diff --git a/Cargo.lock b/Cargo.lock index b606c29..ad7bfe0 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2,17 +2,11 @@ # It is not intended for manual editing. version = 3 -[[package]] -name = "autocfg" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa" - [[package]] name = "bitflags" -version = "1.3.2" +version = "2.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" +checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07" [[package]] name = "cfg-if" @@ -22,9 +16,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" [[package]] name = "getrandom" -version = "0.2.10" +version = "0.2.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427" +checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f" dependencies = [ "cfg-if", "libc", @@ -41,39 +35,21 @@ dependencies = [ [[package]] name = "libc" -version = "0.2.147" +version = "0.2.150" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3" - -[[package]] -name = "memoffset" -version = "0.7.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4" -dependencies = [ - "autocfg", -] +checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c" [[package]] name = "nix" -version = "0.26.2" +version = "0.27.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bfdda3d196821d6af13126e40375cdf7da646a96114af134d5f417a9a1dc8e1a" +checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053" dependencies = [ "bitflags", "cfg-if", "libc", - "memoffset", - "pin-utils", - "static_assertions", ] -[[package]] -name = "pin-utils" -version = "0.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" - [[package]] name = "ppv-lite86" version = "0.2.17" @@ -142,12 +118,6 @@ dependencies = [ "windows", ] -[[package]] -name = "static_assertions" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" - [[package]] name = "tcp_reverse_shell" version = "1.5.4" @@ -165,9 +135,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423" [[package]] name = "windows" -version = "0.51.1" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ca229916c5ee38c2f2bc1e9d8f04df975b4bd93f9955dc69fabb5d91270045c9" +checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be" dependencies = [ "windows-core", "windows-targets", @@ -175,18 +145,18 @@ dependencies = [ [[package]] name = "windows-core" -version = "0.51.1" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1f8cf84f35d2db49a46868f947758c7a1138116f7fac3bc844f43ade1292e64" +checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9" dependencies = [ "windows-targets", ] [[package]] name = "windows-targets" -version = "0.48.5" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c" +checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd" dependencies = [ "windows_aarch64_gnullvm", "windows_aarch64_msvc", @@ -199,45 +169,45 @@ dependencies = [ [[package]] name = "windows_aarch64_gnullvm" -version = "0.48.5" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8" +checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea" [[package]] name = "windows_aarch64_msvc" -version = "0.48.5" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc" +checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef" [[package]] name = "windows_i686_gnu" -version = "0.48.5" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e" +checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313" [[package]] name = "windows_i686_msvc" -version = "0.48.5" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406" +checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a" [[package]] name = "windows_x86_64_gnu" -version = "0.48.5" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e" +checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd" [[package]] name = "windows_x86_64_gnullvm" -version = "0.48.5" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc" +checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e" [[package]] name = "windows_x86_64_msvc" -version = "0.48.5" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538" +checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04" [[package]] name = "xor_params" diff --git a/Cargo.toml b/Cargo.toml index ea3192a..dde4abc 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -10,6 +10,8 @@ members = [ "xor_params", ] +resolver = "2" + [profile.release] codegen-units = 1 lto = true diff --git a/process_hollowing/Cargo.toml b/process_hollowing/Cargo.toml index f445d96..923e845 100644 --- a/process_hollowing/Cargo.toml +++ b/process_hollowing/Cargo.toml @@ -22,14 +22,19 @@ rco_config = {path = "../rco_config", version = ">=0.2.0"} rco_utils = {path = "../rco_utils", version = ">=1.0.1"} [target.'cfg(target_os="linux")'.dependencies] -nix = ">=0.16" +nix.version = ">=0.27.0" +nix.features = [ + "process", + "ptrace", +] [target.'cfg(windows)'.dependencies] -windows.version = ">=0.51.0" +windows.version = ">=0.52.0" windows.features = [ "Wdk_System_Threading", "Win32_Foundation", "Win32_Security", "Win32_System_Diagnostics_Debug", "Win32_System_Kernel", - "Win32_System_Threading" ] + "Win32_System_Threading", +] diff --git a/process_hollowing/src/process_hollowing_windows.rs b/process_hollowing/src/process_hollowing_windows.rs index d08924b..e255c35 100644 --- a/process_hollowing/src/process_hollowing_windows.rs +++ b/process_hollowing/src/process_hollowing_windows.rs @@ -41,12 +41,12 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { panic!("Could not create the suspended {target_process} with CreateProcessA"); } - // Get the PEB base address of the suspended process with ZwQueryInformationProcess + // Get the PEB base address of the suspended process with NtQueryInformationProcess // WINDOWS --> https://docs.microsoft.com/en-us/windows/win32/procthread/zwqueryinformationprocess // RUST --> https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/System/Threading/fn.NtQueryInformationProcess.html let process_handle = process_information.hProcess; let mut basic_information = PROCESS_BASIC_INFORMATION::default(); - if let Err(error) = unsafe { + if unsafe { NtQueryInformationProcess( process_handle, PROCESSINFOCLASS::default(), @@ -54,8 +54,8 @@ pub fn hollow_and_run(shellcode: &[u8], target_process: &str) { POINTER_SIZE_TIMES_SIX, &mut 0_u32, ) - } { - panic!("Could not get the entry point with ZwQueryInformationProcess: {error}"); + }.is_err() { + panic!("Could not get the entry point with NtQueryInformationProcess"); } // Use ReadProcessMemory to read 8 bytes of memory; the address of the code base diff --git a/process_migration/Cargo.toml b/process_migration/Cargo.toml index 39a4024..a9135bc 100644 --- a/process_migration/Cargo.toml +++ b/process_migration/Cargo.toml @@ -21,14 +21,19 @@ rco_config = {path = "../rco_config", version = ">=0.2.0"} rco_utils = {path = "../rco_utils", version = ">=1.0.1"} [target.'cfg(target_os="linux")'.dependencies] -nix = ">=0.16" +nix.version = ">=0.27.0" +nix.features = [ + "process", + "ptrace", +] [target.'cfg(windows)'.dependencies] -windows.version = ">=0.51.0" +windows.version = ">=0.52.0" windows.features = [ "Win32_Foundation", "Win32_Security", "Win32_System_Diagnostics_Debug", "Win32_System_Diagnostics_ToolHelp", "Win32_System_Memory", - "Win32_System_Threading" ] + "Win32_System_Threading", +] diff --git a/rco_utils/Cargo.toml b/rco_utils/Cargo.toml index b997d4e..d897428 100644 --- a/rco_utils/Cargo.toml +++ b/rco_utils/Cargo.toml @@ -19,7 +19,7 @@ antistring = ["windows"] rand.optional = true rand.version = ">=0.8.5" windows.optional = true -windows.version = ">=0.51.0" +windows.version = ">=0.52.0" windows.features = [ "Win32_Foundation", "Win32_Networking", @@ -27,4 +27,5 @@ windows.features = [ "Win32_System_Diagnostics_Debug", "Win32_System_LibraryLoader", "Win32_System_SystemInformation", - "Win32_System_SystemServices" ] + "Win32_System_SystemServices", +] diff --git a/tcp_reverse_shell/Cargo.toml b/tcp_reverse_shell/Cargo.toml index c0f4eea..a30aa85 100644 --- a/tcp_reverse_shell/Cargo.toml +++ b/tcp_reverse_shell/Cargo.toml @@ -20,10 +20,11 @@ rco_config = {path = "../rco_config", version = ">=0.2.0"} rco_utils = {path = "../rco_utils", version = ">=1.0.1"} [target.'cfg(windows)'.dependencies] -windows.version = ">=0.51.0" +windows.version = ">=0.52.0" windows.features = [ "Win32_Foundation", "Win32_Security", "Win32_Networking_WinSock", "Win32_System_SystemInformation", - "Win32_System_Threading" ] + "Win32_System_Threading", +]