagebox  -f raw -o shellcode.bin

• Then convert the shellcode( in binary/raw format ) into a UUID string format using the Python3 script, bin_to_uuid.py:

  ./bin_to_uuid.py -p shellcode.bin > uuid.txt

• xor encrypt the UUID strings in the uuid.txt using the Python3 script, xor_encryptor.py.

  ./xor_encryptor.py uuid.txt > xor_crypted_out.txt

• Copy the C-style array in the file, xor_crypted_out.txt, and paste it in the C++ file as an array of unsigned char i.e. unsigned char payload[]{your_output_from_xor_crypted_out.txt}

Execution

This shellcode injection technique comprises the following subsequent steps:

• First things first, it allocates virtual memory for payload execution and residence via VirtualAlloc
• It xor decrypts the payload using the xor key value
• Uses UuidFromStringA to convert UUID strings into their binary representation and store them in the previously allocated memory. This is used to avoid the usage of suspicious APIs like WriteProcessMemory or memcpy.
• Use EnumChildWindows to execute the payload previously loaded into memory( in step 1 )