diff --git a/docs/source/crypto.rst b/docs/source/crypto.rst index cbd2640..fd34bef 100644 --- a/docs/source/crypto.rst +++ b/docs/source/crypto.rst @@ -30,9 +30,17 @@ import_pfx .. autofunction:: import_pfx + Certificate """"""""""" +.. warning:: + + The classes described here are under heavy test and try. + + The classes, methods and properties described here will problably change as I haven't yet had the time + to try it out in real cases and figure out the final look of the API I want to do. + .. note:: See sample :ref:`sample_crypto_certificate` @@ -54,10 +62,6 @@ CryptObject .. autoclass:: CryptObject - .. warning:: - - The methods and property of this class will problably change as I haven't yet had the time - to try it out in real cases. CryptContext diff --git a/docs/source/generated.rst b/docs/source/generated.rst index 8c7d149..0308f3a 100644 --- a/docs/source/generated.rst +++ b/docs/source/generated.rst @@ -18,7 +18,6 @@ Here is every generated definition by type: .. toctree:: :maxdepth: 1 - :numbered: windef_generated.rst ntstatus_generated.rst diff --git a/docs/source/ntstatus_generated.rst b/docs/source/ntstatus_generated.rst index ee888a9..da17fa1 100644 --- a/docs/source/ntstatus_generated.rst +++ b/docs/source/ntstatus_generated.rst @@ -1,4 +1,5 @@ .. currentmodule:: windows.generated_def + Ntstatus -------- .. autodata:: STATUS_SUCCESS diff --git a/docs/source/rpc.rst b/docs/source/rpc.rst index 18274ad..a238a10 100644 --- a/docs/source/rpc.rst +++ b/docs/source/rpc.rst @@ -32,7 +32,7 @@ Epmapper :exclude-members: count, index :func:`find_alpc_endpoints` -''''''''''''''''''''''''' +''''''''''''''''''''''''''' .. autofunction:: find_alpc_endpoints @@ -210,7 +210,7 @@ Each NDR class has a function :func:`pack`. NDR STREAM -^^^^^^^^^^ +'''''''''' .. autoclass:: NdrStream diff --git a/docs/source/sample.rst b/docs/source/sample.rst index 2e6cd4b..cf3b6bc 100644 --- a/docs/source/sample.rst +++ b/docs/source/sample.rst @@ -186,7 +186,7 @@ Output:: Output:: - (cmd λ) python.exe network.py + (cmd λ) python.exe network\network.py Working on ipv4 == Listening == Some listening connections: [, , ] @@ -413,7 +413,7 @@ Ouput:: Ouput:: - (cmd λ) python.exe debug\debug\attach.py + (cmd λ) python.exe debug\attach.py Finding process with pid <11392> Target is Debugger attached: @@ -441,7 +441,7 @@ Native code tester Ouput:: - (cmd λ) python.exe .\samples\test_code.py "mov eax, 0x42424242" "eax=0x11223344" + (cmd λ) python.exe test_code.py "mov eax, 0x42424242" "eax=0x11223344" Testing x86 code Startup context is: Eip -> 0x3f0000L @@ -473,7 +473,7 @@ Ouput:: Eax: 0x11223344 -> 0x42424242 (+0x31200efe) - (cmd λ) python64 .\samples\test_code.py --x64 "mov r15, 0x11223344; push r14; call r15" "rcx=1; r14=0x4242424243434343" + (cmd λ) python64 test_code.py --x64 "mov r15, 0x11223344; push r14; call r15" "rcx=1; r14=0x4242424243434343" Testing x64 code Startup context is: Rip -> 0x205a1d60000L @@ -720,7 +720,7 @@ Ouput:: Found it ! == PE Analysis == - Target sha1 = <059cb1ba1a41433a18dd8f87422c2ac3bf35b7b8> + Target sha1 = Analysing File has 1 signer(s): Signer 0: @@ -866,7 +866,7 @@ Manual UAC Output:: - (cmd λ) python samples\rpc\uac.py + (cmd λ) python rpc\uac.py Namespace(cmdline='', creationflags=CREATE_UNICODE_ENVIRONMENT(0x400L), target='C:\\Python27\\python.exe', uacflags=17) # UAC pop - asking to execute python.exe | Clicking Yes Return value = 0x6 @@ -890,7 +890,7 @@ Manual ``LsarEnumeratePrivileges`` Output:: - (cmd λ) python samples\rpc\lsass.py + (cmd λ) python rpc\lsass.py (2, u'SeCreateTokenPrivilege') (3, u'SeAssignPrimaryTokenPrivilege') (4, u'SeLockMemoryPrivilege') diff --git a/docs/source/windef_generated.rst b/docs/source/windef_generated.rst index 7d3540e..96c385f 100644 --- a/docs/source/windef_generated.rst +++ b/docs/source/windef_generated.rst @@ -1,4 +1,5 @@ .. currentmodule:: windows.generated_def + Windef ------ .. autodata:: INVALID_HANDLE_VALUE diff --git a/docs/source/windows.rst b/docs/source/windows.rst index d0b658b..f4665ab 100644 --- a/docs/source/windows.rst +++ b/docs/source/windows.rst @@ -14,8 +14,12 @@ The defaults objects accessible in ``windows`` are: The submodules that you might use by themself are: * :mod:`windows.native_exec` * :mod:`windows.winproxy` + * :mod:`windows.wintrust` + * :mod:`windows.crypto` * :mod:`windows.utils` * :mod:`windows.debug` + * :mod:`windows.alpc` + * :mod:`windows.rpc` * :mod:`windows.com` .. _object_system: diff --git a/docs/source/winproxy.rst b/docs/source/winproxy.rst index d721bdc..a24a26d 100644 --- a/docs/source/winproxy.rst +++ b/docs/source/winproxy.rst @@ -103,6 +103,7 @@ Transparent proxies: * GetExitCodeProcess(hProcess, lpExitCode) * GetExitCodeThread(hThread, lpExitCode) * GetLastError() +* GetLengthSid(pSid) * GetLogicalDriveStringsA(nBufferLength, lpBuffer) * GetLogicalDriveStringsW(nBufferLength, lpBuffer) * GetProcAddress(hModule, lpProcName) @@ -138,6 +139,7 @@ Transparent proxies: * Wow64RevertWow64FsRedirection(OldValue) * lstrcmpA(lpString1, lpString2) * lstrcmpW(lpString1, lpString2) + Functions: * AddVectoredContinueHandler:: @@ -201,6 +203,12 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* CertEnumCTLsInStore:: + + CertEnumCTLsInStore(hCertStore, pPrevCtlContext) + Errcheck: + raise Kernel32Error if result is 0 + * CertEnumCertificateContextProperties:: CertEnumCertificateContextProperties(pCertContext, dwPropId) @@ -261,6 +269,12 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* CloseServiceHandle:: + + CloseServiceHandle(hSCObject) + Errcheck: + raise Kernel32Error if result is 0 + * CoCreateInstance:: CoCreateInstance(rclsid, pUnkOuter=None, dwClsContext=tagCLSCTX.CLSCTX_INPROC_SERVER(0x1L), riid=NeededParameter, ppv=NeededParameter) @@ -333,6 +347,18 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* CreateProcessAsUserA:: + + CreateProcessAsUserA(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation) + Errcheck: + raise Kernel32Error if result is 0 + +* CreateProcessAsUserW:: + + CreateProcessAsUserW(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation) + Errcheck: + raise Kernel32Error if result is 0 + * CreateProcessW:: CreateProcessW(lpApplicationName, lpCommandLine=None, lpProcessAttributes=None, lpThreadAttributes=None, bInheritHandles=False, dwCreationFlags=0, lpEnvironment=None, lpCurrentDirectory=None, lpStartupInfo=None, lpProcessInformation=None) @@ -357,6 +383,12 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* CreateWellKnownSid:: + + CreateWellKnownSid(WellKnownSidType, DomainSid=None, pSid=None, cbSid=NeededParameter) + Errcheck: + raise Kernel32Error if result is 0 + * CryptAcquireCertificatePrivateKey:: CryptAcquireCertificatePrivateKey(pCert, dwFlags, pvParameters, phCryptProvOrNCryptKey, pdwKeySpec, pfCallerFreeProvOrNCryptKey) @@ -411,6 +443,24 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* CryptCATEnumerateAttr:: + + CryptCATEnumerateAttr(hCatalog, pCatMember, pPrevAttr) + Errcheck: + Nothing special + +* CryptCATEnumerateCatAttr:: + + CryptCATEnumerateCatAttr(hCatalog, pPrevAttr) + Errcheck: + Nothing special + +* CryptCATEnumerateMember:: + + CryptCATEnumerateMember(hCatalog, pPrevMember) + Errcheck: + Nothing special + * CryptDecodeObject:: CryptDecodeObject(dwCertEncodingType, lpszStructType, pbEncoded, cbEncoded, dwFlags, pvStructInfo, pcbStructInfo) @@ -471,6 +521,18 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* CryptUIDlgViewContext:: + + CryptUIDlgViewContext(dwContextType, pvContext, hwnd, pwszTitle, dwFlags, pvReserved) + Errcheck: + raise Kernel32Error if result is 0 + +* DeleteProcThreadAttributeList:: + + DeleteProcThreadAttributeList(lpAttributeList) + Errcheck: + raise Kernel32Error if result is 0 + * DeviceIoControl:: DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize=None, lpOutBuffer=NeededParameter, nOutBufferSize=None, lpBytesReturned=None, lpOverlapped=None) @@ -717,6 +779,22 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* GetWindowsDirectoryA:: + + GetWindowsDirectoryA(lpBuffer, uSize=None) + Errcheck: + raise Kernel32Error if result is 0 + +* GetWindowsDirectoryW:: + + GetWindowsDirectoryW(lpBuffer, uSize=None) + Errcheck: + raise Kernel32Error if result is 0 + +* InitializeProcThreadAttributeList:: + + InitializeProcThreadAttributeList(lpAttributeList=None, dwAttributeCount=NeededParameter, dwFlags=0, lpSize=NeededParameter) + * LdrLoadDll:: LdrLoadDll(PathToFile, Flags, ModuleFileName, ModuleHandle) @@ -733,6 +811,18 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* LookupPrivilegeNameA:: + + LookupPrivilegeNameA(lpSystemName, lpLuid, lpName, cchName) + Errcheck: + raise Kernel32Error if result is 0 + +* LookupPrivilegeNameW:: + + LookupPrivilegeNameW(lpSystemName, lpLuid, lpName, cchName) + Errcheck: + raise Kernel32Error if result is 0 + * LookupPrivilegeValueA:: LookupPrivilegeValueA(lpSystemName=None, lpName=NeededParameter, lpLuid=NeededParameter) @@ -751,6 +841,18 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* MessageBoxA:: + + MessageBoxA(hWnd=0, lpText=NeededParameter, lpCaption=None, uType=0) + Errcheck: + raise Kernel32Error if result is 0 + +* MessageBoxW:: + + MessageBoxW(hWnd=0, lpText=NeededParameter, lpCaption=None, uType=0) + Errcheck: + raise Kernel32Error if result is 0 + * NtAlpcAcceptConnectPort:: NtAlpcAcceptConnectPort(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection) @@ -767,6 +869,30 @@ Functions: NtAlpcCreatePort(PortHandle, ObjectAttributes, PortAttributes) +* NtAlpcCreatePortSection:: + + NtAlpcCreatePortSection(PortHandle, Flags, SectionHandle, SectionSize, AlpcSectionHandle, ActualSectionSize) + +* NtAlpcCreateSectionView:: + + NtAlpcCreateSectionView(PortHandle, Flags, ViewAttributes) + +* NtAlpcDeletePortSection:: + + NtAlpcDeletePortSection(PortHandle, Flags, SectionHandle) + +* NtAlpcDeleteSectionView:: + + NtAlpcDeleteSectionView(PortHandle, Flags, ViewBase) + +* NtAlpcDisconnectPort:: + + NtAlpcDisconnectPort(PortHandle, Flags) + +* NtAlpcQueryInformation:: + + NtAlpcQueryInformation(PortHandle, PortInformationClass, PortInformation, Length, ReturnLength) + * NtAlpcSendWaitReceivePort:: NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout) @@ -775,6 +901,10 @@ Functions: NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength) +* NtCreateSection:: + + NtCreateSection(SectionHandle, DesiredAccess, ObjectAttributes, MaximumSize, SectionPageProtection, AllocationAttributes, FileHandle) + * NtCreateThreadEx:: NtCreateThreadEx(ThreadHandle=None, DesiredAccess=2097151, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown=0) @@ -783,6 +913,10 @@ Functions: NtGetContextThread(hThread, lpContext) +* NtMapViewOfSection:: + + NtMapViewOfSection(SectionHandle, ProcessHandle, BaseAddress, ZeroBits, CommitSize, SectionOffset, ViewSize, InheritDisposition, AllocationType, Win32Protect) + * NtOpenDirectoryObject:: NtOpenDirectoryObject(DirectoryHandle, DesiredAccess, ObjectAttributes) @@ -791,6 +925,10 @@ Functions: NtOpenEvent(EventHandle, DesiredAccess, ObjectAttributes) +* NtOpenSection:: + + NtOpenSection(SectionHandle, DesiredAccess, ObjectAttributes) + * NtOpenSymbolicLinkObject:: NtOpenSymbolicLinkObject(LinkHandle, DesiredAccess, ObjectAttributes) @@ -827,10 +965,18 @@ Functions: NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None) +* NtReadVirtualMemory:: + + NtReadVirtualMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead) + * NtSetContextThread:: NtSetContextThread(hThread, lpContext) +* NtUnmapViewOfSection:: + + NtUnmapViewOfSection(ProcessHandle, BaseAddress) + * NtWow64ReadVirtualMemory64:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead=None) @@ -876,6 +1022,18 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* OpenServiceA:: + + OpenServiceA(hSCManager, lpServiceName, dwDesiredAccess) + Errcheck: + raise Kernel32Error if result is 0 + +* OpenServiceW:: + + OpenServiceW(hSCManager, lpServiceName, dwDesiredAccess) + Errcheck: + raise Kernel32Error if result is 0 + * OpenThread:: OpenThread(dwDesiredAccess=THREAD_ALL_ACCESS(0x1f03ffL), bInheritHandle=0, dwThreadId=NeededParameter) @@ -1008,6 +1166,12 @@ Functions: RtlDecompressBuffer(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize, FinalUncompressedSize) +* RtlGetUnloadEventTraceEx:: + + RtlGetUnloadEventTraceEx(ElementSize, ElementCount, EventTrace) + Errcheck: + Nothing special + * SetConsoleCtrlHandler:: SetConsoleCtrlHandler(HandlerRoutine, Add) @@ -1045,6 +1209,18 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* StartServiceA:: + + StartServiceA(hService, dwNumServiceArgs, lpServiceArgVectors) + Errcheck: + raise Kernel32Error if result is 0 + +* StartServiceW:: + + StartServiceW(hService, dwNumServiceArgs, lpServiceArgVectors) + Errcheck: + raise Kernel32Error if result is 0 + * Thread32First:: Thread32First(hSnapshot, lpte) @@ -1059,6 +1235,18 @@ Functions: Errcheck: Nothing special +* TpCallbackSendAlpcMessageOnCompletion:: + + TpCallbackSendAlpcMessageOnCompletion(TpHandle, PortHandle, Flags, SendMessage) + Errcheck: + raise Kernel32Error if result is NOT 0 + +* UpdateProcThreadAttribute:: + + UpdateProcThreadAttribute(lpAttributeList, dwFlags=0, Attribute=NeededParameter, lpValue=NeededParameter, cbSize=NeededParameter, lpPreviousValue=None, lpReturnSize=None) + Errcheck: + raise Kernel32Error if result is 0 + * VerQueryValueA:: VerQueryValueA(pBlock, lpSubBlock, lplpBuffer, puLen) @@ -1148,4 +1336,4 @@ Functions: WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize=None, lpNumberOfBytesWritten=None) Computer nSize with len(lpBuffer) if not given Errcheck: - raise Kernel32Error if result is 0 \ No newline at end of file + raise Kernel32Error if result is 0 diff --git a/docs/source/winstructs_generated.rst b/docs/source/winstructs_generated.rst index 0d5ebf0..7f6c33e 100644 --- a/docs/source/winstructs_generated.rst +++ b/docs/source/winstructs_generated.rst @@ -1,4 +1,5 @@ .. currentmodule:: windows.generated_def + Winstructs ---------- _LIST_ENTRY @@ -11943,26 +11944,6 @@ _SID_NAME_USE .. attribute:: SidTypeLabel(10) -NET_FW_PROFILE_TYPE2_ -''''''''''''''''''''' -.. class:: NET_FW_PROFILE_TYPE2 - - Alias for :class:`NET_FW_PROFILE_TYPE2_` - -.. class:: NET_FW_PROFILE_TYPE2_ - - - .. attribute:: NET_FW_PROFILE2_DOMAIN(1) - - - .. attribute:: NET_FW_PROFILE2_PRIVATE(2) - - - .. attribute:: NET_FW_PROFILE2_PUBLIC(4) - - - .. attribute:: NET_FW_PROFILE2_ALL(2147483647) - NET_FW_ACTION_ '''''''''''''' .. class:: NET_FW_ACTION @@ -11997,23 +11978,6 @@ NET_FW_MODIFY_STATE_ .. attribute:: NET_FW_MODIFY_STATE_INBOUND_BLOCKED(2) -NET_FW_RULE_DIRECTION_ -'''''''''''''''''''''' -.. class:: NET_FW_RULE_DIRECTION - - Alias for :class:`NET_FW_RULE_DIRECTION_` - -.. class:: NET_FW_RULE_DIRECTION_ - - - .. attribute:: NET_FW_RULE_DIR_IN(1) - - - .. attribute:: NET_FW_RULE_DIR_OUT(2) - - - .. attribute:: NET_FW_RULE_DIR_MAX(3) - tag_WBEMSTATUS '''''''''''''' .. class:: WBEMSTATUS