Giter VIP home page Giter VIP logo

betterxencrypt's Introduction

__________        __    __              ____  ___                                         __   
\______   \ _____/  |__/  |_  __________\   \/  /____   ____   ___________ ___.__._______/  |_ 
 |    |  _// __ \   __\   __\/ __ \_  __ \     // __ \ /    \_/ ___\_  __ <   |  |\____ \   __\
 |    |   \  ___/|  |  |  | \  ___/|  | \/     \  ___/|   |  \  \___|  | \/\___  ||  |_> >  |  
 |______  /\___  >__|  |__|  \___  >__| /___/\  \___  >___|  /\___  >__|   / ____||   __/|__|  
        \/     \/                \/           \_/   \/     \/     \/       \/     |__|         

BetterXencrypt

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs. cause Xencrypt is not FUD anymore and easily get caught by AMSI,i recode the stub and now it FUD again. And the original Xencrypt,if you see on the screenshot proof,he's tested on Windows 8,and if i test it on the newest Windows 10,it doesnt FUD, cause that i want to make it FUD again and make everyone happy :D

This tool tested on Windows 10 v20H2 with MSFVenom PSH payload

Proof-Of-FUDness (if you dont trust my word)

https://www.virustotal.com/gui/file/427c697e11d476f733aaad9fc2ed9dffd8c8b45d84a772c5179d3134d19ac24d/detection

Features

  • Bypasses AMSI,Behavior Monitoring,and all modern AVs in use on MetaDefender and VirusTotal
  • Compresses and encrypts powershell scripts
  • Has a minimal and often even negative (thanks to the compression) overhead
  • Multiple types of encryption and compression
  • Randomizes variable names to further obfuscate the decrypter stub
  • Super easy to modify to create your own crypter variant
  • Supports recursive layering (crypter crypting the crypted output), tested up to 500 layers.
  • Supports Import-Module as well as standard running as long as the input script also supported it
  • All features in a single file so you can take it with you anywhere!

Note

Don't be a script kiddie, I made this GPLv3 so you can make your own modifications. But yeah i'll keep developing this tool,and if you dont want to make your own modifications,its fine anyway.

Thanks To

  • Me for not dying when creating this tool
  • Xentropy and SecForce for creating the original Xencrypt
  • Ed Wilson AKA Microsoft Scripting Guy for the great Powershell scripting tutorials
  • and the last one is Emeric Nasi for the research on bypassing AV dynamics

Usage

Its better to run BetterXencrypt script on Linux Powershell,cause i never try it on Windows Powershell. (Surprised that Linux have Powershell?Take a look at this)

Import-Module ./betterxencrypt.ps1
Invoke-BetterXencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1

You will now have an encrypted xenmimi.ps1 file in your current working directory. You can use it in the same way as you would the original script, so in this case:

Import-Module ./xenmimi.ps1
Invoke-Mimikatz

It also supports recursive layering via the -Iterations flag.

Invoke-BetterXencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1 -Iterations 100

Warning though, the files can get big and generating the output file can take a very long time depending on the scripts and number of iterations requested.

To-do List

betterxencrypt's People

Contributors

getrektboy724 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

betterxencrypt's Issues

I'm unsure of how to actually use this to FUD an executable?

Hi there,

Thanks for the excellent tool : )

Here is my use case. I have an executable (it's a RAT).
Now I'm unsure of how to use the tool to FUD the executable.

Do I specify the ./path/to/file.exe inside --infile or how does that work? is that even possible?

.exe

Why doesn't it works with exe file. Was it meant for only powershell ?

Awesome Repo

This repo is getting noticed gud keep rocking

Payload still getting flagged

Hey there, I've ran the script using 1 iteration but the resultant payload still got flagged, also importing the encrypted script took a very long time, is that normal?

PS D:\Tools\AVtest> Invoke-BetterXencrypt -infile D:\Tools\AVtest\Invoke-DCSync.ps1 -outfile D:\Tools\AVtest\Invoke-xen.ps1 -iterations 1
 ____       _   _          __  __                                _
| __ )  ___| |_| |_ ___ _ _\ \/ /___ _ __   ___ _ __ _   _ _ __ | |_
|  _ \ / _ \ __| __/ _ \ '__\  // _ \ '_ \ / __| '__| | | | '_ \| __|
| |_) |  __/ |_| ||  __/ |  /  \  __/ | | | (__| |  | |_| | |_) | |_
|____/ \___|\__|\__\___|_| /_/\_\___|_| |_|\___|_|   \__, | .__/ \__|
                                                     |___/|_|
----------------------------------------------------------------------
[-----------------Your Lovely FUD Powershell Crypter-----------------]
[-----------------Recoded With Love By GetRektBoy724-----------------]
[------------------https://github.com/GetRektBoy724------------------]
[*] Reading 'D:\Tools\AVtest\Invoke-DCSync.ps1' ...
[*] Starting code layer  ...
[*] Compressing ...
[*] Generating encryption key ...
[*] Encrypting with AES...
[*] Encrypting with XOR ...
[*] Finalizing code layer ...
[*] Writing 'D:\Tools\AVtest\Invoke-xen.ps1' ...
[+] Done!
PS D:\Tools\AVtest> . .\Invoke-xen.ps1
IEX : At line:1 char:1
+ function Invoke-DCSync
+ ~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.
At D:\Tools\AVtest\Invoke-xen.ps1:65 char:1
+ IEX($iqshjgzoxhqtihsn)
+ ~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException
    + FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand

Tutorial

Screenshot 2021-12-28 130543
Can you make tutorials on how to encrypt 1 file without getting any error. I am new to powershell and keep getting this error

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.