mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
hakril
2588 lines
383 KiB
HTML
2588 lines
383 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
|
|
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|
|
|
<title>16. Samples of code — PythonForWindows 0.3 documentation</title>
|
|
|
|
<link rel="stylesheet" href="_static/classic.css" type="text/css" />
|
|
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
|
|
|
|
<script type="text/javascript">
|
|
var DOCUMENTATION_OPTIONS = {
|
|
URL_ROOT: './',
|
|
VERSION: '0.3',
|
|
COLLAPSE_INDEX: false,
|
|
FILE_SUFFIX: '.html',
|
|
HAS_SOURCE: true,
|
|
SOURCELINK_SUFFIX: '.txt'
|
|
};
|
|
</script>
|
|
<script type="text/javascript" src="_static/jquery.js"></script>
|
|
<script type="text/javascript" src="_static/underscore.js"></script>
|
|
<script type="text/javascript" src="_static/doctools.js"></script>
|
|
<link rel="index" title="Index" href="genindex.html" />
|
|
<link rel="search" title="Search" href="search.html" />
|
|
<link rel="prev" title="15. Internals" href="internals.html" />
|
|
</head>
|
|
<body role="document">
|
|
<div class="related" role="navigation" aria-label="related navigation">
|
|
<h3>Navigation</h3>
|
|
<ul>
|
|
<li class="right" style="margin-right: 10px">
|
|
<a href="genindex.html" title="General Index"
|
|
accesskey="I">index</a></li>
|
|
<li class="right" >
|
|
<a href="py-modindex.html" title="Python Module Index"
|
|
>modules</a> |</li>
|
|
<li class="right" >
|
|
<a href="internals.html" title="15. Internals"
|
|
accesskey="P">previous</a> |</li>
|
|
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.3 documentation</a> »</li>
|
|
</ul>
|
|
</div>
|
|
|
|
<div class="document">
|
|
<div class="documentwrapper">
|
|
<div class="bodywrapper">
|
|
<div class="body" role="main">
|
|
|
|
<div class="section" id="samples-of-code">
|
|
<h1>16. Samples of code<a class="headerlink" href="#samples-of-code" title="Permalink to this headline">¶</a></h1>
|
|
<div class="section" id="processes">
|
|
<h2>16.1. Processes<a class="headerlink" href="#processes" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="windows-current-process">
|
|
<span id="sample-current-process"></span><h3>16.1.1. <code class="docutils literal"><span class="pre">windows.current_process</span></code><a class="headerlink" href="#windows-current-process" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
|
|
<span class="c1"># Here is our current process</span>
|
|
<span class="n">cp</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"current process is </span><span class="si">{cp}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"current process is a <</span><span class="si">{cp.bitness}</span><span class="s2">> bits process"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"current process is a SysWow64 process ? <</span><span class="si">{cp.is_wow_64}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"current process pid <</span><span class="si">{cp.pid}</span><span class="s2">> and ppid <</span><span class="si">{cp.ppid}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Here are the current process threads: <</span><span class="si">{cp.threads}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Let's execute some native code ! (0x41 + 1)"</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
|
|
<span class="c1"># Let's generate some native code</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"Eax"</span><span class="p">,</span> <span class="mh">0x41</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Inc</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"RAX"</span><span class="p">,</span> <span class="mh">0x41</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Inc</span><span class="p">(</span><span class="s2">"RAX"</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
|
|
<span class="n">native_code</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
|
|
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">native_code</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Native code returned <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Allocating memory in current process"</span><span class="p">)</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">cp</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span> <span class="c1"># Default alloc is RWX (so secure !)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Allocated memory is at <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">addr</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Writing 'SOME STUFF' in allocation memory"</span><span class="p">)</span>
|
|
<span class="n">cp</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="s2">"SOME STUFF"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Reading memory : <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">cp</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python32.exe process\current_process.py
|
|
current process is <windows.winobject.process.CurrentProcess object at 0x030A2590>
|
|
current process is a <32> bits process
|
|
current process is a SysWow64 process ? <True>
|
|
current process pid <8264> and ppid <4100>
|
|
Here are the current process threads: <[<WinThread 13540 owner "python.exe" at 0x32d3210>]>
|
|
Let's execute some native code ! (0x41 + 1)
|
|
Native code returned <0x42>
|
|
Allocating memory in current process
|
|
Allocated memory is at <0xd60000>
|
|
Writing 'SOME STUFF' in allocation memory
|
|
Reading memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="remote-process-winprocess">
|
|
<span id="sample-remote-process"></span><h3>16.1.2. Remote process : <code class="xref py py-class docutils literal"><span class="pre">WinProcess</span></code><a class="headerlink" href="#remote-process-winprocess" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating a notepad"</span><span class="p">)</span> <span class="c1">## Replaced calc.exe by notepad.exe cause of windows 10.</span>
|
|
<span class="n">notepad</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">create_process</span><span class="p">(</span><span class="sa">r</span><span class="s2">"C:\windows\system32\notepad.exe"</span><span class="p">)</span>
|
|
<span class="c1"># You don't need to do that in our case, but it's useful to now</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for notepads in the processes"</span><span class="p">)</span>
|
|
<span class="n">all_notepads</span> <span class="o">=</span> <span class="p">[</span><span class="n">proc</span> <span class="k">for</span> <span class="n">proc</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span> <span class="k">if</span> <span class="n">proc</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">"notepad.exe"</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"They are currently <</span><span class="si">{0}</span><span class="s2">> notepads running on the system"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">all_notepads</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Let's play with our notepad: <</span><span class="si">{notepad}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our notepad pid is </span><span class="si">{notepad.pid}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our notepad is a <</span><span class="si">{notepad.bitness}</span><span class="s2">> bits process"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our notepad is a SysWow64 process ? <</span><span class="si">{notepad.is_wow_64}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our notepad have threads ! <</span><span class="si">{notepad.threads}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
|
|
<span class="c1"># PEB STUFF</span>
|
|
<span class="n">peb</span> <span class="o">=</span> <span class="n">notepad</span><span class="o">.</span><span class="n">peb</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exploring our notepad PEB ! </span><span class="si">{peb}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="o">=</span><span class="n">peb</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Command line is </span><span class="si">{peb.commandline}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="o">=</span><span class="n">peb</span><span class="p">))</span>
|
|
<span class="n">modules</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Here are 3 loaded modules: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">modules</span><span class="p">[:</span><span class="mi">3</span><span class="p">]))</span>
|
|
<span class="c1"># See iat_hook.py for module exploration</span>
|
|
|
|
|
|
<span class="c1"># Remote alloc / read / write</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Allocating memory in our notepad"</span><span class="p">)</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">notepad</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Allocated memory is at <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">addr</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Writing 'SOME STUFF' in allocated memory"</span><span class="p">)</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="s2">"SOME STUFF"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Reading allocated memory : <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">notepad</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
|
|
|
|
|
|
<span class="c1"># Remote Execution</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)"</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">notepad</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
|
|
<span class="c1"># Let's generate some native code</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">addr</span><span class="p">),</span> <span class="mh">0x42424242</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">,</span> <span class="mh">0x1337</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">'RAX'</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">"[RAX]"</span><span class="p">),</span> <span class="mh">0x42424242</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"RAX"</span><span class="p">,</span> <span class="mh">0x1337</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Executing native code !"</span><span class="p">)</span>
|
|
<span class="n">t</span> <span class="o">=</span> <span class="n">notepad</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">code</span><span class="o">.</span><span class="n">get_code</span><span class="p">())</span>
|
|
<span class="n">t</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Return code = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">t</span><span class="o">.</span><span class="n">exit_code</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Reading allocated memory : <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">notepad</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Executing python code !"</span><span class="p">)</span>
|
|
<span class="c1"># Make 'windows' importable in remote python</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">"import sys; sys.path.append(r'</span><span class="si">{0}</span><span class="s2">')"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="p">[</span><span class="o">-</span><span class="mi">1</span><span class="p">]))</span>
|
|
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">"import windows"</span><span class="p">)</span>
|
|
<span class="c1"># Let's write in the notepad 'current_process' memory :)</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">"addr = </span><span class="si">{addr}</span><span class="s2">; windows.current_process.write_memory(addr, 'HELLO FROM notepad')"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">addr</span><span class="o">=</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Reading allocated memory : <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">notepad</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
|
|
|
|
<span class="c1"># python_execute is 'safe':</span>
|
|
<span class="c1"># - it waits for the thread completion</span>
|
|
<span class="c1"># - it raise an error if remote code raised some</span>
|
|
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Trying to import in remote module 'FAKE_MODULE'"</span><span class="p">)</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">"def func():</span><span class="se">\n</span><span class="s2"> import FAKE_MODULE</span><span class="se">\n</span><span class="s2">func()"</span><span class="p">)</span>
|
|
<span class="k">except</span> <span class="n">windows</span><span class="o">.</span><span class="n">injection</span><span class="o">.</span><span class="n">RemotePythonError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Remote ERROR !"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">e</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"That's all ! killing the notepad"</span><span class="p">)</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe process\remote_process.py
|
|
Creating a notepad
|
|
Looking for notepads in the processes
|
|
They are currently <1> notepads running on the system
|
|
Let's play with our notepad: <<WinProcess "notepad.exe" pid 2044 at 0x40ce850>>
|
|
Our notepad pid is 2044
|
|
Our notepad is a <32> bits process
|
|
Our notepad is a SysWow64 process ? <True>
|
|
Our notepad have threads ! <[<WinThread 7700 owner "notepad.exe" at 0x41faee0>, <WinThread 7264 owner "notepad.exe" at 0x41faf30>, ...]>
|
|
Exploring our notepad PEB ! <windows.winobject.process.RemotePEB object at 0x03F6CDA0>
|
|
Command line is <RemoteWinUnicodeString ""C:\windows\system32\notepad.exe"" at 0x3f6cf80>
|
|
Here are 3 loaded modules: [<RemoteLoadedModule "notepad.exe" at 0x3f6cf30>, <RemoteLoadedModule "ntdll.dll" at 0x3f6ce40>, <RemoteLoadedModule "kernel32.dll" at 0x3f6cee0>]
|
|
Allocating memory in our notepad
|
|
Allocated memory is at <0x6f80000>
|
|
Writing 'SOME STUFF' in allocated memory
|
|
Reading allocated memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)
|
|
Executing native code !
|
|
Return code = 0x1337L
|
|
Reading allocated memory : <'BBBB STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
Executing python code !
|
|
Reading allocated memory : <'HELLO FROM notepad\x00\x00'>
|
|
Trying to import in remote module 'FAKE_MODULE'
|
|
Remote ERROR !
|
|
Traceback (most recent call last):
|
|
File "<string>", line 3, in <module>
|
|
File "<string>", line 2, in func
|
|
ImportError: No module named FAKE_MODULE
|
|
|
|
That's all ! killing the notepad
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="peb-exploration">
|
|
<span id="sample-peb-exploration"></span><h3>16.1.3. <code class="xref py py-class docutils literal"><span class="pre">PEB</span></code> exploration<a class="headerlink" href="#peb-exploration" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exploring the current process PEB"</span><span class="p">)</span>
|
|
<span class="n">peb</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"PEB is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="p">))</span>
|
|
<span class="n">commandline</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">commandline</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Commandline object is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">commandline</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Commandline string is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">commandline</span><span class="o">.</span><span class="n">Buffer</span><span class="p">)))</span>
|
|
|
|
<span class="n">imagepath</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">imagepath</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Imagepath </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">imagepath</span><span class="p">))</span>
|
|
|
|
<span class="n">modules</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Printing some modules: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"</span><span class="se">\n</span><span class="s2">"</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="nb">str</span><span class="p">(</span><span class="n">m</span><span class="p">)</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">modules</span><span class="p">[:</span><span class="mi">6</span><span class="p">])))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"=== K32 ==="</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for kernel32.dll"</span><span class="p">)</span>
|
|
<span class="n">k32</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">"kernel32.dll"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Kernel32 module: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Module name = <</span><span class="si">{0}</span><span class="s2">> | Fullname = <</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="n">k32</span><span class="o">.</span><span class="n">fullname</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Kernel32 is loaded at address </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">k32</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"=== K32 PE ==="</span><span class="p">)</span>
|
|
<span class="n">k32pe</span> <span class="o">=</span> <span class="n">k32</span><span class="o">.</span><span class="n">pe</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"PE Representation of k32: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32pe</span><span class="p">))</span>
|
|
<span class="n">exports</span> <span class="o">=</span> <span class="n">k32pe</span><span class="o">.</span><span class="n">exports</span>
|
|
<span class="n">some_exports</span> <span class="o">=</span> <span class="nb">dict</span><span class="p">((</span><span class="n">k</span><span class="p">,</span><span class="n">v</span><span class="p">)</span> <span class="k">for</span> <span class="n">k</span><span class="p">,</span><span class="n">v</span> <span class="ow">in</span> <span class="n">exports</span><span class="o">.</span><span class="n">items</span><span class="p">()</span> <span class="k">if</span> <span class="n">k</span> <span class="ow">in</span> <span class="p">[</span><span class="mi">0</span><span class="p">,</span> <span class="mi">42</span><span class="p">,</span> <span class="s2">"VirtualAlloc"</span><span class="p">,</span> <span class="s2">"CreateFileA"</span><span class="p">])</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Here are some exports </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">some_exports</span><span class="p">))</span>
|
|
|
|
<span class="n">imports</span> <span class="o">=</span> <span class="n">k32pe</span><span class="o">.</span><span class="n">imports</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Import DLL dependancies are (without api-*): </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">x</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">imports</span><span class="o">.</span><span class="n">keys</span><span class="p">()</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">x</span><span class="o">.</span><span class="n">startswith</span><span class="p">(</span><span class="s2">"api-"</span><span class="p">)]))</span>
|
|
|
|
<span class="n">NtCreateFile_iat</span> <span class="o">=</span> <span class="p">[</span><span class="n">x</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">imports</span><span class="p">[</span><span class="s2">"ntdll.dll"</span><span class="p">]</span> <span class="k">if</span> <span class="n">x</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">"NtCreateFile"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"IAT Entry for ntdll!NtCreateFile = </span><span class="si">{0}</span><span class="s2"> | addr = </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">NtCreateFile_iat</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="n">NtCreateFile_iat</span><span class="o">.</span><span class="n">addr</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Sections: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32pe</span><span class="o">.</span><span class="n">sections</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe process\peb.py
|
|
Exploring the current process PEB
|
|
PEB is <<windows.winobject.PEB object at 0x02649B70>>
|
|
Commandline object is <WinUnicodeString "python.exe peb.py " at 0x2649c60>
|
|
Commandline string is u'python.exe peb.py '
|
|
Imagepath <WinUnicodeString "C:\Python27\python.exe" at 0x2649d50>
|
|
Printing some modules: <LoadedModule "python.exe" at 0x272a030>
|
|
<LoadedModule "ntdll.dll" at 0x272a080>
|
|
<LoadedModule "kernel32.dll" at 0x272acb0>
|
|
<LoadedModule "kernelbase.dll" at 0x272ad00>
|
|
<LoadedModule "python27.dll" at 0x272ad50>
|
|
<LoadedModule "msvcr90.dll" at 0x272ada0>
|
|
=== K32 ===
|
|
Looking for kernel32.dll
|
|
Kernel32 module: <LoadedModule "kernel32.dll" at 0x272acb0>
|
|
Module name = <kernel32.dll> | Fullname = <C:\Windows\SYSTEM32\KERNEL32.DLL>
|
|
Kernel32 is loaded at address 0x774c0000
|
|
=== K32 PE ===
|
|
PE Representation of k32: <windows.pe_parse.PEFile object at 0x0272D350>
|
|
Here are some exports {0: 2001566688L, u'CreateFileA': 2001635616L, 42: 2001647872L, u'VirtualAlloc': 2001570704L}
|
|
Import DLL dependancies are (without api-*): [u'ntdll.dll', u'kernelbase.dll']
|
|
IAT Entry for ntdll!NtCreateFile = <IATEntry "NtCreateFile" ordinal 253> | addr = 0x77541128L
|
|
Sections: [<PESection ".text">, <PESection ".rdata">, <PESection ".data">, <PESection ".rsrc">, <PESection ".reloc">]
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="iat-hooking">
|
|
<span id="sample-iat-hook"></span><h3>16.1.4. IAT hooking<a class="headerlink" href="#iat-hooking" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">_winreg</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="c1"># Here is a demo of IAT hooking in python</span>
|
|
<span class="c1"># We will hook the 'RegOpenKeyExA' entry of Python27.dll because it is easy to trigger !</span>
|
|
|
|
<span class="c1"># First: let's create our hook</span>
|
|
<span class="c1"># windows.hooks.RegOpenKeyExACallback is generated based on windows.generated_def.winfuncs</span>
|
|
<span class="nd">@windows</span><span class="o">.</span><span class="n">hooks</span><span class="o">.</span><span class="n">RegOpenKeyExACallback</span>
|
|
<span class="k">def</span> <span class="nf">open_reg_hook</span><span class="p">(</span><span class="n">hKey</span><span class="p">,</span> <span class="n">lpSubKey</span><span class="p">,</span> <span class="n">ulOptions</span><span class="p">,</span> <span class="n">samDesired</span><span class="p">,</span> <span class="n">phkResult</span><span class="p">,</span> <span class="n">real_function</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<in hook> Hook called | hKey = </span><span class="si">{0}</span><span class="s2"> | lpSubKey = <</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">hKey</span><span class="p">),</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="c1"># Our hook can choose to call the real_function or not</span>
|
|
<span class="k">if</span> <span class="s2">"SECRET"</span> <span class="ow">in</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<in hook> Secret key asked, returning magic handle 0x12345678"</span><span class="p">)</span>
|
|
<span class="c1"># We must respect the hooked method return-value interface</span>
|
|
<span class="n">phkResult</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="mh">0x12345678</span>
|
|
<span class="k">return</span> <span class="mi">0</span>
|
|
<span class="k">if</span> <span class="s2">"FAIL"</span> <span class="ow">in</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<in hook> Asked for a failing key: returning 0x2a"</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="mi">42</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<in hook> Non-secret key : calling normal function"</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">real_function</span><span class="p">()</span>
|
|
|
|
|
|
<span class="c1"># Get the peb of our process</span>
|
|
<span class="n">peb</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span>
|
|
|
|
<span class="c1"># Get the pythonxx.dll module</span>
|
|
<span class="n">pythondll_module</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">startswith</span><span class="p">(</span><span class="s2">"python"</span><span class="p">)</span> <span class="ow">and</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">".dll"</span><span class="p">)][</span><span class="mi">0</span><span class="p">]</span>
|
|
|
|
<span class="c1"># Get the iat entries for DLL advapi32.dll</span>
|
|
<span class="n">adv_imports</span> <span class="o">=</span> <span class="n">pythondll_module</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">imports</span><span class="p">[</span><span class="s1">'advapi32.dll'</span><span class="p">]</span>
|
|
|
|
<span class="c1"># Get RegOpenKeyExA iat entry</span>
|
|
<span class="n">RegOpenKeyExA_iat</span> <span class="o">=</span> <span class="p">[</span><span class="n">n</span> <span class="k">for</span> <span class="n">n</span> <span class="ow">in</span> <span class="n">adv_imports</span> <span class="k">if</span> <span class="n">n</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">"RegOpenKeyExA"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
|
|
<span class="c1"># Setup our hook</span>
|
|
<span class="n">RegOpenKeyExA_iat</span><span class="o">.</span><span class="n">set_hook</span><span class="p">(</span><span class="n">open_reg_hook</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Use python native module _winreg that call 'RegOpenKeyExA'</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Asking for <MY_SECRET_KEY>"</span><span class="p">)</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="mi">1234567</span><span class="p">,</span> <span class="s2">"MY_SECRET_KEY"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Result = "</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Asking for <MY_FAIL_KEY>"</span><span class="p">)</span>
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="mi">1234567</span><span class="p">,</span> <span class="s2">"MY_FAIL_KEY"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Result = "</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
|
|
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Asking for <HKEY_CURRENT_USER/Software>"</span><span class="p">)</span>
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="n">_winreg</span><span class="o">.</span><span class="n">HKEY_CURRENT_USER</span><span class="p">,</span> <span class="s2">"Software"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Result = "</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
|
|
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">process</span>\<span class="n">iat_hook</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Asking</span> <span class="k">for</span> <span class="o"><</span><span class="n">MY_SECRET_KEY</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x12d687</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o"><</span><span class="n">MY_SECRET_KEY</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Secret</span> <span class="n">key</span> <span class="n">asked</span><span class="p">,</span> <span class="n">returning</span> <span class="n">magic</span> <span class="n">handle</span> <span class="mh">0x12345678</span>
|
|
<span class="n">Result</span> <span class="o">=</span> <span class="mh">0x12345678</span>
|
|
|
|
<span class="n">Asking</span> <span class="k">for</span> <span class="o"><</span><span class="n">MY_FAIL_KEY</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x12d687</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o"><</span><span class="n">MY_FAIL_KEY</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Asked</span> <span class="k">for</span> <span class="n">a</span> <span class="n">failing</span> <span class="n">key</span><span class="p">:</span> <span class="n">returning</span> <span class="mh">0x2a</span>
|
|
<span class="ne">WindowsError</span><span class="p">(</span><span class="mi">42</span><span class="p">,</span> <span class="s1">'Windows Error 0x2A'</span><span class="p">)</span>
|
|
|
|
<span class="n">Asking</span> <span class="k">for</span> <span class="o"><</span><span class="n">HKEY_CURRENT_USER</span><span class="o">/</span><span class="n">Software</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x80000001</span><span class="n">L</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o"><</span><span class="n">Software</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Non</span><span class="o">-</span><span class="n">secret</span> <span class="n">key</span> <span class="p">:</span> <span class="n">calling</span> <span class="n">normal</span> <span class="n">function</span>
|
|
<span class="n">Result</span> <span class="o">=</span> <span class="mh">0x108</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-system">
|
|
<span id="sample-system"></span><h2>16.2. <code class="docutils literal"><span class="pre">windows.system</span></code><a class="headerlink" href="#windows-system" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="n">system</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Basic system infos:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" version = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">version</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" bitness = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" computer_name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">computer_name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" product_type = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">product_type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" version_name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">version_name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"There is </span><span class="si">{0}</span><span class="s2"> processes"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"There is </span><span class="si">{0}</span><span class="s2"> threads"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">threads</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Dumping first logical drive:"</span><span class="p">)</span>
|
|
<span class="n">drive</span> <span class="o">=</span> <span class="n">system</span><span class="o">.</span><span class="n">logicaldrives</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">drive</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"type = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"path = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">path</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Dumping first service:"</span><span class="p">)</span>
|
|
<span class="n">serv</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">services</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">serv</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"description = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">description</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"status = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">status</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"process = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">process</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Finding a service in a user process:"</span><span class="p">)</span>
|
|
<span class="n">serv</span> <span class="o">=</span> <span class="p">[</span><span class="n">s</span> <span class="k">for</span> <span class="n">s</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">services</span> <span class="k">if</span> <span class="n">s</span><span class="o">.</span><span class="n">process</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">serv</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"description = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">description</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"status = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">status</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"process = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">process</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Enumerating handles:"</span><span class="p">)</span>
|
|
<span class="n">handles</span> <span class="o">=</span> <span class="n">system</span><span class="o">.</span><span class="n">handles</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" There are </span><span class="si">{0}</span><span class="s2"> handles:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">handles</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" First handle is: "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">handles</span><span class="p">[</span><span class="mi">0</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Enumerating handles of the current process:"</span><span class="p">)</span>
|
|
<span class="n">cp_handles</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" There are </span><span class="si">{0}</span><span class="s2"> handles for this process"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">cp_handles</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Looking for a File handle:"</span><span class="p">)</span>
|
|
<span class="n">file_h</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">cp_handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">type</span> <span class="o">==</span> <span class="s2">"File"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Handle is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">file_h</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Name is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">file_h</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">system</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Basic</span> <span class="n">system</span> <span class="n">infos</span><span class="p">:</span>
|
|
<span class="n">version</span> <span class="o">=</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="mi">3</span><span class="p">)</span>
|
|
<span class="n">bitness</span> <span class="o">=</span> <span class="mi">64</span>
|
|
<span class="n">computer_name</span> <span class="o">=</span> <span class="n">HAKRIL</span><span class="o">-</span><span class="n">PC</span>
|
|
<span class="n">product_type</span> <span class="o">=</span> <span class="n">VER_NT_WORKSTATION</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="n">version_name</span> <span class="o">=</span> <span class="n">Windows</span> <span class="mf">8.1</span>
|
|
|
|
<span class="n">There</span> <span class="ow">is</span> <span class="mi">117</span> <span class="n">processes</span>
|
|
<span class="n">There</span> <span class="ow">is</span> <span class="mi">1246</span> <span class="n">threads</span>
|
|
|
|
<span class="n">Dumping</span> <span class="n">first</span> <span class="n">logical</span> <span class="n">drive</span><span class="p">:</span>
|
|
<span class="o"><</span><span class="n">LogicalDrive</span> <span class="s2">"C:</span><span class="se">\"</span><span class="s2"> (DRIVE_FIXED)></span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">C</span><span class="p">:</span>\
|
|
<span class="nb">type</span> <span class="o">=</span> <span class="n">DRIVE_FIXED</span><span class="p">(</span><span class="mh">0x3</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="n">path</span> <span class="o">=</span> \<span class="n">Device</span>\<span class="n">HarddiskVolume2</span>
|
|
|
|
<span class="n">Dumping</span> <span class="n">first</span> <span class="n">service</span><span class="p">:</span>
|
|
<span class="o"><</span><span class="n">ServiceA</span> <span class="s2">"ACPI"</span><span class="o">></span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">ACPI</span>
|
|
<span class="n">description</span> <span class="o">=</span> <span class="n">Microsoft</span> <span class="n">ACPI</span> <span class="n">Driver</span>
|
|
<span class="n">status</span> <span class="o">=</span> <span class="n">ServiceStatus</span><span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="n">SERVICE_KERNEL_DRIVER</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">),</span> <span class="n">state</span><span class="o">=</span><span class="n">SERVICE_RUNNING</span><span class="p">(</span><span class="mh">0x4</span><span class="n">L</span><span class="p">),</span> <span class="n">control_accepted</span><span class="o">=</span><span class="mi">1</span><span class="n">L</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="n">process</span> <span class="o">=</span> <span class="kc">None</span>
|
|
|
|
<span class="n">Finding</span> <span class="n">a</span> <span class="n">service</span> <span class="ow">in</span> <span class="n">a</span> <span class="n">user</span> <span class="n">process</span><span class="p">:</span>
|
|
<span class="o"><</span><span class="n">ServiceA</span> <span class="s2">"Appinfo"</span><span class="o">></span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">Appinfo</span>
|
|
<span class="n">description</span> <span class="o">=</span> <span class="n">Application</span> <span class="n">Information</span>
|
|
<span class="n">status</span> <span class="o">=</span> <span class="n">ServiceStatus</span><span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="n">SERVICE_WIN32_SHARE_PROCESS</span><span class="p">(</span><span class="mh">0x20</span><span class="n">L</span><span class="p">),</span> <span class="n">state</span><span class="o">=</span><span class="n">SERVICE_RUNNING</span><span class="p">(</span><span class="mh">0x4</span><span class="n">L</span><span class="p">),</span> <span class="n">control_accepted</span><span class="o">=</span><span class="mi">129</span><span class="n">L</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="n">process</span> <span class="o">=</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"svchost.exe"</span> <span class="n">pid</span> <span class="mi">988</span> <span class="n">at</span> <span class="mh">0x2e64750</span><span class="o">></span>
|
|
|
|
<span class="n">Enumerating</span> <span class="n">handles</span><span class="p">:</span>
|
|
<span class="n">There</span> <span class="n">are</span> <span class="mi">40664</span> <span class="n">handles</span><span class="p">:</span>
|
|
<span class="n">First</span> <span class="n">handle</span> <span class="ow">is</span><span class="p">:</span> <span class="o"><</span><span class="n">Handle</span> <span class="n">value</span><span class="o">=<</span><span class="mh">0x4</span><span class="o">></span> <span class="ow">in</span> <span class="n">process</span> <span class="n">pid</span><span class="o">=</span><span class="mi">4</span><span class="o">></span>
|
|
<span class="n">Enumerating</span> <span class="n">handles</span> <span class="n">of</span> <span class="n">the</span> <span class="n">current</span> <span class="n">process</span><span class="p">:</span>
|
|
<span class="n">There</span> <span class="n">are</span> <span class="mi">255</span> <span class="n">handles</span> <span class="k">for</span> <span class="n">this</span> <span class="n">process</span>
|
|
<span class="n">Looking</span> <span class="k">for</span> <span class="n">a</span> <span class="n">File</span> <span class="n">handle</span><span class="p">:</span>
|
|
<span class="n">Handle</span> <span class="ow">is</span> <span class="o"><</span><span class="n">Handle</span> <span class="n">value</span><span class="o">=<</span><span class="mh">0x4</span><span class="o">></span> <span class="ow">in</span> <span class="n">process</span> <span class="n">pid</span><span class="o">=</span><span class="mi">14340</span><span class="o">></span>
|
|
<span class="n">Name</span> <span class="ow">is</span> <span class="o"><</span>\<span class="n">Device</span>\<span class="n">ConDrv</span><span class="o">></span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="network-socket-exploration">
|
|
<span id="sample-network-exploration"></span><h2>16.3. <code class="xref py py-class docutils literal"><span class="pre">Network</span></code> - socket exploration<a class="headerlink" href="#network-socket-exploration" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">socket</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">check_is_elevated</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"!!! Demo will fail because closing a connection require elevated process !!!"</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Working on ipv4"</span><span class="p">)</span>
|
|
<span class="n">conns</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">network</span><span class="o">.</span><span class="n">ipv4</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== Listening =="</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some listening connections: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">][:</span><span class="mi">3</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listening ports are : </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span><span class="o">.</span><span class="n">local_port</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== Established =="</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some established connections: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">][:</span><span class="mi">3</span><span class="p">]))</span>
|
|
|
|
<span class="n">TARGET_HOST</span> <span class="o">=</span> <span class="s2">"localhost"</span>
|
|
<span class="n">TARGET_PORT</span> <span class="o">=</span> <span class="mi">80</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== connection to </span><span class="si">{0}</span><span class="s2">:</span><span class="si">{1}</span><span class="s2"> =="</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET_HOST</span><span class="p">,</span> <span class="n">TARGET_PORT</span><span class="p">))</span>
|
|
<span class="n">s</span> <span class="o">=</span> <span class="n">socket</span><span class="o">.</span><span class="n">create_connection</span><span class="p">((</span><span class="n">TARGET_HOST</span><span class="p">,</span> <span class="n">TARGET_PORT</span><span class="p">))</span>
|
|
|
|
<span class="n">our_connection</span> <span class="o">=</span> <span class="p">[</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">network</span><span class="o">.</span><span class="n">ipv4</span> <span class="k">if</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span> <span class="ow">and</span> <span class="n">c</span><span class="o">.</span><span class="n">remote_port</span> <span class="o">==</span> <span class="n">TARGET_PORT</span> <span class="ow">and</span> <span class="n">c</span><span class="o">.</span><span class="n">remote_addr</span> <span class="o">==</span> <span class="n">s</span><span class="o">.</span><span class="n">getpeername</span><span class="p">()[</span><span class="mi">0</span><span class="p">]]</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our connection is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">our_connection</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Sending YOP"</span><span class="p">)</span>
|
|
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">"YOP"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Closing socket"</span><span class="p">)</span>
|
|
<span class="n">our_connection</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Sending LAIT"</span><span class="p">)</span>
|
|
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">"LAIT"</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">network</span>\<span class="n">network</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Working</span> <span class="n">on</span> <span class="n">ipv4</span>
|
|
<span class="o">==</span> <span class="n">Listening</span> <span class="o">==</span>
|
|
<span class="n">Some</span> <span class="n">listening</span> <span class="n">connections</span><span class="p">:</span> <span class="p">[</span><span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">80</span><span class="o">></span><span class="p">,</span> <span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">135</span><span class="o">></span><span class="p">,</span> <span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">443</span><span class="o">></span><span class="p">]</span>
|
|
<span class="n">Listening</span> <span class="n">ports</span> <span class="n">are</span> <span class="p">:</span> <span class="p">[</span><span class="mi">80</span><span class="p">,</span> <span class="mi">135</span><span class="p">,</span> <span class="mi">443</span><span class="p">,</span> <span class="mi">445</span><span class="p">,</span> <span class="mi">902</span><span class="p">,</span> <span class="mi">912</span><span class="p">,</span> <span class="mi">5357</span><span class="p">,</span> <span class="mi">49152</span><span class="p">,</span> <span class="mi">49153</span><span class="p">,</span> <span class="mi">49154</span><span class="p">,</span> <span class="mi">49155</span><span class="p">,</span> <span class="mi">49157</span><span class="p">,</span> <span class="mi">49159</span><span class="p">,</span> <span class="mi">8307</span><span class="p">,</span> <span class="mi">25340</span><span class="p">,</span> <span class="mi">139</span><span class="p">,</span> <span class="mi">139</span><span class="p">]</span>
|
|
<span class="o">==</span> <span class="n">Established</span> <span class="o">==</span>
|
|
<span class="n">Some</span> <span class="n">established</span> <span class="n">connections</span><span class="p">:</span> <span class="p">[</span><span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">25340</span> <span class="o">-></span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49472</span><span class="o">></span><span class="p">,</span> <span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49173</span> <span class="o">-></span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49174</span><span class="o">></span><span class="p">,</span> <span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49174</span> <span class="o">-></span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49173</span><span class="o">></span><span class="p">]</span>
|
|
<span class="o">==</span> <span class="n">connection</span> <span class="n">to</span> <span class="n">localhost</span><span class="p">:</span><span class="mi">80</span> <span class="o">==</span>
|
|
<span class="n">Our</span> <span class="n">connection</span> <span class="ow">is</span> <span class="p">[</span><span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49616</span> <span class="o">-></span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">80</span><span class="o">></span><span class="p">]</span>
|
|
<span class="n">Sending</span> <span class="n">YOP</span>
|
|
<span class="n">Closing</span> <span class="n">socket</span>
|
|
<span class="n">Sending</span> <span class="n">LAIT</span>
|
|
<span class="n">Traceback</span> <span class="p">(</span><span class="n">most</span> <span class="n">recent</span> <span class="n">call</span> <span class="n">last</span><span class="p">):</span>
|
|
<span class="n">File</span> <span class="s2">".</span><span class="se">\n</span><span class="s2">etwork.py"</span><span class="p">,</span> <span class="n">line</span> <span class="mi">45</span><span class="p">,</span> <span class="ow">in</span> <span class="o"><</span><span class="n">module</span><span class="o">></span>
|
|
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">"LAIT"</span><span class="p">)</span>
|
|
<span class="n">socket</span><span class="o">.</span><span class="n">error</span><span class="p">:</span> <span class="p">[</span><span class="n">Errno</span> <span class="mi">10054</span><span class="p">]</span> <span class="n">An</span> <span class="n">existing</span> <span class="n">connection</span> <span class="n">was</span> <span class="n">forcibly</span> <span class="n">closed</span> <span class="n">by</span> <span class="n">the</span> <span class="n">remote</span> <span class="n">host</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="registry">
|
|
<span id="sample-registry"></span><h2>16.4. <code class="xref py py-class docutils literal"><span class="pre">Registry</span></code><a class="headerlink" href="#registry" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="n">registry</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">registry</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Registry is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registry</span><span class="p">))</span>
|
|
|
|
<span class="n">current_user</span> <span class="o">=</span> <span class="n">registry</span><span class="p">(</span><span class="s2">"HKEY_CURRENT_USER"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"HKEY_CURRENT_USER is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">current_user</span><span class="p">))</span>
|
|
<span class="n">subkeys_name</span> <span class="o">=</span> <span class="p">[</span><span class="n">s</span><span class="o">.</span><span class="n">name</span> <span class="k">for</span> <span class="n">s</span> <span class="ow">in</span> <span class="n">current_user</span><span class="o">.</span><span class="n">subkeys</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"HKEY_CURRENT_USER subkeys names are:"</span><span class="p">)</span>
|
|
<span class="n">pprint</span><span class="o">.</span><span class="n">pprint</span><span class="p">(</span><span class="n">subkeys_name</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Opening 'Software' in HKEY_CURRENT_USER: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">current_user</span><span class="p">(</span><span class="s2">"Software"</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"We can also open it in one access: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registry</span><span class="p">(</span><span class="sa">r</span><span class="s2">"HKEY_CURRENT_USER\Sofware"</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking at CurrentVersion"</span><span class="p">)</span>
|
|
|
|
<span class="n">windows_info</span> <span class="o">=</span> <span class="n">registry</span><span class="p">(</span><span class="s2">"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Key is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows_info</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"values are:"</span><span class="p">)</span>
|
|
<span class="n">pprint</span><span class="o">.</span><span class="n">pprint</span><span class="p">(</span><span class="n">windows_info</span><span class="o">.</span><span class="n">values</span><span class="p">)</span>
|
|
|
|
<span class="n">registered_owner</span> <span class="o">=</span> <span class="n">windows_info</span><span class="p">[</span><span class="s2">"RegisteredOwner"</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"registered owner = <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registered_owner</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">registry</span>\<span class="n">registry</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Registry</span> <span class="ow">is</span> <span class="o"><<</span><span class="n">windows</span><span class="o">.</span><span class="n">registry</span><span class="o">.</span><span class="n">Registry</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x02941290</span><span class="o">>></span>
|
|
<span class="n">HKEY_CURRENT_USER</span> <span class="ow">is</span> <span class="o"><<</span><span class="n">PyHKey</span> <span class="s2">"HKEY_CURRENT_USER"</span><span class="o">>></span>
|
|
<span class="n">HKEY_CURRENT_USER</span> <span class="n">subkeys</span> <span class="n">names</span> <span class="n">are</span><span class="p">:</span>
|
|
<span class="p">[</span><span class="s1">'AppEvents'</span><span class="p">,</span>
|
|
<span class="s1">'AppXBackupContentType'</span><span class="p">,</span>
|
|
<span class="s1">'Console'</span><span class="p">,</span>
|
|
<span class="s1">'Control Panel'</span><span class="p">,</span>
|
|
<span class="s1">'Environment'</span><span class="p">,</span>
|
|
<span class="s1">'EUDC'</span><span class="p">,</span>
|
|
<span class="s1">'Identities'</span><span class="p">,</span>
|
|
<span class="s1">'Keyboard Layout'</span><span class="p">,</span>
|
|
<span class="s1">'Network'</span><span class="p">,</span>
|
|
<span class="s1">'Printers'</span><span class="p">,</span>
|
|
<span class="s1">'Software'</span><span class="p">,</span>
|
|
<span class="s1">'System'</span><span class="p">,</span>
|
|
<span class="s1">'Volatile Environment'</span><span class="p">]</span>
|
|
<span class="n">Opening</span> <span class="s1">'Software'</span> <span class="ow">in</span> <span class="n">HKEY_CURRENT_USER</span><span class="p">:</span> <span class="o"><</span><span class="n">PyHKey</span> <span class="s2">"HKEY_CURRENT_USER\Software"</span><span class="o">></span>
|
|
<span class="n">We</span> <span class="n">can</span> <span class="n">also</span> <span class="nb">open</span> <span class="n">it</span> <span class="ow">in</span> <span class="n">one</span> <span class="n">access</span><span class="p">:</span> <span class="o"><</span><span class="n">PyHKey</span> <span class="s2">"HKEY_CURRENT_USER\Sofware"</span><span class="o">></span>
|
|
<span class="n">Looking</span> <span class="n">at</span> <span class="n">CurrentVersion</span>
|
|
<span class="n">Key</span> <span class="ow">is</span> <span class="o"><</span><span class="n">PyHKey</span> <span class="s2">"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion"</span><span class="o">></span>
|
|
<span class="n">values</span> <span class="n">are</span><span class="p">:</span>
|
|
<span class="p">[</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'SoftwareType'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="sa">u</span><span class="s1">'System'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">),</span>
|
|
<span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'RegisteredOwner'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="sa">u</span><span class="s1">'hakril'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">),</span>
|
|
<span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'InstallDate'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">4</span><span class="p">),</span>
|
|
<span class="o">...</span>
|
|
<span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'PathName'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="sa">u</span><span class="s1">'C:</span><span class="se">\\</span><span class="s1">Windows'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">)]</span>
|
|
<span class="n">registered</span> <span class="n">owner</span> <span class="o">=</span> <span class="o"><</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'RegisteredOwner'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="sa">u</span><span class="s1">'hakril'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">)</span><span class="o">></span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-wintrust">
|
|
<span id="sample-wintrust"></span><h2>16.5. <code class="docutils literal"><span class="pre">windows.wintrust</span></code><a class="headerlink" href="#windows-wintrust" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.wintrust</span>
|
|
|
|
<span class="n">TARGET_FILE</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"C:\windows\system32\ntdll.dll"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Checking signature of <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" is_signed: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">is_signed</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" check_signature: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">check_signature</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)))</span>
|
|
|
|
<span class="n">sign_info</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">full_signature_information</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" full_signature_information:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * signed <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">signed</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * catalog <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">catalog</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * catalogsigned <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">catalogsigned</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * additionalinfo <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">additionalinfo</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Checking signature of some loaded DLL"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">module</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span><span class="p">[:</span><span class="mi">5</span><span class="p">]:</span>
|
|
<span class="n">path</span> <span class="o">=</span> <span class="n">module</span><span class="o">.</span><span class="n">fullname</span>
|
|
<span class="n">is_signed</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">is_signed</span><span class="p">(</span><span class="n">path</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">is_signed</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<</span><span class="si">{0}</span><span class="s2">> : </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">is_signed</span><span class="p">))</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">sign_info</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">full_signature_information</span><span class="p">(</span><span class="n">path</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<</span><span class="si">{0}</span><span class="s2">> : </span><span class="si">{1}</span><span class="s2"> (</span><span class="si">{2}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">is_signed</span><span class="p">,</span> <span class="n">sign_info</span><span class="p">[</span><span class="mi">3</span><span class="p">]))</span>
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">crypto</span>\<span class="n">wintrust</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Checking</span> <span class="n">signature</span> <span class="n">of</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">ntdll</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">is_signed</span><span class="p">:</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="n">check_signature</span><span class="p">:</span> <span class="o"><</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">full_signature_information</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">signed</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">catalog</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">CatRoot</span>\<span class="p">{</span><span class="n">F750E6C3</span><span class="o">-</span><span class="mi">38</span><span class="n">EE</span><span class="o">-</span><span class="mi">11</span><span class="n">D1</span><span class="o">-</span><span class="mf">85E5</span><span class="o">-</span><span class="mi">00</span><span class="n">C04FC295EE</span><span class="p">}</span>\<span class="n">Package_35_for_KB3128650</span><span class="o">~</span><span class="mi">31</span><span class="n">bf3856ad364e35</span><span class="o">~</span><span class="n">amd64</span><span class="o">~~</span><span class="mf">6.3</span><span class="o">.</span><span class="mf">1.2</span><span class="o">.</span><span class="n">cat</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">catalogsigned</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">additionalinfo</span> <span class="o"><</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">Checking</span> <span class="n">signature</span> <span class="n">of</span> <span class="n">some</span> <span class="n">loaded</span> <span class="n">DLL</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">python27</span>\<span class="n">python</span><span class="o">.</span><span class="n">exe</span><span class="o">></span> <span class="p">:</span> <span class="kc">False</span> <span class="p">(</span><span class="n">TRUST_E_NOSIGNATURE</span><span class="p">(</span><span class="mh">0x800b0100</span><span class="n">L</span><span class="p">))</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">ntdll</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="p">:</span> <span class="kc">True</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="p">:</span> <span class="kc">True</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">kernelbase</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="p">:</span> <span class="kc">True</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">python27</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="p">:</span> <span class="kc">False</span> <span class="p">(</span><span class="n">TRUST_E_NOSIGNATURE</span><span class="p">(</span><span class="mh">0x800b0100</span><span class="n">L</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="vectoredexception">
|
|
<span id="sample-vectoredexception"></span><h2>16.6. <code class="xref py py-func docutils literal"><span class="pre">VectoredException()</span></code><a class="headerlink" href="#vectoredexception" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="in-local-process">
|
|
<h3>16.6.1. In local process<a class="headerlink" href="#in-local-process" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">ctypes</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">from</span> <span class="nn">windows.winobject.exception</span> <span class="k">import</span> <span class="n">VectoredException</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def.windef</span> <span class="k">as</span> <span class="nn">windef</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
|
|
<span class="nd">@VectoredException</span>
|
|
<span class="k">def</span> <span class="nf">handler</span><span class="p">(</span><span class="n">exc</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"==Entry of VEH handler=="</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionCode</span> <span class="o">==</span> <span class="n">EXCEPTION_ACCESS_VIOLATION</span><span class="p">:</span>
|
|
<span class="n">target_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionInformation</span><span class="p">[</span><span class="mi">1</span><span class="p">],</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Instr at </span><span class="si">{0}</span><span class="s2"> accessed to addr </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionAddress</span><span class="p">),</span> <span class="nb">hex</span><span class="p">(</span><span class="n">target_addr</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Resetting page protection to <PAGE_READWRITE>"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_READWRITE</span><span class="p">)</span>
|
|
<span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ContextRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span> <span class="o">=</span> <span class="mi">1</span>
|
|
<span class="k">return</span> <span class="n">windef</span><span class="o">.</span><span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exception of type </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionCode</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Resetting page protection to <PAGE_NOACCESS>"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_NOACCESS</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">windef</span><span class="o">.</span><span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
|
|
|
|
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">AddVectoredExceptionHandler</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">handler</span><span class="p">)</span>
|
|
|
|
<span class="n">target_page</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Protected page is at <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">target_page</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Setting page protection to <PAGE_NOACCESS>"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_NOACCESS</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">target_page</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Value 1 read"</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">target_page</span> <span class="o">+</span> <span class="mh">0x10</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Value 2 read"</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">process</span>\<span class="n">veh_segv</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Protected</span> <span class="n">page</span> <span class="ow">is</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x1db0000</span><span class="o">></span>
|
|
<span class="n">Setting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_NOACCESS</span><span class="o">></span>
|
|
|
|
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
|
|
<span class="n">Instr</span> <span class="n">at</span> <span class="mh">0x1d1ab574</span> <span class="n">accessed</span> <span class="n">to</span> <span class="n">addr</span> <span class="mh">0x1db0000</span>
|
|
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_READWRITE</span><span class="o">></span>
|
|
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
|
|
<span class="ne">Exception</span> <span class="n">of</span> <span class="nb">type</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_NOACCESS</span><span class="o">></span>
|
|
<span class="n">Value</span> <span class="mi">1</span> <span class="n">read</span>
|
|
|
|
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
|
|
<span class="n">Instr</span> <span class="n">at</span> <span class="mh">0x1d1ab574</span> <span class="n">accessed</span> <span class="n">to</span> <span class="n">addr</span> <span class="mh">0x1db0010</span>
|
|
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_READWRITE</span><span class="o">></span>
|
|
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
|
|
<span class="ne">Exception</span> <span class="n">of</span> <span class="nb">type</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_NOACCESS</span><span class="o">></span>
|
|
<span class="n">Value</span> <span class="mi">2</span> <span class="n">read</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="in-remote-process">
|
|
<h3>16.6.2. In remote process<a class="headerlink" href="#in-remote-process" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
<span class="n">python_code</span> <span class="o">=</span> <span class="s2">"""</span>
|
|
<span class="s2">import windows</span>
|
|
<span class="s2">import ctypes</span>
|
|
<span class="s2">import windows</span>
|
|
<span class="s2">from windows.winobject.exception import VectoredException</span>
|
|
<span class="s2">import windows.generated_def.windef as windef</span>
|
|
<span class="s2">from windows.generated_def.winstructs import *</span>
|
|
|
|
<span class="s2">windows.utils.create_console()</span>
|
|
|
|
<span class="s2">module_to_trace = "gdi32.dll"</span>
|
|
<span class="s2">nb_repeat = [5]</span>
|
|
|
|
<span class="s2">@VectoredException</span>
|
|
<span class="s2">def handler(exc):</span>
|
|
<span class="s2"> if exc[0].ExceptionRecord[0].ExceptionCode == EXCEPTION_ACCESS_VIOLATION:</span>
|
|
<span class="s2"> print("")</span>
|
|
<span class="s2"> target_addr = ctypes.cast(exc[0].ExceptionRecord[0].ExceptionInformation[1], ctypes.c_void_p).value</span>
|
|
<span class="s2"> print("Instr at </span><span class="si">{0}</span><span class="s2"> accessed to addr </span><span class="si">{1}</span><span class="s2"> (</span><span class="si">{2}</span><span class="s2">)".format(hex(exc[0].ExceptionRecord[0].ExceptionAddress), hex(target_addr), module_to_trace))</span>
|
|
<span class="s2"> windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_EXECUTE_READWRITE)</span>
|
|
<span class="s2"> nb_repeat[0] -= 1</span>
|
|
<span class="s2"> if nb_repeat[0]:</span>
|
|
<span class="s2"> exc[0].ContextRecord[0].EEFlags.TF = 1</span>
|
|
<span class="s2"> else:</span>
|
|
<span class="s2"> print("No more tracing !")</span>
|
|
<span class="s2"> return windef.EXCEPTION_CONTINUE_EXECUTION</span>
|
|
<span class="s2"> else:</span>
|
|
<span class="s2"> print("Exception of type </span><span class="si">{0}</span><span class="s2">".format(exc[0].ExceptionRecord[0].ExceptionCode))</span>
|
|
<span class="s2"> print("Resetting page protection to <PAGE_READWRITE>")</span>
|
|
<span class="s2"> windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)</span>
|
|
<span class="s2"> return windef.EXCEPTION_CONTINUE_EXECUTION</span>
|
|
|
|
|
|
<span class="s2">windows.winproxy.AddVectoredExceptionHandler(0, handler)</span>
|
|
|
|
<span class="s2">print("Tracing execution in module: <</span><span class="si">{0}</span><span class="s2">>".format(module_to_trace))</span>
|
|
|
|
<span class="s2">module = [x for x in windows.current_process.peb.modules if x.name == module_to_trace][0]</span>
|
|
<span class="s2">target_page = module.baseaddr</span>
|
|
<span class="s2">code_size = module.pe.get_OptionalHeader().SizeOfCode</span>
|
|
|
|
<span class="s2">print("Protected page is at </span><span class="si">{0}</span><span class="s2">".format(hex(target_page)))</span>
|
|
<span class="s2">windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)</span>
|
|
<span class="s2">"""</span>
|
|
|
|
<span class="n">c</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">CREATE_SUSPENDED</span><span class="p">)</span>
|
|
<span class="n">x</span> <span class="o">=</span> <span class="n">c</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="n">python_code</span><span class="p">)</span>
|
|
|
|
<span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">time</span>
|
|
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.1</span><span class="p">)</span>
|
|
|
|
<span class="k">for</span> <span class="n">t</span> <span class="ow">in</span> <span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">:</span>
|
|
<span class="n">t</span><span class="o">.</span><span class="n">suspend</span><span class="p">()</span>
|
|
|
|
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">1</span><span class="p">)</span>
|
|
<span class="n">c</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe process\remote_veh_segv.py
|
|
(In another console)
|
|
|
|
Tracing execution in module: <gdi32.dll>
|
|
Protected page is at 0x7ffa3c700000L
|
|
|
|
Instr at 0x7ffa3c70f0f0L accessed to addr 0x7ffa3c70f0f0L (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0f5L accessed to addr 0x7ffa3c70f0f5L (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0faL accessed to addr 0x7ffa3c70f0faL (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0ffL accessed to addr 0x7ffa3c70f0ffL (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f100L accessed to addr 0x7ffa3c70f100L (gdi32.dll)
|
|
No more tracing !
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="debugging">
|
|
<span id="sample-debugger"></span><h2>16.7. Debugging<a class="headerlink" href="#debugging" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="debugger">
|
|
<h3>16.7.1. <code class="xref py py-class docutils literal"><span class="pre">Debugger</span></code><a class="headerlink" href="#debugger" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">MyDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Got exception </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">PrintUnicodeString</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Breakpoint</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">argument_position</span><span class="p">):</span>
|
|
<span class="nb">super</span><span class="p">(</span><span class="n">PrintUnicodeString</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">arg_pos</span> <span class="o">=</span> <span class="n">argument_position</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">p</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span>
|
|
<span class="n">t</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span>
|
|
<span class="n">esp</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">Esp</span>
|
|
|
|
<span class="n">unicode_string_addr</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">esp</span> <span class="o">+</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">arg_pos</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">*</span> <span class="mi">4</span><span class="p">)</span>
|
|
<span class="n">wstring_addr</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">unicode_string_addr</span> <span class="o">+</span> <span class="mi">4</span><span class="p">)</span>
|
|
<span class="n">dll_loaded</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_wstring</span><span class="p">(</span><span class="n">wstring_addr</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Loading <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">dll_loaded</span><span class="p">))</span>
|
|
|
|
<span class="k">if</span> <span class="n">dll_loaded</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">"ole32.dll"</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Ask to load <ole32.dll>: exiting process"</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
|
|
|
|
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">MyDebugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">PrintUnicodeString</span><span class="p">(</span><span class="s2">"ntdll!LdrLoadDll"</span><span class="p">,</span> <span class="n">argument_position</span><span class="o">=</span><span class="mi">2</span><span class="p">))</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">debug</span>\<span class="n">debugger_print_LdrLoaddll</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">KERNEL32</span><span class="o">.</span><span class="n">DLL</span><span class="o">></span>
|
|
<span class="n">Got</span> <span class="n">exception</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">(</span><span class="mh">0x80000003</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x77a73bad</span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">IMM32</span><span class="o">.</span><span class="n">DLL</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">WinSxS</span>\<span class="n">x86_microsoft</span><span class="o">.</span><span class="n">windows</span><span class="o">.</span><span class="n">gdiplus_6595b64144ccf1df_1</span><span class="o">.</span><span class="mf">1.9600</span><span class="o">.</span><span class="mi">17415</span><span class="n">_none_dad8722c5bcc2d8f</span>\<span class="n">gdiplus</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">shell32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SYSTEM32</span>\<span class="n">WINMM</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Ask</span> <span class="n">to</span> <span class="n">load</span> <span class="o"><</span><span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span><span class="p">:</span> <span class="n">exiting</span> <span class="n">process</span>
|
|
</pre></div>
|
|
</div>
|
|
<div class="section" id="single-stepping">
|
|
<h4>16.7.1.1. Single stepping<a class="headerlink" href="#single-stepping" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">MyDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="nb">super</span><span class="p">(</span><span class="n">MyDebugger</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">=</span> <span class="mi">0</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Got exception </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_single_step</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Got single_step </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">-=</span> <span class="mi">1</span>
|
|
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">></span> <span class="mi">0</span><span class="p">:</span>
|
|
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"No more single step: exiting"</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">SingleStepOnWrite</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">MemoryBreakpoint</span><span class="p">):</span>
|
|
<span class="sd">"""Check that BP/dbg can trigger single step and that instruction follows"""</span>
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">fault_addr</span> <span class="o">=</span> <span class="n">exc</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionInformation</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span>
|
|
<span class="n">eip</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">pc</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Instruction at <</span><span class="si">{0:#x}</span><span class="s2">> wrote at <</span><span class="si">{1:#x}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">eip</span><span class="p">,</span> <span class="n">fault_addr</span><span class="p">))</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">=</span> <span class="mi">4</span>
|
|
<span class="k">return</span> <span class="n">dbg</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
|
|
|
|
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">MyDebugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
|
|
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
|
|
<span class="n">data</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
|
|
|
|
<span class="n">injected</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="s2">"EAX"</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Add</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">,</span> <span class="mi">4</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span> <span class="o">+</span> <span class="mi">4</span><span class="p">),</span> <span class="s2">"EAX"</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Add</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">,</span> <span class="mi">8</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span> <span class="o">+</span> <span class="mi">8</span><span class="p">),</span> <span class="s2">"EAX"</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Nop</span><span class="p">()</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Nop</span><span class="p">()</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
|
|
<span class="n">calc</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">injected</span><span class="o">.</span><span class="n">get_code</span><span class="p">())</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">SingleStepOnWrite</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="n">size</span><span class="o">=</span><span class="mi">8</span><span class="p">,</span> <span class="n">events</span><span class="o">=</span><span class="s2">"W"</span><span class="p">))</span>
|
|
<span class="n">calc</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">debug</span>\<span class="n">debugger_membp_singlestep</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Got</span> <span class="n">exception</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">(</span><span class="mh">0x80000003</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x77ae3c7d</span>
|
|
<span class="n">Instruction</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x8d0006</span><span class="o">></span> <span class="n">wrote</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x8e0000</span><span class="o">></span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d000c</span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d0011</span>
|
|
<span class="n">Instruction</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x8d0011</span><span class="o">></span> <span class="n">wrote</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x8e0004</span><span class="o">></span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d0017</span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d001c</span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d0022</span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d0023</span>
|
|
<span class="n">No</span> <span class="n">more</span> <span class="n">single</span> <span class="n">step</span><span class="p">:</span> <span class="n">exiting</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-debug-functionbp">
|
|
<h4>16.7.1.2. <a class="reference internal" href="debug.html#windows.debug.FunctionBP" title="windows.debug.FunctionBP"><code class="xref py py-class docutils literal"><span class="pre">windows.debug.FunctionBP</span></code></a><a class="headerlink" href="#windows-debug-functionbp" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
<span class="k">class</span> <span class="nc">FollowNtCreateFile</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">FunctionBP</span><span class="p">):</span>
|
|
<span class="n">TARGET</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtCreateFile</span>
|
|
<span class="n">COUNTER</span> <span class="o">=</span> <span class="mi">3</span>
|
|
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">COUNTER</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exiting process"</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
<span class="k">return</span>
|
|
<span class="n">params</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">extract_arguments</span><span class="p">(</span><span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="p">,</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="p">)</span>
|
|
<span class="n">filename</span> <span class="o">=</span> <span class="n">params</span><span class="p">[</span><span class="s2">"ObjectAttributes"</span><span class="p">]</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">ObjectName</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Buffer</span>
|
|
<span class="n">handle_addr</span> <span class="o">=</span> <span class="n">params</span><span class="p">[</span><span class="s2">"FileHandle"</span><span class="p">]</span><span class="o">.</span><span class="n">value</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">handle_addr</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">break_on_ret</span><span class="p">(</span><span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">ret_trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">filename</span><span class="p">,</span> <span class="n">handle_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">data</span>
|
|
<span class="n">ret_value</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">func_result</span> <span class="c1"># EAX / RAX depending of bitness</span>
|
|
<span class="n">handle_value</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">handle_addr</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">ret_value</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"NtCreateFile of <</span><span class="si">{0}</span><span class="s2">> FAILED (result=</span><span class="si">{1:#x}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">ret_value</span><span class="p">))</span>
|
|
<span class="k">return</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"NtCreateFile of <</span><span class="si">{0}</span><span class="s2">>: handle = </span><span class="si">{1:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">handle_value</span><span class="p">))</span>
|
|
<span class="c1"># Manual verification</span>
|
|
<span class="n">fhandle</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span> <span class="ow">and</span> <span class="n">h</span><span class="o">.</span><span class="n">wValue</span> <span class="o">==</span> <span class="n">handle_value</span><span class="p">]</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">fhandle</span><span class="p">:</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"handle not found!"</span><span class="p">)</span>
|
|
<span class="n">fhandle</span> <span class="o">=</span> <span class="n">fhandle</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Handle manually found! typename=<</span><span class="si">{0}</span><span class="s2">>, name=<</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">fhandle</span><span class="o">.</span><span class="n">type</span><span class="p">,</span> <span class="n">fhandle</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">COUNTER</span> <span class="o">-=</span> <span class="mi">1</span>
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">FollowNtCreateFile</span><span class="p">())</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe debug\debug_functionbp.py
|
|
NtCreateFile of <\??\C:\Windows\syswow64\en-US\calc.exe.mui>: handle = 0xac
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\calc.exe.mui>
|
|
|
|
NtCreateFile of <\Device\DeviceApi\CMApi>: handle = 0x108
|
|
Handle manually found! typename=<File>, name=<\Device\DeviceApi>
|
|
|
|
NtCreateFile of <\??\C:\Windows\Fonts\staticcache.dat>: handle = 0x154
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat>
|
|
|
|
Exiting process
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="debugger-attach">
|
|
<span id="sample-debugger-attach"></span><h4>16.7.1.3. <a class="reference internal" href="debug.html#windows.debug.Debugger.attach" title="windows.debug.Debugger.attach"><code class="xref py py-func docutils literal"><span class="pre">Debugger.attach</span></code></a><a class="headerlink" href="#debugger-attach" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
<span class="c1"># Just a debugger that follow NtCreateFile and print filename & handler</span>
|
|
<span class="kn">from</span> <span class="nn">debug_functionbp</span> <span class="k">import</span> <span class="n">FollowNtCreateFile</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">follow_create_file</span><span class="p">(</span><span class="n">pid</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Finding process with pid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">pid</span><span class="p">))</span>
|
|
<span class="n">target</span> <span class="o">=</span> <span class="p">[</span><span class="n">p</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span> <span class="k">if</span> <span class="n">p</span><span class="o">.</span><span class="n">pid</span> <span class="o">==</span> <span class="n">pid</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Target is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="p">))</span>
|
|
<span class="n">dbg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="o">.</span><span class="n">attach</span><span class="p">(</span><span class="n">target</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Debugger attached: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">dbg</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">FollowNtCreateFile</span><span class="p">())</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="c1"># Create a non-debugged process safe to debug</span>
|
|
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="mi">0</span><span class="p">)</span>
|
|
<span class="c1"># Give ovnly the PID to follow_create_file</span>
|
|
<span class="n">follow_create_file</span><span class="p">(</span><span class="n">calc</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe debug\attach.py
|
|
Finding process with pid <11392>
|
|
Target is <WinProcess "notepad.exe" pid 11392 at 0x471a750>
|
|
Debugger attached: <windows.debug.debugger.Debugger object at 0x04707EF0>
|
|
|
|
NtCreateFile of <\??\C:\Windows\Fonts\staticcache.dat>: handle = 0x288
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume4\Windows\Fonts\StaticCache.dat>
|
|
|
|
NtCreateFile of <\??\C:\WINDOWS\Registration\R000000000015.clb>: handle = 0x320
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume4\Windows\Registration\R000000000015.clb>
|
|
|
|
NtCreateFile of <\??\C:\WINDOWS\Globalization\Sorting\sortdefault.nls>: handle = 0x334
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume4\Windows\Globalization\Sorting\SortDefault.nls>
|
|
|
|
Exiting process
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="native-code-tester">
|
|
<h4>16.7.1.4. Native code tester<a class="headerlink" href="#native-code-tester" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">argparse</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span> <span class="k">as</span> <span class="nn">dbg</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">hexdump</span><span class="p">(</span><span class="n">string</span><span class="p">,</span> <span class="n">start_addr</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
|
|
<span class="n">result</span> <span class="o">=</span> <span class="s2">""</span>
|
|
<span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
|
|
<span class="k">return</span>
|
|
<span class="n">ascii</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="s2">"."</span><span class="o">*</span><span class="mi">256</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">1</span><span class="p">,</span><span class="mh">0x7f</span><span class="p">):</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="nb">chr</span><span class="p">(</span><span class="n">i</span><span class="p">)</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x0</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x7</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x8</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x9</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0xa</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x1b</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0xd</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0xff</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"</span><span class="se">\x13</span><span class="s2">"</span>
|
|
<span class="n">ascii</span> <span class="o">=</span> <span class="s2">""</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">ascii</span><span class="p">)</span>
|
|
<span class="n">offset</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="k">while</span> <span class="p">(</span><span class="n">offset</span><span class="o">+</span><span class="mh">0x10</span><span class="p">)</span> <span class="o"><=</span> <span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">):</span>
|
|
<span class="n">line</span> <span class="o">=</span> <span class="n">string</span><span class="p">[</span><span class="n">offset</span><span class="p">:(</span><span class="n">offset</span><span class="o">+</span><span class="mh">0x10</span><span class="p">)]</span>
|
|
<span class="n">linebuf</span> <span class="o">=</span> <span class="s2">" </span><span class="si">%08X</span><span class="s2"> "</span> <span class="o">%</span> <span class="p">(</span><span class="n">offset</span> <span class="o">+</span> <span class="n">start_addr</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="mi">16</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="n">i</span> <span class="o">==</span> <span class="mi">8</span><span class="p">:</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">"</span><span class="si">%02X</span><span class="s2"> "</span> <span class="o">%</span> <span class="nb">ord</span><span class="p">(</span><span class="n">line</span><span class="p">[</span><span class="n">i</span><span class="p">])</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="mi">16</span><span class="p">):</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="n">ascii</span><span class="p">[</span><span class="nb">ord</span><span class="p">(</span><span class="n">line</span><span class="p">[</span><span class="n">i</span><span class="p">])]</span>
|
|
<span class="n">result</span> <span class="o">+=</span> <span class="n">linebuf</span><span class="o">+</span><span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
|
|
<span class="n">offset</span> <span class="o">+=</span> <span class="mh">0x10</span>
|
|
<span class="k">if</span> <span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">%</span> <span class="mh">0x10</span><span class="p">)</span> <span class="o">></span> <span class="mi">0</span><span class="p">:</span>
|
|
<span class="n">linebuf</span> <span class="o">=</span> <span class="s2">" </span><span class="si">%08X</span><span class="s2"> "</span> <span class="o">%</span> <span class="p">(</span><span class="n">offset</span> <span class="o">+</span> <span class="n">start_addr</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">((</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span><span class="o">-</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">%</span> <span class="mh">0x10</span><span class="p">)),(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">))):</span>
|
|
<span class="k">if</span> <span class="n">i</span> <span class="o">==</span> <span class="mi">8</span><span class="p">:</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">"</span><span class="si">%02X</span><span class="s2"> "</span> <span class="o">%</span> <span class="nb">ord</span><span class="p">(</span><span class="n">string</span><span class="p">[</span><span class="n">i</span><span class="p">])</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span><span class="o">*</span><span class="p">(</span><span class="mh">0x10</span><span class="o">-</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">%</span> <span class="mh">0x10</span><span class="p">))</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">((</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span><span class="o">-</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">%</span> <span class="mh">0x10</span><span class="p">)),(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">))):</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="n">ascii</span><span class="p">[</span><span class="nb">ord</span><span class="p">(</span><span class="n">string</span><span class="p">[</span><span class="n">i</span><span class="p">])]</span>
|
|
<span class="n">result</span> <span class="o">+=</span> <span class="n">linebuf</span><span class="o">+</span><span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
|
|
<span class="k">return</span> <span class="n">result</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">CodeTesteur</span><span class="p">(</span><span class="n">dbg</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">register_start</span><span class="o">=</span><span class="p">{}):</span>
|
|
<span class="nb">super</span><span class="p">(</span><span class="n">CodeTesteur</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="n">process</span><span class="p">)</span>
|
|
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">initial_code</span> <span class="o">=</span> <span class="n">code</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="s2">"</span><span class="se">\xcc</span><span class="s2">"</span>
|
|
|
|
<span class="n">code_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_code_in_target</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span>
|
|
<span class="n">register_start</span><span class="p">[</span><span class="s2">"pc"</span><span class="p">]</span> <span class="o">=</span> <span class="n">code_addr</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span> <span class="o">=</span> <span class="n">process</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span><span class="o">.</span><span class="n">context</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">setup_target_context</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="p">,</span> <span class="n">register_start</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Startup context is:"</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="o">.</span><span class="n">dump</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="o">.</span><span class="n">EEFlags</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span><span class="o">.</span><span class="n">suspend</span><span class="p">()</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span><span class="o">.</span><span class="n">set_context</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">init_breakpoint</span> <span class="o">=</span> <span class="kc">False</span>
|
|
|
|
<span class="k">def</span> <span class="nf">write_code_in_target</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">):</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">process</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">code</span><span class="p">))</span>
|
|
<span class="n">process</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">addr</span>
|
|
|
|
<span class="k">def</span> <span class="nf">setup_target_context</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ctx</span><span class="p">,</span> <span class="n">register_start</span><span class="p">):</span>
|
|
<span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="n">value</span> <span class="ow">in</span> <span class="n">register_start</span><span class="o">.</span><span class="n">items</span><span class="p">():</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="nb">hasattr</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">name</span><span class="p">):</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Unknown register to setup <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">setattr</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">value</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">x</span><span class="p">):</span>
|
|
<span class="n">exc_code</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
|
|
<span class="n">exc_addr</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">init_breakpoint</span> <span class="ow">and</span> <span class="n">exc_code</span> <span class="o">==</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">:</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">init_breakpoint</span> <span class="o">=</span> <span class="kc">True</span>
|
|
<span class="k">return</span>
|
|
<span class="n">ctx</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"==Post-exec context=="</span><span class="p">)</span>
|
|
<span class="n">ctx</span><span class="o">.</span><span class="n">dump</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">ctx</span><span class="o">.</span><span class="n">EEFlags</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">exc_code</span> <span class="o">==</span> <span class="n">EXCEPTION_BREAKPOINT</span> <span class="ow">and</span> <span class="n">exc_addr</span> <span class="o">==</span> <span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="o">.</span><span class="n">pc</span> <span class="o">+</span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">initial_code</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<Normal terminaison>"</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<</span><span class="si">{0}</span><span class="s2">> at <</span><span class="si">{1:#x}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">exc_code</span><span class="p">,</span> <span class="n">exc_addr</span><span class="p">))</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">report_ctx_diff</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="p">,</span> <span class="n">ctx</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
<span class="k">return</span>
|
|
|
|
<span class="k">def</span> <span class="nf">report_ctx_diff</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">start</span><span class="p">,</span> <span class="n">now</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"==DIFF=="</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="n">start_value</span> <span class="ow">in</span> <span class="n">start</span><span class="o">.</span><span class="n">regs</span><span class="p">():</span>
|
|
<span class="n">now_value</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">now</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">start_value</span> <span class="o">!=</span> <span class="n">now_value</span><span class="p">:</span>
|
|
<span class="n">diff</span> <span class="o">=</span> <span class="n">now_value</span> <span class="o">-</span> <span class="n">start_value</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2">: </span><span class="si">{1:#x}</span><span class="s2"> -> </span><span class="si">{2:#x}</span><span class="s2"> (</span><span class="si">{3:+#x}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">start_value</span><span class="p">,</span> <span class="n">now_value</span><span class="p">,</span> <span class="n">diff</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">start</span><span class="o">.</span><span class="n">sp</span> <span class="o">></span> <span class="n">now</span><span class="o">.</span><span class="n">sp</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Negative Stack: dumping:"</span><span class="p">)</span>
|
|
<span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">now</span><span class="o">.</span><span class="n">sp</span><span class="p">,</span> <span class="n">start</span><span class="o">.</span><span class="n">sp</span> <span class="o">-</span> <span class="n">now</span><span class="o">.</span><span class="n">sp</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">hexdump</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="n">start</span><span class="o">.</span><span class="n">sp</span><span class="p">))</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">test_code_x86</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">regs</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">raw</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Testing x86 code"</span><span class="p">)</span>
|
|
<span class="n">process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">raw</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">" "</span><span class="p">,</span> <span class="s2">""</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">'hex'</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="n">code</span><span class="p">)</span>
|
|
|
|
<span class="n">start_register</span> <span class="o">=</span> <span class="p">{}</span>
|
|
<span class="k">if</span> <span class="n">regs</span><span class="p">:</span>
|
|
<span class="k">for</span> <span class="n">name_value</span> <span class="ow">in</span> <span class="n">regs</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">";"</span><span class="p">):</span>
|
|
<span class="n">name</span><span class="p">,</span> <span class="n">value</span> <span class="o">=</span> <span class="n">name_value</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">"="</span><span class="p">)</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">name</span><span class="o">.</span><span class="n">strip</span><span class="p">()</span><span class="o">.</span><span class="n">capitalize</span><span class="p">()</span>
|
|
<span class="k">if</span> <span class="n">name</span> <span class="o">==</span> <span class="s2">"Eflags"</span><span class="p">:</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="s2">"EFlags"</span>
|
|
<span class="n">value</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">value</span><span class="o">.</span><span class="n">strip</span><span class="p">(),</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">start_register</span><span class="p">[</span><span class="n">name</span><span class="p">]</span> <span class="o">=</span> <span class="n">value</span>
|
|
|
|
|
|
<span class="n">x</span> <span class="o">=</span> <span class="n">CodeTesteur</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">start_register</span><span class="p">)</span>
|
|
<span class="n">x</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
<span class="k">def</span> <span class="nf">test_code_x64</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">regs</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">raw</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Testing x64 code"</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Cannot debug a 64b process from 32b python"</span><span class="p">)</span>
|
|
<span class="n">process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">raw</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">" "</span><span class="p">,</span> <span class="s2">""</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">'hex'</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="n">code</span><span class="p">)</span>
|
|
|
|
<span class="n">start_register</span> <span class="o">=</span> <span class="p">{}</span>
|
|
<span class="k">if</span> <span class="n">regs</span><span class="p">:</span>
|
|
<span class="k">for</span> <span class="n">name_value</span> <span class="ow">in</span> <span class="n">regs</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">";"</span><span class="p">):</span>
|
|
<span class="n">name</span><span class="p">,</span> <span class="n">value</span> <span class="o">=</span> <span class="n">name_value</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">"="</span><span class="p">)</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">name</span><span class="o">.</span><span class="n">strip</span><span class="p">()</span><span class="o">.</span><span class="n">capitalize</span><span class="p">()</span>
|
|
<span class="k">if</span> <span class="n">name</span> <span class="o">==</span> <span class="s2">"Eflags"</span><span class="p">:</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="s2">"EFlags"</span>
|
|
<span class="n">value</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">value</span><span class="o">.</span><span class="n">strip</span><span class="p">(),</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">start_register</span><span class="p">[</span><span class="n">name</span><span class="p">]</span> <span class="o">=</span> <span class="n">value</span>
|
|
|
|
|
|
<span class="n">x</span> <span class="o">=</span> <span class="n">CodeTesteur</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">start_register</span><span class="p">)</span>
|
|
<span class="n">x</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">)</span>
|
|
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--x64'</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s1">'store_const'</span><span class="p">,</span> <span class="n">dest</span><span class="o">=</span><span class="s2">"func"</span><span class="p">,</span> <span class="n">const</span><span class="o">=</span><span class="n">test_code_x64</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="n">test_code_x86</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Code is x64'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--raw'</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s1">'store_true'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'argument is raw assembled code (in hex)'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'code'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The code to execute'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'regs'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s2">"?"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The default values of the registers'</span><span class="p">)</span>
|
|
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
|
|
<span class="n">res</span><span class="o">.</span><span class="n">func</span><span class="p">(</span><span class="o">**</span><span class="n">res</span><span class="o">.</span><span class="vm">__dict__</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">test_code</span><span class="o">.</span><span class="n">py</span> <span class="s2">"mov eax, 0x42424242"</span> <span class="s2">"eax=0x11223344"</span>
|
|
<span class="n">Testing</span> <span class="n">x86</span> <span class="n">code</span>
|
|
<span class="n">Startup</span> <span class="n">context</span> <span class="ow">is</span><span class="p">:</span>
|
|
<span class="n">Eip</span> <span class="o">-></span> <span class="mh">0x3f0000</span><span class="n">L</span>
|
|
<span class="n">Esp</span> <span class="o">-></span> <span class="mh">0x3bfae4</span><span class="n">L</span>
|
|
<span class="n">Eax</span> <span class="o">-></span> <span class="mh">0x11223344</span><span class="n">L</span>
|
|
<span class="n">Ebx</span> <span class="o">-></span> <span class="mh">0x5a6000</span><span class="n">L</span>
|
|
<span class="n">Ecx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Edx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Ebp</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Edi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Esi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">EFlags</span> <span class="o">-></span> <span class="mh">0x202</span><span class="n">L</span>
|
|
<span class="n">EEflags</span><span class="p">(</span><span class="mh">0x202</span><span class="n">L</span><span class="p">:</span><span class="n">IF</span><span class="p">)</span>
|
|
<span class="o">==</span><span class="n">Post</span><span class="o">-</span><span class="n">exec</span> <span class="n">context</span><span class="o">==</span>
|
|
<span class="n">Eip</span> <span class="o">-></span> <span class="mh">0x3f0007</span><span class="n">L</span>
|
|
<span class="n">Esp</span> <span class="o">-></span> <span class="mh">0x3bfae4</span><span class="n">L</span>
|
|
<span class="n">Eax</span> <span class="o">-></span> <span class="mh">0x42424242</span><span class="n">L</span>
|
|
<span class="n">Ebx</span> <span class="o">-></span> <span class="mh">0x5a6000</span><span class="n">L</span>
|
|
<span class="n">Ecx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Edx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Ebp</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Edi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Esi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">EFlags</span> <span class="o">-></span> <span class="mh">0x202</span><span class="n">L</span>
|
|
<span class="n">EEflags</span><span class="p">(</span><span class="mh">0x202</span><span class="n">L</span><span class="p">:</span><span class="n">IF</span><span class="p">)</span>
|
|
<span class="o"><</span><span class="n">Normal</span> <span class="n">terminaison</span><span class="o">></span>
|
|
<span class="o">==</span><span class="n">DIFF</span><span class="o">==</span>
|
|
<span class="n">Eip</span><span class="p">:</span> <span class="mh">0x3f0000</span> <span class="o">-></span> <span class="mh">0x3f0007</span> <span class="p">(</span><span class="o">+</span><span class="mh">0x7</span><span class="p">)</span>
|
|
<span class="n">Eax</span><span class="p">:</span> <span class="mh">0x11223344</span> <span class="o">-></span> <span class="mh">0x42424242</span> <span class="p">(</span><span class="o">+</span><span class="mh">0x31200efe</span><span class="p">)</span>
|
|
|
|
|
|
<span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python64</span> <span class="n">test_code</span><span class="o">.</span><span class="n">py</span> <span class="o">--</span><span class="n">x64</span> <span class="s2">"mov r15, 0x11223344; push r14; call r15"</span> <span class="s2">"rcx=1; r14=0x4242424243434343"</span>
|
|
<span class="n">Testing</span> <span class="n">x64</span> <span class="n">code</span>
|
|
<span class="n">Startup</span> <span class="n">context</span> <span class="ow">is</span><span class="p">:</span>
|
|
<span class="n">Rip</span> <span class="o">-></span> <span class="mh">0x205a1d60000</span><span class="n">L</span>
|
|
<span class="n">Rsp</span> <span class="o">-></span> <span class="mh">0xe24a88fa88</span><span class="n">L</span>
|
|
<span class="n">Rax</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rbx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rcx</span> <span class="o">-></span> <span class="mh">0x1</span><span class="n">L</span>
|
|
<span class="n">Rdx</span> <span class="o">-></span> <span class="mh">0xe24aaf9000</span><span class="n">L</span>
|
|
<span class="n">Rbp</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rdi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rsi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R8</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R9</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R10</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R11</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R12</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R13</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R14</span> <span class="o">-></span> <span class="mh">0x4242424243434343</span><span class="n">L</span>
|
|
<span class="n">R15</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">EFlags</span> <span class="o">-></span> <span class="mh">0x200</span><span class="n">L</span>
|
|
<span class="n">EEflags</span><span class="p">(</span><span class="mh">0x200</span><span class="n">L</span><span class="p">:</span><span class="n">IF</span><span class="p">)</span>
|
|
<span class="o">==</span><span class="n">Post</span><span class="o">-</span><span class="n">exec</span> <span class="n">context</span><span class="o">==</span>
|
|
<span class="n">Rip</span> <span class="o">-></span> <span class="mh">0x11223344</span><span class="n">L</span>
|
|
<span class="n">Rsp</span> <span class="o">-></span> <span class="mh">0xe24a88fa78</span><span class="n">L</span>
|
|
<span class="n">Rax</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rbx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rcx</span> <span class="o">-></span> <span class="mh">0x1</span><span class="n">L</span>
|
|
<span class="n">Rdx</span> <span class="o">-></span> <span class="mh">0xe24aaf9000</span><span class="n">L</span>
|
|
<span class="n">Rbp</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rdi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rsi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R8</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R9</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R10</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R11</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R12</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R13</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R14</span> <span class="o">-></span> <span class="mh">0x4242424243434343</span><span class="n">L</span>
|
|
<span class="n">R15</span> <span class="o">-></span> <span class="mh">0x11223344</span><span class="n">L</span>
|
|
<span class="n">EFlags</span> <span class="o">-></span> <span class="mh">0x10202</span><span class="n">L</span>
|
|
<span class="n">EEflags</span><span class="p">(</span><span class="mh">0x10202</span><span class="n">L</span><span class="p">:</span><span class="n">IF</span><span class="o">|</span><span class="n">RF</span><span class="p">)</span>
|
|
<span class="o"><</span><span class="n">EXCEPTION_ACCESS_VIOLATION</span><span class="p">(</span><span class="mh">0xc0000005</span><span class="n">L</span><span class="p">)</span><span class="o">></span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x11223344</span><span class="o">></span>
|
|
<span class="o">==</span><span class="n">DIFF</span><span class="o">==</span>
|
|
<span class="n">Rip</span><span class="p">:</span> <span class="mh">0x205a1d60000</span> <span class="o">-></span> <span class="mh">0x11223344</span> <span class="p">(</span><span class="o">-</span><span class="mh">0x20590b3ccbc</span><span class="p">)</span>
|
|
<span class="n">Rsp</span><span class="p">:</span> <span class="mh">0xe24a88fa88</span> <span class="o">-></span> <span class="mh">0xe24a88fa78</span> <span class="p">(</span><span class="o">-</span><span class="mh">0x10</span><span class="p">)</span>
|
|
<span class="n">R15</span><span class="p">:</span> <span class="mh">0x0</span> <span class="o">-></span> <span class="mh">0x11223344</span> <span class="p">(</span><span class="o">+</span><span class="mh">0x11223344</span><span class="p">)</span>
|
|
<span class="n">EFlags</span><span class="p">:</span> <span class="mh">0x200</span> <span class="o">-></span> <span class="mh">0x10202</span> <span class="p">(</span><span class="o">+</span><span class="mh">0x10002</span><span class="p">)</span>
|
|
<span class="n">Negative</span> <span class="n">Stack</span><span class="p">:</span> <span class="n">dumping</span><span class="p">:</span>
|
|
<span class="n">E24A88FA88</span> <span class="mi">0</span><span class="n">C</span> <span class="mi">00</span> <span class="n">D6</span> <span class="n">A1</span> <span class="mi">05</span> <span class="mi">02</span> <span class="mi">00</span> <span class="mi">00</span> <span class="mi">43</span> <span class="mi">43</span> <span class="mi">43</span> <span class="mi">43</span> <span class="mi">42</span> <span class="mi">42</span> <span class="mi">42</span> <span class="mi">42</span> <span class="o">........</span><span class="n">CCCCBBBB</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="localdebugger">
|
|
<span id="sample-local-debugger"></span><h3>16.7.2. <code class="xref py py-class docutils literal"><span class="pre">LocalDebugger</span></code><a class="headerlink" href="#localdebugger" title="Permalink to this headline">¶</a></h3>
|
|
<div class="section" id="in-current-process">
|
|
<h4>16.7.2.1. In current process<a class="headerlink" href="#in-current-process" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
|
|
<span class="k">class</span> <span class="nc">SingleSteppingDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">LocalDebugger</span><span class="p">):</span>
|
|
<span class="n">SINGLE_STEP_COUNT</span> <span class="o">=</span> <span class="mi">4</span>
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_exception_code</span><span class="p">()</span>
|
|
<span class="n">context</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_exception_context</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"EXCEPTION !!!! Got a </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">context</span><span class="o">.</span><span class="n">pc</span><span class="p">))</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">SINGLE_STEP_COUNT</span> <span class="o">-=</span> <span class="mi">1</span>
|
|
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">SINGLE_STEP_COUNT</span><span class="p">:</span>
|
|
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
<span class="k">return</span> <span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
|
|
|
|
<span class="k">class</span> <span class="nc">RewriteBreakpoint</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">HXBreakpoint</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">context</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">get_exception_context</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"GOT AN HXBP at 0x</span><span class="si">{0:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">context</span><span class="o">.</span><span class="n">pc</span><span class="p">))</span>
|
|
<span class="c1"># Rewrite the infinite loop with 2 nop</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="s2">"</span><span class="se">\x90\x90</span><span class="s2">"</span><span class="p">)</span>
|
|
<span class="c1"># Ask for a single stepping</span>
|
|
<span class="k">return</span> <span class="n">dbg</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
|
|
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">SingleSteppingDebugger</span><span class="p">()</span>
|
|
<span class="c1"># Infinite loop + nop + ret</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">"label :begin; jmp :begin; nop; ret"</span><span class="p">)</span>
|
|
<span class="n">func</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Code addr = 0x</span><span class="si">{0:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
|
|
<span class="c1"># Create a thread that will infinite loop</span>
|
|
<span class="n">t</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="c1"># Add a breakpoint on the infitine loop</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">RewriteBreakpoint</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
|
|
<span class="n">t</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Done!"</span><span class="p">)</span>
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe debug\local_debugger.py
|
|
Code addr = 0xcf0002
|
|
GOT AN HXBP at 0xcf0002
|
|
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0003
|
|
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0004
|
|
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0005
|
|
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x770d7c04
|
|
Done!
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="id1">
|
|
<h4>16.7.2.2. In remote process<a class="headerlink" href="#id1" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">ctypes</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
<span class="n">remote_code</span> <span class="o">=</span> <span class="s2">"""</span>
|
|
<span class="s2">import windows</span>
|
|
<span class="s2">from windows.generated_def.winstructs import *</span>
|
|
|
|
<span class="s2">windows.utils.create_console()</span>
|
|
|
|
<span class="s2">class YOLOHXBP(windows.debug.HXBreakpoint):</span>
|
|
<span class="s2"> def trigger(self, dbg, exc):</span>
|
|
<span class="s2"> p = windows.current_process</span>
|
|
<span class="s2"> arg_pos = 2</span>
|
|
<span class="s2"> context = dbg.get_exception_context()</span>
|
|
<span class="s2"> esp = context.Esp</span>
|
|
<span class="s2"> unicode_string_addr = p.read_ptr(esp + (arg_pos + 1) * 4)</span>
|
|
<span class="s2"> wstring_addr = p.read_ptr(unicode_string_addr + 4)</span>
|
|
<span class="s2"> dll_loaded = p.read_wstring(wstring_addr)</span>
|
|
<span class="s2"> print("I AM LOADING <</span><span class="si">{0}</span><span class="s2">>".format(dll_loaded))</span>
|
|
|
|
<span class="s2">d = windows.debug.LocalDebugger()</span>
|
|
|
|
<span class="s2">exp = windows.current_process.peb.modules[1].pe.exports</span>
|
|
<span class="s2">#windows.utils.FixedInteractiveConsole(locals()).interact()</span>
|
|
<span class="s2">ldr = exp["LdrLoadDll"]</span>
|
|
<span class="s2">d.add_bp(YOLOHXBP(ldr))</span>
|
|
|
|
<span class="s2">"""</span>
|
|
|
|
<span class="n">c</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">CREATE_SUSPENDED</span><span class="p">)</span>
|
|
<span class="n">c</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="n">remote_code</span><span class="p">)</span>
|
|
<span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">time</span>
|
|
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">2</span><span class="p">)</span>
|
|
<span class="n">c</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">debug</span>\<span class="n">local_debugger_remote_process</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="p">(</span><span class="n">In</span> <span class="n">another</span> <span class="n">console</span><span class="p">)</span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">WinSxS</span>\<span class="n">x86_microsoft</span><span class="o">.</span><span class="n">windows</span><span class="o">.</span><span class="n">gdiplus_6595b64144ccf1df_1</span><span class="o">.</span><span class="mf">1.9600</span><span class="o">.</span><span class="mi">17415</span><span class="n">_none_dad8722c5bcc2d8f</span>\<span class="n">gdiplus</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SysWOW64</span>\<span class="n">oleacc</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">OLEAUT32</span><span class="o">.</span><span class="n">DLL</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">MSCTF</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SysWOW64</span>\<span class="n">msxml6</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">shell32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SYSTEM32</span>\<span class="n">WINMM</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="wmi-requests">
|
|
<span id="wmi-request"></span><h2>16.8. WMI requests<a class="headerlink" href="#wmi-requests" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"WMI requester is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Selecting * from 'Win32_Process'"</span><span class="p">)</span>
|
|
<span class="n">result</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">select</span><span class="p">(</span><span class="s2">"Win32_Process"</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"They are <</span><span class="si">{0}</span><span class="s2">> processes"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">result</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for ourself via pid"</span><span class="p">)</span>
|
|
<span class="n">us</span> <span class="o">=</span> <span class="p">[</span><span class="n">p</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">result</span> <span class="k">if</span> <span class="nb">int</span><span class="p">(</span><span class="n">p</span><span class="p">[</span><span class="s2">"ProcessId"</span><span class="p">])</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some info about our process:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"Name"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"Name"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"ProcessId"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"ProcessId"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"OSName"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"OSName"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"UserModeTime"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"UserModeTime"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"WindowsVersion"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"WindowsVersion"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"CommandLine"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"CommandLine"</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk>:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">vol</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">select</span><span class="p">(</span><span class="s2">"Win32_LogicalDisk"</span><span class="p">,</span> <span class="p">[</span><span class="s2">"Caption"</span><span class="p">,</span> <span class="s2">"FileSystem"</span><span class="p">,</span> <span class="s2">"FreeSpace"</span><span class="p">]):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">vol</span><span class="p">))</span>
|
|
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">wmi</span>\<span class="n">wmi_request</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">WMI</span> <span class="n">requester</span> <span class="ow">is</span> <span class="o"><</span><span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">WmiRequester</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x02B37EF0</span><span class="o">></span>
|
|
<span class="n">Selecting</span> <span class="o">*</span> <span class="kn">from</span> <span class="s1">'Win32_Process'</span>
|
|
<span class="n">They</span> <span class="n">are</span> <span class="o"><</span><span class="mi">92</span><span class="o">></span> <span class="n">processes</span>
|
|
<span class="n">Looking</span> <span class="k">for</span> <span class="n">ourself</span> <span class="n">via</span> <span class="n">pid</span>
|
|
<span class="n">Some</span> <span class="n">info</span> <span class="n">about</span> <span class="n">our</span> <span class="n">process</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">Name</span> <span class="o">-></span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span>
|
|
<span class="o">*</span> <span class="n">ProcessId</span> <span class="o">-></span> <span class="mi">7968</span>
|
|
<span class="o">*</span> <span class="n">OSName</span> <span class="o">-></span> <span class="n">Microsoft</span> <span class="n">Windows</span> <span class="mf">8.1</span> <span class="n">Pro</span><span class="o">|</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span><span class="o">|</span>\<span class="n">Device</span>\<span class="n">Harddisk0</span>\<span class="n">Partition2</span>
|
|
<span class="o">*</span> <span class="n">UserModeTime</span> <span class="o">-></span> <span class="mi">2812500</span>
|
|
<span class="o">*</span> <span class="n">WindowsVersion</span> <span class="o">-></span> <span class="mf">6.3</span><span class="o">.</span><span class="mi">9600</span>
|
|
<span class="o">*</span> <span class="n">CommandLine</span> <span class="o">-></span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="o">.</span>\<span class="n">samples</span>\<span class="n">wmi_request</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="o"><</span><span class="n">Select</span> <span class="n">Caption</span><span class="p">,</span><span class="n">FileSystem</span><span class="p">,</span><span class="n">FreeSpace</span> <span class="kn">from</span> <span class="nn">Win32_LogicalDisk</span><span class="o">></span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="p">{</span><span class="s1">'Caption'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'C:'</span><span class="p">,</span> <span class="s1">'FreeSpace'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'43991547904'</span><span class="p">,</span> <span class="s1">'FileSystem'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'NTFS'</span><span class="p">}</span>
|
|
<span class="o">*</span> <span class="p">{</span><span class="s1">'Caption'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'E:'</span><span class="p">,</span> <span class="s1">'FreeSpace'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'82776027136'</span><span class="p">,</span> <span class="s1">'FileSystem'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'NTFS'</span><span class="p">}</span>
|
|
<span class="o">*</span> <span class="p">{</span><span class="s1">'Caption'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'F:'</span><span class="p">,</span> <span class="s1">'FreeSpace'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'5711265792'</span><span class="p">,</span> <span class="s1">'FileSystem'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'FAT32'</span><span class="p">}</span>
|
|
<span class="o">*</span> <span class="p">{</span><span class="s1">'Caption'</span><span class="p">:</span> <span class="sa">u</span><span class="s1">'G:'</span><span class="p">,</span> <span class="s1">'FreeSpace'</span><span class="p">:</span> <span class="kc">None</span><span class="p">,</span> <span class="s1">'FileSystem'</span><span class="p">:</span> <span class="kc">None</span><span class="p">}</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="using-com-inetfwpolicy2">
|
|
<span id="sample-com-firewall"></span><h2>16.9. using COM: <code class="docutils literal"><span class="pre">INetFwPolicy2</span></code><a class="headerlink" href="#using-com-inetfwpolicy2" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="n">interfaces</span>
|
|
|
|
<span class="c1"># This code is a simple version of the firewall code in windows.winoject.network</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Initialisation of COM"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">init</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating INetFwPolicy2 variable"</span><span class="p">)</span>
|
|
<span class="n">firewall</span> <span class="o">=</span> <span class="n">interfaces</span><span class="o">.</span><span class="n">INetFwPolicy2</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2"> (value = </span><span class="si">{1}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">firewall</span><span class="p">,</span> <span class="n">firewall</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Generating CLSID"</span><span class="p">)</span>
|
|
<span class="n">NetFwPolicy2CLSID</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">IID</span><span class="o">.</span><span class="n">from_string</span><span class="p">(</span><span class="s2">"E2B3C97F-6AE1-41AC-817A-F6F92166D7DD"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">NetFwPolicy2CLSID</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating COM instance"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">create_instance</span><span class="p">(</span><span class="n">NetFwPolicy2CLSID</span><span class="p">,</span> <span class="n">firewall</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2"> (value = 0x</span><span class="si">{1:0}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">firewall</span><span class="p">,</span> <span class="n">firewall</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Checking for enabled profiles"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">profile</span> <span class="ow">in</span> <span class="p">[</span><span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_DOMAIN</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_PRIVATE</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_PUBLIC</span><span class="p">]:</span>
|
|
<span class="n">enabled</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VARIANT_BOOL</span><span class="p">()</span>
|
|
<span class="n">firewall</span><span class="o">.</span><span class="n">get_FirewallEnabled</span><span class="p">(</span><span class="n">profile</span><span class="p">,</span> <span class="n">enabled</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">profile</span><span class="p">,</span> <span class="n">enabled</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">com</span>\<span class="n">com_inetfwpolicy2</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Initialisation</span> <span class="n">of</span> <span class="n">COM</span>
|
|
<span class="n">Creating</span> <span class="n">INetFwPolicy2</span> <span class="n">variable</span>
|
|
<span class="o"><</span><span class="n">INetFwPolicy2</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x02DC8210</span><span class="o">></span> <span class="p">(</span><span class="n">value</span> <span class="o">=</span> <span class="kc">None</span><span class="p">)</span>
|
|
|
|
<span class="n">Generating</span> <span class="n">CLSID</span>
|
|
<span class="o"><</span><span class="n">IID</span> <span class="s2">"E2B3C97F-6AE1-41AC-817A-F6F92166D7DD"</span><span class="o">></span>
|
|
|
|
<span class="n">Creating</span> <span class="n">COM</span> <span class="n">instance</span>
|
|
<span class="o"><</span><span class="n">INetFwPolicy2</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x02DC8210</span><span class="o">></span> <span class="p">(</span><span class="n">value</span> <span class="o">=</span> <span class="mh">0x8984848</span><span class="p">)</span>
|
|
|
|
<span class="n">Checking</span> <span class="k">for</span> <span class="n">enabled</span> <span class="n">profiles</span>
|
|
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_DOMAIN</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">)</span> <span class="o">-></span> <span class="kc">True</span>
|
|
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_PRIVATE</span><span class="p">(</span><span class="mh">0x2</span><span class="n">L</span><span class="p">)</span> <span class="o">-></span> <span class="kc">True</span>
|
|
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_PUBLIC</span><span class="p">(</span><span class="mh">0x4</span><span class="n">L</span><span class="p">)</span> <span class="o">-></span> <span class="kc">True</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-crypto">
|
|
<h2>16.10. <a class="reference internal" href="crypto.html#module-windows.crypto" title="windows.crypto"><code class="xref py py-mod docutils literal"><span class="pre">windows.crypto</span></code></a><a class="headerlink" href="#windows-crypto" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="encryption-demo">
|
|
<span id="sample-crypto-encryption"></span><h3>16.10.1. Encryption demo<a class="headerlink" href="#encryption-demo" title="Permalink to this headline">¶</a></h3>
|
|
<p>This sample is a working POC able to generate key-pair, encrypt and decrypt file.</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">argparse</span>
|
|
<span class="kn">import</span> <span class="nn">windows.crypto</span> <span class="k">as</span> <span class="nn">crypto</span>
|
|
<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">winproxy</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="o">*</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.crypto.generation</span> <span class="k">as</span> <span class="nn">gencrypt</span>
|
|
|
|
<span class="c1"># http://stackoverflow.com/questions/1461272/basic-questions-on-microsoft-cryptoapi</span>
|
|
|
|
<span class="k">def</span> <span class="nf">crypt</span><span class="p">(</span><span class="n">src</span><span class="p">,</span> <span class="n">dst</span><span class="p">,</span> <span class="n">certs</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="sd">"""Encrypt the content of 'src' file with the certifacts in 'certs' into 'dst'"""</span>
|
|
<span class="c1"># Open every certificates in the certs list</span>
|
|
<span class="n">certlist</span> <span class="o">=</span> <span class="p">[</span><span class="n">crypto</span><span class="o">.</span><span class="n">CertificateContext</span><span class="o">.</span><span class="n">from_file</span><span class="p">(</span><span class="n">x</span><span class="p">)</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">certs</span><span class="p">]</span>
|
|
<span class="c1"># Encrypt the content of 'src' with all the public keys(certs)</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">encrypt</span><span class="p">(</span><span class="n">certlist</span><span class="p">,</span> <span class="n">src</span><span class="o">.</span><span class="n">read</span><span class="p">())</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Encryption done. Result:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
|
|
<span class="c1"># Write the result in 'dst'</span>
|
|
<span class="n">dst</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
|
|
<span class="n">dst</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
|
|
<span class="n">src</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
|
|
|
|
<span class="k">def</span> <span class="nf">decrypt</span><span class="p">(</span><span class="n">src</span><span class="p">,</span> <span class="n">pfxfile</span><span class="p">,</span> <span class="n">password</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="sd">"""Decrypt the content of 'src' with the private key in 'pfxfile'. the 'pfxfile' is open using the 'password'"""</span>
|
|
<span class="c1"># Open the 'pfx' with the given password</span>
|
|
<span class="n">pfx</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">import_pfx</span><span class="p">(</span><span class="n">pfxfile</span><span class="o">.</span><span class="n">read</span><span class="p">(),</span> <span class="n">password</span><span class="p">)</span>
|
|
<span class="c1"># Decrypt the content of the file</span>
|
|
<span class="n">decrypted</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">decrypt</span><span class="p">(</span><span class="n">pfx</span><span class="p">,</span> <span class="n">src</span><span class="o">.</span><span class="n">read</span><span class="p">())</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="sa">u</span><span class="s2">"Result = <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">decrypted</span><span class="p">))</span>
|
|
<span class="k">return</span> <span class="n">decrypted</span>
|
|
|
|
<span class="n">PFW_TMP_KEY_CONTAINER</span> <span class="o">=</span> <span class="s2">"PythonForWindowsTMPContainer"</span>
|
|
|
|
<span class="k">def</span> <span class="nf">genkeys</span><span class="p">(</span><span class="n">common_name</span><span class="p">,</span> <span class="n">pfxpassword</span><span class="p">,</span> <span class="n">outname</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="sd">"""Generate a SHA256/RSA key pair. A self-signed certificate with 'common_name' is stored as 'outname'.cer.</span>
|
|
<span class="sd"> The private key is stored in 'outname'.pfx protected with 'pfxpassword'"""</span>
|
|
<span class="n">cert_store</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">EHCERTSTORE</span><span class="o">.</span><span class="n">new_in_memory</span><span class="p">()</span>
|
|
<span class="c1"># Create a TMP context that will hold our newly generated key-pair</span>
|
|
<span class="k">with</span> <span class="n">crypto</span><span class="o">.</span><span class="n">CryptContext</span><span class="p">(</span><span class="n">PFW_TMP_KEY_CONTAINER</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">PROV_RSA_FULL</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">retrycreate</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span> <span class="k">as</span> <span class="n">ctx</span><span class="p">:</span>
|
|
<span class="n">key</span> <span class="o">=</span> <span class="n">HCRYPTKEY</span><span class="p">()</span>
|
|
<span class="c1"># Generate a key-pair that is exportable</span>
|
|
<span class="n">winproxy</span><span class="o">.</span><span class="n">CryptGenKey</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">AT_KEYEXCHANGE</span><span class="p">,</span> <span class="n">CRYPT_EXPORTABLE</span><span class="p">,</span> <span class="n">key</span><span class="p">)</span>
|
|
<span class="c1"># It does NOT destroy the key-pair from the container,</span>
|
|
<span class="c1"># It only release the key handle</span>
|
|
<span class="c1"># https://msdn.microsoft.com/en-us/library/windows/desktop/aa379918(v=vs.85).aspx</span>
|
|
<span class="n">winproxy</span><span class="o">.</span><span class="n">CryptDestroyKey</span><span class="p">(</span><span class="n">key</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Descrption of the key-container that will be used to generate the certificate</span>
|
|
<span class="n">KeyProvInfo</span> <span class="o">=</span> <span class="n">CRYPT_KEY_PROV_INFO</span><span class="p">()</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">pwszContainerName</span> <span class="o">=</span> <span class="n">PFW_TMP_KEY_CONTAINER</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">pwszProvName</span> <span class="o">=</span> <span class="kc">None</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">dwProvType</span> <span class="o">=</span> <span class="n">PROV_RSA_FULL</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">dwFlags</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">cProvParam</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">rgProvParam</span> <span class="o">=</span> <span class="kc">None</span>
|
|
<span class="c1">#KeyProvInfo.dwKeySpec = AT_SIGNATURE</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">dwKeySpec</span> <span class="o">=</span> <span class="n">AT_KEYEXCHANGE</span>
|
|
|
|
<span class="n">crypt_algo</span> <span class="o">=</span> <span class="n">CRYPT_ALGORITHM_IDENTIFIER</span><span class="p">()</span>
|
|
<span class="n">crypt_algo</span><span class="o">.</span><span class="n">pszObjId</span> <span class="o">=</span> <span class="n">szOID_RSA_SHA256RSA</span>
|
|
|
|
<span class="n">certif_name</span> <span class="o">=</span> <span class="s2">"CN=</span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">common_name</span><span class="p">)</span>
|
|
<span class="c1"># Generate a self-signed certificate based on the given key-container and signature algorithme</span>
|
|
<span class="n">certif</span> <span class="o">=</span> <span class="n">gencrypt</span><span class="o">.</span><span class="n">generate_selfsigned_certificate</span><span class="p">(</span><span class="n">certif_name</span><span class="p">,</span> <span class="n">key_info</span><span class="o">=</span><span class="n">KeyProvInfo</span><span class="p">,</span> <span class="n">signature_algo</span><span class="o">=</span><span class="n">crypt_algo</span><span class="p">)</span>
|
|
<span class="c1"># Add the newly created certificate to our TMP cert-store</span>
|
|
<span class="n">cert_store</span><span class="o">.</span><span class="n">add_certificate</span><span class="p">(</span><span class="n">certif</span><span class="p">)</span>
|
|
<span class="c1"># Generate a pfx from the TMP cert-store</span>
|
|
<span class="n">pfx</span> <span class="o">=</span> <span class="n">gencrypt</span><span class="o">.</span><span class="n">generate_pfx</span><span class="p">(</span><span class="n">cert_store</span><span class="p">,</span> <span class="n">pfxpassword</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">outname</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="n">outname</span> <span class="o">=</span> <span class="n">common_name</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
|
|
|
|
<span class="c1"># Dump the certif (public key) and pfx (public + private keys)</span>
|
|
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outname</span> <span class="o">+</span> <span class="s2">".cer"</span><span class="p">,</span> <span class="s2">"wb"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
|
|
<span class="c1"># The encoded certif only contains the public key</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">certif</span><span class="o">.</span><span class="n">encoded</span><span class="p">)</span>
|
|
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outname</span> <span class="o">+</span> <span class="s2">".pfx"</span><span class="p">,</span> <span class="s2">"wb"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">pfx</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">certif</span><span class="p">)</span>
|
|
<span class="c1"># Destroy the TMP key container</span>
|
|
<span class="n">prov</span> <span class="o">=</span> <span class="n">HCRYPTPROV</span><span class="p">()</span>
|
|
<span class="n">winproxy</span><span class="o">.</span><span class="n">CryptAcquireContextW</span><span class="p">(</span><span class="n">prov</span><span class="p">,</span> <span class="n">PFW_TMP_KEY_CONTAINER</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">PROV_RSA_FULL</span><span class="p">,</span> <span class="n">CRYPT_DELETEKEYSET</span><span class="p">)</span>
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">)</span>
|
|
<span class="n">subparsers</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">add_subparsers</span><span class="p">(</span><span class="n">description</span><span class="o">=</span><span class="s1">'valid subcommands'</span><span class="p">,)</span>
|
|
|
|
<span class="n">cryptparse</span> <span class="o">=</span> <span class="n">subparsers</span><span class="o">.</span><span class="n">add_parser</span><span class="p">(</span><span class="s1">'crypt'</span><span class="p">)</span>
|
|
<span class="n">cryptparse</span><span class="o">.</span><span class="n">set_defaults</span><span class="p">(</span><span class="n">func</span><span class="o">=</span><span class="n">crypt</span><span class="p">)</span>
|
|
|
|
<span class="n">cryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'src'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'rb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'File to encrypt'</span><span class="p">)</span>
|
|
<span class="n">cryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'dst'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'wb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The encrypted file'</span><span class="p">)</span>
|
|
<span class="n">cryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'certs'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="nb">str</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'+'</span><span class="p">,</span>
|
|
<span class="n">help</span><span class="o">=</span><span class="s1">'List of certfile used to encrypt the src'</span><span class="p">)</span>
|
|
|
|
<span class="n">decryptparse</span> <span class="o">=</span> <span class="n">subparsers</span><span class="o">.</span><span class="n">add_parser</span><span class="p">(</span><span class="s1">'decrypt'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">set_defaults</span><span class="p">(</span><span class="n">func</span><span class="o">=</span><span class="n">decrypt</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'src'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'rb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'File to decrypt'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'pfxfile'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'rb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'PFX file to use'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'password'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Password of the PFX'</span><span class="p">)</span>
|
|
|
|
<span class="n">genkeysparse</span> <span class="o">=</span> <span class="n">subparsers</span><span class="o">.</span><span class="n">add_parser</span><span class="p">(</span><span class="s1">'genkey'</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">set_defaults</span><span class="p">(</span><span class="n">func</span><span class="o">=</span><span class="n">genkeys</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'common_name'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'?'</span><span class="p">,</span> <span class="n">metavar</span><span class="o">=</span><span class="s1">'CommonName'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="s1">'DEFAULT'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'the common name of the certificate'</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'outname'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'?'</span><span class="p">,</span><span class="n">help</span><span class="o">=</span><span class="s1">'The filename base for the generated files'</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--pfxpassword'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'?'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Password to protect the PFX'</span><span class="p">)</span>
|
|
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="n">res</span><span class="o">.</span><span class="n">func</span><span class="p">(</span><span class="o">**</span><span class="n">res</span><span class="o">.</span><span class="vm">__dict__</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python crypto\encryption_demo.py genkey YOLOCERTIF mykey --pfxpassword MYPASSWORD
|
|
<CertificatContext "YOLOCERTIF" serial="1b a4 3e 17 f7 ed ec ab 4f f8 11 46 48 e9 29 25">
|
|
|
|
(cmd λ) ls
|
|
mykey.cer mykey.pfx
|
|
|
|
(cmd λ) echo|set /p="my secret message" > message.txt
|
|
|
|
(cmd λ) python crypto\encryption_demo.py crypt message.txt message.crypt mykey.cer
|
|
Encryption done. Result:
|
|
bytearray(b'0\x82\x01\x19\x06\t*\x86H\x86\xf7\r\x01\x07\x03\xa0\x82\x01\n0\x82\x01\x06\x02\x01\x001\x81\xc30\x81
|
|
\xc0\x02\x01\x000)0\x151\x130\x11\x06\x03U\x04\x03\x13\nYOLOCERTIF\x02\x10\x1b\xa4>\x17\xf7\xed\xec\xabO\xf8\x11
|
|
FH\xe9)%0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\x00\x04\x81\x80V\x89)\xf5\xaaM\x99cEA\x17^\xa2D~\x94\xe3\xf2\x1f
|
|
\x05Y\xc2\xbb\xb2\xbbYBpU6\x870\xce\xe7\xd2M{\xbb\xb9K\xa0\xf5\xe5\x93\xca\xedF\x80.x\xdc\xf2\x0c\xa6UO\x01\r\xaf
|
|
\xd0Z\xd9\xabnzR\xd4j=\xca\xc2RG\xcd\x11u\x82\x7f\x8c\xd8t\xb9\xf9\xe8%\xfal\xaaHPj;\xecKk]\t%\xfd\x91\xcc\xe0lWf
|
|
\xc6\x12x\x1am\xc8\x01t\xac\xa6\xf3#\x02\xd4J \x8eZ\xbb\x10W\xe1 0;\x06\t*\x86H\x86\xf7\r\x01\x07\x010\x14\x06\x08*
|
|
\x86H\x86\xf7\r\x03\x07\x04\x08\x14F\x04\xad\xed9\xed<\x80\x18\x80]6\xccTV\xbc\xb8*\x84QY!~\xb3\n\x1aV\xd4\rf\xd1n:')
|
|
|
|
(cmd λ) python crypto\encryption_demo.py decrypt message.crypt mykey.pfx BADPASS
|
|
Traceback (most recent call last):
|
|
File "..\samples\encryption_demo.py", line 103, in <module>
|
|
res.func(**res.__dict__)
|
|
File "..\samples\encryption_demo.py", line 26, in decrypt
|
|
pfx = crypto.import_pfx(pfxfile.read(), password)
|
|
File "c:\users\hakril\documents\work\pythonforwindows\windows\crypto\certificate.py", line 153, in import_pfx
|
|
cert_store = winproxy.PFXImportCertStore(pfx, password, flags)
|
|
File "c:\users\hakril\documents\work\pythonforwindows\windows\winproxy.py", line 1065, in PFXImportCertStore
|
|
return PFXImportCertStore.ctypes_function(pPFX, szPassword, dwFlags)
|
|
File "c:\users\hakril\documents\work\pythonforwindows\windows\winproxy.py", line 148, in perform_call
|
|
return self._cprototyped(*args)
|
|
File "c:\users\hakril\documents\work\pythonforwindows\windows\winproxy.py", line 69, in kernel32_error_check
|
|
raise Kernel32Error(func_name)
|
|
windows.winproxy.Kernel32Error: PFXImportCertStore: [Error 86] The specified network password is not correct.
|
|
|
|
(cmd λ) python crypto\encryption_demo.py decrypt message.crypt mykey.pfx MYPASSWORD
|
|
Result = <my secret message>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="certificate-demo">
|
|
<span id="sample-crypto-certificate"></span><h3>16.10.2. Certificate demo<a class="headerlink" href="#certificate-demo" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">hashlib</span>
|
|
<span class="kn">import</span> <span class="nn">windows.crypto</span>
|
|
|
|
<span class="n">windowscert</span> <span class="o">=</span> <span class="s2">"""-----BEGIN CERTIFICATE-----</span>
|
|
<span class="s2">MIIFBDCCA+ygAwIBAgITMwAAAQZuwyXEMckYDgAAAAABBjANBgkqhkiG9w0BAQsF</span>
|
|
<span class="s2">ADCBhDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT</span>
|
|
<span class="s2">B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEuMCwGA1UE</span>
|
|
<span class="s2">AxMlTWljcm9zb2Z0IFdpbmRvd3MgUHJvZHVjdGlvbiBQQ0EgMjAxMTAeFw0xNjEw</span>
|
|
<span class="s2">MTEyMDM5MzFaFw0xODAxMTEyMDM5MzFaMHAxCzAJBgNVBAYTAlVTMRMwEQYDVQQI</span>
|
|
<span class="s2">EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv</span>
|
|
<span class="s2">ZnQgQ29ycG9yYXRpb24xGjAYBgNVBAMTEU1pY3Jvc29mdCBXaW5kb3dzMIIBIjAN</span>
|
|
<span class="s2">BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyWcaCYghNInk3ecpyu2uZ7LCV9QS</span>
|
|
<span class="s2">7GWYr41ufTkcL66ewHxlAoWjmkKG6W2Bp9BYYQok10iDeDGACE9Vjr6m4Jdh+YuN</span>
|
|
<span class="s2">RLxMnHC8JTGzk96CzmdBPAuUWdAcHNmTkIWQF6AXzsbBWsekQejvDBygAOCuIYh4</span>
|
|
<span class="s2">sBgNa5cjTxQc7Iyp9c7RxBmThV5BNFTOnSN6D9N8zU+ENgIZuyHxGvqzRdrhU4G4</span>
|
|
<span class="s2">Cg/h1CkI4TgeZQZCeUNPnWV6DMuvPCiqGEia5phOJZyENKND0Sx6eQZrYnuz1gMn</span>
|
|
<span class="s2">YaEnO+ggegtt4pWpqg8Ch0jNrkL1fb3Kzz7E34/K9dcTgaOymfF6qUKabQIDAQAB</span>
|
|
<span class="s2">o4IBgDCCAXwwHwYDVR0lBBgwFgYKKwYBBAGCNwoDBgYIKwYBBQUHAwMwHQYDVR0O</span>
|
|
<span class="s2">BBYEFBEciVg/vsVmKtr/hmHt7KM6g8lSMFIGA1UdEQRLMEmkRzBFMQ0wCwYDVQQL</span>
|
|
<span class="s2">EwRNT1BSMTQwMgYDVQQFEysyMjk4NzkrMTQ3NDQ5YmUtMTVhOC00ZWJhLTkzZjMt</span>
|
|
<span class="s2">ZDExMGE1YzQ1NTUyMB8GA1UdIwQYMBaAFKkpAjmOFsSXeM2Q+Z5PmuF8Va9TMFQG</span>
|
|
<span class="s2">A1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv</span>
|
|
<span class="s2">Y3JsL01pY1dpblByb1BDQTIwMTFfMjAxMS0xMC0xOS5jcmwwYQYIKwYBBQUHAQEE</span>
|
|
<span class="s2">VTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3Bz</span>
|
|
<span class="s2">L2NlcnRzL01pY1dpblByb1BDQTIwMTFfMjAxMS0xMC0xOS5jcnQwDAYDVR0TAQH/</span>
|
|
<span class="s2">BAIwADANBgkqhkiG9w0BAQsFAAOCAQEAvYC1iawgKoxXAotQXaN0lj1J5VX01/un</span>
|
|
<span class="s2">7JybZF4sPMG4acoFT85Ao5U6TK5ATPB7yPUulAivp8908DwTGqN+Ju6iH+UkvAb+</span>
|
|
<span class="s2">a/WcHVEMxQXK5eOFNE6yekUArBGbMNWlTFrpwklmVTnL9R+4aApTEe6ITT1KLDio</span>
|
|
<span class="s2">5uFw98n5Sqgh+In073czyiTG7MVhBexbOfhgnciXoufeyhwy1pYgjouSqSQZs4bj</span>
|
|
<span class="s2">cUwQTwGlS2Gd5a+3nblhjn+QhSszIo1K5n1udLPFWtn29BuGlSrtTXPv5OCfNtLO</span>
|
|
<span class="s2">l2ec6CyjDQc6HcQBNCsbJVq6qGtQbYNE+ih+KhIU4tO5jf25xthf2g==</span>
|
|
<span class="s2">-----END CERTIFICATE-----"""</span>
|
|
|
|
|
|
<span class="n">raw_cert</span> <span class="o">=</span> <span class="p">(</span><span class="s2">""</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">windowscert</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">"</span><span class="se">\n</span><span class="s2">"</span><span class="p">)[</span><span class="mi">1</span><span class="p">:</span><span class="o">-</span><span class="mi">1</span><span class="p">]))</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">'base64'</span><span class="p">)</span>
|
|
<span class="n">cert</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">CertificateContext</span><span class="o">.</span><span class="n">from_buffer</span><span class="p">(</span><span class="n">raw_cert</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Analysing certificate: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * issuer: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">issuer</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * raw_serial: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">raw_serial</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * serial: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">serial</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * encoded start: <</span><span class="si">{0!r}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">encoded</span><span class="p">[:</span><span class="mi">20</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span> <span class="s2">""</span>
|
|
<span class="n">chains</span> <span class="o">=</span> <span class="n">cert</span><span class="o">.</span><span class="n">chains</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"This certificate has </span><span class="si">{0}</span><span class="s2"> certificate chain(s)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">chains</span><span class="p">)))</span>
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">chain</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">chains</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Chain </span><span class="si">{0}</span><span class="s2">:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">i</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">ccert</span> <span class="ow">in</span> <span class="n">chain</span><span class="p">:</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" </span><span class="si">{0}</span><span class="s2">:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ccert</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * issuer: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ccert</span><span class="o">.</span><span class="n">issuer</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span> <span class="s2">""</span>
|
|
<span class="n">cert_to_verif</span> <span class="o">=</span> <span class="n">ccert</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for <</span><span class="si">{0}</span><span class="s2">> in trusted certificates"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert_to_verif</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="n">root_store</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">EHCERTSTORE</span><span class="o">.</span><span class="n">from_system_store</span><span class="p">(</span><span class="s2">"Root"</span><span class="p">)</span>
|
|
<span class="c1"># This is not the correct way verify the validity of a certificate chain.</span>
|
|
<span class="c1"># I would say that if the goal is to verify the signature of the certificate: use wintrust.</span>
|
|
<span class="c1"># (or maybe CertVerifyCertificateChainPolicy : https://msdn.microsoft.com/en-us/library/windows/desktop/aa377163(v=vs.85).aspx)</span>
|
|
<span class="n">matchs</span> <span class="o">=</span> <span class="p">[</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">root_store</span><span class="o">.</span><span class="n">certs</span> <span class="k">if</span> <span class="n">c</span> <span class="o">==</span> <span class="n">cert_to_verif</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"matches = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">matchs</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">matchs</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Found it !"</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Not found :("</span><span class="p">)</span>
|
|
|
|
<span class="c1">## Extract certificates of a PE file</span>
|
|
<span class="c1">## This code is not a fixed API and the current state of my tests</span>
|
|
|
|
<span class="nb">print</span> <span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span> <span class="p">(</span><span class="s2">"== PE Analysis =="</span><span class="p">)</span>
|
|
<span class="n">TARGET_FILE</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"C:\windows\system32\ntdll.dll"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Target sha1 = <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">hashlib</span><span class="o">.</span><span class="n">sha1</span><span class="p">(</span><span class="nb">open</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">,</span> <span class="s2">"rb"</span><span class="p">)</span><span class="o">.</span><span class="n">read</span><span class="p">())</span><span class="o">.</span><span class="n">hexdigest</span><span class="p">()))</span>
|
|
<span class="n">cryptobj</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">CryptObject</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Analysing </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cryptobj</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"File has </span><span class="si">{0}</span><span class="s2"> signer(s):"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cryptobj</span><span class="o">.</span><span class="n">crypt_msg</span><span class="o">.</span><span class="n">nb_signer</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">signer</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">cryptobj</span><span class="o">.</span><span class="n">crypt_msg</span><span class="o">.</span><span class="n">signers</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Signer </span><span class="si">{0}</span><span class="s2">:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">i</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Issuer: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">ECRYPT_DATA_BLOB</span><span class="p">(</span><span class="n">signer</span><span class="o">.</span><span class="n">Issuer</span><span class="o">.</span><span class="n">cbData</span><span class="p">,</span> <span class="n">signer</span><span class="o">.</span><span class="n">Issuer</span><span class="o">.</span><span class="n">pbData</span><span class="p">)</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * HashAlgorithme: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">signer</span><span class="o">.</span><span class="n">HashAlgorithm</span><span class="o">.</span><span class="n">pszObjId</span><span class="p">))</span>
|
|
<span class="n">cert</span> <span class="o">=</span> <span class="n">cryptobj</span><span class="o">.</span><span class="n">cert_store</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">signer</span><span class="o">.</span><span class="n">Issuer</span><span class="p">,</span> <span class="n">signer</span><span class="o">.</span><span class="n">SerialNumber</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Certificate: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"File embdeds </span><span class="si">{0}</span><span class="s2"> certificate(s):"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cryptobj</span><span class="o">.</span><span class="n">crypt_msg</span><span class="o">.</span><span class="n">nb_cert</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">certificate</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">cryptobj</span><span class="o">.</span><span class="n">crypt_msg</span><span class="o">.</span><span class="n">certs</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">) </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">i</span><span class="p">,</span> <span class="n">certificate</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python crypto\certificate.py
|
|
Analysing certificate: <CertificateContext "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">
|
|
* name: <Microsoft Windows>
|
|
* issuer: <Microsoft Windows Production PCA 2011>
|
|
* raw_serial: <[51, 0, 0, 1, 6, 110, 195, 37, 196, 49, 201, 24, 14, 0, 0, 0, 0, 1, 6]>
|
|
* serial: <33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06>
|
|
* encoded start: <bytearray(b'0\x82\x05\x040\x82\x03\xec\xa0\x03\x02\x01\x02\x02\x133\x00\x00\x01\x06')>
|
|
|
|
This certificate has 1 certificate chain(s)
|
|
Chain 0:
|
|
<CertificateContext "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">:
|
|
* issuer: <Microsoft Windows Production PCA 2011>
|
|
<CertificateContext "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">:
|
|
* issuer: <Microsoft Root Certificate Authority 2010>
|
|
<CertificateContext "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">:
|
|
* issuer: <Microsoft Root Certificate Authority 2010>
|
|
|
|
Looking for <Microsoft Root Certificate Authority 2010> in trusted certificates
|
|
matches = [<CertificateContext "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">]
|
|
Found it !
|
|
|
|
== PE Analysis ==
|
|
Target sha1 = <eb90bc0e33f3e62b0eac4afa8bfcf42a5d4e7bbb>
|
|
Analysing <CryptObject "C:\windows\system32\ntdll.dll" content_type=CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED(0xaL)>
|
|
File has 1 signer(s):
|
|
Signer 0:
|
|
* Issuer: bytearray(b'0\x81\x841\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\x08\x13\nWashington1\x100\x0e\x06\x03U\x04\x07\x13\x07Redmond1\x1e0\x1c\x06\x03U\x04\n\x13\x15Microsoft Corporation1.0,\x06\x03U\x04\x03\x13%Microsoft Windows Production PCA 2011')
|
|
* HashAlgorithme: 2.16.840.1.101.3.4.2.1
|
|
* Certificate: <CertificateContext "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">
|
|
|
|
File embdeds 2 certificate(s):
|
|
* 0) <CertificateContext "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">
|
|
* 1) <CertificateContext "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-alpc">
|
|
<h2>16.11. <a class="reference internal" href="alpc.html#module-windows.alpc" title="windows.alpc"><code class="xref py py-mod docutils literal"><span class="pre">windows.alpc</span></code></a><a class="headerlink" href="#windows-alpc" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="simple-alpc-communication">
|
|
<span id="sample-alpc"></span><h3>16.11.1. simple alpc communication<a class="headerlink" href="#simple-alpc-communication" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">multiprocessing</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.alpc</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="n">LPC_CONNECTION_REQUEST</span><span class="p">,</span> <span class="n">LPC_REQUEST</span>
|
|
|
|
<span class="n">PORT_NAME</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"\RPC Control\PythonForWindowsPORT"</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">alpc_server</span><span class="p">():</span>
|
|
<span class="n">server</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcServer</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">)</span> <span class="c1"># Create the ALPC Port</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] PORT <</span><span class="si">{0}</span><span class="s2">> CREATED"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">))</span>
|
|
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">server</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span> <span class="c1"># Wait for a message</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Message type = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Received data: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="k">assert</span> <span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span> <span class="o">==</span> <span class="n">LPC_CONNECTION_REQUEST</span> <span class="c1"># Check that message is a connection request</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Connection request"</span><span class="p">)</span>
|
|
<span class="n">server</span><span class="o">.</span><span class="n">accept_connection</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">server</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span> <span class="c1"># Wait for a real message</span>
|
|
<span class="nb">print</span> <span class="s2">""</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Received message: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Message type = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="k">assert</span> <span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span> <span class="o">==</span> <span class="n">LPC_REQUEST</span>
|
|
<span class="c1"># We can reply by two ways:</span>
|
|
<span class="c1"># - Send the same message with modified data</span>
|
|
<span class="c1"># - Recreate a Message and copy the MessageId</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"REQUEST '</span><span class="si">{0}</span><span class="s2">' DONE"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">)</span>
|
|
<span class="n">server</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">alpc_client</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Client pid = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">))</span>
|
|
<span class="c1"># Creation an 'AlpcClient' with a port name will connect to the port with an empty message</span>
|
|
<span class="n">client</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcClient</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] Connected: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">client</span><span class="p">))</span>
|
|
<span class="c1"># Send a message / wait for the response</span>
|
|
<span class="n">response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">send_receive</span><span class="p">(</span><span class="s2">"Hello world !"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] Response: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="c1"># You can also send message without waiting for a response with 'client.send'</span>
|
|
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="n">proc</span> <span class="o">=</span> <span class="n">multiprocessing</span><span class="o">.</span><span class="n">Process</span><span class="p">(</span><span class="n">target</span><span class="o">=</span><span class="n">alpc_server</span><span class="p">,</span> <span class="n">args</span><span class="o">=</span><span class="p">())</span>
|
|
<span class="n">proc</span><span class="o">.</span><span class="n">start</span><span class="p">()</span>
|
|
<span class="kn">import</span> <span class="nn">time</span><span class="p">;</span> <span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.5</span><span class="p">)</span>
|
|
<span class="n">alpc_client</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"BYE"</span><span class="p">)</span>
|
|
<span class="n">proc</span><span class="o">.</span><span class="n">terminate</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python alpc\simple_alpc.py
|
|
[SERV] PORT <\RPC Control\PythonForWindowsPORT> CREATED
|
|
Client pid = 15044
|
|
[SERV] Message type = 0x300a
|
|
[SERV] Received data: <>
|
|
[SERV] Connection request
|
|
[CLIENT] Connected: <windows.alpc.AlpcClient object at 0x0377FDB0>
|
|
|
|
[SERV] Received message: <Hello world !>
|
|
[SERV] Message type = 0x3001
|
|
[CLIENT] Response: <REQUEST 'Hello world !' DONE>
|
|
BYE
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="advanced-alpc-communication">
|
|
<span id="sample-advanced-alpc"></span><h3>16.11.2. advanced alpc communication<a class="headerlink" href="#advanced-alpc-communication" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">multiprocessing</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.alpc</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="n">LPC_CONNECTION_REQUEST</span><span class="p">,</span> <span class="n">LPC_REQUEST</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">ctypes</span>
|
|
<span class="kn">import</span> <span class="nn">tempfile</span>
|
|
|
|
<span class="n">PORT_NAME</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"\RPC Control\PythonForWindowsPORT_2"</span>
|
|
<span class="n">PORT_CONTEXT</span> <span class="o">=</span> <span class="mh">0x11223344</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">full_alpc_server</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"server pid = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">))</span>
|
|
<span class="n">server</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcServer</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] PORT <</span><span class="si">{0}</span><span class="s2">> CREATED"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">))</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">server</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] == Message received =="</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span> <span class="o">==</span> <span class="n">LPC_CONNECTION_REQUEST</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * ALPC connection request: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"Connection message response"</span>
|
|
<span class="n">server</span><span class="o">.</span><span class="n">accept_connection</span><span class="p">(</span><span class="n">msg</span><span class="p">,</span> <span class="n">port_context</span><span class="o">=</span><span class="n">PORT_CONTEXT</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Expected connection"</span><span class="p">)</span>
|
|
|
|
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">server</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] == Message received =="</span><span class="p">)</span>
|
|
<span class="c1"># print(" * Data: {0}".format(msg.data))</span>
|
|
<span class="c1"># print("[SERV] RECV Message type = {0:#x}".format(msg.type))</span>
|
|
<span class="c1"># print("[SERV] RECV Message Valid ATTRS = {0:#x}".format(msg.attributes.ValidAttributes))</span>
|
|
<span class="c1"># print("[SERV] RECV Message ATTRS = {0:#x}".format(msg.attributes.AllocatedAttributes))</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span> <span class="o">==</span> <span class="n">LPC_REQUEST</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * ALPC request: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * view_is_valid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">view_is_valid</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">view_is_valid</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message view attribute:"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="p">,</span> <span class="s2">" - VIEW"</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
<span class="n">view_data</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_string</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">ViewBase</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Reading view content: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">view_data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * security_is_valid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">security_is_valid</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * handle_is_valid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_is_valid</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">handle_is_valid</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">Handle</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message handle attribute:"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="p">,</span> <span class="s2">" - HANDLE"</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">ObjectType</span> <span class="o">==</span> <span class="mi">1</span><span class="p">:</span>
|
|
<span class="n">f</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">create_file_from_handle</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">Handle</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - File: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">f</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - content: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">f</span><span class="o">.</span><span class="n">read</span><span class="p">()))</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - unknow object type == </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">ObjectType</span><span class="p">))</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">-=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_HANDLE_ATTRIBUTE</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * context_is_valid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">context_is_valid</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">context_is_valid</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message context attribute:"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">context_attribute</span><span class="p">,</span> <span class="s2">" - CTX"</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">&</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_TOKEN_ATTRIBUTE</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message token attribute:"</span><span class="p">)</span>
|
|
<span class="n">token_struct</span> <span class="o">=</span> <span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">get_attribute</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_TOKEN_ATTRIBUTE</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">token_struct</span><span class="p">,</span> <span class="s2">" - TOKEN"</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
|
|
<span class="c1"># We can reply by to way:</span>
|
|
<span class="c1"># - Send the same message with modified data</span>
|
|
<span class="c1"># - Recreate a Message and copy the MessageId</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"REQUEST '</span><span class="si">{0}</span><span class="s2">' DONE"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">)</span>
|
|
<span class="n">server</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Unexpected message type"</span><span class="p">)</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">send_message_with_handle</span><span class="p">(</span><span class="n">client</span><span class="p">):</span>
|
|
<span class="nb">print</span> <span class="s2">""</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[Client] == Sending a message with a handle =="</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Craft a file with some data</span>
|
|
<span class="n">f</span> <span class="o">=</span> <span class="n">tempfile</span><span class="o">.</span><span class="n">NamedTemporaryFile</span><span class="p">()</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="s2">"Tempfile data <3"</span><span class="p">)</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">seek</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span>
|
|
|
|
<span class="c1"># New message with a Handle</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcMessage</span><span class="p">()</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_HANDLE_ATTRIBUTE</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">Flags</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_HANDLEFLG_DUPLICATE_SAME_ACCESS</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">Handle</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">get_handle_from_file</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">ObjectType</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">DesiredAccess</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"some message with a file"</span>
|
|
<span class="n">client</span><span class="o">.</span><span class="n">send_receive</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">send_message_with_view</span><span class="p">(</span><span class="n">client</span><span class="p">):</span>
|
|
<span class="nb">print</span> <span class="s2">""</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[Client] == Sending a message with a view =="</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Create View</span>
|
|
<span class="n">section</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">create_port_section</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mh">0x4000</span><span class="p">)</span>
|
|
<span class="n">view</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">map_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="mi">0</span><span class="p">],</span> <span class="mh">0x4000</span><span class="p">)</span>
|
|
|
|
<span class="c1"># New message with a View</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcMessage</span><span class="p">(</span><span class="mh">0x2000</span><span class="p">)</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_VIEW_ATTRIBUTE</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">Flags</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">ViewBase</span> <span class="o">=</span> <span class="n">view</span><span class="o">.</span><span class="n">ViewBase</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">SectionHandle</span> <span class="o">=</span> <span class="n">view</span><span class="o">.</span><span class="n">SectionHandle</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">ViewSize</span> <span class="o">=</span> <span class="mh">0x4000</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"some message with a view"</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">view</span><span class="o">.</span><span class="n">ViewBase</span><span class="p">,</span> <span class="s2">"The content of the view :)</span><span class="se">\x00</span><span class="s2">"</span><span class="p">)</span>
|
|
<span class="n">client</span><span class="o">.</span><span class="n">send_receive</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">alpc_client</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Client pid = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">))</span>
|
|
<span class="n">client</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcClient</span><span class="p">()</span>
|
|
|
|
<span class="c1"># You can create a non-connected AlpcClient and send a custom</span>
|
|
<span class="c1"># 'AlpcMessage' for complexe alpc port connection.</span>
|
|
<span class="n">connect_message</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcMessage</span><span class="p">()</span>
|
|
<span class="n">connect_message</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"Connection request client message"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] == Connecting to port =="</span><span class="p">)</span>
|
|
<span class="n">connect_response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">connect_to_port</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">,</span> <span class="n">connect_message</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] Connected with response: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">connect_response</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
|
|
<span class="c1"># AlpcClient send/recv/send_receive methods accept both string or</span>
|
|
<span class="c1"># AlpcMessage for complexe message.</span>
|
|
<span class="nb">print</span><span class="s2">""</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] == Sending a message =="</span><span class="p">)</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcMessage</span><span class="p">()</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"Complex Message 1"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Sending Message <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="n">response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">send_receive</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] Server response: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] RESP Message Valid ATTRS = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">response</span><span class="o">.</span><span class="n">valid_attributes</span><span class="p">))</span>
|
|
|
|
<span class="n">send_message_with_handle</span><span class="p">(</span><span class="n">client</span><span class="p">)</span>
|
|
<span class="n">send_message_with_view</span><span class="p">(</span><span class="n">client</span><span class="p">)</span>
|
|
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="n">proc</span> <span class="o">=</span> <span class="n">multiprocessing</span><span class="o">.</span><span class="n">Process</span><span class="p">(</span><span class="n">target</span><span class="o">=</span><span class="n">full_alpc_server</span><span class="p">,</span> <span class="n">args</span><span class="o">=</span><span class="p">())</span>
|
|
<span class="n">proc</span><span class="o">.</span><span class="n">start</span><span class="p">()</span>
|
|
<span class="kn">import</span> <span class="nn">time</span><span class="p">;</span> <span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.5</span><span class="p">)</span>
|
|
<span class="n">alpc_client</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"BYE"</span><span class="p">)</span>
|
|
<span class="n">proc</span><span class="o">.</span><span class="n">terminate</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">alpc</span>\<span class="n">advanced_alpc</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">server</span> <span class="n">pid</span> <span class="o">=</span> <span class="mi">13000</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="n">PORT</span> <span class="o"><</span>\<span class="n">RPC</span> <span class="n">Control</span>\<span class="n">PythonForWindowsPORT_2</span><span class="o">></span> <span class="n">CREATED</span>
|
|
<span class="n">Client</span> <span class="n">pid</span> <span class="o">=</span> <span class="mi">2100</span>
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="o">==</span> <span class="n">Connecting</span> <span class="n">to</span> <span class="n">port</span> <span class="o">==</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">ALPC</span> <span class="n">connection</span> <span class="n">request</span><span class="p">:</span> <span class="o"><</span><span class="n">Connection</span> <span class="n">request</span> <span class="n">client</span> <span class="n">message</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="n">Connected</span> <span class="k">with</span> <span class="n">response</span><span class="p">:</span> <span class="o"><</span><span class="n">Connection</span> <span class="n">message</span> <span class="n">response</span><span class="o">></span>
|
|
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="o">==</span> <span class="n">Sending</span> <span class="n">a</span> <span class="n">message</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">Sending</span> <span class="n">Message</span> <span class="o"><</span><span class="n">Complex</span> <span class="n">Message</span> <span class="mi">1</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">ALPC</span> <span class="n">request</span><span class="p">:</span> <span class="o"><</span><span class="n">Complex</span> <span class="n">Message</span> <span class="mi">1</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">view_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">security_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">handle_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">context_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">context</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">PortContext</span> <span class="o">-></span> <span class="mh">0x11223344</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageContext</span> <span class="o">-></span> <span class="kc">None</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">Sequence</span> <span class="o">-></span> <span class="mh">0x1</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">CallbackId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">token</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">TokenId</span> <span class="o">-></span> <span class="mh">0x1e4ecacc</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">AuthenticationId</span> <span class="o">-></span> <span class="mh">0x48989</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">ModifiedId</span> <span class="o">-></span> <span class="mh">0x48995</span><span class="n">L</span>
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="n">Server</span> <span class="n">response</span><span class="p">:</span> <span class="o"><</span><span class="n">REQUEST</span> <span class="s1">'Complex Message 1'</span> <span class="n">DONE</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="n">RESP</span> <span class="n">Message</span> <span class="n">Valid</span> <span class="n">ATTRS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ALPC_MESSAGE_CONTEXT_ATTRIBUTE</span><span class="p">(</span><span class="mh">0x20000000</span><span class="n">L</span><span class="p">)]</span>
|
|
|
|
<span class="p">[</span><span class="n">Client</span><span class="p">]</span> <span class="o">==</span> <span class="n">Sending</span> <span class="n">a</span> <span class="n">message</span> <span class="k">with</span> <span class="n">a</span> <span class="n">handle</span> <span class="o">==</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">ALPC</span> <span class="n">request</span><span class="p">:</span> <span class="o"><</span><span class="n">some</span> <span class="n">message</span> <span class="k">with</span> <span class="n">a</span> <span class="n">file</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">view_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">security_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">handle_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">handle</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">HANDLE</span><span class="o">.</span><span class="n">Flags</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">HANDLE</span><span class="o">.</span><span class="n">Handle</span> <span class="o">-></span> <span class="mh">0x260</span>
|
|
<span class="o">-</span> <span class="n">HANDLE</span><span class="o">.</span><span class="n">ObjectType</span> <span class="o">-></span> <span class="mh">0x1</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">HANDLE</span><span class="o">.</span><span class="n">DesiredAccess</span> <span class="o">-></span> <span class="mh">0x13019f</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">File</span><span class="p">:</span> <span class="o"><</span><span class="nb">open</span> <span class="n">file</span> <span class="s1">'<fdopen>'</span><span class="p">,</span> <span class="n">mode</span> <span class="s1">'r'</span> <span class="n">at</span> <span class="mh">0x02D529C0</span><span class="o">></span>
|
|
<span class="o">-</span> <span class="n">content</span><span class="p">:</span> <span class="o"><</span><span class="n">Tempfile</span> <span class="n">data</span> <span class="o"><</span><span class="mi">3</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">context_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">context</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">PortContext</span> <span class="o">-></span> <span class="mh">0x11223344</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageContext</span> <span class="o">-></span> <span class="kc">None</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">Sequence</span> <span class="o">-></span> <span class="mh">0x2</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">CallbackId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">token</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">TokenId</span> <span class="o">-></span> <span class="mh">0x1e4ecacc</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">AuthenticationId</span> <span class="o">-></span> <span class="mh">0x48989</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">ModifiedId</span> <span class="o">-></span> <span class="mh">0x48995</span><span class="n">L</span>
|
|
|
|
<span class="p">[</span><span class="n">Client</span><span class="p">]</span> <span class="o">==</span> <span class="n">Sending</span> <span class="n">a</span> <span class="n">message</span> <span class="k">with</span> <span class="n">a</span> <span class="n">view</span> <span class="o">==</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">ALPC</span> <span class="n">request</span><span class="p">:</span> <span class="o"><</span><span class="n">some</span> <span class="n">message</span> <span class="k">with</span> <span class="n">a</span> <span class="n">view</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">view_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">view</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">VIEW</span><span class="o">.</span><span class="n">Flags</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">VIEW</span><span class="o">.</span><span class="n">SectionHandle</span> <span class="o">-></span> <span class="kc">None</span>
|
|
<span class="o">-</span> <span class="n">VIEW</span><span class="o">.</span><span class="n">ViewBase</span> <span class="o">-></span> <span class="mh">0x2770000</span>
|
|
<span class="o">-</span> <span class="n">VIEW</span><span class="o">.</span><span class="n">ViewSize</span> <span class="o">-></span> <span class="mh">0x4000</span>
|
|
<span class="o">*</span> <span class="n">Reading</span> <span class="n">view</span> <span class="n">content</span><span class="p">:</span> <span class="o"><</span><span class="n">The</span> <span class="n">content</span> <span class="n">of</span> <span class="n">the</span> <span class="n">view</span> <span class="p">:)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">security_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">handle_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">context_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">context</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">PortContext</span> <span class="o">-></span> <span class="mh">0x11223344</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageContext</span> <span class="o">-></span> <span class="kc">None</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">Sequence</span> <span class="o">-></span> <span class="mh">0x3</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">CallbackId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">token</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">TokenId</span> <span class="o">-></span> <span class="mh">0x1e4ecacc</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">AuthenticationId</span> <span class="o">-></span> <span class="mh">0x48989</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">ModifiedId</span> <span class="o">-></span> <span class="mh">0x48995</span><span class="n">L</span>
|
|
<span class="n">BYE</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-rpc">
|
|
<h2>16.12. <a class="reference internal" href="rpc.html#module-windows.rpc" title="windows.rpc"><code class="xref py py-mod docutils literal"><span class="pre">windows.rpc</span></code></a><a class="headerlink" href="#windows-rpc" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="manual-uac">
|
|
<span id="sample-rpc-uac"></span><h3>16.12.1. Manual UAC<a class="headerlink" href="#manual-uac" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">argparse</span>
|
|
<span class="kn">import</span> <span class="nn">sys</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.rpc</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
<span class="kn">from</span> <span class="nn">windows.rpc</span> <span class="k">import</span> <span class="n">ndr</span>
|
|
|
|
<span class="c1"># NDR Descriptions</span>
|
|
<span class="k">class</span> <span class="nc">NDRPoint</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStructure</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
<span class="k">class</span> <span class="nc">NdrUACStartupInfo</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStructure</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">NDRPoint</span><span class="p">]</span>
|
|
|
|
<span class="k">class</span> <span class="nc">RAiLaunchAdminProcessParameters</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrParameters</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">,</span>
|
|
<span class="n">NdrUACStartupInfo</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
<span class="k">class</span> <span class="nc">NdrProcessInformation</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrParameters</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span> <span class="o">*</span> <span class="mi">4</span>
|
|
|
|
<span class="c1"># Parsing args</span>
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--target'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="n">sys</span><span class="o">.</span><span class="n">executable</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Executable to launch'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--cmdline'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="s2">""</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The commandline for the process'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--uacflags'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="nb">int</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="mi">0</span><span class="p">),</span> <span class="n">default</span><span class="o">=</span><span class="mh">0x11</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--creationflags'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="nb">int</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="mi">0</span><span class="p">),</span> <span class="n">default</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">CREATE_UNICODE_ENVIRONMENT</span><span class="p">)</span>
|
|
<span class="n">params</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">params</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Connecting to RPC Interface.</span>
|
|
<span class="n">UAC_UIID</span> <span class="o">=</span> <span class="s2">"201ef99a-7fa0-444c-9399-19ba84f12a1a"</span>
|
|
<span class="n">client</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">rpc</span><span class="o">.</span><span class="n">find_alpc_endpoint_and_connect</span><span class="p">(</span><span class="n">UAC_UIID</span><span class="p">)</span>
|
|
<span class="n">iid</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">bind</span><span class="p">(</span><span class="n">UAC_UIID</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Marshalling parameters.</span>
|
|
<span class="n">parameters</span> <span class="o">=</span> <span class="n">RAiLaunchAdminProcessParameters</span><span class="o">.</span><span class="n">pack</span><span class="p">([</span>
|
|
<span class="n">params</span><span class="o">.</span><span class="n">target</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\x00</span><span class="s2">"</span><span class="p">,</span> <span class="c1"># Application Path</span>
|
|
<span class="n">params</span><span class="o">.</span><span class="n">cmdline</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\x00</span><span class="s2">"</span><span class="p">,</span> <span class="c1"># Commandline</span>
|
|
<span class="n">params</span><span class="o">.</span><span class="n">uacflags</span><span class="p">,</span> <span class="c1"># UAC-Request Flag</span>
|
|
<span class="n">params</span><span class="o">.</span><span class="n">creationflags</span><span class="p">,</span> <span class="c1"># dwCreationFlags</span>
|
|
<span class="s2">"</span><span class="se">\x00</span><span class="s2">"</span><span class="p">,</span> <span class="c1"># StartDirectory</span>
|
|
<span class="s2">"WinSta0</span><span class="se">\\</span><span class="s2">Default</span><span class="se">\x00</span><span class="s2">"</span><span class="p">,</span> <span class="c1"># Station</span>
|
|
<span class="c1"># Startup Info</span>
|
|
<span class="p">(</span><span class="kc">None</span><span class="p">,</span> <span class="c1"># Title</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwX</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwY</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwXSize</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwYSize</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwXCountChars</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwYCountChars</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwFillAttribute</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwFlags</span>
|
|
<span class="mi">5</span><span class="p">,</span> <span class="c1"># wShowWindow</span>
|
|
<span class="c1"># Point structure: Use MonitorFromPoint to setup StartupInfo.hStdOutput</span>
|
|
<span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">)),</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># Window-Handle to know if UAC can steal focus</span>
|
|
<span class="mh">0xffffffff</span><span class="p">])</span> <span class="c1"># UAC Timeout</span>
|
|
|
|
<span class="n">result</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">call</span><span class="p">(</span><span class="n">iid</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">parameters</span><span class="p">)</span>
|
|
<span class="n">stream</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrStream</span><span class="p">(</span><span class="n">result</span><span class="p">)</span>
|
|
|
|
<span class="n">ph</span><span class="p">,</span> <span class="n">th</span><span class="p">,</span> <span class="n">pid</span><span class="p">,</span> <span class="n">tid</span> <span class="o">=</span> <span class="n">NdrProcessInformation</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">return_value</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Return value = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">return_value</span><span class="p">))</span>
|
|
<span class="n">target</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">handle</span><span class="o">=</span><span class="n">ph</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Created process is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * bitness is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="n">bitness</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * integrity: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">integrity</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * elevated: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">is_elevated</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">rpc</span>\<span class="n">uac</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Namespace</span><span class="p">(</span><span class="n">cmdline</span><span class="o">=</span><span class="s1">''</span><span class="p">,</span> <span class="n">creationflags</span><span class="o">=</span><span class="n">CREATE_UNICODE_ENVIRONMENT</span><span class="p">(</span><span class="mh">0x400</span><span class="n">L</span><span class="p">),</span> <span class="n">target</span><span class="o">=</span><span class="s1">'C:</span><span class="se">\\</span><span class="s1">Python27</span><span class="se">\\</span><span class="s1">python.exe'</span><span class="p">,</span> <span class="n">uacflags</span><span class="o">=</span><span class="mi">17</span><span class="p">)</span>
|
|
<span class="c1"># UAC pop - asking to execute python.exe | Clicking Yes</span>
|
|
<span class="n">Return</span> <span class="n">value</span> <span class="o">=</span> <span class="mh">0x6</span>
|
|
<span class="n">Created</span> <span class="n">process</span> <span class="ow">is</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"python.exe"</span> <span class="n">pid</span> <span class="mi">19304</span> <span class="n">at</span> <span class="mh">0x455f7d0</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">bitness</span> <span class="ow">is</span> <span class="mi">32</span>
|
|
<span class="o">*</span> <span class="n">integrity</span><span class="p">:</span> <span class="n">SECURITY_MANDATORY_HIGH_RID</span><span class="p">(</span><span class="mh">0x3000</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="o">*</span> <span class="n">elevated</span><span class="p">:</span> <span class="kc">True</span>
|
|
|
|
<span class="c1"># The new python.exe in another window</span>
|
|
<span class="o">>>></span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">integrity</span>
|
|
<span class="n">SECURITY_MANDATORY_HIGH_RID</span><span class="p">(</span><span class="mh">0x3000</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="o">>>></span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">is_elevated</span>
|
|
<span class="kc">True</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="manual-lsarenumerateprivileges">
|
|
<span id="sample-rpc-lsass"></span><h3>16.12.2. Manual <code class="docutils literal"><span class="pre">LsarEnumeratePrivileges</span></code><a class="headerlink" href="#manual-lsarenumerateprivileges" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows.rpc</span>
|
|
<span class="kn">from</span> <span class="nn">windows.rpc</span> <span class="k">import</span> <span class="n">ndr</span>
|
|
|
|
|
|
<span class="c1"># Ndr stuff</span>
|
|
<span class="k">class</span> <span class="nc">NdrContext</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStructure</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">PLSAPR_OBJECT_ATTRIBUTES</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStructure</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">),</span> <span class="c1"># We dont care if the subtype as we will pass None</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">),</span> <span class="c1"># We dont care if the subtype as we will pass None</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">)]</span> <span class="c1"># We dont care if the subtype as we will pass None</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">LsarOpenPolicy2Parameter</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrParameters</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">PLSAPR_OBJECT_ATTRIBUTES</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">LsarEnumeratePrivilegesParameter</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrParameters</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">NdrContext</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">LSAPR_POLICY_PRIVILEGE_DEF</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="nd">@classmethod</span>
|
|
<span class="k">def</span> <span class="nf">unpack</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">stream</span><span class="p">):</span>
|
|
<span class="n">size1</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrShort</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">ptr</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrShort</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">size2</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">luid</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrHyper</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">ptr</span><span class="p">,</span> <span class="n">luid</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">LSAPR_PRIVILEGE_ENUM_BUFFER</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="nd">@classmethod</span>
|
|
<span class="k">def</span> <span class="nf">unpack</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">stream</span><span class="p">):</span>
|
|
<span class="n">entries</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">array_size</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">array_ptr</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="c1"># Unpack pointed array</span>
|
|
<span class="n">array_size2</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="k">assert</span> <span class="n">array_size</span> <span class="o">==</span> <span class="n">array_size2</span>
|
|
<span class="n">x</span> <span class="o">=</span> <span class="p">[]</span>
|
|
<span class="c1"># unpack each elements LSAPR_POLICY_PRIVILEGE_DEF</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="n">array_size2</span><span class="p">):</span>
|
|
<span class="n">ptr</span><span class="p">,</span> <span class="n">luid</span> <span class="o">=</span> <span class="n">LSAPR_POLICY_PRIVILEGE_DEF</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">ptr</span><span class="p">:</span>
|
|
<span class="n">x</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">luid</span><span class="p">)</span>
|
|
<span class="c1"># unpack pointed strings</span>
|
|
<span class="n">result</span> <span class="o">=</span> <span class="p">[]</span>
|
|
<span class="k">for</span> <span class="n">luid</span> <span class="ow">in</span> <span class="n">x</span><span class="p">:</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrWcharConformantVaryingArrays</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">result</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">luid</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
|
|
<span class="k">return</span> <span class="n">result</span>
|
|
|
|
|
|
<span class="c1"># Actual code</span>
|
|
|
|
<span class="c1">## LSASS alpc endpoints is fixed, no need for the epmapper</span>
|
|
<span class="n">client</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">rpc</span><span class="o">.</span><span class="n">RPCClient</span><span class="p">(</span><span class="sa">r</span><span class="s2">"\RPC Control\lsasspirpc"</span><span class="p">)</span>
|
|
<span class="c1">## Bind to the desired interface</span>
|
|
<span class="n">iid</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">bind</span><span class="p">(</span><span class="s1">'12345778-1234-abcd-ef00-0123456789ab'</span><span class="p">,</span> <span class="n">version</span><span class="o">=</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">))</span>
|
|
|
|
<span class="c1">## Craft parameters and call 'LsarOpenPolicy2'</span>
|
|
<span class="n">params</span> <span class="o">=</span> <span class="n">LsarOpenPolicy2Parameter</span><span class="o">.</span><span class="n">pack</span><span class="p">([</span><span class="kc">None</span><span class="p">,</span> <span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span><span class="p">),</span> <span class="mh">0x20000000</span><span class="p">])</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">call</span><span class="p">(</span><span class="n">iid</span><span class="p">,</span> <span class="mi">44</span><span class="p">,</span> <span class="n">params</span><span class="p">)</span>
|
|
<span class="c1">## Unpack the resulting handle</span>
|
|
<span class="n">handle</span> <span class="o">=</span> <span class="n">NdrContext</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStream</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
|
|
|
|
<span class="c1">## Craft parameters and call 'LsarEnumeratePrivileges'</span>
|
|
<span class="n">x</span> <span class="o">=</span> <span class="n">LsarEnumeratePrivilegesParameter</span><span class="o">.</span><span class="n">pack</span><span class="p">([</span><span class="n">handle</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mi">10000</span><span class="p">]);</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">call</span><span class="p">(</span><span class="n">iid</span><span class="p">,</span> <span class="mi">2</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
|
|
|
|
<span class="c1">## Unpack the resulting 'LSAPR_PRIVILEGE_ENUM_BUFFER'</span>
|
|
<span class="n">priviledges</span> <span class="o">=</span> <span class="n">LSAPR_PRIVILEGE_ENUM_BUFFER</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStream</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">priv</span> <span class="ow">in</span> <span class="n">priviledges</span><span class="p">:</span>
|
|
<span class="nb">print</span> <span class="n">priv</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">rpc</span>\<span class="n">lsass</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreateTokenPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">3</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeAssignPrimaryTokenPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">4</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeLockMemoryPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeIncreaseQuotaPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeMachineAccountPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">7</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeTcbPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSecurityPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">9</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeTakeOwnershipPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">10</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeLoadDriverPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">11</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSystemProfilePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">12</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSystemtimePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">13</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeProfileSingleProcessPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">14</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeIncreaseBasePriorityPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">15</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreatePagefilePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreatePermanentPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">17</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeBackupPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">18</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeRestorePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">19</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeShutdownPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">20</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeDebugPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">21</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeAuditPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">22</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSystemEnvironmentPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">23</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeChangeNotifyPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">24</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeRemoteShutdownPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">25</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeUndockPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">26</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSyncAgentPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">27</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeEnableDelegationPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">28</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeManageVolumePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">29</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeImpersonatePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">30</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreateGlobalPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">31</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeTrustedCredManAccessPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">32</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeRelabelPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">33</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeIncreaseWorkingSetPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">34</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeTimeZonePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">35</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreateSymbolicLinkPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">36</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeDelegateSessionUserImpersonatePrivilege'</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
|
|
<div class="sphinxsidebarwrapper">
|
|
<h3><a href="index.html">Table Of Contents</a></h3>
|
|
<ul>
|
|
<li><a class="reference internal" href="#">16. Samples of code</a><ul>
|
|
<li><a class="reference internal" href="#processes">16.1. Processes</a><ul>
|
|
<li><a class="reference internal" href="#windows-current-process">16.1.1. <code class="docutils literal"><span class="pre">windows.current_process</span></code></a></li>
|
|
<li><a class="reference internal" href="#remote-process-winprocess">16.1.2. Remote process : <code class="docutils literal"><span class="pre">WinProcess</span></code></a></li>
|
|
<li><a class="reference internal" href="#peb-exploration">16.1.3. <code class="docutils literal"><span class="pre">PEB</span></code> exploration</a></li>
|
|
<li><a class="reference internal" href="#iat-hooking">16.1.4. IAT hooking</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-system">16.2. <code class="docutils literal"><span class="pre">windows.system</span></code></a></li>
|
|
<li><a class="reference internal" href="#network-socket-exploration">16.3. <code class="docutils literal"><span class="pre">Network</span></code> - socket exploration</a></li>
|
|
<li><a class="reference internal" href="#registry">16.4. <code class="docutils literal"><span class="pre">Registry</span></code></a></li>
|
|
<li><a class="reference internal" href="#windows-wintrust">16.5. <code class="docutils literal"><span class="pre">windows.wintrust</span></code></a></li>
|
|
<li><a class="reference internal" href="#vectoredexception">16.6. <code class="docutils literal"><span class="pre">VectoredException()</span></code></a><ul>
|
|
<li><a class="reference internal" href="#in-local-process">16.6.1. In local process</a></li>
|
|
<li><a class="reference internal" href="#in-remote-process">16.6.2. In remote process</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#debugging">16.7. Debugging</a><ul>
|
|
<li><a class="reference internal" href="#debugger">16.7.1. <code class="docutils literal"><span class="pre">Debugger</span></code></a><ul>
|
|
<li><a class="reference internal" href="#single-stepping">16.7.1.1. Single stepping</a></li>
|
|
<li><a class="reference internal" href="#windows-debug-functionbp">16.7.1.2. <code class="docutils literal"><span class="pre">windows.debug.FunctionBP</span></code></a></li>
|
|
<li><a class="reference internal" href="#debugger-attach">16.7.1.3. <code class="docutils literal"><span class="pre">Debugger.attach</span></code></a></li>
|
|
<li><a class="reference internal" href="#native-code-tester">16.7.1.4. Native code tester</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#localdebugger">16.7.2. <code class="docutils literal"><span class="pre">LocalDebugger</span></code></a><ul>
|
|
<li><a class="reference internal" href="#in-current-process">16.7.2.1. In current process</a></li>
|
|
<li><a class="reference internal" href="#id1">16.7.2.2. In remote process</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#wmi-requests">16.8. WMI requests</a></li>
|
|
<li><a class="reference internal" href="#using-com-inetfwpolicy2">16.9. using COM: <code class="docutils literal"><span class="pre">INetFwPolicy2</span></code></a></li>
|
|
<li><a class="reference internal" href="#windows-crypto">16.10. <code class="docutils literal"><span class="pre">windows.crypto</span></code></a><ul>
|
|
<li><a class="reference internal" href="#encryption-demo">16.10.1. Encryption demo</a></li>
|
|
<li><a class="reference internal" href="#certificate-demo">16.10.2. Certificate demo</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-alpc">16.11. <code class="docutils literal"><span class="pre">windows.alpc</span></code></a><ul>
|
|
<li><a class="reference internal" href="#simple-alpc-communication">16.11.1. simple alpc communication</a></li>
|
|
<li><a class="reference internal" href="#advanced-alpc-communication">16.11.2. advanced alpc communication</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-rpc">16.12. <code class="docutils literal"><span class="pre">windows.rpc</span></code></a><ul>
|
|
<li><a class="reference internal" href="#manual-uac">16.12.1. Manual UAC</a></li>
|
|
<li><a class="reference internal" href="#manual-lsarenumerateprivileges">16.12.2. Manual <code class="docutils literal"><span class="pre">LsarEnumeratePrivileges</span></code></a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
|
|
<h4>Previous topic</h4>
|
|
<p class="topless"><a href="internals.html"
|
|
title="previous chapter">15. Internals</a></p>
|
|
<div role="note" aria-label="source link">
|
|
<h3>This Page</h3>
|
|
<ul class="this-page-menu">
|
|
<li><a href="_sources/sample.rst.txt"
|
|
rel="nofollow">Show Source</a></li>
|
|
</ul>
|
|
</div>
|
|
<div id="searchbox" style="display: none" role="search">
|
|
<h3>Quick search</h3>
|
|
<form class="search" action="search.html" method="get">
|
|
<div><input type="text" name="q" /></div>
|
|
<div><input type="submit" value="Go" /></div>
|
|
<input type="hidden" name="check_keywords" value="yes" />
|
|
<input type="hidden" name="area" value="default" />
|
|
</form>
|
|
</div>
|
|
<script type="text/javascript">$('#searchbox').show(0);</script>
|
|
</div>
|
|
</div>
|
|
<div class="clearer"></div>
|
|
</div>
|
|
<div class="related" role="navigation" aria-label="related navigation">
|
|
<h3>Navigation</h3>
|
|
<ul>
|
|
<li class="right" style="margin-right: 10px">
|
|
<a href="genindex.html" title="General Index"
|
|
>index</a></li>
|
|
<li class="right" >
|
|
<a href="py-modindex.html" title="Python Module Index"
|
|
>modules</a> |</li>
|
|
<li class="right" >
|
|
<a href="internals.html" title="15. Internals"
|
|
>previous</a> |</li>
|
|
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.3 documentation</a> »</li>
|
|
</ul>
|
|
</div>
|
|
<div class="footer" role="contentinfo">
|
|
© Copyright 2015, Clement Rouault.
|
|
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.5.5.
|
|
</div>
|
|
</body>
|
|
</html> |