diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 277be8c..04538c7 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -5,6 +5,8 @@ set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} /MT") #add the application that will be used for tests: add_subdirectory ( test_case1 ) +add_subdirectory ( dpc_test ) +add_subdirectory ( injector ) enable_testing() diff --git a/tests/dpc_test/CMakeLists.txt b/tests/dpc_test/CMakeLists.txt new file mode 100644 index 0000000..e8a521f --- /dev/null +++ b/tests/dpc_test/CMakeLists.txt @@ -0,0 +1,17 @@ +cmake_minimum_required (VERSION 2.8) +project (dpc_test) + +set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} /MT") + +set (srcs + main.cpp +) + +set (hdrs +) + +add_executable ( ${PROJECT_NAME} ${hdrs} ${srcs}) + +if(PE2SHC_BUILD_TESTING) + INSTALL( TARGETS ${PROJECT_NAME} DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT ${PROJECT_NAME} ) +endif() diff --git a/tests/dpc_test/main.cpp b/tests/dpc_test/main.cpp new file mode 100644 index 0000000..ae4db2b --- /dev/null +++ b/tests/dpc_test/main.cpp @@ -0,0 +1,16 @@ +#include +#include + +int main() +{ + PROCESS_MITIGATION_DYNAMIC_CODE_POLICY dcp = {}; + dcp.ProhibitDynamicCode = 1; + SetProcessMitigationPolicy(ProcessDynamicCodePolicy, &dcp, sizeof(dcp)); + + std::cout << "PROCESS_MITIGATION_DYNAMIC_CODE_POLICY enabled...\n"; + while (true) + { + Sleep(6000); + } + return 0; +} diff --git a/tests/injector/CMakeLists.txt b/tests/injector/CMakeLists.txt new file mode 100644 index 0000000..26ca244 --- /dev/null +++ b/tests/injector/CMakeLists.txt @@ -0,0 +1,19 @@ +cmake_minimum_required (VERSION 2.8) +project (injector) + +set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} /MT") + +set (srcs + main.cpp + util.cpp +) + +set (hdrs + util.h +) + +add_executable ( ${PROJECT_NAME} ${hdrs} ${srcs}) + +if(PE2SHC_BUILD_TESTING) + INSTALL( TARGETS ${PROJECT_NAME} DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT ${PROJECT_NAME} ) +endif() diff --git a/tests/injector/main.cpp b/tests/injector/main.cpp new file mode 100644 index 0000000..4808ac7 --- /dev/null +++ b/tests/injector/main.cpp @@ -0,0 +1,45 @@ +#include +#include +#include "util.h" + +int main(int argc, char *argv[]) +{ + if (argc < 2) { + std::cout << "Args: \n"; + return 0; + } + + char *path = argv[1]; + int pid = atoi(argv[2]); + size_t shc_size = 0; + BYTE *shellcode = util::load_file(path, shc_size); + if (!shellcode) { + std::cerr << "Could not load the shellcode file\n"; + return -1; + } + std::cout << "Injecting to: " << pid << "\n"; + HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); + if (hProcess == NULL) { + std::cerr << "[ERROR] Could not open process : " << std::hex << GetLastError() << std::endl; + return -1; + } + LPVOID remote_buf = VirtualAllocEx(hProcess, NULL, shc_size, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE); + if (remote_buf == NULL) { + std::cerr << "[ERROR] Could not allocate a remote buffer : " << std::hex << GetLastError() << std::endl; + return -1; + } + if (!WriteProcessMemory(hProcess, remote_buf, shellcode, shc_size, NULL)) { + std::cerr << "[ERROR] WriteProcessMemory failed, status : " << std::hex << GetLastError() << std::endl; + return -1; + } + HANDLE hMyThread = NULL; + DWORD threadId = 0; + if ((hMyThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)remote_buf, NULL, 0, &threadId)) == NULL) { + std::cerr << "[ERROR] CreateRemoteThread failed, status : " << std::hex << GetLastError() << std::endl; + return -1; + } + std::cout << "Injected, created Thread, id = " << threadId << "\n"; + CloseHandle(hMyThread); + CloseHandle(hProcess); + return 0; +} diff --git a/tests/injector/util.cpp b/tests/injector/util.cpp new file mode 100644 index 0000000..7d373d0 --- /dev/null +++ b/tests/injector/util.cpp @@ -0,0 +1,81 @@ +#include "util.h" +#include + +BYTE* util::alloc_aligned(size_t buffer_size, DWORD protect, ULONGLONG desired_base) +{ + if (!buffer_size) return NULL; + + BYTE* buf = (BYTE*)VirtualAlloc((LPVOID)desired_base, buffer_size, MEM_COMMIT | MEM_RESERVE, protect); + return buf; +} + +bool util::free_aligned(BYTE* buffer) +{ + if (buffer == nullptr) return true; + if (!VirtualFree(buffer, 0, MEM_RELEASE)) { +#ifdef _DEBUG + std::cerr << "Releasing failed" << std::endl; +#endif + return false; + } + return true; +} + +BYTE* util::load_file(IN const char *filename, OUT size_t &read_size) +{ + HANDLE file = CreateFileA(filename, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + if (file == INVALID_HANDLE_VALUE) { +#ifdef _DEBUG + std::cerr << "Could not open file!" << std::endl; +#endif + return nullptr; + } + HANDLE mapping = CreateFileMapping(file, 0, PAGE_READONLY, 0, 0, 0); + if (!mapping) { +#ifdef _DEBUG + std::cerr << "Could not create mapping!" << std::endl; +#endif + CloseHandle(file); + return nullptr; + } + BYTE *dllRawData = (BYTE*)MapViewOfFile(mapping, FILE_MAP_READ, 0, 0, 0); + if (!dllRawData) { +#ifdef _DEBUG + std::cerr << "Could not map view of file" << std::endl; +#endif + CloseHandle(mapping); + CloseHandle(file); + return nullptr; + } + size_t r_size = GetFileSize(file, 0); + if (read_size != 0 && read_size <= r_size) { + r_size = read_size; + } + if (IsBadReadPtr(dllRawData, r_size)) { + std::cerr << "[-] Mapping of " << filename << " is invalid!" << std::endl; + UnmapViewOfFile(dllRawData); + CloseHandle(mapping); + CloseHandle(file); + return nullptr; + } + BYTE* localCopyAddress = alloc_aligned(r_size, PAGE_READWRITE); + if (localCopyAddress != nullptr) { + memcpy(localCopyAddress, dllRawData, r_size); + read_size = r_size; + } + else { + read_size = 0; +#ifdef _DEBUG + std::cerr << "Could not allocate memory in the current process" << std::endl; +#endif + } + UnmapViewOfFile(dllRawData); + CloseHandle(mapping); + CloseHandle(file); + return localCopyAddress; +} + +void util::free_file(BYTE* buffer) +{ + free_aligned(buffer); +} diff --git a/tests/injector/util.h b/tests/injector/util.h new file mode 100644 index 0000000..2d01a47 --- /dev/null +++ b/tests/injector/util.h @@ -0,0 +1,15 @@ +#pragma once + +#include + + +namespace util { + + BYTE* alloc_aligned(size_t buffer_size, DWORD protect, ULONGLONG desired_base=0); + + bool free_aligned(BYTE* buffer); + + BYTE* load_file(IN const char *filename, OUT size_t &read_size); + + void free_file(BYTE* buffer); +} diff --git a/tests/test_case1/main.cpp b/tests/test_case1/main.cpp index addb03b..77b4d07 100644 --- a/tests/test_case1/main.cpp +++ b/tests/test_case1/main.cpp @@ -17,6 +17,7 @@ int main() if (get_date() == 1337) { std::cout << "Test passed!\n"; } + MessageBoxW(0, L"Hello World!", L"Demo!", MB_OK); std::cout << "Test Case 1 finished\n"; return 0; }