I come back in this lesson, I'm going to explain to you the project itself, the source code, so there'll
be two main buttons.
The first button will be the year early cell and the second button will be the dial injector trojan.
So the jail cell will be converted into a form it hex, format it and put it inside the jails, Virginia,
So.
So, Gwen, download this project called 16 Project Password, Sniffer and Zip It and put it in Maldive
two folder.
Inside it, you find two folders and one EPA monitor capture, which will not be here.
But this one was from the previous lesson where we use API monitor to hunt the API function that saves
the password.
So the two for this year, one is in Delta region, Drugeon, the director general, Jack.
This refers to this.
Project and the other one is a pacifist for Yale, which is first to this one here.
So let's take a look at each one then.
So first we look at the idea injected religion.
They are too far.
You have your computer screen visual, compile this into a new form.
That's open this and see what's inside.
Now, this deal injector is a classic injection.
And we have here the shark, the shark for the past 24.
These puzzles differ.
He's referring to this, but here.
Despite our comes from here and this, the file is.
This one, this project.
This will be compiled into a deal.
And then converted into this text format.
And putting say to you.
So that's how we can get your gear inside the gear injector Trojan.
So it is a kind of chocolate.
It is quite big because it is a complete executable file and deal financially.
So let's go down to the end of this and take a look at do you mean?
So when this program runs you.
Go to Maine here.
Eventually, you need to convert this into a win win in order to heighten the console terminal, but
for testing and developmental stages.
We always want to make it easy, so we just put me here.
So that you can bring up, he can bring to the console, they can develop.
So right now, you can see here, when this thing runs, it will.
Keep on looping, you keep on looking.
While the IDs zero zero is to the ID, referring to the terror group, the target, so this video here
is referring to the video for their group.
So when it truly starts, it is looking for that group.
So you here you are searching for a very good social process and process to inject the process of changing
his name here.
In this string very accurately.
So if he doesn't find it, you keep on looking and you stick for one thousand milliseconds between each
loop.
Which is one second.
So once we are crew has loaded, the idea will be none zero.
So he would then proceed to the next step and the next step by several activists in memory.
We continue.
The first thing we do is get it back to the dealer.
So this part of the town is actually define the clap here.
Get back to the.
Over here, we want to get the temporary off and then the funding to a temporary park now in windows.
The temporary part can be accessed.
By using this special constant environment, constant percentage, 10 percentage.
And then he will find here.
So the idea is to use this path to to expand and bring out the Alpha.
So remember in our design of the system, once did you injected Trojan has found it very crude has loaded
into memory it is supposed to unpack.
Yeah.
So what we're doing is you're picking this gel into the temporary folder, which is here.
So that is the reason why we are doing this.
Get back to jail because you want to get temporary part and then a pen this string to it so that you
will get the complete payoff.
Then you print this for debugging purposes so that we can be sure that we get the correct part.
So the string carries just to append the this name to the end of this temporary path.
If you get from this API, so get tempah, you can read up by referring to my notes, which I already
provide for you.
Here he can read all about it here.
So this is a reference for Get Temporary Pop.
So the he has got two parameters the string.
They are going to stall the result here and the.
So you must make sure that you provide the first parameter, the length of the string to it is big enough
to stall the path.
So it's going to be a long bar.
So I put five and two should be sufficient for getting through to the full path to the this year.
5+2 Bath is more than enough to get this far.
This story is the second one would be the string itself.
So this file into the mismatch this.
So at the end of this function, call this string we start if we're path to a temporary folder and this
path is used later on in, say, the function, then we call the unpacking function here.
So the next step is you call you and pick your function and the function who then create the folder
will then create a file using this path.
This you got from here, from the previous call.
So you create this file containing the jail cell and then over here you will check whether you successfully
creating the handle.
And what if you have successfully created a handle?
There's no area and then you write the file.
So here is where you write the price.
So it's only for DLP, which is this all existing here?
All this thing here is called.
It sniffer DLP.
So you're going to dump all of this into a file.
Using erectile function.
This one right fire function.
So far, function, you can refer to the MSDN.
Over here, it accepts all these parameters.
The handle of the file is the first parameter.
So just hang up the file, you got it from here when you create a file and here's where you use it.
And then here, the second parameter is your string in this case is your hex string.
The shellcode itself, the be executable, which you are going to dumb into this location, into this
file.
And then the science used to say the function to calculate the size.
So the tip parameters are size and number four is number based return, which is not so important in
the last one, is also not important.
So after you've written this, you all your persistence for a deal will be inside your temporary for
the.
Then you close the handle.
So at this point in time, you have all your gear and bank and then you bring a message to inform the
user.
This is for debugging purposes, and then here is where you get the library function from to.
So this dynamic loading the trying to obfuscate the function, so that's why we're doing dynamic loading.
So we get a process of the library because this is a drill.
So you know, if a deal you won the call the library after the year has been attached to the target.
So here you open the process, open process is where you open the fire, so
open process.
You open the file to Billy the Kid.
You would have got it from up here.
The search for process.
By the way, this is a process, I think, yes, before I vote, yes, please.
In the press, in a previous lessons, so I won't go through any such process where you search for whatever
process you want.
In this case, we are accurate.
And if if I see if we return the.
That is how he does it.
So he ipid's over here and we'll hear.
And you're using it inside open process, so you open that process in this case, a process, the idea
would be a very big idea and then you start to this handle.
And if there is no area, that means if the process does exist, it managed to open, then you will
allocate memory in target.
So you're allocating memory in the there could be some soda in the next step, you can copy your tweet.
So that the deal is the The Daily Show, the location of the town inside a temporary folder and in a
next in the next function call create remote track.
You actually pass the library function.
You should go from here.
And then the perimeter to the library function.
So this very much is slightly different.
In this year, you get the function that you want to create machine and a barometer for it.
So Peter, I breezed this one, the library and he read name here is actually the party idea, which
you copy from here to here.
So this is in effect, asking the library to look your passwords and you verify and then you bring the
message here to the user.
Then you close the handle.
Then you sleep for about five seconds to give time for a deal to inject in a ditch and then you try
to delay it, but you won't be able to do it OK because the library is loading.
OK, so a day you said, Yeah, injector.
Now let's take a look at the the other project, which is your process new feature.
So the passive sniffer is going to hook the yeah.
The API, which we got from the previous lesson and that API, if you recall, is this API, which we
got it from API monitor.
White Cha to motivate.
All right, so let's take a look.
So it is going to use the tourist library to do it, and it is why we are before and in the previous
year lessons.
And here is where we are using it.
And if you call in order to use a library here to put a detour package here, which contains all they
need to, is a library.
And here, the fastest you must be here also belongs to eToys.
So let's take a look at password sniffer.
OK, so pastors need further continue.
This one pointed to oregano, Rachel Martin buy.
So this can be obtained from the MSDN library over here.
Right?
You go to this website and take a look at it.
This is the great chart in Martin, back years before, so I lost a copy of this.
You can click copy here and then basically here, I'll tell you, they see here, you convert this into
a function pointer and put it in front.
And put this week API as there is so this included bracket here, so this would convert it into a function
pointer.
All right.
So and then after then you assign weight champ to motivate function to this fashion point to then from
here onwards, you can use this.
To refer to this function.
Then we declare their function for a prototype, for who target and who target.
All right, let's go straight to the women.
Yeah, I mean, so as you recall, every detail we have a year, I mean, this is where the execution
of guilt begins.
And there is always a switch statement for the triggers that will be called when the DEA attaches or
detaches.
So in the case Veridia attaches, we are going to hook target.
We are going to call this function.
And when the DEA dtg, we are going to in this case, trigger this and call unhooked target.
So let's take a look at the hook target first.
So this would target who said a hook on the right charge to motivate API function, which you saw above,
and this will use the transaction functions which you have studied before.
So after you finish here, you have to put your function pointer and your substitute hooking function.
So you are going to replace the watch to modify your own cooking function over here.
All right.
And then once you replacing, this thing will run instead of the original original function.
So the whoop right to modify function is here.
Guess who would take over the actual function?
And you say here all you're doing is you are reusing back in the same parameters for the original white
jar to multiply because you are going to pass it to the original function point to.
The reason you do that is because you want to extract the fish parameter, which contains your password.
That's why you are recreating the parameters, although this is your own function.
So you are recreating a barometer so that you can pass all these same parameters back to the original
function.
All right.
And why do that?
Because we're here.
The next step, you are going to string this fifth parameter.
OK.
And you are going to strike me and then say me to this password, string this past history and restore
your actual password, and then I'll tell you, I'll put you back string to inform the user that you
have successfully whatever you successfully capture.
Now you can use Pranav here because Pranav will need to run if your function is functioning.
In this case, here you are not using may function.
He is in dire need and this thing is going to become part stealthily so that you will not show any console
that's way in place in place of Britney.
You can use output debug string.
So when you are good, you are saying you have to use another program called Give Up.
You wish I would demonstrate in the particular.
So the Debug You program will show every debugging which comes from this function.
So this fine tuning output, this this message to the to the other to call the value and you can see
or debugging information here.
So it is only useful when you are developing the Trojan.
Once you finish developing, you can all combine all this.
Well, let's come back to the our hope, our cooking function.
So here now that you have gotten the the password start in password string.
Next step is to store the captured data in a fire.
So here you use create fire again.
This time you are going to star in this in this fake password.
Thanks.
And so here you are, creating this farm, getting a handle.
And then here you are writing your password to the fire.
So at the end of this function column, you have a new farm called password tags in this location.
So that's it.
So this is how we can steal a password using this API hugging.
Yeah, ingestion.
And later on, I speak to you about persistence.
Persistence is where you you put your Trojan in a location, especially a location called a startup
folder, so that when the computer reboots your Trojan, you also always run that are also explained
in the life walkthrough later.
So that's all for this exploration of the apes, and it's Osgood.
Thank you for watching.
I'll see you in the next one.