From e46dc48c375d75a2b03196c759f85d55fbe54d30 Mon Sep 17 00:00:00 2001 From: hakril Date: Thu, 27 Sep 2018 02:11:45 +0200 Subject: [PATCH] Addapt codebase and tests to winproxy refactoring (replace Kernel32Error to WinproxyError) --- tests/test_crypto.py | 2 +- tests/test_process.py | 17 +++++++++++++++++ tests/test_winproxy.py | 7 ++++++- windows/crypto/certificate.py | 2 +- windows/crypto/encrypt_decrypt.py | 2 +- windows/syswow64.py | 4 ++-- windows/utils/winutils.py | 6 +++--- windows/winobject/network.py | 4 ++-- windows/winobject/process.py | 13 ++++++------- 9 files changed, 39 insertions(+), 18 deletions(-) diff --git a/tests/test_crypto.py b/tests/test_crypto.py index 38c66b8..75dbf33 100644 --- a/tests/test_crypto.py +++ b/tests/test_crypto.py @@ -216,7 +216,7 @@ def test_sign_verify_fail(rawcert, rawpfx): assert message_to_sign in signed_blob # Tamper the signed mesasge content signed_blob = signed_blob.replace("message", "massage") - with pytest.raises(windows.winproxy.Kernel32Error) as excinfo: + with pytest.raises(windows.winproxy.WinproxyError) as excinfo: decoded_blob = windows.crypto.verify_signature(cert, signed_blob) assert excinfo.value.winerror == gdef.STATUS_INVALID_SIGNATURE diff --git a/tests/test_process.py b/tests/test_process.py index 64faad3..8d4fed0 100644 --- a/tests/test_process.py +++ b/tests/test_process.py @@ -417,3 +417,20 @@ class TestProcessWithCheckGarbage(object): image_path_from_process_params = proc32_64.peb.ProcessParameters.contents.ImagePathName.str.lower() image_path_from_module = proc32_64.peb.modules[0].fullname.lower() assert image_path_from_process_params == image_path_from_module + + def test_lower_integrity(self, proc32): + # Lowering the integrity in remote process + # Because we don't want to mess with the token of our testing process + + proc32.execute_python("import windows") + # We stock the handle becase lowering the integrity + # will mess with token retrieval + proc32.execute_python("token = windows.current_process.token") + proc32.execute_python("token.integrity = 123") + # execute_python will raise this in our own process :) + proc32.execute_python("assert token.integrity == 123") + + def test_remote_assertion_error(self, proc32): + proc32.execute_python("assert 1 == 1") + with pytest.raises(windows.injection.RemotePythonError): + proc32.execute_python("assert 1 == 2") diff --git a/tests/test_winproxy.py b/tests/test_winproxy.py index 1c93b4a..9b66bfa 100644 --- a/tests/test_winproxy.py +++ b/tests/test_winproxy.py @@ -10,4 +10,9 @@ pytestmark = pytest.mark.usefixtures('check_for_gc_garbage') def test_createfileA_fail(): with pytest.raises(WindowsError) as ar: - windows.winproxy.CreateFileA("NONEXISTFILE.FILE") \ No newline at end of file + windows.winproxy.CreateFileA("NONEXISTFILE.FILE") + + +def test_lstrcmpa(): + assert windows.winproxy.lstrcmpA("LOL", "NO-LOL") + assert not windows.winproxy.lstrcmpA("LOL", "LOL") \ No newline at end of file diff --git a/windows/crypto/certificate.py b/windows/crypto/certificate.py index a136c83..0b115a5 100644 --- a/windows/crypto/certificate.py +++ b/windows/crypto/certificate.py @@ -115,7 +115,7 @@ class CertificateStore(gdef.HCERTSTORE): while True: try: cert = winproxy.CertEnumCertificatesInStore(self, last) - except winproxy.Kernel32Error as e: + except winproxy.WinproxyError as e: if (e.winerror & 0xffffffff) in (gdef.CRYPT_E_NOT_FOUND,): return tuple(res) raise diff --git a/windows/crypto/encrypt_decrypt.py b/windows/crypto/encrypt_decrypt.py index 5210873..9936e1e 100644 --- a/windows/crypto/encrypt_decrypt.py +++ b/windows/crypto/encrypt_decrypt.py @@ -96,7 +96,7 @@ def encrypt(cert_or_certlist, msg, algo=szOID_NIST_AES256_CBC, initvector=genini def decrypt(cert_store, encrypted): """Try to decrypt the ``encrypted`` msg with any certificate in ``cert_store``. - If there is no certificate able to decrypt the message ``Kernel32Error(winerror=0x8009200c)`` is raised. + If there is no certificate able to decrypt the message ``WinproxyError(winerror=0x8009200c)`` is raised. :param cert_store: :type cert_store: :class:`CertificateStore` diff --git a/windows/syswow64.py b/windows/syswow64.py index de96ad8..cf0b8bc 100644 --- a/windows/syswow64.py +++ b/windows/syswow64.py @@ -10,7 +10,7 @@ import windows.native_exec.simple_x64 as x64 from generated_def.winstructs import * from windows.winobject import process from windows import winproxy -from winproxy import NeededParameter, NtdllProxy, error_ntstatus +from winproxy import NeededParameter # Special code for syswow64 process CS_32bits = 0x23 @@ -239,7 +239,7 @@ def ntquerysysteminformation_syswow64_error_check(result, func, args): # Ignore STATUS_INFO_LENGTH_MISMATCH if SystemInformation is None if result == STATUS_INFO_LENGTH_MISMATCH and not args[1]: return args - raise Kernel32Error("{0} failed with NTStatus {1}".format(func_name, hex(result))) + raise WinproxyError("{0} failed with NTStatus {1}".format(func_name, hex(result))) @Syswow64ApiProxy(winproxy.NtQuerySystemInformation, errcheck=ntquerysysteminformation_syswow64_error_check) # @Syswow64ApiProxy(winproxy.NtQuerySystemInformation) diff --git a/windows/utils/winutils.py b/windows/utils/winutils.py index 3a69fd3..8f7aa55 100644 --- a/windows/utils/winutils.py +++ b/windows/utils/winutils.py @@ -37,7 +37,7 @@ def get_remote_func_addr(target, dll_name, func_name): def is_wow_64(hProcess): try: fnIsWow64Process = get_func_addr("kernel32.dll", "IsWow64Process") - except winproxy.Kernel32Error: + except winproxy.WinproxyError: return False IsWow64Process = ctypes.WINFUNCTYPE(BOOL, HANDLE, ctypes.POINTER(BOOL))(fnIsWow64Process) Wow64Process = BOOL() @@ -328,7 +328,7 @@ def ntstatus(code): def get_long_path(path): """Return the long path form for ``path``. - :raise: :class:`~windows.winproxy.Kernel32Error` if ``path`` does not exists + :raise: :class:`~windows.winproxy.WinproxyError` if ``path`` does not exists :param path: a valid Windows path :type path: :class:`str` | :obj:`unicode` :returns: :class:`str` | :obj:`unicode` -- same type as ``path`` parameter @@ -346,7 +346,7 @@ def get_long_path(path): def get_short_path(path): """Return the short path form for ``path`` - :raise: :class:`~windows.winproxy.Kernel32Error` if ``path`` does not exists + :raise: :class:`~windows.winproxy.WinproxyError` if ``path`` does not exists :param path: a valid Windows path :type path: :class:`str` | :obj:`unicode` :returns: :class:`str` | :obj:`unicode` -- same type as ``path`` parameter diff --git a/windows/winobject/network.py b/windows/winobject/network.py index 13c4fe2..e38e597 100644 --- a/windows/winobject/network.py +++ b/windows/winobject/network.py @@ -415,7 +415,7 @@ class Network(object): size = ctypes.c_uint(0) try: winproxy.GetExtendedTcpTable(None, ctypes.byref(size), ulAf=AF_INET) - except winproxy.IphlpapiError: + except winproxy.WinproxyError: pass # Allow us to set size to the needed value buffer = (ctypes.c_char * size.value)() winproxy.GetExtendedTcpTable(buffer, ctypes.byref(size), ulAf=AF_INET) @@ -427,7 +427,7 @@ class Network(object): size = ctypes.c_uint(0) try: winproxy.GetExtendedTcpTable(None, ctypes.byref(size), ulAf=AF_INET6) - except winproxy.IphlpapiError: + except winproxy.WinproxyError: pass # Allow us to set size to the needed value buffer = (ctypes.c_char * size.value)() winproxy.GetExtendedTcpTable(buffer, ctypes.byref(size), ulAf=AF_INET6) diff --git a/windows/winobject/process.py b/windows/winobject/process.py index 56281ba..6c5f42e 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -25,7 +25,6 @@ from windows.generated_def.winstructs import * from windows.generated_def.ntstatus import NtStatusException from windows.winobject import exception -from windows.winobject import sid from windows.winobject import apisetmap @@ -430,7 +429,7 @@ class Process(utils.AutoHandle): v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=res) except NtStatusException as e: if e.code & 0xffffffff == 0XC000000D: - raise winproxy.Kernel32Error("NtQueryVirtualMemory_32_to_64") + raise winproxy.WinproxyError("NtQueryVirtualMemory_32_to_64") raise return res @@ -451,7 +450,7 @@ class Process(utils.AutoHandle): try: x = self.query_memory(addr) yield x - except winproxy.Kernel32Error: + except winproxy.WinproxyError: return addr += x.RegionSize @@ -533,7 +532,7 @@ class Process(utils.AutoHandle): try: size = winproxy.GetMappedFileNameW(self.handle, addr, buffer, buffer_size) - except winproxy.Kernel32Error as e: + except winproxy.WinproxyError as e: if e.winerror not in (gdef.ERROR_UNEXP_NET_ERR, gdef.ERROR_FILE_INVALID): raise # Raise if error type is not expected: detect mapped aborted transaction return None @@ -573,7 +572,7 @@ class Process(utils.AutoHandle): for i in itertools.count(): try: x = self.read_memory(addr + readden, read_size) - except winproxy.Kernel32Error as e: + except winproxy.WinproxyError as e: if read_size == 2: raise # handle read_wstring at end of page @@ -597,7 +596,7 @@ class Process(utils.AutoHandle): while True: try: x = self.read_memory(addr + readden, read_size) - except winproxy.Kernel32Error as e: + except winproxy.WinproxyError as e: if read_size == 2: raise # handle read_wstring at end of page @@ -1177,7 +1176,7 @@ class Token(utils.AutoHandle): """ mandatory_label = TOKEN_MANDATORY_LABEL() mandatory_label.Label.Attributes = 0x60 - mandatory_label.Label.Sid = sid.EPSID.from_string("S-1-16-{0}".format(integrity)) + mandatory_label.Label.Sid = PSID.from_string("S-1-16-{0}".format(integrity)) self.set_informations(TokenIntegrityLevel, mandatory_label) integrity = property(get_integrity, set_integrity)