admin/nixpal-shellsilo
1
0
Fork 0
mirror of https://github.com/nixpal/shellsilo synced 2026-06-06 16:24:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Tarek Ahmed
2024-06-16 13:29:53 -07:00
committed by GitHub
commit bc63b1b192
12 changed files with 2251 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
constants.py
+51
View File
@@ -0,0 +1,51 @@
dataTypes = {
"PWSTR":0x4,
"PVOID":0x4,
"PWCHAR":0x4,
"PSIZE_T":0x4,
"HANDLE":0x4,
"SIZE_T":0x4,
"UCHAR":0x1,
"USHORT":0x2,
"BYTE":0x1,
"ULONG":0x4,
"ULONG_PTR":0x4,
"SIZE_T":0x4,
"NTSTATUS":0x4,
"DWORD":0x4,
"KPRIORITY":0x4,
"ACCESS_MASK":0x4}
specialVars = {"GetCurrentProcess()":hex(0xffffffff),
"MEM_COMMIT":hex(0x1000),
"MEM_RESERVE":hex(0x2000),
"MEM_RELEASE":hex(0x8000),
"PAGE_EXECUTE_READWRITE":hex(0x40),
"PAGE_READWRITE":hex(0x4),
"PAGE_READONLY":hex(0x2),
"PROCESS_ALL_ACCESS":hex(0x1fffff),
"THREAD_ALL_ACCESS":hex(0x001FFFFF),
"False":hex(0x0),
"True":hex(0x1),
"NTSTATUS":"NULL",
"NULL":hex(0x0)}
sysCalls = {"NtAllocateVirtualMemory":{"10":["0018"],
"11":["0018"]
},
"NtQuerySystemInformation":{"10":["0036"],
"11":["0167" ,"0169", "016c", "016c", "016d"]
},
"NtOpenProcess":{"10":["0026"],
"11":["0029"]
},
"NtWriteVirtualMemory":{"10":["003A"],
"11":["0030"]
},
"NtCreateThreadEx":{"10":["00b3","00b4","00b6","00b9","00ba","00bb","00bc","00bd","00bd","00c1","00c1","00c1","00c2","00c2"],
"11":["00c5","00c6","00c7","00c7","00c8"]
}
}
if.c
+26
View File
@@ -0,0 +1,26 @@
#include <Windows.h>
#include <iostream>
// Define necessary structures and types
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
<MAIN>
{
DWORD test = 10;
DWORD test2 = 12;
while(TRUE){
if (test == test2){
break;
}
}
}
nt.c
+52
View File
@@ -0,0 +1,52 @@
#include <Windows.h>
#include <stdio.h>
// Define NTDLL function prototypes
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID;
<MAIN>
{
HANDLE processHandle = GetCurrentProcess();
PVOID remoteAddress = NULL;
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
CLIENT_ID ClientId;
ClientId.UniqueProcess = 8888;
NTSTATUS status;
HANDLE hProcess = NULL;
DWORD DesiredAccess = PROCESS_ALL_ACCESS;
DWORD allocationSize = 1024;
status = NtOpenProcess(
&hProcess,
DesiredAccess,
&ObjectAttributes,
&ClientId
);
status = NtAllocateVirtualMemory(hProcess,
&remoteAddress,
0,
&allocationSize,
MEM_COMMIT | MEM_RESERVE,
PAGE_READWRITE);
return 0;
}
ntalloc.c
+34
View File
@@ -0,0 +1,34 @@
#include <Windows.h>
#include <stdio.h>
// Define NTDLL function prototypes
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID;
<MAIN>
{
NTSTATUS status;
PVOID address = NULL;
SIZE_T size = 4096;
NtAllocateVirtualMemory(GetCurrentProcess(), &address, 0, &size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
NtWriteVirtualMemoty(
return 0;
}
ntalloc2.c
+27
View File
@@ -0,0 +1,27 @@
#include <Windows.h>
#include <iostream>
// Define necessary structures and types
<MAIN>
{
PVOID BaseAddress = NULL;
ULONG NumberOfBytesWritten = 0;
SIZE_T RegionSize = 0x2000;
DWORD ZeroBits = 0;
HANDLE hProcess = GetCurrentProcess();
NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)
PVOID buffer = "Hello";
ULONG NumberOfBytesToWrite = sizeof(buffer);
NtWriteVirtualMemory(hProcess, BaseAddress, buffer, NumberOfBytesToWrite, &NumberOfBytesWritten);
}
}
ntquery.c
+25
View File
@@ -0,0 +1,25 @@
#include <Windows.h>
#include <iostream>
// Define necessary structures and types
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
<MAIN>
{
DWORD test = 10;
while(TRUE){
if (test <= 12){
break;
}
}
}
ntwritevirtmem.c
+50
View File
@@ -0,0 +1,50 @@
#include <Windows.h>
#include <iostream>
// Define necessary structures and types
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
<MAIN>
{
DWORD targetProcessId = 5244;
CLIENT_ID clientId = NULL;
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
clientId.UniqueProcess = targetProcessId;
clientId.UniqueThread = NULL;
HANDLE hProcess = NULL;
NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientId);
PVOID remoteBuffer = NULL;
SIZE_T bufferSize = 4096;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES)
PVOID mystr = "Hello, World!";
ULONG numOfBytesWritten = 0;
NtAllocateVirtualMemory(hProcess, &remoteBuffer, 0, &bufferSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
NtWriteVirtualMemory(hProcess, remoteBuffer, dataToWrite, 13, &numOfBytesWritten);
}
ntwrt.c
+118
View File
@@ -0,0 +1,118 @@
#include <Windows.h>
#include <iostream>
// Define necessary structures and types
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
hidden struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
BYTE Reserved1[48];
PUNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
PVOID Reserved2;
ULONG HandleCount;
ULONG SessionId;
PVOID Reserved3;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG Reserved4;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
PVOID Reserved5;
SIZE_T QuotaPagedPoolUsage;
PVOID Reserved6;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER Reserved7[6];
} SYSTEM_PROCESS_INFORMATION;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
<MAIN>
{
UNICODE_STRING NtImagePath;
CLIENT_ID clientId = NULL;
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
clientId.UniqueThread = NULL;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
PVOID BaseAddress = NULL;
ULONG NumberOfBytesWritten = 0;
SIZE_T RegionSize = 0x2000;
DWORD p = NULL;
DWORD ZeroBits = 0;
DWORD dwRet = NULL;
NTSTATUS dwStatus = NULL;
DWORD SystemProcessInformation = 0x5;
DWORD nextEntry = 0;
DWORD imageName = 0;
DWORD newBaseAddress = 0;
DWORD processId = 0;
while(TRUE){
NtAllocateVirtualMemory(GetCurrentProcess(), &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
dwStatus = NtQuerySystemInformation(SystemProcessInformation, BaseAddress, RegionSize, &dwRet);
if (dwStatus == 0)
{
break;
}
dwRet += 0x2000;
RegionSize = dwRet;
BaseAddress = 0;
}
newBaseAddress = BaseAddress;
while(TRUE){
nextEntry = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->NextEntryOffset;
if (nextEntry == 0)
{
break;
}
newBaseAddress += nextEntry;
imageName = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->ImageName->Buffer;
InitUnicodeStr(NtImagePath, "CrypTool.exe");
if (imageName == NtImagePath)
{
processId = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->UniqueProcessId;
break;
}
}
HANDLE hProcess = NULL;
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
CLIENT_ID ClientId;
ClientId.UniqueProcess = processId;
NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &ClientId);
BaseAddress = 0;
NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
PVOID buffer = "h";
ULONG NumberOfBytesToWrite = sizeof(buffer);
NtWriteVirtualMemory(hProcess, BaseAddress, buffer, NumberOfBytesToWrite, &NumberOfBytesWritten);
HANDLE ThreadHandle = NULL;
NtCreateThreadEx(&ThreadHandle, 0x1FFFFF, NULL, hProcess, BaseAddress, NULL, NULL, NULL, NULL, NULL, NULL);
}
}
ntwrt.old.c
+80
View File
@@ -0,0 +1,80 @@
#include <Windows.h>
#include <iostream>
// Define necessary structures and types
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
hidden struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
BYTE Reserved1[48];
PUNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
PVOID Reserved2;
ULONG HandleCount;
ULONG SessionId;
PVOID Reserved3;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG Reserved4;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
PVOID Reserved5;
SIZE_T QuotaPagedPoolUsage;
PVOID Reserved6;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER Reserved7[6];
} SYSTEM_PROCESS_INFORMATION;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
<MAIN>
{
DWORD targetProcessId = 0x9c0;
CLIENT_ID clientId = NULL;
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
clientId.UniqueProcess = targetProcessId;
clientId.UniqueThread = NULL;
HANDLE hProcess = NULL;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
PVOID BaseAddress = NULL;
ULONG_PTR ZeroBits = NULL;
ULONG NumberOfBytesWritten = 0;
SIZE_T RegionSize = 0x1000;
DWORD rtn = NULL;
DWORD imageName = NULL;
NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientId);
rtn = NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
imageName = (SYSTEM_PROCESS_INFORMATION)rtn->ImageName->Length;
PVOID Buffer = "Hello, World!";
ULONG NumberOfBytesToWrite = sizeof(Buffer);
NtWriteVirtualMemory(hProcess, BaseAddress, Buffer, NumberOfBytesToWrite, &NumberOfBytesWritten);
}
q.c
+70
View File
@@ -0,0 +1,70 @@
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
hidden struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
BYTE Reserved1[48];
PUNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
PVOID Reserved2;
ULONG HandleCount;
ULONG SessionId;
PVOID Reserved3;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG Reserved4;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
PVOID Reserved5;
SIZE_T QuotaPagedPoolUsage;
PVOID Reserved6;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER Reserved7[6];
} SYSTEM_PROCESS_INFORMATION;
typedef struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
BYTE Reserved1[48];
PUNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
PVOID Reserved2;
ULONG HandleCount;
ULONG SessionId;
PVOID Reserved3;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG Reserved4;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
PVOID Reserved5;
SIZE_T QuotaPagedPoolUsage;
PVOID Reserved6;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
<MAIN>
{
DWORD test = NULL;
DWORD rtn = NULL;
test = (SYSTEM_PROCESS_INFORMATION)rtn->ImageName->Length;
return 0;
}
shellsilo.py
+1718
View File
File diff suppressed because it is too large Load Diff
test3.py
View File