.NET Builder /Stub - Fully Cryptable | NO EOF

[.NET] Builder /Stub - Fully Cryptable | NO EOF - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Builder /Stub - Fully Cryptable | NO EOF (/showthread.php?tid=4546155)

Builder /Stub - Fully Cryptable | NO EOF - Proton! - Nov 20, 2014

Hey ya'll, I remember back before I was in the struggle to find out the best way to make a builder for my RAT; How would I go on about writing settings to the stub.

Well, today I'll be showing you how to do this, and it's actually rather simple :)
The best though; It does not involve EOF, so It's pretty much fully cryptable!

First let me explain you what we are going to be using to write to the stub;
The UpdateResource API in the kernel32.dll

First download this class. (This is the class containing the functions to read/write resources.

So to explain the functions:

The function 'WriteResource' is a function that I made that you can simply call to write resources to the specified file with the specified resourcename. The resource written has to be byte array; whether that is a string encoded as byte array or some serialized data, thaty

It does the following: Retrieves a handle for updating resources by calling the native function "BeginUpdateResource"

Gets a pointer for the resource value that is going to be written to the resource.
Calls the UpdateResource function to write the new resource to the file.

The function 'ReadResource' is a function that I made that you can simply call to read the resources from the specified file using the specified resourcename. The filename can be specified as Nothing, that will make it read the resources from itself (what the stub does).

It does the following:
Retrieves a handle for the found resource. Retrieves a handle for the resource when it's loaded.
Gets the size of the resource so it can allocate the proper sized byte array for the data.
* Copies the data from the resource into the byte array and retrieves it.

Here is a simple builder:
In my builder I have two textboxes
The settings I use for demonstration is called 'Host' and 'Port'.
Some typical scenario for this would be in a RAT stub or something along those lines.
This is the code for the Button called "Build":

Code 
Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click

      Using SFD As New SaveFileDialog()

      SFD.Title = "Save the stub..."

      SFD.Filter = "Executable (*.exe) |*.exe"

      If Not SFD.ShowDialog() = Windows.Forms.DialogResult.OK Then Return

      File.WriteAllBytes(SFD.FileName, My.Resources.Stub)

      If ResourceManager.WriteResource(SFD.FileName, "Host", Encoding.UTF8.GetBytes(TextBox1.Text)) AndAlso _

      ResourceManager.WriteResource(SFD.FileName, "Port", Encoding.UTF8.GetBytes(TextBox2.Text)) Then

      MessageBox.Show("The stub was successfully built!", "Success!", MessageBoxButtons.OK, MessageBoxIcon.Information)

      Process.Start("explorer.exe", "/select, " & SFD.FileName)

      End If

      End Using

    End Sub

Pretty clean..

Now the stub code:

Code 
Module Main

    Sub Main()

      RetrieveTheSettings()

    End Sub

    Sub RetrieveTheSettings()

      Dim Host As String = Encoding.UTF8.GetString(ResourceManager.ReadResource(Nothing, "Host"))

      Dim Port As String = Encoding.UTF8.GetString(ResourceManager.ReadResource(Nothing, "Port"))

      MessageBox.Show(String.Format("Settings Read:{0}Host:{1}{2}Port:{3}", vbCrLf, Host, vbCrLf, Port), "Success!", MessageBoxButtons.OK, MessageBoxIcon.Information)

    End Sub

End Module

If you want to download my solution, you may do so here.

I hope you guys enjoyed this tutorial, and hopefully I explained it decently enough :)

And if you have any feedback, please leave; criticism or positive :)

~ Regards Proton!

* - nathan72389 - Nov 20, 2014

after EOF this is the next insecure way of storing stuff.
it actually makes it easier for me to remove any info that your storing.
think reshacker...
you dont need a whole class for what 3,4 api calls.
this is old school also. vb6(and lower) had been using this for a loooooong time.
most other builder/stub applications regardless of the language still use this method.
heck, i still use it in delphi.
its nice to see something posted over again with 1/2 an explanation.