Esempio n. 1
0
    def _createInjectedStubs_remote_thread(self, dll, mem):
        """Allocate memory, create an ASM stub, copy strings and code into the target and executed via CreateRemoteThread().
        
        This stub has five goals:
        - AllocConsole: This gives us a new console in the target process.
        - LoadLibraryA: This is used to load the pydetour dll into the process.
        - GetProcAddress: This is used to find our target exported function from within the above DLL.
        - Launch python code: Call the exported function, passing the path of the bootstrap function.
        - Return exit status via ExitThread.
        
        This function returns a dictionary of allocation points in the remote process.
        
        High level description of ASM function::
        
            def InjectedStub():
                kernel32.AllocConsole()
                hModule = kernel32.LoadLibraryA(dll)
                if not hModule:
                    ExitThread(errors['ll_failed'])
                rpf = kernel32.GetProcAddress(hModule, "run_python_file")
                if not rpf:
                    ExitThread(errors['gpc_failed'])
                ret = rpf(Paths.inside_bootstrap_py)
                ExitThread(ret)
        """
        errors = TargetLauncher.ERROR_CODES_NAMED

        alloc = {}
        alloc['pyPath'] = mem.allocWrite(Paths.inside_bootstrap_py)
        alloc['dllPath'] = mem.allocWrite(dll)
        alloc['dllFunc'] = mem.allocWrite("run_python_file")
        alloc['executionPoint'] = mem.alloc(None, 128) #we need about 123 bytes
        hM = kernel32.GetModuleHandleA("kernel32.dll")

        from util.buffer import ASMBuffer
        buf = ASMBuffer(128)

        #buf.INT3() #Debugger trap
        
        #---------------------------------------------------------------------
        buf.movEAX_Addr(kernel32.GetProcAddress(hM, "AllocConsole"))
        buf.callEAX() #AllocConsole()
        
        #---------------------------------------------------------------------
        buf.pushAddr(alloc['dllPath'])
        buf.movEAX_Addr(kernel32.GetProcAddress(hM, "LoadLibraryA"))
        buf.callEAX() #hModule to dll -> EAX
        buf.cmpEAX_Byte(0x0)
        buf.namedJNZ("ll_success")

        if True:
            #buf.movEAX_Addr(kernel32.GetProcAddress(hM, "GetLastError"))
            #buf.callEAX() #GetLastError
            #buf.pushEAX()
            buf.pushDword(errors['ll_failed']) #PUSH 0x1 (thread exit code) 1 = LoadLibrary Failed
            buf.movEAX_Addr(kernel32.GetProcAddress(hM, "ExitThread"))
            buf.callEAX() #This cleanly exits the thread    

        #---------------------------------------------------------------------
        buf.nameTarget("ll_success")
        buf.pushAddr(alloc['dllFunc'])
        buf.pushEAX()    #PUSH EAX (hModule to dll)
        buf.movEAX_Addr(kernel32.GetProcAddress(hM, "GetProcAddress"))
        buf.callEAX() #dllFunc() address -> EAX
		
        buf.cmpEAX_Byte(0x0)
        buf.namedJNZ("gpa_success")

        if True:
            buf.pushDword(errors['gpc_failed']) #PUSH thread exit code 'GetProcAddress Failed'
            buf.movEAX_Addr(kernel32.GetProcAddress(hM, "ExitThread"))
            buf.callEAX() #This cleanly exits the thread

        #---------------------------------------------------------------------
        buf.nameTarget("gpa_success")
        buf.pushAddr(1) #turns on pdb debugging
        buf.pushAddr(alloc['pyPath'])
        buf.callEAX() #This calls our run_python_code script
        buf.addESP(8)
        buf.cmpEAX_Byte(0x0)
        buf.namedJZ("run_success")

        if True:
            #run_python_code failed, return it's error code
            buf.pushEAX()
            buf.movEAX_Addr(kernel32.GetProcAddress(hM, "ExitThread"))
            buf.callEAX() #This cleanly exits the thread
        
        #---------------------------------------------------------------------
        buf.nameTarget("run_success")
        
        #buf.INT3()
        
        buf.pushByte(0) #PUSH 0x0 (thread exit code, success)
        buf.movEAX_Addr(kernel32.GetProcAddress(hM, "ExitThread"))
        buf.callEAX() #This cleanly exits the thread
        
        
        buf.push([0xCC, 0xCC, 0xCC, 0xCC, 0xCC]) #Debugger trap
        buf.push([0xCC, 0xCC, 0xCC, 0xCC, 0xCC]) #Debugger trap
        
        buf.verifyJumps()
        log.debug("Stub is %s bytes."%(buf.cursor))
        mem.write(alloc['executionPoint'], buf.buf.raw)
        
        return alloc
Esempio n. 2
0
    def _createInjectedStubs_doubleapc(self, dll, mem, parent_wait, child_wait):
        """Allocate memory, create an ASM stub, copy strings and code into the target.
        
        This stub has five goals:
        - AllocConsole: This gives us a new console in the target process.
        - LoadLibraryA: This is used to load the pydetour dll into the process.
        - GetProcAddress: This is used to find our target exported function from within the above DLL.
        - Launch python code: Call the exported function, passing the path of the bootstrap function.
        - Replace entry point with the bytes we grabbed
        - Return exit status (?somehow)
        
        This function returns a dictionary of allocation points in the remote process.
        
        High level description of ASM function::
        
            def InjectedStub():
                kernel32.AllocConsole()
                hModule = kernel32.LoadLibraryA(dll)
                if not hModule:
                    ExitThread(errors['ll_failed'])
                rpf = kernel32.GetProcAddress(hModule, "run_python_file")
                if not rpf:
                    ExitThread(errors['gpc_failed'])
                ret = rpf(Paths.inside_bootstrap_py)
                return
        """
        errors = TargetLauncher.ERROR_CODES_NAMED

        alloc = {}
        alloc['pyPath'] = mem.allocWrite(Paths.inside_bootstrap_py)
        alloc['dllPath'] = mem.allocWrite(dll)
        alloc['dllFunc'] = mem.allocWrite("run_python_file")
        alloc['parent_wait'] = mem.allocWrite(parent_wait)
        alloc['child_wait'] = mem.allocWrite(child_wait)
        alloc['executionPoint'] = mem.alloc(None, 256)
        alloc['secondAPC'] = mem.alloc(None, 256)
        hM = kernel32.GetModuleHandleA("kernel32.dll")
        hM_ntdll = kernel32.GetModuleHandleA("ntdll.dll")

        from util.buffer import ASMBuffer
        
        if True:
            #This stub is the /second/ apc to run
            buf = ASMBuffer(256)
            #---------------------------------------------------------------------
            #---------------------------------------------------------------------
            #---------------------------------------------------------------------
            buf.callEAX(kernel32.GetProcAddress(hM, "AllocConsole"))
            
            #---------------------------------------------------------------------
            buf.pushAddr(alloc['dllPath'])
            buf.callEAX(kernel32.GetProcAddress(hM, "LoadLibraryA")) #hModule to dll -> EAX
            buf.cmpEAX_Byte(0x0)
            buf.namedJNZ("ll_success")

            if True:
                buf.callEAX(kernel32.GetProcAddress(hM, "GetLastError"))
                buf.INT3()
                #buf.pushEAX()
                buf.pushDword(errors['ll_failed']) #PUSH 0x1 (thread exit code) 1 = LoadLibrary Failed
                #buf.movEAX_Addr(kernel32.GetProcAddress(hM, "ExitThread"))
                buf.popEAX()
                buf.namedJMP("exit")

            #---------------------------------------------------------------------
            buf.nameTarget("ll_success")
            buf.pushAddr(alloc['dllFunc'])
            buf.pushEAX()    #PUSH EAX (hModule to dll)
            buf.callEAX(kernel32.GetProcAddress(hM, "GetProcAddress"))
            buf.cmpEAX_Byte(0x0)
            buf.namedJNZ("gpa_success")

            if True:
                buf.INT3()
                buf.pushDword(errors['gpc_failed']) #PUSH thread exit code 'GetProcAddress Failed'
                #buf.movEAX_Addr(kernel32.GetProcAddress(hM, "ExitThread"))
                buf.popEAX()
                buf.namedJMP("exit")

            #---------------------------------------------------------------------
            buf.nameTarget("gpa_success")
            buf.pushAddr(1) #turns on pdb debugging
            buf.pushAddr(alloc['pyPath'])
            buf.callEAX() #This calls our run_python_code script
            buf.addESP(8)
            buf.cmpEAX_Byte(0x0)
            buf.namedJZ("run_success")

            if True:
                buf.INT3()
                #run_python_code failed, return it's error code
                buf.pushEAX()
                #buf.movEAX_Addr(kernel32.GetProcAddress(hM, "ExitThread"))
                buf.popEAX()
                buf.namedJMP("exit")
            
            #---------------------------------------------------------------------
            buf.nameTarget("run_success")
            buf.nameTarget("exit", allowFlowThrough=True)
            
            self._asmbuf_setevent(buf, hM, alloc['parent_wait']) #Tell the parent to go ahead
            self._asmbuf_waitevent(buf, hM, alloc['child_wait']) #Wait until parent gives us the go ahead
           
            buf.ret(3*4) #APC is passed 3 params
           
            buf.push([0xCC, 0xCC, 0xCC, 0xCC, 0xCC]) #Debugger trap
            buf.push([0xCC, 0xCC, 0xCC, 0xCC, 0xCC]) #Debugger trap


            
            buf.verifyJumps()
            log.debug("Second APC stub is %s bytes."%(buf.cursor))
            mem.write(alloc['secondAPC'], buf.buf.raw)
        
        if True:
            #This stub is the /first/ apc to run
            #---------------------------------------------------------------------
            #---------------------------------------------------------------------
            from util.buffer import ASMBuffer
            bufapc = ASMBuffer(256)
            bufapc.INT3() #This is skipped over by scheduling the first apc at +1
            self._asmbuf_waitevent(bufapc, hM, alloc['child_wait']) #Wait until the parent gives us the go ahead
            bufapc.pushDword(0)
            bufapc.pushDword(0)
            bufapc.pushDword(0)
            bufapc.pushAddr(alloc['secondAPC'])
            bufapc.callEAX(kernel32.GetProcAddress(hM, "GetCurrentThread"))
            bufapc.pushEAX()
            bufapc.callEAX(kernel32.GetProcAddress(hM_ntdll, "NtQueueApcThread"))
            bufapc.ret(3*4)
            mem.write(alloc['executionPoint'], bufapc.buf.raw)

        return alloc