1+ #include <stdio.h>
2+ #include <winsock2.h>
3+ #include <windows.h>
4+ #include <tchar.h>
5+ #include <psapi.h>
6+ #include <iphlpapi.h>
7+ #include <stdlib.h>
8+ #include <winhttp.h>
9+ #include <stdbool.h>
10+ #include <ws2tcpip.h>
11+ #include <signal.h>
12+
13+ #pragma comment(lib, "iphlpapi.lib")
14+ #pragma comment(lib, "ws2_32.lib")
15+ #pragma comment(lib, "winhttp.lib")
16+
17+
18+ #define API_KEY "<YOUR API KEY>"
19+
20+ void printProcessNames (DWORD processID ) {
21+
22+ // Get a handle to the process.
23+ HANDLE hProcess = OpenProcess (
24+ PROCESS_QUERY_INFORMATION | PROCESS_VM_READ ,
25+ FALSE,
26+ processID
27+ );
28+
29+ // Get the process name.s
30+ if (NULL != hProcess ) {
31+
32+ HMODULE hMod ;
33+ DWORD cbNeeded ;
34+
35+ if (EnumProcessModules (hProcess , & hMod , sizeof (hMod ), & cbNeeded )) {
36+
37+ TCHAR szProcessName [MAX_PATH ];
38+
39+ if (GetModuleBaseName (hProcess , hMod , szProcessName , sizeof (szProcessName ) / sizeof (TCHAR ))) {
40+
41+ _tprintf (TEXT ("\nPROCESS NAME: %s (PID: %u)\n" ), szProcessName , processID );
42+
43+ }
44+
45+
46+ }
47+ else {
48+ printf ("Error getting process name\n" );
49+ }
50+
51+ }
52+
53+ // Release the handle to the process.
54+ if (hProcess && hProcess != INVALID_HANDLE_VALUE ) {
55+ CloseHandle (hProcess );
56+ }
57+
58+ }
59+
60+ // function to do a lookup of the IP address on VirusTotal with the API key to check if it is malicious
61+ bool checkIP (const char * ipAddr ) {
62+
63+ struct in_addr IpAddr ;
64+ int result = inet_pton (AF_INET , ipAddr , & IpAddr );
65+ if (result != 1 ) {
66+ printf ("Invalid IP address format.\n" );
67+ return false;
68+ }
69+ const char * ip = inet_ntoa (IpAddr );
70+
71+ //printf("\DEBUG IP: %s\n", ip);
72+
73+ // Initialize the WinHTTP session.
74+ HINTERNET hSession = WinHttpOpen (L"Orion Lookup/1.0" ,
75+ WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY ,
76+ WINHTTP_NO_PROXY_NAME ,
77+ WINHTTP_NO_PROXY_BYPASS , 0 );
78+
79+ if (hSession ) {
80+
81+ HINTERNET hConnect = WinHttpConnect (hSession , L"www.virustotal.com" ,
82+ INTERNET_DEFAULT_HTTPS_PORT , 0 );
83+
84+ if (hConnect ) {
85+
86+ wchar_t path [256 ];
87+ wsprintfW (path , L"/api/v3/ip_addresses/%S" , ip );
88+ HINTERNET hRequest = WinHttpOpenRequest (hConnect , L"GET" , path ,
89+ NULL , WINHTTP_NO_REFERER ,
90+ WINHTTP_DEFAULT_ACCEPT_TYPES ,
91+ WINHTTP_FLAG_SECURE );
92+
93+ if (hRequest ) {
94+
95+ wchar_t headers [256 ];
96+ wsprintfW (headers , L"x-apikey: %S" , API_KEY );
97+ WinHttpAddRequestHeaders (hRequest , headers , -1 , WINHTTP_ADDREQ_FLAG_ADD );
98+ if (WinHttpSendRequest (hRequest , WINHTTP_NO_ADDITIONAL_HEADERS , 0 , WINHTTP_NO_REQUEST_DATA , 0 , 0 , 0 )) {
99+
100+ if (WinHttpReceiveResponse (hRequest , NULL )) {
101+
102+
103+ DWORD dwSize = 0 ;
104+ DWORD dwDownloaded = 0 ;
105+ LPSTR pszOutBuffer = NULL ;
106+ //LPSTR pszTotalBuffer = NULL;
107+ DWORD totalSize = 0 ;
108+
109+ do {
110+
111+ // Check for available data.
112+ dwSize = 0 ;
113+
114+ if (!WinHttpQueryDataAvailable (hRequest , & dwSize )) {
115+ printf ("Error %u in WinHttpQueryDataAvailable.\n" , GetLastError ());
116+ break ;
117+ }
118+
119+ // Allocate space for the buffer.
120+ LPSTR tempBuffer = (LPSTR ) realloc (pszOutBuffer , totalSize + dwSize + 1 );
121+
122+ if (!tempBuffer ) {
123+
124+ printf ("Out of memory\n" );
125+ free (pszOutBuffer );
126+ dwSize = 0 ;
127+ break ;
128+
129+ } else {
130+
131+ pszOutBuffer = tempBuffer ;
132+ }
133+
134+
135+ // Read the data.
136+ if (!WinHttpReadData (hRequest , (LPVOID )(pszOutBuffer + totalSize ),
137+
138+ dwSize , & dwDownloaded )) {
139+ printf ("Error %u in WinHttpReadData.\n" , GetLastError ());
140+ free (pszOutBuffer );
141+ break ;
142+ }
143+
144+ totalSize += dwDownloaded ;
145+ //printf("Total size: %d\n", totalSize);
146+
147+ } while (dwSize > 0 );
148+
149+ if (pszOutBuffer ) {
150+
151+ // parse the JSON response to check if the IP is malicious. Check for the string "last_analysis_stats".
152+ const char * malicious = "\"last_analysis_stats\":" ;
153+ char * pMalicious = strstr (pszOutBuffer , malicious );
154+ if (pMalicious ) {
155+
156+ // get the value of the malicious key
157+ const char * pMaliciouskey = "\"malicious\":" ;
158+ char * pMaliciousValue = strstr (pMalicious , pMaliciouskey );
159+
160+ if (pMaliciousValue ) {
161+
162+ pMaliciousValue += strlen (pMaliciouskey );
163+ int k = atoi (pMaliciousValue );
164+
165+ if (k > 1 ) {
166+
167+ //printf("\t(malicious) [%d]\n", k);
168+ return true;
169+
170+ }
171+ else {
172+
173+ //printf("\t(safe) [%d]\n", k);
174+ return false;
175+ }
176+
177+
178+ }
179+
180+ free (pszOutBuffer );
181+ pszOutBuffer = NULL ; // Set PSZOutBuffer to NULL after freeing it
182+ }
183+
184+
185+ }
186+
187+ //pszOutBuffer = NULL; // Set PSZOutBuffer to NULL after freeing it
188+ }
189+
190+ WinHttpCloseHandle (hRequest );
191+
192+ }
193+
194+ WinHttpCloseHandle (hConnect );
195+
196+ }
197+
198+ WinHttpCloseHandle (hSession );
199+
200+ }
201+
202+
203+ }
204+
205+ return false;
206+ }
207+
208+
209+ int TCPOutboundConnections () {
210+
211+ // PMIB_TCPTABLE2 Pointer to a MIB_TCPTABLE2 structure that contains a table of TCP connections.
212+ PMIB_TCPTABLE2 pTcpTable ;
213+ DWORD dwSize = 0 ;
214+ DWORD dwRetVal = 0 ;
215+
216+ char szLocalAddr [128 ] = { 0 };
217+ char szRemoteAddr [128 ] = { 0 };
218+
219+ struct in_addr IpAddr ;
220+
221+ int i ;
222+
223+ ULONG ulSize = 0 ;
224+
225+ // Allocate memory for the MIB_TCPTABLE structure.
226+ pTcpTable = (MIB_TCPTABLE2 * )malloc (sizeof (MIB_TCPTABLE2 ));
227+
228+ if (pTcpTable == NULL ) {
229+ printf ("Error allocating memory\n" );
230+ return -1 ;
231+ }
232+
233+ ulSize = sizeof (MIB_TCPTABLE );
234+
235+ if ((dwRetVal = GetTcpTable2 (pTcpTable , & ulSize , TRUE)) ==
236+ ERROR_INSUFFICIENT_BUFFER ) {
237+ free (pTcpTable );
238+ pTcpTable = (MIB_TCPTABLE2 * )malloc (ulSize );
239+ if (pTcpTable == NULL ) {
240+ printf ("Error allocating memory\n" );
241+ return -1 ;
242+ }
243+ }
244+
245+ if ((dwRetVal = GetTcpTable2 (pTcpTable , & ulSize , TRUE)) == NO_ERROR ) {
246+
247+ for (i = 0 ; i < (int )pTcpTable -> dwNumEntries ; i ++ ) {
248+
249+ IpAddr .S_un .S_addr = (u_long )pTcpTable -> table [i ].dwLocalAddr ;
250+
251+ if (inet_ntop (AF_INET , & IpAddr , szLocalAddr , sizeof (szLocalAddr )) == NULL ) {
252+ perror ("Local Address conversion error" );
253+ continue ; // Skip this entry on error
254+ }
255+
256+ IpAddr .S_un .S_addr = (u_long )pTcpTable -> table [i ].dwRemoteAddr ;
257+
258+ if (inet_ntop (AF_INET , & IpAddr , szRemoteAddr , sizeof (szRemoteAddr )) == NULL ) {
259+ perror ("Remote Address conversion error" );
260+ continue ; // Skip this entry on error
261+ }
262+
263+
264+ if (strcmp (szLocalAddr , "127.0.0.1" ) == 0 || strcmp (szRemoteAddr , "127.0.0.1" ) == 0 ||
265+ strcmp (szLocalAddr , "0.0.0.0" ) == 0 || strcmp (szRemoteAddr , "0.0.0.0" ) == 0 ) {
266+ continue ;
267+ }
268+
269+ // check if the IP address is malicious with the checkIP function
270+ u_short localport = ntohs ((u_short )pTcpTable -> table [i ].dwLocalPort );
271+ u_short remoteport = ntohs ((u_short )pTcpTable -> table [i ].dwRemotePort );
272+
273+
274+ printf ("\tLocal Port: %d\n" , localport );
275+ //printf("DEBUG: %s\n", szRemoteAddr);
276+ printf ("\tRemote Addr: %s:%d --> [%s]\n" , szRemoteAddr , remoteport , checkIP (szRemoteAddr ) ? "NALICIOUS" : "SAFE" );
277+ printProcessNames (pTcpTable -> table [i ].dwOwningPid );
278+ //checkIP(szRemoteAddr);
279+
280+ }
281+
282+ }
283+ else {
284+
285+ printf ("\tGetTcpTable2 failed with %d\n" , dwRetVal );
286+ free (pTcpTable );
287+ return -1 ;
288+ }
289+
290+ if (pTcpTable != NULL ) {
291+ free (pTcpTable );
292+ pTcpTable = NULL ;
293+ }
294+
295+ return 0 ;
296+
297+ }
298+
299+ void signalHandler (int signalNumber ) {
300+ if (signalNumber == SIGINT ) {
301+ printf ("\nYou pressed Ctrl+C. Exiting...\n" );
302+ exit (0 );
303+ }
304+ }
305+
306+ int main () {
307+
308+ signal (SIGINT , signalHandler );
309+
310+ printf ("\nORION v0.1\n" );
311+ printf ("Author: B0lg0r0v\n" );
312+ printf ("https://arthurminasyan.com/\n\n" );
313+ Sleep (2000 );
314+
315+ TCPOutboundConnections ();
316+
317+ return 0 ;
318+
319+ }
0 commit comments