Skip to content

Commit

Permalink
update api
Browse files Browse the repository at this point in the history
  • Loading branch information
b1nhack committed Jul 9, 2024
1 parent a7900a9 commit cd82070
Show file tree
Hide file tree
Showing 4 changed files with 24 additions and 23 deletions.
20 changes: 10 additions & 10 deletions src/dev/api/encrypt_shellcode.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# encrypt_shellcode

将原始shellcode加密.
Encrypt the original shellcode.

## 函数名
## Function Name

encrypt_shellcode

Expand All @@ -14,7 +14,7 @@ encrypt_shellcode
}
```

`shellcode`为字节数组, 是原始shellcode.
The `shellcode` is a byte array and is the original shellcode.

## Output

Expand All @@ -34,9 +34,9 @@ encrypt_shellcode
}
```

`encrypted`为字节数组, 是加密后的shellcode.
`encrypted` is a byte array, which is the encrypted shellcode.

`pass`为以下json结构数组, 用于patch二进制植入物模板中的加密密码(有的加密方式有多个密码, 所以是一个数组):
`pass` is an array of the following json structure, which is used to patch the encrypted password in the binary implant template (some encryption methods have multiple passwords, so it is an array):

```json
{
Expand All @@ -45,13 +45,13 @@ encrypt_shellcode
}
```

`holder`为字节数组, 是二进制植入物模板解密函数中的密码占位符.
分享Plug-in时请告知如何正确设置解密函数中的密码.
比如[plug-in](https://github.com/pumpbin/plug-in)仓库中的[aes256-gcm](https://github.com/pumpbin/plug-in/tree/main/encrypt_shellcode/aes256-gcm)有如下READEME内容:
The `holder` is a byte array and is a placeholder for the password in the decryption function of the binary implant template.
When sharing a plug-in, please inform how to correctly set the password in the decryption function.
For example, [aes256-gcm](https://github.com/pumpbin/plug-in/tree/main/encrypt_shellcode/aes256-gcm) in the [plug-in](https://github.com/pumpbin/plug-in) repository has the following README content:

> key: `$$KKKKKKKKKKKKKKKKKKKKKKKKKKKK$$`\
> nonce: `$$NNNNNNNN$$`
上述内容表明使用`aes256-gcm` Plug-in, 需要将二进制植入物模板AES256-GCM解密函数中的key设置为`$$KKKKKKKKKKKKKKKKKKKKKKKKKKKK$$`, nonce设置为`$$NNNNNNNN$$`.
The above content shows that when using the `aes256-gcm` plug-in, the key in the AES256-GCM decryption function of the binary implant template needs to be set to `$$KKKKKKKKKKKKKKKKKKKKKKKKKKKK$$`, and the nonce to `$$NNNNNNNN$$`.

`replace_by`为字节数组, 是加密密码. 可以在Plug-in中生成随机加密密码, 使每个生成的最终植入物都有唯一的加密密码.
The `replace_by` is a byte array and is the encryption password. A random encryption password can be generated in the plug-in so that each generated final implant has a unique encryption password.
8 changes: 4 additions & 4 deletions src/dev/api/format_encrypted_shellcode.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# format_encrypted_shellcode

将加密后的shellcode转换成另一种格式, 比如隐写到png, 转换成UUID ...
Convert the encrypted shellcode to another format, such as steganography to png, convert to UUID...

## 函数名
## Function Name

format_encrypted_shellcode

Expand All @@ -14,7 +14,7 @@ format_encrypted_shellcode
}
```

`shellcode`为字节数组, 是加密后的shellcode.
The `shellcode` is a byte array and is the encrypted shellcode.

## Output

Expand All @@ -24,4 +24,4 @@ format_encrypted_shellcode
}
```

`formated_shellcode`为字节数组, 是转换后的shellcode.
`formated_shellcode` is a byte array, which is the converted shellcode.
8 changes: 4 additions & 4 deletions src/dev/api/format_url_remote.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# format_url_remote

将shellcode url转换成另一种格式. (`Remote` Only)
Convert shellcode url to another format. (`Remote` Only)

## 函数名
## Function Name

format_url_remote

Expand All @@ -14,7 +14,7 @@ format_url_remote
}
```

`url`为字符串, 是原始shellcode url.
`url` is a string, which is the original shellcode url.

## Output

Expand All @@ -24,4 +24,4 @@ format_url_remote
}
```

`formated_url`为字符串, 是转换后的shellcode url.
`formated_url` is a string, which is the converted shellcode url.
11 changes: 6 additions & 5 deletions src/dev/api/upload_final_shellcode_remote.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
# upload_final_shellcode_remote

将final shellcode上传到远程服务器. (`Remote` Only)
Upload the final shellcode to the remote server. (`Remote` Only)

final shellcode是经过加密和转换后的shellcode, 如果某个Plug-in未设置, 则原样返回, 例如format_encrypted_shellcode Plug-in未设置, 则原样返回传入的加密后的shellcode.
The final shellcode is the encrypted and converted shellcode. If a plug-in is not set, it is returned as is. For example, if the format_encrypted_shellcode plug-in is not set,
the encrypted shellcode is returned as is.

## 函数名
## Function Name

upload_final_shellcode_remote

Expand All @@ -16,7 +17,7 @@ upload_final_shellcode_remote
}
```

`final_shellcode`为字节数组, 是final shellcode.
`final_shellcode` is a byte array, which is the final shellcode.

## Output

Expand All @@ -26,4 +27,4 @@ upload_final_shellcode_remote
}
```

`url`为字符串, 是上传后的url地址, PumpBin将自动填写到shellcode url输入框中.
`url` is a string, which is the URL address after the upload, and PumpBin will automatically fill it into the shellcode URL input box.

0 comments on commit cd82070

Please sign in to comment.