CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/external/source/evasion/windows/process_herpaderping/ProcessHerpaderping/herpaderp.hpp
Views: 11789
1
#pragma once
2
3
namespace Herpaderp
4
{
5
constexpr static char _TargetFileName[FILE_MAX_PATH] = { 'T', 'A', 'R', 'G', 'E', 'T', 'F', 'I', 'L', 'E', 'N', 'A', 'M', 'E' };
6
constexpr static char _ReplaceWithFileName[FILE_MAX_PATH] = { 'R', 'E', 'P', 'L', 'A', 'C', 'E', 'F', 'I', 'L', 'E', 'N', 'A', 'M', 'E' };
7
8
// If the Herpaderping loader file is changed, update the following sizes accordingly
9
// It should match the loader sizes (ProcessHerpaderpingTemplate_x64.exe and ProcessHerpaderpingTemplate_x86.exe)
10
#ifdef _WIN64
11
#define PAYLOAD_PE_SIZE 0x3400
12
#else
13
#define PAYLOAD_PE_SIZE 0x3200
14
#endif
15
16
static unsigned char payload[PAYLOAD_PE_SIZE] = "PAYLOAD";
17
18
constexpr static uint32_t RandPatternLen{ 0x200 };
19
20
_Must_inspect_result_ HRESULT ExecuteProcess();
21
}
22
23