e3prom / kryptoxin

A security-oriented payload encryption tool written in Python.

Kryptoxin

• Kryptoxin
  • Description
  • Features
  • Installation
    • With pip (latest release)
    • With git (v0.9.9)
  • Usages examples
    • Read, encrypt and decrypt, all from stdin
    • Encrypt using AES-128-CFB
    • Uses the PowerShell load-asm script template
  • Documentation
  • Disclaimer
  • License

Description

Kryptoxin is a Python tool allowing you to generate encrypted payloads effortlessly. This software is primarily intended for use in the security field for storing encrypted objects on target hosts. It can also be used for concealing scripts and binary objects from scrutiny.

The name Kryptoxin comes from the contraction of Kryptos (meaning conceal, hidden or secret in Greek) and the word Toxin (meaning poison). As the name implies, the intended goal of this project is to provide a fast and efficient way of concealing or hiding payloads, thus saving you a lot of time and effort. Most of our templates are "living off the land", using system libraries and encryption routines commonly found in base operating systems installations.

Features

The below features are supported:

• Provides block-cipher encryption algorithms such as the Advanced Encryption Standard or AES.
• Implements basic encryption ciphers such as a derivative of the Caesar Cipher.
• Supports user-specifiable key sizes and block-cipher modes of operations, such as AES256-CBC.
• Generate random cryptographic parameters such as Initialization Vector and Salt.
• Encodes and properly formats variables for fast and streamlined copy/paste operations.
• Handles Text Files, Scripts, Portable Executables (PE), Dynamic Link Libraries (DLLs), and shellcodes objects.
• Generates compact, portable scripts or source codes as outputs for the below programming languages:
  • PowerShell
  • VBA Macro
  • C#
  • C++
  • C
• Implement key derivation functions, such as PBKDF2.
• Supports out-of-band key storage, with conditional trigger mechanisms (not yet available).
• Includes scripts and source code templates to be used for security-related tasks and experimentation.

Installation

With pip (latest release)

pip install kryptoxin

With git (v0.9.9)

git clone https://github.com/e3prom/kryptoxin
cd kryptoxin
git checkout tags/0.9.9
sudo make install

Usages examples

Read, encrypt and decrypt, all from stdin

$ echo -n 'test' | python -m kryptoxin encrypt -k 12345
5bP32GKoJa57IcKL4sWeUQ==

$ echo -n '5bP32GKoJa57IcKL4sWeUQ==' | python -m kryptoxin decrypt -k 12345
test

Encrypt using AES-128-CFB

$ echo -n 'test' | python -m kryptoxin encrypt -k 12345 --alg aes --key_size 128 --mode CFB
E1ZdkFX+N4SjHtcsSi5m2g==

Uses the PowerShell load-asm script template

$ python -m kryptoxin encrypt -k 123456 --random-iv --random-salt \
--lang powershell --action load_asm --in TestLibrary.dll \
--type=TestLibraryClass.Class1 --method=run
2023-03-04 17:33:42,287 - INFO - The Initialization Vector (IV) is: c15c8447204e9025a8ef1e4dd2ea80da
2023-03-04 17:33:42,287 - INFO - The PBKDF2 Salt is: 85858c9115145be223d36750464b8026

$base64EncData = "3Ud7pHQPm/qWOjgtuNOXP2WclPMxz6VuhfRTnwNXDyg="
[...]

Documentation

You can directly visit the online documentation or build it locally using the make docs command.

Disclaimer

This program is distributed "AS IS" without any warranty or conditions of any kind. Under no circumstances can the developers, maintainers, or contributors be held responsible for the improper use of this software. Any damages or consequences resulting from the direct or indirect operation of this software cannot be attributed to the above-mentioned individuals or organizations. All opinions and knowledge expressed in the source codes, documentation, templates and examples are provided for educational and demonstration purposes only. By using this software you agree to the terms expressed therein.

License

Kryptoxin is released under the AGPL-3 license. See LICENSE for more detail.