From eb4057570beddfac69acda641fa6a6d97655680a Mon Sep 17 00:00:00 2001
From: Christopher Paschen <christopher.paschen@trustedsec.com>
Date: Fri, 20 May 2022 10:31:07 -0500
Subject: [PATCH] Add in 4 internal functions for CobaltStrike compatibility

Fix to for BeaconPrintf so it doesn't overwrite last char
---
 COFFLoader.c           |  7 +++++--
 beacon_compatibility.c | 10 +++++++---
 beacon_compatibility.h |  2 +-
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/COFFLoader.c b/COFFLoader.c
index d3ae91d..0070df9 100644
--- a/COFFLoader.c
+++ b/COFFLoader.c
@@ -118,13 +118,15 @@ void* process_symbol(char* symbolstring) {
 #endif
 
     memcpy(localcopy, symbolstring, strlen(symbolstring));
-    if (strncmp(symbolstring, PREPENDSYMBOLVALUE"Beacon", strlen(PREPENDSYMBOLVALUE"Beacon")) == 0 || strncmp(symbolstring, PREPENDSYMBOLVALUE"toWideChar", strlen(PREPENDSYMBOLVALUE"toWideChar")) == 0) {
+    if (strncmp(symbolstring, PREPENDSYMBOLVALUE"Beacon", strlen(PREPENDSYMBOLVALUE"Beacon")) == 0 || strncmp(symbolstring, PREPENDSYMBOLVALUE"toWideChar", strlen(PREPENDSYMBOLVALUE"toWideChar")) == 0 ||
+    strncmp(symbolstring, PREPENDSYMBOLVALUE"GetProcAddress", strlen(PREPENDSYMBOLVALUE"GetProcAddress")) == 0 || strncmp(symbolstring, PREPENDSYMBOLVALUE"LoadLibraryA", strlen(PREPENDSYMBOLVALUE"LoadLibraryA")) == 0 ||
+    strncmp(symbolstring, PREPENDSYMBOLVALUE"GetModuleHandle", strlen(PREPENDSYMBOLVALUE"GetModuleHandle")) == 0 || strncmp(symbolstring, PREPENDSYMBOLVALUE"FreeLibrary", strlen(PREPENDSYMBOLVALUE"FreeLibrary")) == 0) {
         localfunc = symbolstring + strlen(PREPENDSYMBOLVALUE);
         DEBUG_PRINT("\t\tInternalFunction: %s\n", localfunc);
         /* TODO: Get internal symbol here and set to functionaddress, then
          * return the pointer to the internal function*/
 #if defined(_WIN32)
-        for (tempcounter = 0; tempcounter < 25; tempcounter++) {
+        for (tempcounter = 0; tempcounter < 29; tempcounter++) {
             if (InternalFunctions[tempcounter][0] != NULL) {
                 if (strcmp(localfunc, (char*)(InternalFunctions[tempcounter][0])) == 0) {
                     functionaddress = (void*)InternalFunctions[tempcounter][1];
@@ -464,6 +466,7 @@ int main(int argc, char* argv[]) {
         printf("Ran/parsed the coff\n");
         outdata = BeaconGetOutputData(&outdataSize);
         if (outdata != NULL) {
+
             printf("Outdata Below:\n\n%s\n", outdata);
         }
 #endif
diff --git a/beacon_compatibility.c b/beacon_compatibility.c
index 8bbc000..ef7917c 100644
--- a/beacon_compatibility.c
+++ b/beacon_compatibility.c
@@ -26,7 +26,7 @@
 
 
  /* Data Parsing */
-unsigned char* InternalFunctions[25][2] = {
+unsigned char* InternalFunctions[29][2] = {
     {(unsigned char*)"BeaconDataParse", (unsigned char*)BeaconDataParse},
     {(unsigned char*)"BeaconDataInt", (unsigned char*)BeaconDataInt},
     {(unsigned char*)"BeaconDataShort", (unsigned char*)BeaconDataShort},
@@ -49,7 +49,11 @@ unsigned char* InternalFunctions[25][2] = {
     {(unsigned char*)"BeaconInjectProcess", (unsigned char*)BeaconInjectProcess},
     {(unsigned char*)"BeaconInjectTemporaryProcess", (unsigned char*)BeaconInjectTemporaryProcess},
     {(unsigned char*)"BeaconCleanupProcess", (unsigned char*)BeaconCleanupProcess},
-    {(unsigned char*)"toWideChar", (unsigned char*)toWideChar}
+    {(unsigned char*)"toWideChar", (unsigned char*)toWideChar},
+    {(unsigned char*)"LoadLibraryA", (unsigned char*)LoadLibraryA},
+    {(unsigned char*)"GetProcAddress", (unsigned char*)GetProcAddress},
+    {(unsigned char*)"GetModuleHandle", (unsigned char*)GetModuleHandleA},
+    {(unsigned char*)"FreeLibrary", (unsigned char*)FreeLibrary}
 };
 
 uint32_t swap_endianess(uint32_t indata) {
@@ -230,7 +234,7 @@ void BeaconPrintf(int type, char* fmt, ...) {
     beacon_compatibility_output = tempptr;
     memset(beacon_compatibility_output + beacon_compatibility_offset, 0, length + 1);
     va_start(args, fmt);
-    length = vsnprintf(beacon_compatibility_output + beacon_compatibility_offset, length, fmt, args);
+    length = vsnprintf(beacon_compatibility_output + beacon_compatibility_offset, length +1, fmt, args);
     beacon_compatibility_size += length;
     beacon_compatibility_offset += length;
     va_end(args);
diff --git a/beacon_compatibility.h b/beacon_compatibility.h
index 4e53b62..e168127 100644
--- a/beacon_compatibility.h
+++ b/beacon_compatibility.h
@@ -8,7 +8,7 @@
  */
 #ifndef BEACON_COMPATIBILITY_H_
  /* Structures as is in beacon.h */
-extern unsigned char* InternalFunctions[25][2];
+extern unsigned char* InternalFunctions[29][2];
 typedef struct {
     char * original; /* the original buffer [so we can free it] */
     char * buffer;   /* current pointer into our buffer */