mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Clement Rouault
284 lines
9.8 KiB
ReStructuredText
284 lines
9.8 KiB
ReStructuredText
Samples of code
|
|
===============
|
|
|
|
.. _sample_current_process:
|
|
|
|
``windows.current_process``
|
|
"""""""""""""""""""""""""""
|
|
|
|
.. literalinclude:: ..\..\samples\current_process.py
|
|
|
|
Output::
|
|
|
|
(cmd λ) python32.exe current_process.py
|
|
current process is <windows.winobject.CurrentProcess object at 0x026CD190>
|
|
current process is a <32> bits process
|
|
current process is a SysWow64 process ? <True>
|
|
current process pid <7432> and ppid <5412>
|
|
Here are the current process threads: <[<WinThread 5264 owner "python.exe" at 0x28563f0>]>
|
|
Let's execute some native code ! (0x41 + 1)
|
|
Waiting for execution to finish !
|
|
Native code returned <0x42L>
|
|
Allocating memory in current process
|
|
Allocated memory is at <0x3f0000>
|
|
Writing 'SOME STUFF' in allocation memory
|
|
Reading memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
|
|
.. _sample_remote_process:
|
|
|
|
Remote process : :class:`WinProcess`
|
|
""""""""""""""""""""""""""""""""""""
|
|
|
|
.. literalinclude:: ..\..\samples\remote_calc.py
|
|
|
|
Output::
|
|
|
|
(cmd λ) python.exe remote_calc.py
|
|
Creating a calc
|
|
Looking for calcs in the processes
|
|
They are currently <1> calcs running on the system
|
|
Let's play with our calc: <<WinProcess "calc.exe" pid 8052 at 0x27bd5d0>>
|
|
Our calc pid is 8052
|
|
Our calc is a <32> bits process
|
|
Our calc is a SysWow64 process ? <True>
|
|
Our calc have threads ! <[<WinThread 8552 owner "calc.exe" at 0x27f7f30>, <WinThread 3464 owner "calc.exe" at 0x27f7f80>, <WinThread 3840 owner "calc.exe" at 0x27fa030>]>
|
|
Exploring our calc PEB ! <windows.winobject.RemotePEB object at 0x026DDD00>
|
|
Command line is <RemoteWinUnicodeString ""C:\windows\system32\calc.exe"" at 0x26ddee0>
|
|
Here are 3 loaded modules: [<RemoteLoadedModule "calc.exe" at 0x26dde40>, <RemoteLoadedModule "ntdll.dll" at 0x26ddf30>, <RemoteLoadedModule "kernel32.dll" at 0x26ddc60>]
|
|
Allocating memory in our calc
|
|
Allocated memory is at <0x5c90000>
|
|
Writing 'SOME STUFF' in allocated memory
|
|
Reading allocated memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
Execution some native code in our calc (write 0x424242 at allocated address + return 0x1337
|
|
Executing native code !
|
|
Return code = 0x1337L
|
|
Reading allocated memory : <'BBBB STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
Executing python code !
|
|
Reading allocated memory : <'HELLO FROM CALC\x00\x00\x00\x00\x00'>
|
|
Trying to import in remote module 'FAKE_MODULE'
|
|
Remote ERROR !
|
|
Traceback (most recent call last):
|
|
File "<string>", line 3, in <module>
|
|
File "<string>", line 2, in func
|
|
ImportError: No module named FAKE_MODULE
|
|
|
|
That's all ! killing the calc
|
|
|
|
|
|
.. _sample_peb_exploration:
|
|
|
|
:class:`PEB` exploration
|
|
""""""""""""""""""""""""
|
|
|
|
.. literalinclude:: ..\..\samples\peb.py
|
|
|
|
Output::
|
|
|
|
(cmd λ) python.exe peb.py
|
|
Exploring the current process PEB
|
|
PEB is <<windows.winobject.PEB object at 0x02649B70>>
|
|
Commandline object is <WinUnicodeString "python.exe peb.py " at 0x2649c60>
|
|
Commandline string is u'python.exe peb.py '
|
|
Imagepath <WinUnicodeString "C:\Python27\python.exe" at 0x2649d50>
|
|
Printing some modules: <LoadedModule "python.exe" at 0x272a030>
|
|
<LoadedModule "ntdll.dll" at 0x272a080>
|
|
<LoadedModule "kernel32.dll" at 0x272acb0>
|
|
<LoadedModule "kernelbase.dll" at 0x272ad00>
|
|
<LoadedModule "python27.dll" at 0x272ad50>
|
|
<LoadedModule "msvcr90.dll" at 0x272ada0>
|
|
=== K32 ===
|
|
Looking for kernel32.dll
|
|
Kernel32 module: <LoadedModule "kernel32.dll" at 0x272acb0>
|
|
Module name = <kernel32.dll> | Fullname = <C:\Windows\SYSTEM32\KERNEL32.DLL>
|
|
Kernel32 is loaded at address 0x774c0000
|
|
=== K32 PE ===
|
|
PE Representation of k32: <windows.pe_parse.PEFile object at 0x0272D350>
|
|
Here are some exports {0: 2001566688L, u'CreateFileA': 2001635616L, 42: 2001647872L, u'VirtualAlloc': 2001570704L}
|
|
Import DLL dependancies are (without api-*): [u'ntdll.dll', u'kernelbase.dll']
|
|
IAT Entry for ntdll!NtCreateFile = <IATEntry "NtCreateFile" ordinal 253> | addr = 0x77541128L
|
|
Sections: [<PESection ".text">, <PESection ".rdata">, <PESection ".data">, <PESection ".rsrc">, <PESection ".reloc">]
|
|
|
|
|
|
.. _sample_iat_hook:
|
|
|
|
IAT hooking
|
|
"""""""""""
|
|
|
|
.. literalinclude:: ..\..\samples\iat_hook.py
|
|
|
|
Output::
|
|
|
|
(cmd λ) python iat_hook.py
|
|
Asking for <MY_SECRET_KEY>
|
|
<in hook> Hook called | hKey = 0x12d687 | lpSubKey = <MY_SECRET_KEY>
|
|
<in hook> Secret key asked, returning magic handle 0x12345678
|
|
Result = 0x12345678
|
|
|
|
Asking for <MY_FAIL_KEY>
|
|
<in hook> Hook called | hKey = 0x12d687 | lpSubKey = <MY_FAIL_KEY>
|
|
<in hook> Asked for a failing key: returning 0x2a
|
|
WindowsError(42, 'Windows Error 0x2A')
|
|
|
|
Asking for <HKEY_CURRENT_USER/Software>
|
|
<in hook> Hook called | hKey = 0x80000001L | lpSubKey = <Software>
|
|
<in hook> Non-secret key : calling normal function
|
|
Result = 0x108
|
|
|
|
.. _sample_network_exploration:
|
|
|
|
:class:`Network` - socket exploration
|
|
"""""""""""""""""""""""""""""""""""""
|
|
|
|
.. literalinclude:: ..\..\samples\network.py
|
|
|
|
Output::
|
|
|
|
(cmd λ) python.exe network.py
|
|
Working on ipv4
|
|
== Listening ==
|
|
Some listening connections: [<TCP IPV4 Listening socket on 0.0.0.0:80>, <TCP IPV4 Listening socket on 0.0.0.0:135>, <TCP IPV4 Listening socket on 0.0.0.0:443>]
|
|
Listening ports are : [80, 135, 443, 445, 902, 912, 5357, 49152, 49153, 49154, 49155, 49157, 49159, 8307, 25340, 139, 139]
|
|
== Established ==
|
|
Some established connections: [<TCP IPV4 Connection 127.0.0.1:25340 -> 127.0.0.1:49472>, <TCP IPV4 Connection 127.0.0.1:49173 -> 127.0.0.1:49174>, <TCP IPV4 Connection 127.0.0.1:49174 -> 127.0.0.1:49173>]
|
|
== connection to localhost:80 ==
|
|
Our connection is [<TCP IPV4 Connection 127.0.0.1:49616 -> 127.0.0.1:80>]
|
|
Sending YOP
|
|
Closing socket
|
|
Sending LAIT
|
|
Traceback (most recent call last):
|
|
File ".\network.py", line 45, in <module>
|
|
s.send("LAIT")
|
|
socket.error: [Errno 10054] An existing connection was forcibly closed by the remote host
|
|
|
|
|
|
.. _sample_registry:
|
|
|
|
:class:`Registry`
|
|
"""""""""""""""""
|
|
|
|
.. literalinclude:: ..\..\samples\registry.py
|
|
|
|
Output::
|
|
|
|
(cmd λ) python.exe registry.py
|
|
Registry is <<windows.registry.Registry object at 0x02941290>>
|
|
HKEY_CURRENT_USER is <<PyHKey "HKEY_CURRENT_USER">>
|
|
HKEY_CURRENT_USER subkeys names are:
|
|
['AppEvents',
|
|
'AppXBackupContentType',
|
|
'Console',
|
|
'Control Panel',
|
|
'Environment',
|
|
'EUDC',
|
|
'Identities',
|
|
'Keyboard Layout',
|
|
'Network',
|
|
'Printers',
|
|
'Software',
|
|
'System',
|
|
'Volatile Environment']
|
|
Opening 'Software' in HKEY_CURRENT_USER: <PyHKey "HKEY_CURRENT_USER\Software">
|
|
We can also open it in one access: <PyHKey "HKEY_CURRENT_USER\Sofware">
|
|
Looking at CurrentVersion
|
|
Key is <PyHKey "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion">
|
|
values are:
|
|
[KeyValue(name='SoftwareType', value=u'System', type=1),
|
|
KeyValue(name='RegisteredOwner', value=u'hakril', type=1),
|
|
KeyValue(name='InstallDate', value=0, type=4),
|
|
...
|
|
KeyValue(name='PathName', value=u'C:\\Windows', type=1)]
|
|
registered owner = <KeyValue(name='RegisteredOwner', value=u'hakril', type=1)>
|
|
|
|
|
|
.. _sample_vectoredexception:
|
|
|
|
:func:`VectoredException`
|
|
"""""""""""""""""""""""""
|
|
|
|
In local process
|
|
''''''''''''''''
|
|
|
|
.. literalinclude:: ..\..\samples\veh_segv.py
|
|
|
|
Output::
|
|
|
|
(cmd λ) python.exe veh_segv.py
|
|
Protected page is at <0x1db0000>
|
|
Setting page protection to <PAGE_NOACCESS>
|
|
|
|
==Entry of VEH handler==
|
|
Instr at 0x1d1ab574 accessed to addr 0x1db0000
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
==Entry of VEH handler==
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_NOACCESS>
|
|
Value 1 read
|
|
|
|
==Entry of VEH handler==
|
|
Instr at 0x1d1ab574 accessed to addr 0x1db0010
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
==Entry of VEH handler==
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_NOACCESS>
|
|
Value 2 read
|
|
|
|
|
|
In remote process
|
|
'''''''''''''''''
|
|
|
|
.. literalinclude:: ..\..\samples\remote_veh_segv.py
|
|
|
|
Output::
|
|
|
|
(cmd λ) python .exe.\samples\remote_veh_segv.py
|
|
(In another console)
|
|
|
|
Tracing execution in module: <gdi32.dll>
|
|
Protected page is at 0x7ffa3c700000L
|
|
|
|
Instr at 0x7ffa3c70f0f0L accessed to addr 0x7ffa3c70f0f0L (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0f5L accessed to addr 0x7ffa3c70f0f5L (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0faL accessed to addr 0x7ffa3c70f0faL (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0ffL accessed to addr 0x7ffa3c70f0ffL (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f100L accessed to addr 0x7ffa3c70f100L (gdi32.dll)
|
|
No more tracing !
|
|
|
|
|
|
.. _sample_debugger:
|
|
|
|
Debugging
|
|
"""""""""
|
|
|
|
.. literalinclude:: ..\..\samples\debugger.py
|
|
|
|
Ouput::
|
|
|
|
(cmd λ) python.exe .\samples\debugger.py
|
|
Loading <KERNEL32.DLL>
|
|
Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77a73bad
|
|
Loading <C:\Windows\system32\IMM32.DLL>
|
|
Loading <C:\Windows\system32\uxtheme.dll>
|
|
Loading <C:\Windows\system32\uxtheme.dll>
|
|
Loading <C:\Windows\system32\uxtheme.dll>
|
|
Loading <C:\Windows\system32\uxtheme.dll>
|
|
Loading <kernel32.dll>
|
|
Loading <C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.17415_none_dad8722c5bcc2d8f\gdiplus.dll>
|
|
Loading <comctl32.dll>
|
|
Loading <comctl32.dll>
|
|
Loading <comctl32.dll>
|
|
Loading <C:\Windows\system32\shell32.dll>
|
|
Loading <C:\Windows\SYSTEM32\WINMM.dll>
|
|
Loading <C:\Windows\system32\ole32.dll>
|
|
Ask to load <ole32.dll>: exiting process |