Skip to content

Domain spoof #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
cccs-mog wants to merge 4 commits into
base: capemon
Choose a base branch
from
Draft

Domain spoof #129

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7e91547
Update hook_wmi.c
cccs-mog Apr 21, 2026
778eddc
Update hook_network.c
cccs-mog Apr 23, 2026
03b1260
Working on the NetApiBuffer
cccs-mog Apr 29, 2026
08cbcbd
Fixing size for buffer
cccs-mog Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 23 additions & 3 deletions hook_network.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
#include "config.h"
#include "misc.h"

#define NERR_Success 0

extern unsigned int dropped_count;
extern BOOL DumpRegion(PVOID Address);
extern void DebugOutput(_In_ LPCTSTR lpOutputString, ...);
Expand Down Expand Up @@ -994,9 +996,27 @@ HOOKDEF(ULONG, WINAPI, NetGetJoinInformation,
_Out_ DWORD * BufferType
) {
ULONG ret = Old_NetGetJoinInformation(lpServer, lpNameBuffer, BufferType);

LOQ_zero("network", "uuI", "Server", lpServer, "NetBIOSName", *lpNameBuffer, "JoinStatus", BufferType);

if (ret != 0 || ret == NULL)
LOQ_zero("network", "u", "Server", lpServer, "NetBIOSName");
return ret;
if (g_config.no_stealth)
{
LOQ_zero("network", "uuI", "Server", lpServer, "NetBIOSName", *lpNameBuffer, "JoinStatus", BufferType);
}
else
{
//Faking to be part of a domain in order to bypass some detections
LOQ_zero("network", "uuI", "Server", lpServer, "NetBIOSName", *lpNameBuffer, "JoinStatus", BufferType);
if (*BufferType !=3) {
*BufferType = 3;
LPWSTR fake_domain_name = L"myDomain";
DWORD net = NetApiBufferAllocate(sizeof(WCHAR) * wcslen((LPCWSTR)fake_domain_name), (LPVOID *)&fake_domain_name);
if(net == NERR_Success)
lpNameBuffer = &fake_domain_name;
else
*lpNameBuffer = *fake_domain_name;
}
Comment thread
cccs-mog marked this conversation as resolved.
}
return ret;
}

Expand Down
4 changes: 4 additions & 0 deletions hook_wmi.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,10 @@ void SpoofWmiData(const wchar_t* szClassName, const wchar_t* wszName, VARIANT* p
}
}
}
else if (pVal->vt == VT_BOOL) {
if ((!_wcsicmp(szClassName, L"Win32_ComputerSystem") && (!_wcsicmp(wszName, L"PartOfDomain"))))
pVal->boolVal = VARIANT_TRUE;
}
//
// Spoofery logic for NULL
//
Expand Down