1+ #include <stdio.h>
2+ #include <Windows.h>
3+ #include "beacon.h"
4+
5+ DECLSPEC_IMPORT BOOL WINAPI KERNEL32$SetFileTime (HANDLE , const FILETIME * , const FILETIME * , const FILETIME * );
6+ DECLSPEC_IMPORT HANDLE WINAPI KERNEL32$CreateFileA (LPCSTR , DWORD , DWORD , LPSECURITY_ATTRIBUTES , DWORD , DWORD , HANDLE );
7+ DECLSPEC_IMPORT BOOL WINAPI KERNEL32$CloseHandle (HANDLE );
8+ DECLSPEC_IMPORT BOOL WINAPI KERNEL32$GetFileTime (HANDLE , LPFILETIME , LPFILETIME , LPFILETIME );
9+ DECLSPEC_IMPORT DWORD WINAPI KERNEL32$GetLastError ();
10+
11+ void go (char * buff , int len ) {
12+ datap parser ;
13+ char * sourceFile ;
14+ char * targetFile ;
15+
16+ BeaconDataParse (& parser , buff , len );
17+ sourceFile = BeaconDataExtract (& parser , NULL );
18+ targetFile = BeaconDataExtract (& parser , NULL );
19+
20+ if (!sourceFile || !targetFile ) {
21+ BeaconPrintf (CALLBACK_ERROR , "[!] Error: Two file paths required\n" );
22+ BeaconPrintf (CALLBACK_ERROR , "[-] Usage: inline-execute timestamp.o \"source_file\" \"target_file\"\n" );
23+ return ;
24+ }
25+
26+ BeaconPrintf (CALLBACK_OUTPUT , "[-] Source: %s\n" , sourceFile );
27+ BeaconPrintf (CALLBACK_OUTPUT , "[-] Target: %s\n" , targetFile );
28+
29+ HANDLE hSourceFile = KERNEL32$CreateFileA (
30+ sourceFile ,
31+ GENERIC_READ ,
32+ FILE_SHARE_READ ,
33+ NULL ,
34+ OPEN_EXISTING ,
35+ FILE_ATTRIBUTE_NORMAL ,
36+ NULL
37+ );
38+
39+ if (hSourceFile == INVALID_HANDLE_VALUE ) {
40+ BeaconPrintf (CALLBACK_ERROR , "[!] Failed to open source file (Error: %d)\n" , KERNEL32$GetLastError ());
41+ return ;
42+ }
43+
44+ FILETIME ftCreation , ftLastAccess , ftLastWrite ;
45+ if (!KERNEL32$GetFileTime (hSourceFile , & ftCreation , & ftLastAccess , & ftLastWrite )) {
46+ BeaconPrintf (CALLBACK_ERROR , "[!] Failed to get source timestamps (Error: %d)\n" , KERNEL32$GetLastError ());
47+ KERNEL32$CloseHandle (hSourceFile );
48+ return ;
49+ }
50+
51+ KERNEL32$CloseHandle (hSourceFile );
52+
53+ HANDLE hTargetFile = KERNEL32$CreateFileA (
54+ targetFile ,
55+ FILE_WRITE_ATTRIBUTES ,
56+ FILE_SHARE_READ | FILE_SHARE_WRITE ,
57+ NULL ,
58+ OPEN_EXISTING ,
59+ FILE_ATTRIBUTE_NORMAL ,
60+ NULL
61+ );
62+
63+ if (hTargetFile == INVALID_HANDLE_VALUE ) {
64+ BeaconPrintf (CALLBACK_ERROR , "[!] Failed to open target file (Error: %d)\n" , KERNEL32$GetLastError ());
65+ return ;
66+ }
67+
68+ if (!KERNEL32$SetFileTime (hTargetFile , & ftCreation , & ftLastAccess , & ftLastWrite )) {
69+ BeaconPrintf (CALLBACK_ERROR , "[!] Failed to modify timestamps (Error: %d)\n" , KERNEL32$GetLastError ());
70+ }
71+ else {
72+ BeaconPrintf (CALLBACK_OUTPUT , "[+] Successfully modified timestamps\n" );
73+ }
74+
75+ KERNEL32$CloseHandle (hTargetFile );
76+ }
0 commit comments