# Xeca | PowerShell Payload Generator

**URL:** <https://onehack.st/t/xeca-powershell-payload-generator/99844>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, hacking\
**Created:** [August 7, 2020, 12:45pm UTC](https://onehack.st/t/xeca-powershell-payload-generator/99844 "2020-08-07T12:45:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [August 7, 2020, 12:45pm UTC](https://onehack.st/t/xeca-powershell-payload-generator/99844/1 "2020-08-07T12:45:52Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/a/6ae1ddef2cd091ed6c5d85ef9c4adacc5d6f5748.png)

xeca is a project that creates encrypted PowerShell payloads for offensive purposes.  
Creating position independent shellcode from DLL files is also possible.

**Install**  
Firstly ensure that rust is [installed](https://www.rust-lang.org/tools/install), then build the project with the following command:

```auto
cargo build

```

**How It Works**

1. Identify and encrypt the payload. Load encrypted payload into a powershell script and save to a file named “launch.txt”
2. The key to decrypt the payload is saved to a file named “safe.txt”
3. Execute “launch.txt” on a remote host

- The script will call back to the attacker defined web server to retrieve the decryption key “safe.txt”
- Decrypt the payload in memory
- Execute the intended payload in memory

**Mitigations**  
If users must have access to programs such as powershell.exe, consider minimising security risks with [Just Enough Administration](https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7) and [PowerShell Logging](https://docs.microsoft.com/en-us/powershell/scripting/windows-powershell/wmf/whats-new/script-logging?view=powershell-7). Application control policies can be deployed via a whitelisting technology such as [Ap pLocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).

**Acknowledgements**  
This tool would not be possible without the sharing of knowledge and information. Ideas, snippets and code from the following authors should be acknowledged:  
[@monoxgas](https://github.com/monoxgas)  
[@H0neyBadger](https://github.com/H0neyBadger)  
[@stephenfewer](https://github.com/stephenfewer)  
[@dismantl](https://github.com/dismantl)

**License**  
xeca is licensed under [GPLv3](https://www.gnu.org/licenses/gpl-3.0.en.html), some sub-components may have separate licenses. See their respective references in this project for details.

## GitHub:

> **[GitHub - postrequest/xeca: PowerShell payload generator](https://github.com/postrequest/xeca)**
>
> PowerShell payload generator