1

I am facing problem in finding bad characters because the hex codes are being replaced with \x3F & some other codes.

enter image description here

Here I have all the 256 hex chars from \x01 to \xFF and as you can see many of the hex char is being replaced with \x3F and other chars and hence I am not able to figure out the bad chars.

I tried to figure out the bad chars & the chars which are being replaced, which are: 

\x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x95\x97\x98\x99\x9a\x9b\x9c\x9e\x9f\xa4\xa6\xa8\xb4\xb8\xbc\xbd\xbe

Then I used msfvenom to generate the shellcode but getting below result.

$msfvenom -a x86 --platform windows -p windows/exec cmd=cmd.exe -b '\x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x95\x97\x98\x99\x9a\x9b\x9c\x9e\x9f\xa4\xa6\xa8\xb4\xb8\xbc\xbd\xbe' -f c
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai failed with A valid opcode permutation could not be found.
Attempting to encode payload with 1 iterations of generic/none
generic/none failed with Encoding failed due to a bad character (index=3, char=0x00)
Attempting to encode payload with 1 iterations of x86/call4_dword_xor
x86/call4_dword_xor failed with A valid encoding key could not be found.
Attempting to encode payload with 1 iterations of x86/countdown
x86/countdown failed with Encoding failed due to a bad character (index=84, char=0x0d)
Attempting to encode payload with 1 iterations of x86/fnstenv_mov
x86/fnstenv_mov failed with A valid encoding key could not be found.
Attempting to encode payload with 1 iterations of x86/jmp_call_additive
x86/jmp_call_additive failed with Encoding failed due to a bad character (index=15, char=0x85)
Attempting to encode payload with 1 iterations of x86/xor_dynamic
Error: Bad character found in stub for the Dynamic key XOR Encoder encoder.
Improve this question

2 Answers 2

Reset to default
1

The input string is probably decoded as UTF-8 string. The '?' appears because the encoding is invalid. The easiest way to preserve the shellcode is probably use an ASCII encoder, since UTF-8 is backward compatible with ASCII.

Improve this answer
2
  • Hey, the issue was there because I was creating the shellcode on my linux vm and then I was copying it to windows7 vm to excute it. May be the encoding on windows was differerent from linux and some characters were not recognized. When I created the shellcode on the same windows machine it loaded properly in the memory. By the way what encoding differences would be there if we copy some data from linux to windows? Commented Sep 13, 2019 at 13:57
  • You need to provide more details to have an answer, e.g. how you load the payload, what's the target, etc. But, basically, if you copy the payload from your Linux (vm) to Windows as hex char (i.e. \xNN\xNN\xNN\xNN...), the encoding won't change. So far, I have the impression the target application decodes your payload as an UTF-8 string. Commented Sep 16, 2019 at 3:24
0

I would try to go with a trial&error approach. Seems the restricted chars are inside the range from 0x80 to 0xa9 with some exclusions. If you're developing an exploit and you haven't got time to figure it out try to suppose these as bad chars and avoid their use with msfvenom encoding.

If you have time, try to use a buffer like 0x41 0x41 0x41 0xbadchar 0x41 ... 0x41 proceeding one by one, in the end, you will figure it out precisely.

Badchars hunting is time-intensive task ... :-|

Improve this answer
1
  • I have tried these approach and figured out that chars: \x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x95\x97\x98\x99\x9a\x9b\x9c\x9e\x9f\xa4\xa6xa8\xb4\xb8\xbc\xbd\xbe are either bad chars or being replaced with other chars. I use these as a bad char in msfvenon to generate the shellcode but getting no success. Commented Sep 11, 2019 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.