Our crypter hides the actual code from static code analysis.
EXAMPLE => STAGE 1 -> STAGE 2 -> STUB
The STUB will be launched on the victim.
The binary that will act as the finished crypter and can be deployed.
Places a encrypted buffer (EXAMPLE executable) in the STUB's memory so it can be executed with anonFile() in memory. It makes use of execle() fileless.
Encrypts the STAGE 1 functionality in a section where it can decrypt itself in memory(page) when launched. Makes use of section decryption and hides the STAGE 1 functionality.
The examle target binary we want to hide, but launch.
make
make run
- Encrypt/Decrypt payload
- Using seeds to change the file signature
https://github.com/droberson/ELFcrypt
https://0x00sec.org/t/binary-armory-wiki/25679/9
https://github.com/0x00pf/0x00sec_code/tree/master/crypter