🔎 Without Alphanumeric Characters (Shellcode)

[MisTraleuh]

🔎 Without Alphanumeric Characters (Shellcode)

Important

This is a Fuck-Jails research thread.
The objective is to discover reproducible shellcode techniques that contain no alphanumeric characters in the payload bytes,
then promote confirmed patterns into documented payload pages.

Reference environment (mandatory for validation):

• 🐧 Ubuntu 22.04
• 🧱 Architecture: x86_64
• 🛠 Tooling: gcc (system default)

Execution model (required):

• Shellcode is read from stdin into an RWX mmap and executed.
• Optional offset can be applied via argv.

If your approach requires a different architecture, a different runner, or special kernel settings,
document it in Environment Adjustments with a reason.

---

❓ What are we trying to explore?

We want shellcode where the raw bytes contain:

• ❌ No ASCII alphanumeric characters: A–Z (0x41–0x5A), a–z (0x61–0x7A), and 0–9 (0x30–0x39)

The payload must still execute and produce a measurable behavior.

Typical goals:

• exit(code)
• write(1, "OK\n", 3)
• execve("/bin/sh", ...) (if possible under constraints)
• open/read/write templates

---

🎯 Goal

Find reproducible shellcode patterns that:

• contain zero alphanumeric characters in the shellcode bytes
• execute correctly under the provided runner
• are easy to validate and reuse

✅ Success means:

• Payload bytes contain no [A-Za-z0-9]
• Payload executes under Ubuntu 22.04 x86_64 with the exact runner
• Behavior is proven via output / exit code / syscall effect

---

🧩 Scope / Clarifications

Note

This thread is about byte-level constraints on shellcode.
"Without alphanumeric characters" refers to the shellcode byte stream (stdin payload), not the C runner source.

If your method relies on:

• a decoder stub
• staged shellcode
• self-modifying code
• polymorphic encodings

That's allowed — as long as the delivered bytes contain no alphanumeric characters.

---

🧪 Required Runner (copy/paste)

Use this exact executor for validation:

#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <string.h>
#include <unistd.h>

#define SHELLCODE_SIZE 0x1000

int main(int argc, char *argv[]) {
    void (*shellcode)();

    shellcode = mmap(NULL, SHELLCODE_SIZE,
                     PROT_READ | PROT_WRITE | PROT_EXEC,
                     MAP_PRIVATE | MAP_ANON, -1, 0);

    if(shellcode == MAP_FAILED) {
        perror("[-] mmap");
        exit(1);
    }

    read(0, shellcode, SHELLCODE_SIZE);

    if(argc == 2) {
        shellcode += atoi(argv[1]);
    }

    shellcode();

    return 0;
}

Compile with:

$ gcc runner.c -o runner

Run with:

$ cat payload.bin | ./runner
# Optional offset:
$ cat payload.bin | ./runner 5

✅ Restriction Check (mandatory)

Important

Every working submission must include proof that the payload contains no alphanumeric characters.

Use one of the following checks (paste the output in your reply):

Check A : grep (simple)

$ LC_ALL=C grep -aob '[A-Za-z0-9]' payload.bin || echo "OK: no alphanumeric characters found"

Check B : hexdump + manual proof (fallback)

$ hexdump -Cv payload.bin | head

Check C : python validator (recommended)

$ python3 - << 'PY'
import sys, string
b=open("payload.bin","rb").read()
alnum=set(bytes(string.ascii_letters + string.digits,"ascii"))
bad=[(i,x) for i,x in enumerate(b) if x in alnum]
if bad:
    print("FAIL: alphanumeric characters found:", len(bad))
    print("first 10:", bad[:10])
    sys.exit(1)
print("OK: no alphanumeric characters found. size =", len(b))
PY

⚙️ Environment

Baseline:

• OS: Ubuntu 22.04
• Arch: x86_64
• Runner: provided above
• Compiler: gcc (default)
• Environment Adjustments

Warning

If your approach depends on:

• a different architecture (i386 / arm64)
• a different runner (different mmap / protections)
  -disabled protections / kernel settings

You must clearly document:

• what changed
• why it's needed
• exact reproduction steps

🧠 Current Status

• No confirmed "without alphanumeric" shellcode pattern yet.
• Collecting encoding/decoder/staging approaches.

💬 Discussion Guidelines

Tip

Keep contributions minimal, technical, and reproducible.

✅ Encouraged

• Decoder stubs with non-alphanumeric bytes
• Two-stage payloads (stage1 decodes stage2)
• Self-modifying code techniques
• Syscall templates (write/exit/open/read/write)
• Notes about bad-byte avoidance strategies

❌ Avoid

• Screenshots instead of code/bytes
• "Works for me" without payload.bin + checks
• Kernel exploits / escalation
• Off-topic exploitation context

🧷 Final Contribution Format (required)

When replying with a technique, use:

1. Approach Name
   Short and descriptive.

2. Target Behavior
   What syscall/action does it achieve?

3. Payload Bytes
   Provide either:

• a payload.bin generation method, or
• the raw bytes (escaped / hex), small enough to paste

4. Runner Command
   Exact command used:

$ gcc runner.c -o runner
$ cat payload.bin | ./runner

(+ optional offset if used)

5. Restriction Proof
   Paste output of one of the checks:

grep -aob '[A-Za-z0-9]' ...

python validator output

6. Notes
   Size, portability, assumptions, limitations.