admin/fortra-No-Consolation
1
0
Fork 0
mirror of https://github.com/fortra/No-Consolation synced 2026-06-06 15:44:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

link PE to PEB with correct name and path, update demo.png

Browse Source
This commit is contained in:
S4ntiagoP
2024-05-15 11:35:18 -03:00
parent d673fb9dce
commit c1d8bf1323
9 changed files with 31 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
No-Consolation.cna
+7 -3
View File
@@ -1,13 +1,15 @@
alias noconsolation
{
local('$bid $barch $PE $args $path $path_set $name_set $pebytes $x $matchfound $pe_id $local $cmdline $headers $method $use_unicode $timeout $nooutput $alloc_console $close_handles $free_libs $dont_save $list_pes $unload_pe $link_to_peb');
local('$bid $barch $PE $args $path $path_set $name_set $pebytes $x $matchfound $pe_id $local $cmdline $headers $method $use_unicode $timeout $nooutput $alloc_console $close_handles $free_libs $dont_save $list_pes $unload_pe $link_to_peb $pepath $pename');
$bid = $1;
$pe_id = 0;
$local = 0;
$i = 1;
$path = '';
$pename = '';
$pepath = '';
$path_set = 0;
$name_set = 0;
$pebytes = '';
@@ -187,6 +189,7 @@ alias noconsolation
if ($local == 0)
{
$pename = split("/", $path, 50)[-1];
$pepath = "C:\\Windows\\System32\\" . $pename;
$handle = openf($path);
$pebytes = readb($handle, -1);
@@ -201,6 +204,7 @@ alias noconsolation
else
{
$pename = split('\\\\', $path, 50)[-1];
$pepath = $path;
}
}
@@ -217,7 +221,7 @@ alias noconsolation
}
}
runpe($bid, $pename, $pebytes, $path, $local, $timeout, $headers, $cmdline, $method, $use_unicode, $nooutput, $alloc_console, $close_handles, $free_libs, $dont_save, $list_pes, $unload_pe, mynick(), tstamp(ticks()), $link_to_peb);
runpe($bid, $pename, $pepath, $pebytes, $path, $local, $timeout, $headers, $cmdline, $method, $use_unicode, $nooutput, $alloc_console, $close_handles, $free_libs, $dont_save, $list_pes, $unload_pe, mynick(), tstamp(ticks()), $link_to_peb);
}
sub runpe{
@@ -233,7 +237,7 @@ sub runpe{
}
# Pack the arguments
$args = bof_pack($1, "zbziiiZzziiiiiiizzzi", $2, $3, $4, $5, $6, $7, $8, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20);
$args = bof_pack($1, "ZzZbziiiZzziiiiiiizzzi", $2 $2, $3, $4, $5, $6, $7, $8, $9, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21);
# Execute BOF
beacon_inline_execute($1, $data, "go", $args);
dist/NoConsolation.x64.o
Vendored
BIN
View File
Binary file not shown.
dist/NoConsolation.x86.o
Vendored
BIN
View File
Binary file not shown.
include/bofdefs.h
+8 -8
View File
@@ -437,12 +437,12 @@ WINBASEAPI NTSTATUS NTAPI NTDLL$NtQueryVirtualMemory(HANDLE ProcessHandle, PVO
WINBASEAPI NTSTATUS NTAPI NTDLL$NtCreateThreadEx(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, HANDLE ProcessHandle, PVOID StartRoutine, PVOID Argument, ULONG CreateFlags, SIZE_T ZeroBits, SIZE_T StackSize, SIZE_T MaximumStackSize, PVOID AttributeList);
WINBASEAPI SIZE_T NTSYSAPI NTDLL$RtlCompareMemory(VOID *Source1, VOID *Source2, SIZE_T Length);
WINBASEAPI int __cdecl MSVCRT$_stricmp(const char *string1,const char *string2);
WINBASEAPI void __cdecl MSVCRT$memset(void *dest, int c, size_t count);
WINBASEAPI PVOID __cdecl MSVCRT$memcpy(void * __restrict__ _Dst,const void * __restrict__ _Src,size_t _MaxCount);
WINBASEAPI int __cdecl MSVCRT$strncmp(const char *s1, const char *s2, size_t n);
WINBASEAPI int __cdecl MSVCRT$strcmp(const char *s1, const char *s2);
WINBASEAPI int __cdecl MSVCRT$wcscmp(const wchar_t *string1, const wchar_t *string2);
WINBASEAPI WCHAR* __cdecl MSVCRT$wcscpy(WCHAR *strDestination,const WCHAR *strSource);
WINBASEAPI int __cdecl MSVCRT$_stricmp(const char *string1,const char *string2);
WINBASEAPI void __cdecl MSVCRT$memset(void *dest, int c, size_t count);
WINBASEAPI PVOID __cdecl MSVCRT$memcpy(void * __restrict__ _Dst,const void * __restrict__ _Src,size_t _MaxCount);
WINBASEAPI int __cdecl MSVCRT$strncmp(const char *s1, const char *s2, size_t n);
WINBASEAPI int __cdecl MSVCRT$wcscmp(const wchar_t *string1, const wchar_t *string2);
WINBASEAPI HANDLE WINAPI KERNEL32$GetProcessHeap(VOID);
WINBASEAPI void * WINAPI KERNEL32$HeapAlloc (HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes);
@@ -472,12 +472,12 @@ WINBASEAPI BOOL WINAPI KERNEL32$FreeLibrary(HANDLE hLibModule);
#define NtCreateThreadEx NTDLL$NtCreateThreadEx
#define RtlCompareMemory NTDLL$RtlCompareMemory
#define wcscpy MSVCRT$wcscpy
#define _stricmp MSVCRT$_stricmp
#define memset MSVCRT$memset
#define memcpy MSVCRT$memcpy
#define strncmp MSVCRT$strncmp
#define strcmp MSVCRT$strcmp
#define wcscmp MSVCRT$wcscmp
#define wcscmp MSVCRT$wcscmp
#define GetProcessHeap KERNEL32$GetProcessHeap
#define HeapAlloc KERNEL32$HeapAlloc
include/entry.h
+2
View File
@@ -30,6 +30,8 @@ typedef struct _LIB_LOADED {
} LIB_LOADED, * PLIB_LOADED;
typedef struct _LOADED_PE_INFO {
WCHAR pe_wname[MAX_PATH];
WCHAR pe_wpath[MAX_PATH];
PVOID pe_base;
SIZE_T pe_size;
LPWSTR cmdwline;
resources/demo.png
BIN
View File
Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 15 KiB

After

Width:  |  Height:  |  Size: 12 KiB

source/entry.c
+8
View File
@@ -13,6 +13,8 @@ int go(IN PCHAR Buffer, IN ULONG Length)
datap parser = { 0 };
int pe_length = 0;
LPSTR pe_name = NULL;
LPWSTR pe_wname = NULL;
LPWSTR pe_wpath = NULL;
PVOID pe_bytes = 0;
LPSTR pe_path = 0;
BOOL local = FALSE;
@@ -39,8 +41,12 @@ int go(IN PCHAR Buffer, IN ULONG Length)
PLOADED_PE_INFO peinfo = NULL;
BeaconDataParse(&parser, Buffer, Length);
pe_wname = (LPWSTR)BeaconDataExtract(&parser, NULL);
pe_wname = pe_wname[0] ? pe_wname : NULL;
pe_name = BeaconDataExtract(&parser, NULL);
pe_name = pe_name[0] ? pe_name : NULL;
pe_wpath = (LPWSTR)BeaconDataExtract(&parser, NULL);
pe_wpath = pe_wpath[0] ? pe_wpath : NULL;
pe_bytes = BeaconDataExtract(&parser, &pe_length);
pe_path = BeaconDataExtract(&parser, NULL);
pe_path = pe_path[0] ? pe_path : NULL;
@@ -67,6 +73,8 @@ int go(IN PCHAR Buffer, IN ULONG Length)
peinfo = intAlloc(sizeof(LOADED_PE_INFO));
wcscpy(peinfo->pe_wname, pe_wname ? pe_wname : L"NoConsolation.dll");
wcscpy(peinfo->pe_wpath, pe_wpath ? pe_wpath : L"C:\\Windows\\System32\\NoConsolation.dll");
peinfo->timeout = timeout;
peinfo->headers = headers;
peinfo->method = method[0] ? method : NULL;
source/peb.c
+4 -4
View File
@@ -307,7 +307,7 @@ PRTL_RB_TREE find_module_base_address_index(VOID)
for (INT i = 0; i < nt->FileHeader.NumberOfSections; i++)
{
if (!strcmp(".data", (LPCSTR)sh->Name))
if (!strncmp(".data", (LPCSTR)sh->Name, 6))
{
stBegin = RVA2VA(SIZE_T, ldr_entry->DllBase, sh->VirtualAddress);
dwLen = sh->Misc.VirtualSize;
@@ -578,9 +578,9 @@ PLDR_DATA_TABLE_ENTRY2 create_ldr_entry(
return NULL;
}
// you might want to change these
RtlInitUnicodeString(&full_dll_name, L"C:\\Windows\\System32\\NoConsolation.dll");
RtlInitUnicodeString(&base_dll_name, L"NoConsolation.dll");
// set the PE name and path
RtlInitUnicodeString(&full_dll_name, peinfo->pe_wpath);
RtlInitUnicodeString(&base_dll_name, peinfo->pe_wname);
ldr_entry = intAlloc(sizeof(LDR_DATA_TABLE_ENTRY2));
if (!ldr_entry)
source/utils.c
+2 -2
View File
@@ -625,7 +625,7 @@ BOOL protect_inverted_function_table(
pSection = IMAGE_FIRST_SECTION(nt);
for (INT i = 0; i < nt->FileHeader.NumberOfSections; i++)
{
if (!strcmp(".mrdata", (LPCSTR)pSection->Name))
if (!strncmp(".mrdata", (LPCSTR)pSection->Name, 8))
{
stBegin = RVA2VA(PVOID, dos, pSection->VirtualAddress);
len = pSection->Misc.VirtualSize;
@@ -686,7 +686,7 @@ PVOID find_inverted_function_table()
pSection = IMAGE_FIRST_SECTION(nt);
for (INT i = 0; i < nt->FileHeader.NumberOfSections; i++)
{
if (!strcmp(".mrdata", (LPCSTR)pSection->Name))
if (!strncmp(".mrdata", (LPCSTR)pSection->Name, 8))
{
stBegin = RVA2VA(PVOID, dos, pSection->VirtualAddress);
dwLen = pSection->Misc.VirtualSize;