Skip to the content.

RCO: XOR Params

xor_params

How it works

XOR params performs an exclusive OR (XOR) operation on each byte of the shellcode with each byte of the key (repeating the key if need be).

Using it

  1. [Not shown in demo] Generate shellcode for the desired end result (for example, use msfvenom to generate a reverse TCP shell shellcode for the target operating system)
  2. [Not shown in demo] Open the config file and change the shellcode to the shellcode generated in step 1
  3. [Not shown in demo] Open the config file and change the key to a desired key
  4. [Not shown in demo] Compile the executable
    1. For Linux
      cargo build -p xor_params --release
      
    2. For Windows
      cargo build --target x86_64-pc-windows-gnu -p xor_params --release
      
  5. Run the executable
  6. Open the config file and change encrypted payload to the output of step 5