ChaCha20-Poly1305 encrypted reverse shell in pure x86_64 assembly.
~3.6 KB shellcode. Hell's Gate injector. Zero imports. Full AEAD.
Every byte handcrafted in NASM. No compiler, no runtime, no import table. ChaCha20-Poly1305 AEAD and Hell's Gate injection — all from scratch in position-independent shellcode.
Full RFC 8439 AEAD in pure assembly. 256-bit PSK, fresh random nonce per message, Poly1305 MAC verification rejects tampered payloads.
API resolution, networking, crypto, command execution — all in ~3,600 bytes of position-independent code. No compiler, no runtime.
APIs resolved at runtime via PEB walking and ror13 hash matching. GetProcAddress handles forwarded exports. No import table.
Commands run via CreateProcessA with cmd.exe /c, stdout+stderr captured through anonymous pipes. PeekNamedPipe polling streams output in real-time with a 30-second timeout.
Builds as raw PIC shellcode (vapor.bin) for injection and minimal PE (vapor.exe) for direct execution. Same source, two formats.
Python 3 listener with ChaCha20-Poly1305 encryption, interactive CLI, spinner for long-running commands, and Catppuccin Mocha themed output.
SSNs extracted at runtime from ntdll stubs with Halo's Gate fallback for hooked stubs. All NT syscalls jump to ntdll's own syscall gadget — return address traces to ntdll, not the injector.
Target created suspended, shellcode written via NT syscalls (RW→RX), APC queued to main thread. Fires before process entry point — before EDR userland hooks initialize.
Every message is independently encrypted with a fresh 96-bit nonce. The Poly1305 MAC authenticates the ciphertext per RFC 8439 — any tampered byte is rejected before execution.
Deploy vapor.bin into a target process using direct NT syscalls. No high-level API calls for EDR to hook — SSNs extracted at runtime, syscalls routed through ntdll's own gadget.
4C 8B D1 B8 pattern)syscall; ret (0F 05 C3)What makes Vapor tick — every component implemented from scratch in assembly.
Provide an LHOST, LPORT, and a 256-bit pre-shared key. The build produces shellcode, PE, and injector outputs.