admin/trickster0-OffensiveRust
1
0
Fork 0
mirror of https://github.com/trickster0/OffensiveRust synced 2026-06-08 17:54:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

litcrypt string encryption

Browse Source
This commit is contained in:
husky
2022-03-30 12:13:22 -04:00
parent 7e629440f3
commit 8962c1e769
5 changed files with 143 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Litcrypt_String_Encryption/Cargo.lock
Generated
+44
View File
@@ -0,0 +1,44 @@
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3
[[package]]
name = "litcrypt"
version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5f82f92066d9d41b3a569b459b7874e67feb835507a83b7bd142ea9f56c620c7"
dependencies = [
"proc-macro2",
"quote",
]
[[package]]
name = "litcrypt_demo"
version = "0.1.0"
dependencies = [
"litcrypt",
]
[[package]]
name = "proc-macro2"
version = "1.0.36"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c7342d5883fbccae1cc37a2353b09c87c9b0f3afd73f5fb9bba687a1f733b029"
dependencies = [
"unicode-xid",
]
[[package]]
name = "quote"
version = "1.0.17"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "632d02bff7f874a36f33ea8bb416cd484b90cc66c1194b1a1110d067a7013f58"
dependencies = [
"proc-macro2",
]
[[package]]
name = "unicode-xid"
version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
Litcrypt_String_Encryption/Cargo.toml
+9
View File
@@ -0,0 +1,9 @@
[package]
name = "litcrypt_demo"
version = "0.1.0"
edition = "2021"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
[dependencies]
litcrypt = "0.3"
Litcrypt_String_Encryption/README.md
+20
View File
@@ -0,0 +1,20 @@
# [Litcrypt](https://github.com/anvie/litcrypt.rs)
This one takes some explanation.
During the OffensiveNotion dev process, Taggart and I found the Litcrypt crate useful in encrypting the literal strings of our agent binary both at rest and in memory. Litcrypt encrypts strings and decrypts them only when they are used. This is useful to conceal strings and retain OPSEC during operations.
## How To
Litcrypt needs an environment variable set in order to encrypt the strings during compilation. You can set this by entering the following in Linux:
```
$ export LITCRYPT_ENCRYPT_KEY="OffensiveRustRules"
```
Then, reopen Visual Studio Code and the Rust Analyzer will recognize that Litcrypt is in use:
```
$ code .
```
Once that env var is set, it's as simple as the usual `cargo build`. You will get a gross error message if the encryption key can't be applied from the env var.
Then, run strings against the binary and look at the ones that show up and the ones that don't.
Litcrypt_String_Encryption/src/main.rs
+42
View File
@@ -0,0 +1,42 @@
#[macro_use]
extern crate litcrypt;
use_litcrypt!();
fn main(){
let payload_url: String = "http://fancyladsnacks.local/definitelymalware.exe".to_string();
let evil_password: String = "OhNoPayUsBitcoin!@#".to_string();
let _can_you_see_me: String = lc!("Can you see me?").to_string();
let _or_can_you_see_me: String = "Or can you see me?".to_string();
println!("[!] Unencrypted Strings:");
println!("\t[*] Downloading evil thing from {}", payload_url);
println!("\t[*] Encrypting all ur filez with password: {}", evil_password);
println!("\t[-] These strings appear in the binary statically. Run strings and grep for them, they are in there.");
println!("\n[!] Encrypted Strings using the lc! macro:");
println!("\t[*] Downloading evil thing from: {}", lc!("http://freetshirts.info.local/superevilthingmuhahahaha.exe"));
println!("\t[*] Encrypting all ur filez with password: {}", lc!("ThisIsTheEncryptionKeyToYourData123!@#"));
println!("\t[+] The evil URL and password strings are encrypted and don't appear statically in the binary! They also don't appear in memory until they are used. Run strings and grep for the URL and encryption key to check");
println!("\n[?] Can I define variables and encrypt them using Litcrypt?\n[A] Nope! You can't use litcrypt to encrypt anything that will not be known at runtime.\n[A] Just like its name suggests, you can only encrypt literal strings. Not variables, raw strings, concatenated strings, or formatted strings.\n[>] Trying to encrypt the same strings but using their defined variables instead of the string literals prints out the value \"unknown\":");
println!("\t[+] Downloading evil thing from {}", lc!(payload_url));
println!("\t[+] Encrypting all ur filez with password: {}", lc!(evil_password));
println!("\n[!] Try using strings to find the two other strings in this program, \"Can you see me?\" and \"Or can you see me?\" (other than in this string, of course). Which one is litcrypted?")
}
// You can imagine a whole bunch of other evil stuff in here:
// fn download_and_run_evil_thing() { .....
// fn solemly_swear_up_to_no_good() { ......
// ... and all of the strings of these functions can use litcrypt to evade static analyzers.
README.md
+28 -27
View File
@@ -31,34 +31,35 @@ My experiments in weaponizing [Rust](https://www.rust-lang.org/) for implant dev
## Examples in this repo
| File | Description |
|--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Allocate_With_Syscalls](../master/Allocate_With_Syscalls/src/main.rs) | It uses NTDLL functions directly with the ntapi Library |
| [Create_DLL](../master/Create_DLL/src/lib.rs) | Creates DLL and pops up a msgbox, Rust does not fully support this so things might get weird since Rust DLL do not have a main function |
| [DeviceIoControl](../master/DeviceIoControl/src/main.rs) | Opens driver handle and executing DeviceIoControl |
| [EnableDebugPrivileges](../master/EnableDebugPrivileges/src/main.rs) | Enable SeDebugPrivilege in the current process |
| [Shellcode_Local_inject](../master/Shellcode_Local_inject/src/main.rs) | Executes shellcode directly in local process by casting pointer |
| [Execute_With_CMD](../master/Execute_Without_Create_Process/src/main.rs) | Executes cmd by passing a command via Rust |
| [ImportedFunctionCall](../master/ImportedFunctionCall/src/main.rs) | It imports minidump from dbghelp and executes it |
| [Kernel_Driver_Exploit](../master/Kernel_Driver_Exploit/src/main.rs) | Kernel Driver exploit for a simple buffer overflow |
| [Named_Pipe_Client](../master/Named_Pipe_Client/src/main.rs) | Named Pipe Client |
| [Named_Pipe_Server](../master/Named_Pipe_Server/src/main.rs) | Named Pipe Server |
| [Process_Injection_CreateThread](../master/Process_Injection_CreateThread/src/main.rs) | Process Injection in running process with CreateThread |
| [Process_Injection_CreateRemoteThread](../master/Process_Injection_CreateRemoteThread/src/main.rs) | Process Injection in remote process with CreateRemoteThread |
| File | Description |
|-------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Allocate_With_Syscalls](../master/Allocate_With_Syscalls/src/main.rs) | It uses NTDLL functions directly with the ntapi Library |
| [Create_DLL](../master/Create_DLL/src/lib.rs) | Creates DLL and pops up a msgbox, Rust does not fully support this so things might get weird since Rust DLL do not have a main function |
| [DeviceIoControl](../master/DeviceIoControl/src/main.rs) | Opens driver handle and executing DeviceIoControl |
| [EnableDebugPrivileges](../master/EnableDebugPrivileges/src/main.rs) | Enable SeDebugPrivilege in the current process |
| [Shellcode_Local_inject](../master/Shellcode_Local_inject/src/main.rs) | Executes shellcode directly in local process by casting pointer |
| [Execute_With_CMD](../master/Execute_Without_Create_Process/src/main.rs) | Executes cmd by passing a command via Rust |
| [ImportedFunctionCall](../master/ImportedFunctionCall/src/main.rs) | It imports minidump from dbghelp and executes it |
| [Kernel_Driver_Exploit](../master/Kernel_Driver_Exploit/src/main.rs) | Kernel Driver exploit for a simple buffer overflow |
| [Named_Pipe_Client](../master/Named_Pipe_Client/src/main.rs) | Named Pipe Client |
| [Named_Pipe_Server](../master/Named_Pipe_Server/src/main.rs) | Named Pipe Server |
| [Process_Injection_CreateThread](../master/Process_Injection_CreateThread/src/main.rs) | Process Injection in running process with CreateThread |
| [Process_Injection_CreateRemoteThread](../master/Process_Injection_CreateRemoteThread/src/main.rs) | Process Injection in remote process with CreateRemoteThread |
| [Process_Injection_Self_EnumSystemGeoID](../master/Process_Injection_Self_EnumSystemGeoID/src/main.rs) | Self injector that uses the EnumSystemsGeoID API call to run shellcode. |
| [Unhooking](../master/Unhooking/src/main.rs) | Unhooking calls |
| [asm_syscall](../master/asm_syscall/src/main.rs) | Obtaining PEB address via asm |
| [base64_system_enum](../master/base64_system_enum/src/main.rs) | Base64 encoding/decoding strings |
| [http-https-requests](../master/http-https-requests/src/main.rs) | HTTP/S requests by ignoring cert check for GET/POST |
| [patch_etw](../master/patch_etw/src/main.rs) | Patch ETW |
| [ppid_spoof](../master/ppid_spoof/src/main.rs) | Spoof parent process for created process |
| [tcp_ssl_client](../master/tcp_ssl_client/src/main.rs) | TCP client with SSL that ignores cert check (Requires openssl and perl to be installed for compiling) |
| [tcp_ssl_server](../master/tcp_ssl_server/src/main.rs) | TCP Server, with port parameter(Requires openssl and perl to be installed for compiling) |
| [wmi_execute](../master/wmi_execute/src/main.rs) | Executes WMI query to obtain the AV/EDRs in the host |
| [Windows.h+ Bindings](../master/bindings.rs) | This file contains structures of Windows.h plus complete customized LDR,PEB,etc.. that are undocumented officially by Microsoft, add at the top of your file include!("../bindings.rs"); |
| [UUID_Shellcode_Execution](../master/UUID_Shellcode_Execution/src/main.rs) | Plants shellcode from UUID array into heap space and uses `EnumSystemLocalesA` Callback in order to execute the shellcode. |
| [AMSI Bypass](../master/amsi_bypass/src/main.rs) | AMSI Bypass on Local Process |
| [Injection_AES_Loader](../master/Injection_AES_Loader/src/main.rs) | NtTestAlert Injection with AES decryption |
| [Unhooking](../master/Unhooking/src/main.rs) | Unhooking calls |
| [asm_syscall](../master/asm_syscall/src/main.rs) | Obtaining PEB address via asm |
| [base64_system_enum](../master/base64_system_enum/src/main.rs) | Base64 encoding/decoding strings |
| [http-https-requests](../master/http-https-requests/src/main.rs) | HTTP/S requests by ignoring cert check for GET/POST |
| [patch_etw](../master/patch_etw/src/main.rs) | Patch ETW |
| [ppid_spoof](../master/ppid_spoof/src/main.rs) | Spoof parent process for created process |
| [tcp_ssl_client](../master/tcp_ssl_client/src/main.rs) | TCP client with SSL that ignores cert check (Requires openssl and perl to be installed for compiling) |
| [tcp_ssl_server](../master/tcp_ssl_server/src/main.rs) | TCP Server, with port parameter(Requires openssl and perl to be installed for compiling) |
| [wmi_execute](../master/wmi_execute/src/main.rs) | Executes WMI query to obtain the AV/EDRs in the host |
| [Windows.h+ Bindings](../master/bindings.rs) | This file contains structures of Windows.h plus complete customized LDR,PEB,etc.. that are undocumented officially by Microsoft, add at the top of your file include!("../bindings.rs"); |
| [UUID_Shellcode_Execution](../master/UUID_Shellcode_Execution/src/main.rs) | Plants shellcode from UUID array into heap space and uses `EnumSystemLocalesA` Callback in order to execute the shellcode. |
| [AMSI Bypass](../master/amsi_bypass/src/main.rs) | AMSI Bypass on Local Process |
| [Injection_AES_Loader](../master/Injection_AES_Loader/src/main.rs) | NtTestAlert Injection with AES decryption |
| [Litcrypt_String_Encryption](../master/Litcrypt_Stirng_Encryption/src/main.rs) | Using the [Litcrypt](https://github.com/anvie/litcrypt.rs) crate top encrypt literal strings at rest and in memory to defeat static AV. |
## Compiling the examples in this repo