WKL-Sec

# White Knight Labs
# Offensive Development Course - Shellcode Decoder Stub
# Author: Stigs

#include <iostream>
#include <vector>
#include <iomanip>
#include <random>

// Modified function to apply obfuscation on shellcode using a dynamic XOR value

WKL-Sec

// White Knight Labs - Offensive Development Course
// String Deobfuscation with Inline-Assembly

// Based on - https://gist.github.com/WKL-Sec/e24830ebfafabc283bd9329e79f71164

#include <iostream>
#include <string>
#include <sstream>
#include <vector>

WKL-Sec

// White Knight Labs - Offensive Development Course
// String Obfuscation

#include <iostream>
#include <string>

// Function to apply XOR, then NOT, and finally ADD 1 for obfuscation
std::string obfuscateString(const std::string& input) {
    std::string output = input;

WKL-Sec

// White Knight Labs - Offensive Development
// Inline Assembly - Get Function Address

#include <iostream>
#include <windows.h>

// Function definition
void* GetFunctionAddress(const char* functionName) {
    void* getFunctionAddr = nullptr;

WKL-Sec

// White Knight Labs - Offensive Development Course
// GetProcAddress Replacement

#include <windows.h>
#include <iostream>

typedef FARPROC (*pAPIFinder)(IN HMODULE modHandle, IN LPCSTR apiName);

FARPROC APIFinder(IN HMODULE modHandle, IN LPCSTR apiName) {
    PBYTE baseAddr = (PBYTE)modHandle;

WKL-Sec

// White Knight Labs - Offensive Development Course
// IAT Table Bypass - GetProcAddress 

#include <windows.h>
#include <iostream>

// Typedef for the OpenProcess function
typedef HANDLE (WINAPI *pOpenProcess)(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId);

int main() {

WKL-Sec

#include <iostream>
#include <windows.h>

void* GetBaseAddressOfKernel32() {
    void* kernel32BaseAddress = nullptr;

    __asm {
        mov rdi, 0xFFFFFFFFFFFFFFFF // Set RDI to -1
        inc rdi                    // Increment RDI to 0
        mov rax, 0                 // Zero out RAX

WKL-Sec

#include <Windows.h>
#include "winternl.h"
#pragma comment(lib, "ntdll")

UINT_PTR sysAddrNtAllocateVirtualMemory;
UINT_PTR sysAddrNtWriteVirtualMemory;
UINT_PTR sysAddrNtCreateThreadEx;
UINT_PTR sysAddrNtWaitForSingleObject;

WKL-Sec

// White Knight Labs - Offensive Development Course
// String Enbcryption- Double XOR

#include <iostream>
#include <string>

// Function to apply XOR operation between the message and a key
std::string xorEncryptDecrypt(const std::string& text, const std::string& key) {
    std::string result = text; // Start with the original text
    

WKL-Sec

#include <windows.h>
#include <sddl.h>
#include <tchar.h>
#include <iostream>
#include <algorithm> 
#include <cctype>    

// Link with the Advapi32.lib to use Windows Security functions
#pragma comment(lib, "advapi32.lib")