24. Maldev Academy Tool - HellShell

Maldev Academy Tool - HellShell

Introduction

At this point of the course, one should have a solid grasp of static evasion using encryption (XOR/RC4/AES) and obfuscation (IPv4/IPv6/MAC/UUID) techniques. Implementing one or more of the previously discussed evasion techniques in the malware can be time-consuming. One solution is to build a tool that takes in the payload and performs the encryption or obfuscation methods.

This module will demo a tool made by the Maldev Academy team that performs these tasks.

Tool Features

The tool has the following features:

• Supports IPv4/IPv6/MAC/UUID Obfuscation

• Supports XOR/RC4/AES encryption

• Supports payload padding

• Provides the decryption function for the selected encryption/obfuscation technique

• Randomly generated encryption keys on every run

Usage

To use HellShell, download the source code and compile it manually. Ensure the build option is set to Release.

                            ###########################################################
                            # HellShell - Designed By MalDevAcademy @NUL0x4C | @mrd0x #
                            ###########################################################

[!] Usage: HellShell.exe <Input Payload FileName> <Enc/Obf *Option*>
[i] Options Can Be :
        1.>>> "mac"     ::: Output The Shellcode As A Array Of Mac Addresses  [FC-48-83-E4-F0-E8]
        2.>>> "ipv4"    ::: Output The Shellcode As A Array Of Ipv4 Addresses [252.72.131.228]
        3.>>> "ipv6"    ::: Output The Shellcode As A Array Of Ipv6 Addresses [FC48:83E4:F0E8:C000:0000:4151:4150:5251]
        4.>>> "uuid"    ::: Output The Shellcode As A Array Of UUid Strings   [FC4883E4-F0E8-C000-0000-415141505251]
        5.>>> "aes"     ::: Output The Shellcode As A Array Of Aes Encrypted Shellcode With Random Key And Iv
        6.>>> "rc4"     ::: Output The Shellcode As A Array Of Rc4 Encrypted Shellcode With Random Key

Example Commands

• HellShell.exe calc.bin aes - Generates an AES encrypted payload and prints it to the console

• HellShell.exe calc.bin aes > AesPayload.c - Generates an AES-encrypted payload and outputs it to AesPayload.c

• HellShell.exe calc.bin ipv6 - Generates an IPv6 obfuscated payload and prints it to the console

Demo

The image below shows HellShell being used to encrypt the payload using the RC4 encryption algorithm and outputting to a file.