diff --git a/SharpSploit/Execution/PlatformInvoke/Win32.cs b/SharpSploit/Execution/PlatformInvoke/Win32.cs index 78501c8..5f08ec5 100644 --- a/SharpSploit/Execution/PlatformInvoke/Win32.cs +++ b/SharpSploit/Execution/PlatformInvoke/Win32.cs @@ -177,6 +177,45 @@ IntPtr hProcess public static extern void GetNativeSystemInfo( ref Execute.Win32.Kernel32.SYSTEM_INFO lpSystemInfo ); + + [DllImport("kernel32.dll", SetLastError = true)] + public static extern bool InitializeProcThreadAttributeList( + IntPtr lpAttributeList, + int dwAttributeCount, + int dwFlags, + ref IntPtr lpSize + ); + + [DllImport("kernel32.dll", SetLastError = true)] + public static extern bool UpdateProcThreadAttribute( + IntPtr lpAttributeList, + uint dwFlags, + IntPtr Attribute, + IntPtr lpValue, + IntPtr cbSize, + IntPtr lpPreviousValue, + IntPtr lpReturnSize + ); + + [DllImport("kernel32.dll", SetLastError = true)] + public static extern bool DeleteProcThreadAttributeList( + IntPtr lpAttributeList + ); + + [DllImport("kernel32.dll")] + public static extern bool CreateProcess( + string lpApplicationName, + string lpCommandLine, + ref Execute.Win32.WinBase._SECURITY_ATTRIBUTES lpProcessAttributes, + ref Execute.Win32.WinBase._SECURITY_ATTRIBUTES lpThreadAttributes, + bool bInheritHandles, + Execute.Win32.Advapi32.CREATION_FLAGS dwCreationFlags, + IntPtr lpEnvironment, + string lpCurrentDirectory, + ref Execute.Win32.ProcessThreadsAPI._STARTUPINFOEX lpStartupInfoEx, + out Execute.Win32.ProcessThreadsAPI._PROCESS_INFORMATION lpProcessInformation + ); + } public static class User32 @@ -387,7 +426,7 @@ public static extern bool CreateProcessWithTokenW( ref Execute.Win32.ProcessThreadsAPI._STARTUPINFO lpStartupInfo, out Execute.Win32.ProcessThreadsAPI._PROCESS_INFORMATION lpProcessInfo ); - + [DllImport("advapi32.dll", SetLastError = true)] public static extern Boolean CredEnumerateW( String Filter, @@ -531,7 +570,7 @@ public static extern Int32 RegQueryInfoKey( IntPtr lpSecurityDescriptor, IntPtr lpftLastWriteTime ); - + [DllImport("advapi32.dll", SetLastError = true)] public static extern Boolean RevertToSelf(); diff --git a/SharpSploit/Execution/Shell.cs b/SharpSploit/Execution/Shell.cs index b443d63..e964478 100644 --- a/SharpSploit/Execution/Shell.cs +++ b/SharpSploit/Execution/Shell.cs @@ -296,5 +296,116 @@ public static string CreateProcessWithToken(string Command, string Path, IntPtr } } } + + /// + /// Creates a process specified as argument using the Platform Invoke API. + /// + /// Simone Salucci (@saim1z) & Daniel López (@attl4s) + /// The target process to execute. + /// PROCESS_INFORMATION structure. + /// + /// Code has been kindly stolen and adapted from TikiTorch (https://github.com/rasta-mouse/TikiTorch/blob/064c60c5e23188867a0f9c5a0626dd39718750d4/TikiLoader/Generic.cs). + /// + public static Win32.ProcessThreadsAPI._PROCESS_INFORMATION CreateProcessPInvoke(string targetProcess, bool blockDLL) + { + Win32.ProcessThreadsAPI._STARTUPINFOEX StartupInfoEx = new Win32.ProcessThreadsAPI._STARTUPINFOEX(); + Win32.ProcessThreadsAPI._PROCESS_INFORMATION ProcInfo = new Win32.ProcessThreadsAPI._PROCESS_INFORMATION(); + + StartupInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(StartupInfoEx); + IntPtr lpValue = Marshal.AllocHGlobal(IntPtr.Size); + + Win32.WinBase._SECURITY_ATTRIBUTES pSec = new Win32.WinBase._SECURITY_ATTRIBUTES(); + Win32.WinBase._SECURITY_ATTRIBUTES tSec = new Win32.WinBase._SECURITY_ATTRIBUTES(); + pSec.nLength = (uint)Marshal.SizeOf(pSec); + tSec.nLength = (uint)Marshal.SizeOf(tSec); + + StartupInfoEx.StartupInfo.dwFlags = (uint)Win32.ProcessThreadsAPI.STARTF.STARTF_USESHOWWINDOW; + StartupInfoEx.StartupInfo.wShowWindow = 0; //SW_HIDE + Win32.Advapi32.CREATION_FLAGS flags = Win32.Advapi32.CREATION_FLAGS.CREATE_NO_WINDOW | Win32.Advapi32.CREATION_FLAGS.EXTENDED_STARTUPINFO_PRESENT | Win32.Advapi32.CREATION_FLAGS.CREATE_SUSPENDED; + + if (blockDLL) + { + IntPtr lpSize = IntPtr.Zero; + PInvoke.Win32.Kernel32.InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpSize); + StartupInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize); + PInvoke.Win32.Kernel32.InitializeProcThreadAttributeList(StartupInfoEx.lpAttributeList, 1, 0, ref lpSize); + Marshal.WriteIntPtr(lpValue, new IntPtr((long)Win32.Advapi32.BINARY_SIGNATURE_POLICY.BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON)); + PInvoke.Win32.Kernel32.UpdateProcThreadAttribute(StartupInfoEx.lpAttributeList, 0, (IntPtr)Win32.Advapi32.PROCESS_THREAD_ATTRIBUTE.MITIGATION_POLICY, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero); + } + + PInvoke.Win32.Kernel32.CreateProcess( + targetProcess, + null, + ref pSec, + ref tSec, + false, + flags, + IntPtr.Zero, + null, + ref StartupInfoEx, + out ProcInfo + ); + + return ProcInfo; + } + + /// + /// Creates a process with the parent process ID specified as argument using the Platform Invoke API. + /// + /// Simone Salucci (@saim1z) & Daniel López (@attl4s) + /// The target process to execute. + /// The parent process ID of the new process executed. + /// PROCESS_INFORMATION structure. + /// + /// Code has been kindly stolen and adapted from TikiTorch (https://github.com/rasta-mouse/TikiTorch/blob/064c60c5e23188867a0f9c5a0626dd39718750d4/TikiLoader/Generic.cs). + /// + public static Win32.ProcessThreadsAPI._PROCESS_INFORMATION CreateProcessPInvokePPID(string targetProcess, int parentProcessId, bool blockDLL) + { + + Win32.ProcessThreadsAPI._STARTUPINFOEX StartupInfoEx = new Win32.ProcessThreadsAPI._STARTUPINFOEX(); + Win32.ProcessThreadsAPI._PROCESS_INFORMATION ProcInfo = new Win32.ProcessThreadsAPI._PROCESS_INFORMATION(); + + StartupInfoEx.StartupInfo.cb = (uint)Marshal.SizeOf(StartupInfoEx); + IntPtr lpValue = Marshal.AllocHGlobal(IntPtr.Size); + + try + { + Win32.WinBase._SECURITY_ATTRIBUTES pSec = new Win32.WinBase._SECURITY_ATTRIBUTES(); + Win32.WinBase._SECURITY_ATTRIBUTES tSec = new Win32.WinBase._SECURITY_ATTRIBUTES(); + pSec.nLength = (uint)Marshal.SizeOf(pSec); + tSec.nLength = (uint)Marshal.SizeOf(tSec); + + StartupInfoEx.StartupInfo.dwFlags = (uint)Win32.ProcessThreadsAPI.STARTF.STARTF_USESHOWWINDOW; + StartupInfoEx.StartupInfo.wShowWindow = 0; //SW_HIDE + Win32.Advapi32.CREATION_FLAGS flags = Win32.Advapi32.CREATION_FLAGS.CREATE_NO_WINDOW | Win32.Advapi32.CREATION_FLAGS.EXTENDED_STARTUPINFO_PRESENT | Win32.Advapi32.CREATION_FLAGS.CREATE_SUSPENDED; + + IntPtr lpSize = IntPtr.Zero; + PInvoke.Win32.Kernel32.InitializeProcThreadAttributeList(IntPtr.Zero, 2, 0, ref lpSize); + StartupInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpSize); + PInvoke.Win32.Kernel32.InitializeProcThreadAttributeList(StartupInfoEx.lpAttributeList, 2, 0, ref lpSize); + + if (blockDLL) + { + Marshal.WriteIntPtr(lpValue, new IntPtr((long)Win32.Advapi32.BINARY_SIGNATURE_POLICY.BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON)); + PInvoke.Win32.Kernel32.UpdateProcThreadAttribute(StartupInfoEx.lpAttributeList, 0, (IntPtr)Win32.Advapi32.PROCESS_THREAD_ATTRIBUTE.MITIGATION_POLICY, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero); + } + + IntPtr parentHandle = Process.GetProcessById(parentProcessId).Handle; + lpValue = Marshal.AllocHGlobal(IntPtr.Size); + Marshal.WriteIntPtr(lpValue, parentHandle); + + PInvoke.Win32.Kernel32.UpdateProcThreadAttribute(StartupInfoEx.lpAttributeList, 0, (IntPtr)Win32.Advapi32.PROCESS_THREAD_ATTRIBUTE.PARENT_PROCESS, lpValue, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero); + PInvoke.Win32.Kernel32.CreateProcess(targetProcess, null, ref pSec, ref tSec, false, flags, IntPtr.Zero, null, ref StartupInfoEx, out ProcInfo); + + return ProcInfo; + } + finally + { + PInvoke.Win32.Kernel32.DeleteProcThreadAttributeList(StartupInfoEx.lpAttributeList); + Marshal.FreeHGlobal(StartupInfoEx.lpAttributeList); + Marshal.FreeHGlobal(lpValue); + } + } + } -} \ No newline at end of file +} diff --git a/SharpSploit/Execution/Win32.cs b/SharpSploit/Execution/Win32.cs index 8806a43..7d80b44 100644 --- a/SharpSploit/Execution/Win32.cs +++ b/SharpSploit/Execution/Win32.cs @@ -489,6 +489,21 @@ public enum SERVICE_ERROR SERVICE_ERROR_SEVERE = 0x00000002, SERVICE_ERROR_CRITICAL = 0x00000003, } + + [Flags] + public enum BINARY_SIGNATURE_POLICY : ulong + { + BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON = 0x100000000000, + BLOCK_NON_MICROSOFT_BINARIES_ALLOW_STORE = 0x300000000000 + } + + [Flags] + public enum PROCESS_THREAD_ATTRIBUTE : int + { + MITIGATION_POLICY = 0x20007, + PARENT_PROCESS = 0x00020000 + } + } public static class Dbghelp @@ -542,7 +557,7 @@ public struct _SYSTEM_INFO [StructLayout(LayoutKind.Sequential)] public struct _SECURITY_ATTRIBUTES { - UInt32 nLength; + public UInt32 nLength; IntPtr lpSecurityDescriptor; Boolean bInheritHandle; }; @@ -868,8 +883,8 @@ public struct _STARTUPINFO [StructLayout(LayoutKind.Sequential)] public struct _STARTUPINFOEX { - _STARTUPINFO StartupInfo; - // PPROC_THREAD_ATTRIBUTE_LIST lpAttributeList; + public _STARTUPINFO StartupInfo; + public IntPtr lpAttributeList; }; //https://msdn.microsoft.com/en-us/library/windows/desktop/ms684873(v=vs.85).aspx