Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/the-xentropy/xencrypt
A PowerShell script anti-virus evasion tool
https://github.com/the-xentropy/xencrypt
crypter ctf-tools powershell redteaming
Last synced: 4 days ago
JSON representation
A PowerShell script anti-virus evasion tool
- Host: GitHub
- URL: https://github.com/the-xentropy/xencrypt
- Owner: the-xentropy
- License: gpl-3.0
- Created: 2020-01-23T00:08:04.000Z (almost 5 years ago)
- Default Branch: master
- Last Pushed: 2023-03-19T21:00:13.000Z (over 1 year ago)
- Last Synced: 2024-11-21T11:51:30.320Z (21 days ago)
- Topics: crypter, ctf-tools, powershell, redteaming
- Language: PowerShell
- Homepage: http://netsec.expert
- Size: 153 KB
- Stars: 1,066
- Watchers: 37
- Forks: 226
- Open Issues: 8
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-hacking-lists - the-xentropy/xencrypt - A PowerShell script anti-virus evasion tool (PowerShell)
README
# Xencrypt
### PowerShell crypter v 1.0
## Authors
Xentropy ( [@SamuelAnttila](http://twitter.com/SamuelAnttila) )
SecForce ( [@SECFORCE_LTD](http://twitter.com/SECFORCE_LTD) )
If you want to read about the design behind this tool and how to make your own crypter, there's an article I wrote about it here: [Write a crypter in any language](https://netsec.expert/2020/02/06/write-a-crypter-in-any-language.html)
## Note
Don't be a script kiddie, I made this GPLv3 so you can make your own modifications. This tool is intended as a demo for how easy it is to write your own crypter. It works for its intended purpose and I will not patch it to make it suitable for yours.
## In action
## Features
Xencrypt:
* Bypasses AMSI and all modern AVs in use on VirusTotal (as of writing)
* Compresses and encrypts powershell scripts
* Has a minimal and often even negative (thanks to the compression) overhead
* Randomizes variable names to further obfuscate the decrypter stub
* Randomizes encryption, compression and even the order that the statements appear in the code for maximum entropy!
* Super easy to modify to create your own crypter variant
* Supports recursive layering (crypter crypting the crypted output), tested up to 500 layers.
* Supports Import-Module as well as standard running as long as the input script also supported it
* GPLv3 -- Free and open-source!
* All features in a single file so you can take it with you anywhere!
* Is despite all of the above not a silver bullet for every configuration -- caveat emptor!
## Usage
```
Import-Module ./xencrypt.ps1
Invoke-Xencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1
```
You will now have an encrypted xenmimi.ps1 file in your current working directory. You can use it in the same way as you would the original script, so in this case:
```
Import-Module ./xenmimi.ps1
Invoke-Mimikatz
```
It also supports recursive layering via the -Iterations flag.
```
Invoke-Xencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1 -Iterations 100
```
Warning though, the files can get big and generating the output file can take a very long time depending on the scripts and number of iterations requested.