smukx-Rust-for-Malware-Development/NtSockets

NTSockets - Improved Verstion of HTTP File Downloader using NtCreateFile and NtDeviceIoControlFile

Overview

NTSockets is a proof-of-concept (PoC) that demonstrates downloading a file via HTTP using low-level Windows NT system calls, specifically NtCreateFile and NtDeviceIoControlFile, to interact with the Auxiliary Function Driver (AFD) for socket operations. This Rust implementation is based on the original C PoC by x86matthew which bypasses the Winsock library to create TCP sockets and perform network communication. The tool also includes a basic DNS client to resolve hostnames, avoiding reliance on Winsock's gethostbyname.

This Rust version enhances the original PoC with improved error handling, support for UDP-based DNS queries, and a more robust implementation tailored for low-level Windows malware research.

Functionality

• HTTP File Download: Downloads files from HTTP servers (port 80) using TCP sockets created via the AFD driver. The program sends a simple HTTP/1.0 GET request and handles responses with or without a Content-Length header.
• DNS Resolution: Resolves hostnames to IPv4 addresses using a custom UDP-based DNS client, querying a hard-coded DNS server (8.8.8.8).
• Low-Level Networking: Uses NtCreateFile to create TCP/UDP sockets and NtDeviceIoControlFile for socket operations (bind, connect, send, receive), bypassing Winsock for stealth.
• File Output: Saves the downloaded file to a specified local path.

New Features in Rust Version

Compared to x86matthew’s original C PoC, this Rust implementation introduces several improvements:

• UDP DNS Support: Replaces the original TCP-based DNS client with a UDP-based implementation, aligning with standard DNS practices and improving query efficiency.
• Timeout Configuration: Adds configurable timeouts for receive operations (e.g., 5 seconds for DNS, 1 second for HTTP), preventing hangs on unresponsive servers.
• Streamlined Code Structure: Organizes socket operations into modular functions (nt_sockets_connect, nt_sockets_send, nt_sockets_recv) with clear error propagation.
• Enhanced DNS Parsing: Improves DNS response parsing with explicit big-endian byte handling and validation, ensuring reliable hostname resolution.
• Rust Safety: Leverages Rust’s type system and memory safety features to reduce risks of buffer overflows and pointer errors present in the C version.
• Robust Error Handling: Implements a custom NTError enum to capture and display detailed errors (NTSTATUS codes, Win32 errors, network issues) with context, improving debugging over the original’s generic error codes.

Usage

Prerequisites

• Rust (stable, latest recommended).
• Windows operating system (tested on Windows 10/11).

Build

cargo build --release

Run

Run the program as Administrator to avoid permission issues with the AFD driver:

target\release\NtSockets.exe <http_url> <output_file_path>

Example:

target\release\NtSockets.exe http://www.example.com/index.html output.txt

Limitations

• HTTP Only: Supports HTTP (port 80) but not HTTPS, as TLS is not implemented (consistent with the original PoC).
• No Redirects: Does not handle HTTP 301/302 redirects.
• Hard-Coded DNS Server: Uses Google’s DNS (8.8.8.8) without fallback or registry-based DNS server lookup.
• Basic HTTP Client: Lacks support for chunked encoding or advanced HTTP features.
• Windows Only: Relies on Windows-specific NT system calls and the AFD driver.

Credits/References

This Rust implementation is based on the NTSockets PoC by x86matthew (Twitter: @x86matthew). Credit goes to x86matthew for the original concept and reverse-engineering of AFD structures.

• https://www.x86matthew.com/view_post?id=ntsockets

Researched and Written in Rust by @5mukx