Skip to content

Commit df37b63

Browse files
xHector1337xHector1337
committed
Add extension encryption manager
1 parent d50dfe0 commit df37b63

4 files changed

Lines changed: 171 additions & 0 deletions

File tree

‎c/meterpreter/source/metsrv/extension_encryption.c‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
#include "extension_encryption.h"
2+
3+
extension_encryption_ctx* extension_statuses[MAX_EXTENSIONS] = { 0 };
4+
5+
BOOL extension_encryption_add(extension_encryption_ctx* ExtensionCtx) {
6+
BOOL ret = FALSE;
7+
8+
if (ExtensionCtx == NULL || !ExtensionCtx->encryptable) {
9+
dprintf("[extension_encryption][extension_encryption_add] Either ExtensionCtx is NULL or Extension is not encryptable.");
10+
return ret;
11+
}
12+
13+
for (int i = 0; i < MAX_EXTENSIONS; i++) {
14+
if (extension_statuses[i] == NULL) {
15+
extension_statuses[i] = ExtensionCtx;
16+
ret = TRUE;
17+
break;
18+
}
19+
}
20+
if (!ret) {
21+
dprintf("[extension_encryption][extension_encryption_add] Couldn't locate an empty member in extension_statuses array.");
22+
}
23+
return ret;
24+
}
25+
26+
BOOL extension_encryption_remove(extension_encryption_ctx* ExtensionCtx) {
27+
BOOL ret = FALSE;
28+
29+
if (ExtensionCtx == NULL) {
30+
dprintf("[extension_encryption][extension_encryption_remove] ExtensionCtx is NULL.");
31+
return ret;
32+
}
33+
34+
for (int i = 0; i < MAX_EXTENSIONS; i++) {
35+
if (extension_statuses[i] == ExtensionCtx) {
36+
extension_statuses[i] = NULL;
37+
ret = TRUE;
38+
break;
39+
}
40+
}
41+
if (!ret) {
42+
dprintf("[extension_encryption][extension_encryption_remove] Couldn't locate ExtensionCtx in extension_statuses array.");
43+
}
44+
return ret;
45+
}
46+
47+
BOOL extension_encryption_encrypt(extension_encryption_ctx* ExtensionCtx) {
48+
RC4_CTX RC4 = { 0 };
49+
size_t KeyLength = 0;
50+
BOOL ret = FALSE;
51+
unsigned char buff[4096] = { 0 };
52+
DWORD diff = 4096;
53+
size_t ByteCounter = 0;
54+
55+
if (ExtensionCtx == NULL || !ExtensionCtx->encryptable || ExtensionCtx->encrypted || !ExtensionCtx->size || ExtensionCtx->key == NULL || ExtensionCtx->loc == NULL) {
56+
dprintf("[extension_encryption][extension_encryption_encrypt] Invalid ExtensionCtx.");
57+
return ret;
58+
}
59+
60+
KeyLength = strlen(ExtensionCtx->key);
61+
62+
if (!KeyLength || !InitRc4(&RC4, ExtensionCtx->key, KeyLength)) {
63+
dprintf("[extension_encryption][extension_encryption_encrypt] Either KeyLength is 0 or InitRc4 failed.");
64+
return ret;
65+
}
66+
67+
for (DWORD i = 0; i != ExtensionCtx->size; i += diff) {
68+
if ((ExtensionCtx->size - i) < 4096) {
69+
diff = ExtensionCtx->size - i;
70+
}
71+
ret = ReadProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionCtx->loc + i, buff, diff, &ByteCounter);
72+
if (!ret || ByteCounter != diff) {
73+
dprintf("[extension_encryption][extension_encryption_encrypt] ReadProcessMemory failed with error 0x%x", GetLasatError());
74+
break;
75+
}
76+
if (!RC4Cipher(&RC4, buff, diff)) {
77+
dprintf("[extension_encryption][extension_encryption_encrypt] RC4Cipher failed.");
78+
ret = FALSE;
79+
break;
80+
}
81+
ret = WriteProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionCtx->loc, buff, diff, &ByteCounter);
82+
if (!ret || ByteCounter != diff) {
83+
dprintf("[extension_encryption][extension_encryption_encrypt] WriteProcessMemory failed with error 0x%x", GetLastError());
84+
break;
85+
}
86+
}
87+
if (ret) {
88+
ExtensionCtx->encrypted = !ExtensionCtx->encrypted;
89+
}
90+
return ret;
91+
}
92+
93+
BOOL extension_encryption_decrypt(extension_encryption_ctx* ExtensionCtx) {
94+
RC4_CTX RC4 = { 0 };
95+
size_t KeyLength = 0;
96+
BOOL ret = FALSE;
97+
unsigned char buff[4096] = { 0 };
98+
DWORD diff = 4096;
99+
size_t ByteCounter = 0;
100+
101+
if (ExtensionCtx == NULL || !ExtensionCtx->encryptable || !ExtensionCtx->encrypted || !ExtensionCtx->size || ExtensionCtx->key == NULL || ExtensionCtx->loc == NULL) {
102+
dprintf("[extension_encryption][extension_encryption_decrypt] Invalid ExtensionCtx.");
103+
return ret;
104+
}
105+
106+
KeyLength = strlen(ExtensionCtx->key);
107+
108+
if (!KeyLength || !InitRc4(&RC4, ExtensionCtx->key, KeyLength)) {
109+
dprintf("[extension_encryption][extension_encryption_decrypt] Either KeyLength is 0 or InitRc4 failed.");
110+
return ret;
111+
}
112+
113+
for (DWORD i = 0; i != ExtensionCtx->size; i += diff) {
114+
if ((ExtensionCtx->size - i) < 4096) {
115+
diff = ExtensionCtx->size - i;
116+
}
117+
ret = ReadProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionCtx->loc + i, buff, diff, &ByteCounter);
118+
if (!ret || ByteCounter != diff) {
119+
dprintf("[extension_encryption][extension_encryption_decrypt] ReadProcessMemory failed with error 0x%x", GetLasatError());
120+
break;
121+
}
122+
if (!RC4Cipher(&RC4, buff, diff)) {
123+
dprintf("[extension_encryption][extension_encryption_decrypt] RC4Cipher failed.");
124+
ret = FALSE;
125+
break;
126+
}
127+
ret = WriteProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionCtx->loc, buff, diff, &ByteCounter);
128+
if (!ret || ByteCounter != diff) {
129+
dprintf("[extension_encryption][extension_encryption_decrypt] WriteProcessMemory failed with error 0x%x", GetLastError());
130+
break;
131+
}
132+
}
133+
if (ret) {
134+
ExtensionCtx->encrypted = !ExtensionCtx->encrypted;
135+
}
136+
return ret;
137+
}
138+
139+
void extension_encryption_encrypt_unused() {
140+
for (int i = 0; i < MAX_EXTENSIONS; i++) {
141+
if (extension_statuses[i] == NULL || !extension_statuses[i]->encryptable || extension_statuses[i]->encrypted || (GetTickCount() - extension_statuses[i]->LastUsedTime) < 600000) {
142+
continue;
143+
}
144+
if (!extension_encryption_encrypt(extension_statuses[i])) {
145+
dprintf("[extension_encryption][extension_encryption_encrypt_unused] extension_statuses[%d] couldn't be encrypted.", i);
146+
}
147+
}
148+
}

‎c/meterpreter/source/metsrv/extension_encryption.h‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#include "rc4.h"
2+
#include "common.h"
3+
4+
#define MAX_EXTENSIONS 32 // ??
5+
6+
typedef struct {
7+
BOOL encryptable;
8+
BOOL encrypted;
9+
LPCSTR key;
10+
LPVOID loc;
11+
DWORD size;
12+
DWORD LastUsedTime;
13+
} extension_encryption_ctx;
14+
15+
BOOL extension_encryption_add(extension_encryption_ctx* ExtensionCtx);
16+
BOOL extension_encryption_remove(extension_encryption_ctx* ExtensionCtx);
17+
BOOL extension_encryption_encrypt(extension_encryption_ctx* ExtensionCtx);
18+
BOOL extension_encryption_decrypt(extension_encryption_ctx* ExtensionCtx);
19+
void extension_encryption_encrypt_unused();

‎c/meterpreter/workspace/metsrv/metsrv.vcxproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -571,6 +571,7 @@ copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\"</Command>
571571
<ClInclude Include="..\..\source\metsrv\pool_party_ext.h" />
572572
<ClInclude Include="..\..\source\metsrv\winapi.h" />
573573
<ClInclude Include="..\..\source\metsrv\rc4.h" />
574+
<ClInclude Include="..\..\source\metsrv\extension_encryption.h" />
574575
</ItemGroup>
575576
<ItemGroup>
576577
<ClCompile Include="..\..\source\metsrv\base.c" />
@@ -603,6 +604,7 @@ copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\"</Command>
603604
<ClCompile Include="..\..\source\metsrv\pool_party.c" />
604605
<ClCompile Include="..\..\source\metsrv\winapi.c" />
605606
<ClCompile Include="..\..\source\metsrv\rc4.c" />
607+
<ClInclude Include="..\..\source\metsrv\extension_encryption.c" />
606608
</ItemGroup>
607609
<ItemGroup>
608610
<MASM Include="..\..\source\ReflectiveDLLInjection\dll\src\GateTrampoline32.asm">

‎c/meterpreter/workspace/metsrv/metsrv.vcxproj.filters‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
<ClInclude Include="..\..\source\metsrv\pool_party_ext.h" />
3030
<ClInclude Include="..\..\source\metsrv\winapi.h" />
3131
<ClInclude Include="..\..\source\metsrv\rc4.h" />
32+
<ClInclude Include="..\..\source\metsrv\extension_encryption.h" />
3233
</ItemGroup>
3334
<ItemGroup>
3435
<ClCompile Include="..\..\source\metsrv\pivot_tree.c" />
@@ -61,6 +62,7 @@
6162
<ClCompile Include="..\..\source\metsrv\pool_party.c" />
6263
<ClCompile Include="..\..\source\metsrv\winapi.c" />
6364
<ClCompile Include="..\..\source\metsrv\rc4.c" />
65+
<ClInclude Include="..\..\source\metsrv\extension_encryption.c" />
6466
</ItemGroup>
6567
<ItemGroup>
6668
<MASM Include="..\..\source\ReflectiveDLLInjection\dll\src\GateTrampoline64.asm" />

0 commit comments

Comments
 (0)