Introduction

MACFuscation applies the same encode-and-pad pattern established in the previous Payload Obfuscation - IPv4/IPv6Fuscation module, only using MAC addresses in place of IP addresses. The block size becomes six bytes and the deobfuscation side switches to a MAC-specific NTAPI, but the surrounding scaffolding is unchanged.

What is MACFuscation

Each MAC address consumes six shellcode bytes and is written in the standard hyphen-separated hexadecimal form (AA-BB-CC-DD-EE-FF). As with IPv6Fuscation, no decimal conversion is required. Reusing the same 16-byte sample from the previous module:

FC 48 83 E4 F0 E8 C0 00 00 00 41 51 41 50 52 51.

The first six bytes form "FC-48-83-E4-F0-E8", the next six form "C0-00-00-00-41-51", and the remaining four bytes fall short of a complete block. PKCS#7 padding fills the gap and allows shellcode of any length to be encoded.

MACFuscation Implementation

The MAC-specific constants describe the format and the block size in our implementation are listed below:

• MAC_STRING_SIZE - The size of a single formatted MAC address string. It is set to 18 bytes to hold six two-character hexadecimal values, five separators, and the terminating null byte.
• MAC_BYTES_COUNT - The number of raw shellcode bytes consumed to generate one MAC address string. A standard MAC address contains six octets, so this value is set to 6.

#define MAC_STRING_SIZE    18// "AA-BB-CC-DD-EE-FF\0"
#define MAC_BYTES_COUNT    6// We need 6 bytes from the shellcode to form one MAC string

The GenerateMac Helper

The GenerateMac helper function listed below is responsible for allocating an 18-byte buffer with LocalAlloc, formating six raw bytes as %02X-%02X-%02X-%02X-%02X-%02X, and returning the formated string.

As in the previous module, wnsprintfA from Shlwapi.dll is preferred over sprintf, which requires #pragma comment(lib, "Shlwapi.lib") and inclusion of <Shlwapi.h>. The returned buffer must be released by the caller with LocalFree.

GenerateMac requires a single parameter, pBytes, which points to the first byte of a six-byte region. The function reads the values at pBytes[0] through pBytes[5] and formats each byte as a two-character uppercase hexadecimal value using the %02X format specifier. Hyphens are inserted between the values to produce a standard MAC address string.

static CHAR* GenerateMac(IN PBYTE pBytes)
{
    // Allocate a buffer for the formatted MAC string of size 'MAC_STRING_SIZE'.
    CHAR* pszMac = (CHAR*)LocalAlloc(LPTR, MAC_STRING_SIZE);
    if (pszMac == NULL)
    {
        printf("[!] LocalAlloc Failed With Error: %lu\n", GetLastError());
        return NULL;
    }

    // Format the 6 bytes as six hyphen-separated hexadecimal octets.
    wnsprintfA(pszMac, MAC_STRING_SIZE,
        "%02X-%02X-%02X-%02X-%02X-%02X",
        pBytes[0], pBytes[1], pBytes[2], pBytes[3], pBytes[4], pBytes[5]);

    return pszMac;
}

The GenerateMacOutput Function

To generate a MAC-addresses array off a specified shellcode, we will construct the GenerateMacOutput function, which follows the same structure as GenerateIpv4Output and GenerateIpv6Output.

It pads the shellcode via PadBufferPkcs7, iterates over the padded buffer one 6-byte chunk at a time, and prints each MAC string as an element of a C array declaration ready to be pasted into a deobfuscation program. Only the block-size constant and the line-break interval change.

GenerateMacOutput requires the following parameters: