{"id":24324,"date":"2022-05-16T11:22:23","date_gmt":"2022-05-16T11:22:23","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=24324"},"modified":"2022-05-16T11:22:24","modified_gmt":"2022-05-16T11:22:24","slug":"nimcrypt2","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/nimcrypt2\/","title":{"rendered":"Nimcrypt2 : .NET, PE, And Raw Shellcode Packer\/Loader Written In Nim"},"content":{"rendered":"\n

Nimcrypt2<\/strong> is yet another PE packer\/loader designed to bypass AV\/EDR. It is an improvement on my original Nimcrypt project, with the main improvements being the use of direct syscalls and the ability to load regular PE files as well as raw shellcode.<\/p>\n\n\n\n

Before going any further, I must acknowledge those who did the VAST majority of work and research that this project depends on. Firstly, I must thank @byt3bl33d3r for his Offensive Nim repo, and @ShitSecure for all of the code snippets he’s publicly released. That is what the original version of this tool was created from, and the current version is no different. Particularly, the new PE loading functionality used in this tool is just an implementation of ShitSecure’s recently released Nim-RunPE code. As of 3\/14\/22, this code also uses his GetSyscallStub code for dynamic syscall usage. I highly encourage sponsoring him for access to his own Nim PE Packer, which is no doubt a much better and more featureful version of this.<\/p>\n\n\n\n

Additionally, I would like to thank @ajpc500 for his NimlineWhispers2 project that this tool uses for direct syscalls. I cannot stress enough how this project is simply an amalgamation of the public work of those previously mentioned, so all credit must go to them.<\/p>\n\n\n\n

Nimcrypt v 2.0
Usage:
nimcrypt -f file_to_load -t csharp\/raw\/pe [-o ] [-p ] [-n] [-u] [-s] [-e] [-g] [-l] [-v]
nimcrypt (-h | –help)
Options:
-h –help Show this screen.
–version Show version.
-f –file filename File to load
-t –type filetype Type of file (csharp, raw, or pe)
-p –process process Name of process for shellcode injection
-o –output filename Filename for compiled exe
-u –unhook Unhook ntdll.dll
-v –verbose Enable verbose messages during execution
-e –encrypt-strings Encrypt strings using the strenc module
-g –get-syscallstub Use GetSyscallStub instead of NimlineWhispers2
-l –llvm-obfuscator Use Obfuscator-LLVM to compile binary
-n –no-randomization Disable syscall name randomization
-s –no-sandbox Disable sandbox checks<\/strong><\/p>\n\n\n\n

Features<\/h4>\n\n\n\n