Art of Shellcoding: Basic AES Shellcode Crypter

Legacy research restoration. Originally published on 28 February 2018 as part of the SecurityTube Linux Assembly Expert programme under student ID SLAE-1080. The original technical sequence, images, code references and publication date have been preserved.

In this post, we will design a shellcode crypter which will encrypt the shellcode and then decrypt the encrypted shellcode and run it dynamically. The libraries we will be using for encryption will be mcrypt, and the shellcode encryption schema is Rijndael-128(AES). 

We will design the crypter in C programming language. The shellcode we will be using for this exercise will be an execve stack based shellcode. Following is the code of the crypter:

Original source code: Open the archived GitHub Gist

The enc_dec function accepts flag value and based on the value it performs either an encryption operation or decryption operation. Also, the length of the key for encryption and decryption is16. On running the crypter, we get the following output:

The exercise demonstrates a basic C-based crypter and runtime-decryption workflow. Encoding or encryption alone does not make shellcode undetectable; modern defensive systems evaluate behaviour, memory activity and execution context in addition to static byte patterns.

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

2026 archival context

This article documents historical 32-bit Linux exploit-development research and tooling. Modern systems commonly add architectural, compiler and operating-system protections that change build and execution behaviour. The material is retained for controlled labs, defensive understanding and the historical research record.

Authorisation notice: Test only on systems you own or are explicitly authorised to assess.