mirror of
https://github.com/r00tkiter/PE2Shellcode
synced 2026-06-08 16:53:41 +00:00
添加项目文件。
This commit is contained in:
DrLyoko
Binary file not shown.
@@ -0,0 +1,169 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>15.0</VCProjectVersion>
|
||||
<ProjectGuid>{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}</ProjectGuid>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<RootNamespace>PE2Shellcode</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0.18362.0</WindowsTargetPlatformVersion>
|
||||
<ProjectName>PE2Shellcode</ProjectName>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v141</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v141</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v141</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v141</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<SubSystem>Console</SubSystem>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<SubSystem>Console</SubSystem>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>MaxSpeed</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||
<SubSystem>Console</SubSystem>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>MaxSpeed</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||
<SubSystem>Console</SubSystem>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.cpp" />
|
||||
<ClCompile Include="PePacket.cpp" />
|
||||
<ClCompile Include="ProccessData.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="PePacket.h" />
|
||||
<ClInclude Include="ProccessData.h" />
|
||||
<ClInclude Include="resource.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ResourceCompile Include="PE2Shellcode.rc" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="..\..\x64.bin" />
|
||||
<None Include="..\PELoader\x86.bin" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,52 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="源文件">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="头文件">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="资源文件">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="ProccessData.cpp">
|
||||
<Filter>源文件</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="main.cpp">
|
||||
<Filter>源文件</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="PePacket.cpp">
|
||||
<Filter>源文件</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="PePacket.h">
|
||||
<Filter>头文件</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="ProccessData.h">
|
||||
<Filter>头文件</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="resource.h">
|
||||
<Filter>头文件</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ResourceCompile Include="PE2Shellcode.rc">
|
||||
<Filter>资源文件</Filter>
|
||||
</ResourceCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="..\PELoader\x86.bin">
|
||||
<Filter>资源文件</Filter>
|
||||
</None>
|
||||
<None Include="..\..\x64.bin">
|
||||
<Filter>资源文件</Filter>
|
||||
</None>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,334 @@
|
||||
#include "PePacket.h"
|
||||
#include "ProccessData.h"
|
||||
#include "resource.h"
|
||||
CPePacket::CPePacket()
|
||||
{
|
||||
rc4Flag = FALSE;
|
||||
cmpFlag = FALSE;
|
||||
data = NULL;
|
||||
head = NULL;
|
||||
shellcode = NULL;
|
||||
dataSize = 0;
|
||||
}
|
||||
CPePacket::~CPePacket()
|
||||
{
|
||||
if (data != NULL)
|
||||
delete data;
|
||||
data = NULL;
|
||||
|
||||
if (head != NULL)
|
||||
delete head;
|
||||
head = NULL;
|
||||
|
||||
if (shellcode != NULL)
|
||||
delete shellcode;
|
||||
shellcode = NULL;
|
||||
|
||||
dataSize = 0;
|
||||
headSize = 0;
|
||||
shellSize = 0;
|
||||
}
|
||||
|
||||
|
||||
int CPePacket::ParsePara(int argc, wchar_t ** argv)
|
||||
{
|
||||
if (argc <= 2)
|
||||
{
|
||||
printf("Used : PE2Shellcode.exe <path of PE>[output path] [-?]\n");
|
||||
printf("[-r] Rc4 encrypt\n");
|
||||
printf("[-c] Compress PE file\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
srcExePath = argv[1];
|
||||
targetBinPath = argv[2];
|
||||
|
||||
if (argc > 2)
|
||||
{
|
||||
for (int i = 3; i < argc; i++)
|
||||
{
|
||||
if (wcscmp(L"-r", argv[i]) == 0 && wcslen(argv[i]) == 2)
|
||||
rc4Flag = true;
|
||||
|
||||
else if (wcscmp(L"-c", argv[i]) == 0 && wcslen(argv[i]) == 2)
|
||||
cmpFlag = true;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
BOOL CPePacket::IsExeFile()
|
||||
{
|
||||
#ifdef _WIN64
|
||||
int bit = 64;
|
||||
#else
|
||||
int bit = 32;
|
||||
#endif
|
||||
|
||||
|
||||
PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)data;
|
||||
|
||||
PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(data + pDos->e_lfanew);
|
||||
|
||||
if (pDos->e_magic != IMAGE_DOS_SIGNATURE)
|
||||
{
|
||||
printf("[!] The file is not PE file.\n");
|
||||
return 1;
|
||||
}
|
||||
if (pNt->Signature != IMAGE_NT_SIGNATURE)
|
||||
{
|
||||
printf("[!] The file is not PE file.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if ((pNt->FileHeader.Characteristics & IMAGE_FILE_DLL) == IMAGE_FILE_DLL)
|
||||
{
|
||||
printf("[!] DLL file is not supported.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
DWORD offsetDonet = pNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress;
|
||||
if (offsetDonet)
|
||||
{
|
||||
printf("[!] .NET applications are not supported.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (pNt->FileHeader.Machine == IMAGE_FILE_MACHINE_I386 && bit == 32)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
else if ((pNt->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 ||
|
||||
pNt->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) && bit == 64)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
printf("[!] Bits of PE file is not match.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
int CPePacket::ReadFileContent()
|
||||
{
|
||||
|
||||
char buffer[1024];
|
||||
DWORD filesize;
|
||||
DWORD dwReadBytes;
|
||||
int Result = 0;
|
||||
|
||||
|
||||
HANDLE hFile = INVALID_HANDLE_VALUE;
|
||||
do
|
||||
{
|
||||
hFile = CreateFileW(srcExePath, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
|
||||
if (hFile == INVALID_HANDLE_VALUE)
|
||||
{
|
||||
Result = GetLastError();
|
||||
printf("[-] Open src file failed.ErrorCode:%d\n", Result);
|
||||
break;
|
||||
}
|
||||
filesize = GetFileSize(hFile, NULL);
|
||||
data = new char[filesize];
|
||||
char *p = data;
|
||||
while (1)
|
||||
{
|
||||
if (!ReadFile(hFile, buffer, 1024, &dwReadBytes, NULL))
|
||||
{
|
||||
Result = GetLastError();
|
||||
printf("[-] ReadFile failed.ErrorCode:%d\n", Result);
|
||||
break;
|
||||
}
|
||||
if (dwReadBytes == 0)
|
||||
break;
|
||||
memcpy(p, buffer, dwReadBytes);
|
||||
p += dwReadBytes;
|
||||
dataSize += dwReadBytes;
|
||||
}
|
||||
} while (FALSE);
|
||||
if (hFile != INVALID_HANDLE_VALUE)
|
||||
CloseHandle(hFile);
|
||||
|
||||
return Result;
|
||||
}
|
||||
|
||||
int CPePacket::CreateBinFile()
|
||||
{
|
||||
|
||||
HANDLE hFile = INVALID_HANDLE_VALUE;
|
||||
DWORD dwWriteBytes;
|
||||
int Result = 0;
|
||||
do
|
||||
{
|
||||
hFile = CreateFileW(targetBinPath, GENERIC_READ | GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
|
||||
if (hFile == INVALID_HANDLE_VALUE)
|
||||
{
|
||||
Result = GetLastError();
|
||||
printf("[-] Create bin file failed. ErrorCode:%d\n", Result);
|
||||
break;
|
||||
}
|
||||
if (!WriteFile(hFile, shellcode, shellSize, &dwWriteBytes, NULL) ||
|
||||
!WriteFile(hFile, head, headSize, &dwWriteBytes, NULL) ||
|
||||
!WriteFile(hFile, data, dataSize, &dwWriteBytes, NULL)
|
||||
)
|
||||
{
|
||||
Result = GetLastError();
|
||||
printf("[-] Write bin file failed. ErrorCode:%d\n", Result);
|
||||
break;
|
||||
}
|
||||
|
||||
} while (FALSE);
|
||||
|
||||
|
||||
if(hFile != INVALID_HANDLE_VALUE)
|
||||
CloseHandle(hFile);
|
||||
return Result;
|
||||
}
|
||||
|
||||
|
||||
int CPePacket::GetCustomHead()
|
||||
{
|
||||
PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)data;
|
||||
|
||||
PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(data + pDos->e_lfanew);
|
||||
|
||||
customHead.size = dataSize;
|
||||
customHead.numberOfSection = pNt->FileHeader.NumberOfSections;
|
||||
customHead.entryPoint = pNt->OptionalHeader.AddressOfEntryPoint;
|
||||
customHead.offsetImportTable = pNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
|
||||
customHead.offsetRelocation = pNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress;
|
||||
customHead.offsetSection = (DA)((char *)IMAGE_FIRST_SECTION(pNt) - (char *)data);
|
||||
customHead.imageAddr = pNt->OptionalHeader.ImageBase;
|
||||
|
||||
//clear DOS head and NT head
|
||||
memset(data, 0, customHead.offsetSection);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int CPePacket::GenerateShellCode()
|
||||
{
|
||||
if (
|
||||
ReadFileContent() ||
|
||||
IsExeFile() ||
|
||||
GetCustomHead() ||
|
||||
ProcessData() ||
|
||||
GetResourceFile() ||
|
||||
PacthCustomHead() ||
|
||||
CreateBinFile()
|
||||
)
|
||||
{
|
||||
printf("[-] Generate failed.\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("[+] Generate success.\n");
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int CPePacket::ProcessData()
|
||||
{
|
||||
if (cmpFlag)
|
||||
{
|
||||
if (CProcsData::CompressData(data, dataSize, data, dataSize))
|
||||
{
|
||||
printf("[-] Compress PE failed.\n");
|
||||
return 1;
|
||||
}
|
||||
else
|
||||
{
|
||||
customHead.flag1 = 1;
|
||||
customHead.compressSize = dataSize;
|
||||
}
|
||||
}
|
||||
|
||||
if (rc4Flag)
|
||||
{
|
||||
if (CProcsData::Rc4Encrypt(data, dataSize, rc4Key, RC4_KEY_SIZE))
|
||||
{
|
||||
printf("[-] Rc4 encrypt failed.\n");
|
||||
return 1;
|
||||
}
|
||||
else
|
||||
{
|
||||
customHead.flag2 = 1;
|
||||
customHead.rc4Size = dataSize;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int CPePacket::GetResourceFile()
|
||||
{
|
||||
HRSRC hRsrc = NULL;
|
||||
DWORD dwSize = 0;
|
||||
HGLOBAL hGlobal = NULL;
|
||||
LPVOID pBuffer = NULL;
|
||||
int Result = 0;
|
||||
do
|
||||
{
|
||||
#ifdef _WIN64
|
||||
hRsrc = FindResource(NULL, MAKEINTRESOURCE(IDR_BIN2), L"BIN");
|
||||
#else
|
||||
hRsrc = FindResource(NULL, MAKEINTRESOURCE(IDR_BIN1), L"BIN");
|
||||
#endif // _WIN64
|
||||
|
||||
if (hRsrc == NULL)
|
||||
{
|
||||
Result = GetLastError();
|
||||
printf("[-] Find resource failed. ErrCode:%d\n", Result);
|
||||
}
|
||||
|
||||
DWORD dwSize = SizeofResource(NULL, hRsrc);
|
||||
if (dwSize == 0)
|
||||
{
|
||||
Result = GetLastError();
|
||||
printf("[-] Get resource size failed. ErrCode:%d\n", Result);
|
||||
}
|
||||
|
||||
|
||||
hGlobal = LoadResource(NULL, hRsrc);
|
||||
if (hGlobal == NULL)
|
||||
{
|
||||
Result = GetLastError();
|
||||
printf("[-] Load resource failed. ErrCode:%d\n", Result);
|
||||
}
|
||||
|
||||
pBuffer = LockResource(hGlobal);
|
||||
|
||||
if (pBuffer == NULL)
|
||||
{
|
||||
Result = GetLastError();
|
||||
printf("[-] Lock resource failed. ErrCode:%d\n", Result);
|
||||
}
|
||||
|
||||
|
||||
shellcode = new char[dwSize];
|
||||
|
||||
memcpy(shellcode, pBuffer, dwSize);
|
||||
shellSize = dwSize;
|
||||
|
||||
} while (FALSE);
|
||||
|
||||
if(hGlobal != NULL)
|
||||
GlobalUnlock(hGlobal);
|
||||
|
||||
|
||||
return Result;
|
||||
}
|
||||
|
||||
|
||||
int CPePacket::PacthCustomHead()
|
||||
{
|
||||
//patch head
|
||||
head = new char[headSize];
|
||||
unsigned char sign[] = { '\xaa','\xbb', '\xcc', '\xdd', '\x01', '\x01', '\x01', '\x01'};
|
||||
memcpy(head, sign, 8);
|
||||
memcpy(head + 8, &customHead, sizeof(CustomHead));
|
||||
memcpy(head + 8 + sizeof(CustomHead), rc4Key, sizeof(rc4Key));
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,101 @@
|
||||
#pragma once
|
||||
|
||||
#include <Windows.h>
|
||||
#include <string>
|
||||
#include <iostream>
|
||||
#include <time.h>
|
||||
/*
|
||||
shellcode struct
|
||||
|
||||
+------------+
|
||||
| PE Load |
|
||||
+------------+
|
||||
| Head | <--- sign + struct CustomHead + rc4key
|
||||
+------------+
|
||||
| |
|
||||
| exe |
|
||||
| |
|
||||
+------------+
|
||||
|
||||
*/
|
||||
#pragma pack(push, 1)
|
||||
#ifdef _WIN64
|
||||
typedef ULONG64 QWORD;
|
||||
typedef QWORD DA;
|
||||
typedef struct CustomHead
|
||||
{
|
||||
QWORD size;//PE size
|
||||
QWORD offsetSection;
|
||||
QWORD numberOfSection;
|
||||
QWORD offsetRelocation;
|
||||
QWORD imageAddr;
|
||||
QWORD offsetImportTable;
|
||||
QWORD entryPoint;
|
||||
QWORD flag1;
|
||||
QWORD compressSize;
|
||||
QWORD flag2;
|
||||
QWORD rc4Size;
|
||||
}*pCustomHead;
|
||||
#else
|
||||
typedef DWORD DA;
|
||||
typedef struct CustomHead
|
||||
{
|
||||
DWORD size;//PE size
|
||||
DWORD offsetSection;
|
||||
DWORD numberOfSection;
|
||||
DWORD offsetRelocation;
|
||||
DWORD imageAddr;
|
||||
DWORD offsetImportTable;
|
||||
DWORD entryPoint;
|
||||
DWORD flag1;
|
||||
DWORD compressSize;
|
||||
DWORD flag2;
|
||||
DWORD rc4Size;
|
||||
}*pCustomHead;
|
||||
#endif // _WIN64
|
||||
#pragma pack(pop)
|
||||
|
||||
#define SIGN_SIZE 8
|
||||
#define RC4_KEY_SIZE 16
|
||||
|
||||
class CPePacket
|
||||
{
|
||||
public:
|
||||
CPePacket();
|
||||
~CPePacket();
|
||||
|
||||
|
||||
int ParsePara(int argc, wchar_t ** argv);
|
||||
|
||||
BOOL IsExeFile();
|
||||
|
||||
int ReadFileContent();
|
||||
|
||||
int CreateBinFile();
|
||||
|
||||
int PacthCustomHead();
|
||||
|
||||
int GetCustomHead();
|
||||
|
||||
int GenerateShellCode();
|
||||
|
||||
int ProcessData();
|
||||
|
||||
int GetResourceFile();
|
||||
|
||||
private:
|
||||
wchar_t *srcExePath;
|
||||
wchar_t *targetBinPath;
|
||||
|
||||
BOOL rc4Flag;
|
||||
BOOL cmpFlag;
|
||||
|
||||
char * head;
|
||||
int headSize = SIGN_SIZE + RC4_KEY_SIZE + sizeof(CustomHead);
|
||||
char * data;
|
||||
int dataSize;
|
||||
char * shellcode;
|
||||
int shellSize;
|
||||
unsigned char rc4Key[RC4_KEY_SIZE];
|
||||
CustomHead customHead;
|
||||
};
|
||||
@@ -0,0 +1,102 @@
|
||||
#include <time.h>
|
||||
#include <Windows.h>
|
||||
#include <iostream>
|
||||
#include "ProccessData.h"
|
||||
|
||||
int CProcsData::Rc4Encrypt(char * org, int size, unsigned char * rc4Key, int keySize)
|
||||
{
|
||||
//create key
|
||||
srand((int)time(0));
|
||||
int i = 0;
|
||||
while (1) {
|
||||
unsigned char r = rand() % 255;
|
||||
if (0x30 <= r && r <= 0x39 || 0x41 <= r && r <= 0x5a || 0x61 <= r && r <= 0x7a)
|
||||
{
|
||||
rc4Key[i++] = r;
|
||||
}
|
||||
if (i > keySize) break;
|
||||
}
|
||||
|
||||
|
||||
unsigned char box[256];
|
||||
unsigned int index_i = 0;
|
||||
unsigned int index_j = 0;
|
||||
|
||||
//init box
|
||||
for (int i = 0; i < 256; i++)
|
||||
{
|
||||
box[i] = i;
|
||||
}
|
||||
|
||||
int j = 0;
|
||||
unsigned char tmp;
|
||||
for (int i = 0; i < 256; i++)
|
||||
{
|
||||
j = (j + box[i] + rc4Key[i % 16]) % 256;
|
||||
tmp = box[i];
|
||||
box[i] = box[j];
|
||||
box[j] = tmp;
|
||||
}
|
||||
|
||||
for (unsigned long k = 0; k < size; k++)
|
||||
{
|
||||
index_i = (index_i + 1) % 256;
|
||||
index_j = (index_j + box[index_i]) % 256;
|
||||
|
||||
tmp = box[index_i];
|
||||
box[index_i] = box[index_j];
|
||||
box[index_j] = tmp;
|
||||
|
||||
DWORD r = (box[index_i] + box[index_j]) % 256;
|
||||
org[k] ^= box[r];
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int CProcsData::CompressData(char * src, int size, char * retData, int & retSize)
|
||||
{
|
||||
|
||||
DWORD dwCompressionFormat = COMPRESSION_FORMAT_LZNT1 | COMPRESSION_ENGINE_MAXIMUM;
|
||||
DWORD dwCompress;
|
||||
DWORD unKnow;
|
||||
|
||||
pRtlCompressBuffer f_RtlCompressBuffer = (pRtlCompressBuffer)GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlCompressBuffer");
|
||||
pRtlGetCompressionWorkSpaceSize f_RelGetCompressionWorkApacesize = (pRtlGetCompressionWorkSpaceSize)GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlGetCompressionWorkSpaceSize");
|
||||
if (f_RtlCompressBuffer == NULL || f_RelGetCompressionWorkApacesize == NULL)
|
||||
{
|
||||
printf("[-] Get Function failed.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
f_RelGetCompressionWorkApacesize(dwCompressionFormat, &dwCompress, &unKnow);
|
||||
|
||||
char *tempMem = new char[dwCompress];
|
||||
char *tempData = new char[size];
|
||||
|
||||
DWORD ret = f_RtlCompressBuffer(
|
||||
dwCompressionFormat,
|
||||
src,
|
||||
size,
|
||||
tempData,
|
||||
size,
|
||||
unKnow,
|
||||
&dwCompress,
|
||||
tempMem
|
||||
);
|
||||
|
||||
if (ret == 0)
|
||||
{
|
||||
retSize = dwCompress;
|
||||
memcpy(retData, tempData, retSize);
|
||||
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("[-] Compress PE failed.\n");
|
||||
}
|
||||
|
||||
delete tempMem;
|
||||
delete tempData;
|
||||
return ret;
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
#pragma once
|
||||
typedef DWORD(__stdcall *pRtlCompressBuffer)(
|
||||
IN ULONG CompressionFormat,
|
||||
IN PVOID SourceBuffer,
|
||||
IN ULONG SourceBufferLength,
|
||||
OUT PVOID DestinationBuffer,
|
||||
IN ULONG DestinationBufferLength,
|
||||
IN ULONG Unknown,
|
||||
OUT PULONG pDestinationSize,
|
||||
IN PVOID WorkspaceBuffer);
|
||||
|
||||
|
||||
typedef DWORD(__stdcall *pRtlGetCompressionWorkSpaceSize)(
|
||||
IN ULONG CompressionFormat,
|
||||
OUT PULONG pNeededBufferSize,
|
||||
OUT PULONG pUnknown);
|
||||
|
||||
namespace CProcsData
|
||||
{
|
||||
|
||||
int Rc4Encrypt(char * org, int size, unsigned char * rc4Key, int keySize);
|
||||
|
||||
int CompressData(char *org, int size, char * retData ,int & retSize);
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
#include <Windows.h>
|
||||
#include <iostream>
|
||||
|
||||
#include "PePacket.h"
|
||||
|
||||
int wmain(int argc, wchar_t * argv[])
|
||||
{
|
||||
|
||||
CPePacket pePacket;
|
||||
|
||||
if (pePacket.ParsePara(argc, argv))
|
||||
{
|
||||
printf("Invaild para\n");
|
||||
exit(0);
|
||||
}
|
||||
|
||||
pePacket.GenerateShellCode();
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
//{{NO_DEPENDENCIES}}
|
||||
// Microsoft Visual C++ 生成的包含文件。
|
||||
// 供 PE2Shellcode.rc 使用
|
||||
//
|
||||
#define IDR_BIN1 101
|
||||
#define IDR_BIN2 102
|
||||
|
||||
// Next default values for new objects
|
||||
//
|
||||
#ifdef APSTUDIO_INVOKED
|
||||
#ifndef APSTUDIO_READONLY_SYMBOLS
|
||||
#define _APS_NEXT_RESOURCE_VALUE 103
|
||||
#define _APS_NEXT_COMMAND_VALUE 40001
|
||||
#define _APS_NEXT_CONTROL_VALUE 1001
|
||||
#define _APS_NEXT_SYMED_VALUE 101
|
||||
#endif
|
||||
#endif
|
||||
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user