0x0 Crypter is a open sourced crypter fully coded by @MpCmdRun
- 🔒 Base64 Protection - Provides a basic protection to your exe on runtime.
- 🛡️ AMSI Bypass - Provides a temporary Bypass to the AmsiScanBuffer on Windows 10 and 11.
- 🛡️ ETW Bypass - Provides a temporary ETW Bypass on Windows 10 and 11.
- 💻 Run as admin - Provides the applicaiton to be ran as administrator (RunAs UAC Bypass).
- 👤 Startup - Creates a scheduled Task to run this .exe everytime to computer turns back on.
This tool is provided for educational purposes only.
You are responsible for how you use this tool.
Unauthorized access to computer systems is illegal.
Intended Use Cases:
- Red Team persistence frameworks
- Malware analysis / simulation environments
- Digital forensics research
- Self-repair recovery scripting
Do not deploy on devices or systems you do not own or have explicit permission to test.
-
Clone the repo:
git clone https://github.com/MpCmdRun/0x0-Crypter cd 0x0-crypter -
Open the solution in Visual Studio 2019/2022.
-
Build Release mode.
-
Run with Administrator privileges. (Could use a UAC Bypass!)
- Implement Obfuscation settings such as ControlFlow, StringEncryption etc. (Add them back from previous v1 6 months ago)
- Implement Encryptor/Utils and switch from Base64 to AES-256 for more secure shit and harder payload discovery
- Implement Settings Saver, which saves your settings in a JSON file in the same directory as 0x0 Crypter.
- Implement Anti-Skid disallowing people to skid this project (some kind of title checker idk maybe todo that later)
- Implement Multiple Outputs such as DLL, BAT, PS1, JS (NodeJs), and GO.
- Implement a better UI and not keep this ugly one (DevExpress?)
- Implement Pulsar Payload Support (might break with some pulsar payloads rn idk)
- Implement a better Building output method
- Implement and switch to a veh2 amsi bypass
- Implement and switch to a template outside of the main form instead of building it from a bunch of tiny templates
- Implement more options for bypassing
- Implement Anti-Triage and other certain sandbox types and if using make fun of the user
- Implement process injection
- Implement Drag n Drop file input
- Concept by @MpCmdRun
- Coded by @MpCmdRun
Feel free to open an Issue or Pull Request.