Shellcode Injection VirtualProtectEx Returns Error

[Ne0nd0g]

Prerequisite

• I have searched the opened & closed issues
• I have searched the WIKI and its FAQ page

Environment Data

• Merlin Version: v1.6.3
• Merlin Build:
• Go Version: 1.19
• Operating System: Microsoft Windows [Version 10.0.19045.2965]

The CreateThread, RtlCreateUserThread, and QueueUserAPC shellcode injection methods use the VirtualProtectEx call without enough arguments causing the error: Invalid access to memory location. The call takes 5 arguments but only 3 are provided. Additionally, the error is not returned to server.

BOOL VirtualProtectEx(
  [in]  HANDLE hProcess,
  [in]  LPVOID lpAddress,
  [in]  SIZE_T dwSize,
  [in]  DWORD  flNewProtect,
  [out] PDWORD lpflOldProtect
);

merlin-agent/commands/exec_windows.go

Line 193 in e58a788

_, _, errVirtualProtectEx := VirtualProtectEx.Call(uintptr(pHandle), addr, uintptr(len(shellcode)), PAGE_EXECUTE)