refactor: make decoy a plugin too

This commit is contained in:
Dobin Rutishauser
2024-06-10 10:06:24 +02:00
parent 85585e598e
commit 71b38a064c
8 changed files with 24 additions and 7 deletions
@@ -36,6 +36,8 @@ int main()
antiemulation();
// Decoy
{{plugin_decoy}}
//WinExec("C:\\windows\\system32\\notepad.exe", 1);
// Allocate 1
+1 -1
View File
@@ -36,7 +36,7 @@ int main()
antiemulation();
// Decoy
//WinExec("C:\\windows\\system32\\notepad.exe", 1);
{{plugin_decoy}}
// Allocate 1
// char *dest = ...
View File
+1
View File
@@ -0,0 +1 @@
WinExec("C:\\windows\\system32\\notepad.exe", 1);
+1
View File
@@ -16,6 +16,7 @@ PATH_PAYLOAD = "data/source/payload/"
PATH_DECODER = "data/source/carrier/decoder/"
PATH_ANTIEMULATION = "data/source/carrier/antiemulation/"
PATH_DECOY = "data/source/carrier/decoy/"
PATH_WEB_PROJECT = "projects/"
+3 -1
View File
@@ -13,7 +13,9 @@ class Settings():
self.carrier_name: str = ""
self.decoder_style: DecoderStyle = DecoderStyle.XOR_1
self.short_call_patching: bool = False
self.antiemulation = "timeraw"
self.plugin_antiemulation = "timeraw"
self.plugin_decoy = "none"
self.dllfunc: str = "" # For DLL injection
+11 -5
View File
@@ -38,23 +38,29 @@ def create_c_from_template(settings: Settings, payload_len: int):
'XOR_KEY2': ascii_to_hex_bytes(config.xor_key2),
})
# Anti-Emulation
# Plugin: Anti-Emulation
filepath_antiemulation = PATH_ANTIEMULATION + "{}.c".format(
settings.antiemulation)
settings.plugin_antiemulation)
with open(filepath_antiemulation, "r", encoding='utf-8') as file:
plugin_antiemualation = file.read()
# Choose correct template
# Plugin: Decoy
filepath_decoy = PATH_DECOY + "{}.c".format(
settings.plugin_decoy)
with open(filepath_decoy, "r", encoding='utf-8') as file:
plugin_decoy = file.read()
# Choose template
dirpath = PATH_CARRIER + settings.carrier_name + "/template.c"
with open(dirpath, 'r', encoding='utf-8') as file:
template_content = file.read()
observer.add_text_file("main_c_template", template_content)
# Render main template
# Render template
template = Template(template_content)
rendered_template = template.render({
'plugin_decoder': plugin_decoder,
'plugin_antiemulation': plugin_antiemualation,
'plugin_decoy': plugin_decoy,
'PAYLOAD_LEN': payload_len,
})
with open(settings.main_c_path, "w", encoding='utf-8') as file:
+5
View File
@@ -146,6 +146,11 @@ def start_real(settings: Settings):
project.settings.decoder_style.value,
project.settings.carrier_invoke_style.value))
logger.info("---[ Plugins: AntiEmulation={} Decoy={}".format(
project.settings.plugin_antiemulation,
project.settings.plugin_decoy)
)
# CREATE: Carrier C source files from template (C->C)
phases.templater.create_c_from_template(settings, project.payload.len)