{"action":"created","issue":{"url":"https://api.github.com/repos/Veil-Framework/Veil-Evasion/issues/141","labels_url":"https://api.github.com/repos/Veil-Framework/Veil-Evasion/issues/141/labels{/name}","comments_url":"https://api.github.com/repos/Veil-Framework/Veil-Evasion/issues/141/comments","events_url":"https://api.github.com/repos/Veil-Framework/Veil-Evasion/issues/141/events","html_url":"https://github.com/Veil-Framework/Veil-Evasion/pull/141","id":71614040,"number":141,"title":"AES encrypt HTTP key request","user":{"login":"killswitch-GUI","id":8761706,"avatar_url":"https://avatars.githubusercontent.com/u/8761706?v=3","gravatar_id":"","url":"https://api.github.com/users/killswitch-GUI","html_url":"https://github.com/killswitch-GUI","followers_url":"https://api.github.com/users/killswitch-GUI/followers","following_url":"https://api.github.com/users/killswitch-GUI/following{/other_user}","gists_url":"https://api.github.com/users/killswitch-GUI/gists{/gist_id}","starred_url":"https://api.github.com/users/killswitch-GUI/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/killswitch-GUI/subscriptions","organizations_url":"https://api.github.com/users/killswitch-GUI/orgs","repos_url":"https://api.github.com/users/killswitch-GUI/repos","events_url":"https://api.github.com/users/killswitch-GUI/events{/privacy}","received_events_url":"https://api.github.com/users/killswitch-GUI/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-04-28T15:01:56Z","updated_at":"2015-06-09T20:56:32Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Veil-Framework/Veil-Evasion/pulls/141","html_url":"https://github.com/Veil-Framework/Veil-Evasion/pull/141","diff_url":"https://github.com/Veil-Framework/Veil-Evasion/pull/141.diff","patch_url":"https://github.com/Veil-Framework/Veil-Evasion/pull/141.patch"},"body":"Lets get this added!!\r\n\r\nThis payload has AES encrypted shellcode stored on a webserver.  At runtime, the executable\r\nuses the key from a HTML requet holding the key, using md5 to hash the html output and produce \r\nrequired 16 Byte key. Than injects it into memory, and executes it.\r\n\r\n[*] Logic:\r\n- HTTP Request on your hosted webpage:                                     <-----\r\n    DOWN ----> Sleep and try to reach supplied webpage using HTTP response code |\r\n    UP ----> Preform MD5 hash of HTML of webpage:\r\n        MD5 ---> pass to decryption function:\r\n            CalL Shellcode ----> Shellcode invojes callback: WIN \r\n\r\n\r\n[*] Benefits:\r\n- Uses urllib2 to make get request against supplied server and returns the \r\n  HTML text for md5 hashing.\r\n- Prevents Key being deployed with payload, preventing payload to run in sandbox\r\n  if target server is taken offline during initial deployment.\r\n- Once use of payload is over, take down webserver to prevent future infections\r\n- Static and future dynamic RE is near impossible without proper data collection. \r\n- Proper web log monitoring will identify when webserver is burnt and crucial to \r\n  remove key to prevent future ability to RE binary. Defenders would need to capture \r\n  live memory to capture key.\r\n"},"comment":{"url":"https://api.github.com/repos/Veil-Framework/Veil-Evasion/issues/comments/110501844","html_url":"https://github.com/Veil-Framework/Veil-Evasion/pull/141#issuecomment-110501844","issue_url":"https://api.github.com/repos/Veil-Framework/Veil-Evasion/issues/141","id":110501844,"user":{"login":"ChrisTruncer","id":1674822,"avatar_url":"https://avatars.githubusercontent.com/u/1674822?v=3","gravatar_id":"","url":"https://api.github.com/users/ChrisTruncer","html_url":"https://github.com/ChrisTruncer","followers_url":"https://api.github.com/users/ChrisTruncer/followers","following_url":"https://api.github.com/users/ChrisTruncer/following{/other_user}","gists_url":"https://api.github.com/users/ChrisTruncer/gists{/gist_id}","starred_url":"https://api.github.com/users/ChrisTruncer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ChrisTruncer/subscriptions","organizations_url":"https://api.github.com/users/ChrisTruncer/orgs","repos_url":"https://api.github.com/users/ChrisTruncer/repos","events_url":"https://api.github.com/users/ChrisTruncer/events{/privacy}","received_events_url":"https://api.github.com/users/ChrisTruncer/received_events","type":"User","site_admin":false},"created_at":"2015-06-09T20:56:32Z","updated_at":"2015-06-09T20:56:32Z","body":"I can confirm that this is good to go, ready for merge on the 15th."}}