DLL now has persistance, Loader deletes itself after extracting dll and creating persistance

This commit is contained in:
hellisabove
2023-07-03 20:15:14 +03:00
parent 9f4a57720b
commit e99cfca22a
22 changed files with 64 additions and 7 deletions
+1
View File
@@ -1,5 +1,6 @@
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Microsoft\VC\v150\Platforms\Win32\PlatformToolsets\v141_xp\Toolset.targets(39,5): warning MSB8051: Support for targeting Windows XP is deprecated and will not be present in future releases of Visual Studio. Please see https://go.microsoft.com/fwlink/?linkid=2023588 for more information.
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Microsoft\VC\v150\Microsoft.CppBuild.targets(391,5): warning MSB8028: The intermediate directory (Debug\) contains files shared from another project (Dll.vcxproj). This can lead to incorrect clean and rebuild behavior.
fundll.cpp
Creating library C:\Users\hellisabove\source\repos\RAT\Debug\FunDLL.lib and object C:\Users\hellisabove\source\repos\RAT\Debug\FunDLL.exp
Generating code
All 3 functions were compiled because no usable IPDB/IOBJ from previous compilation was found.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+1 -1
View File
@@ -31,7 +31,7 @@
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v141_xp</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<CharacterSet>MultiByte</CharacterSet>
<WholeProgramOptimization>true</WholeProgramOptimization>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+7 -3
View File
@@ -6,14 +6,18 @@ BOOL APIENTRY DllMain(HMODULE Base, DWORD Callback, LPVOID Param) {
break;
case DLL_PROCESS_DETACH:
break;
default:
break;
}
return 1;
}
extern "C" __declspec(dllexport) int FunEntry() {
return MessageBoxA(0, "Hello from C2", 0, 0);
char exe[MAX_PATH + 1];
GetModuleFileNameA(0, exe, sizeof(exe));
MessageBoxA(0, exe, "I am inside: ", 0);
return 0;
}