mirror of
https://github.com/rapid7/metasploit-payloads
synced 2025-01-08 14:36:22 +01:00
5280bb7b06
Also move the delay loading code to another location as this isn't part of the RDI source, but was included there beforehand.
74 lines
3.7 KiB
C
74 lines
3.7 KiB
C
//===============================================================================================//
|
|
// Copyright (c) 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
// All rights reserved.
|
|
//
|
|
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
// provided that the following conditions are met:
|
|
//
|
|
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
// conditions and the following disclaimer.
|
|
//
|
|
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
// with the distribution.
|
|
//
|
|
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
// endorse or promote products derived from this software without specific prior written permission.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
// POSSIBILITY OF SUCH DAMAGE.
|
|
//===============================================================================================//
|
|
#include "DelayLoadMetSrv.h"
|
|
#include "GetProcAddressR.h"
|
|
|
|
// The handle to the injected metsrv.dll, needed for delay loading...
|
|
HMODULE hMetSrv = NULL;
|
|
|
|
// All server extensions must support delay loading of metsrv.dll because this dll can be injected
|
|
// via reflective dll injection, as such normal calls to LoadLibrary/GetModuleHandle/GetProcAddress
|
|
// to resolve exports in metsrv.dll will not work as metsrv.dll will be 'invisible' to the native
|
|
// windows kernel32 api's. Theirfore we delay load metsrv.dll and intercept loading and resolving of
|
|
// its exports and resolve them using our own GetProcAddressR() function.
|
|
//
|
|
// To enable all of this in a new extnesion:
|
|
// 1. Add metsrv.dll to the DELAYLOAD option in the projects properties (Configuration->Linker->Input).
|
|
// 2. Add in the include file #include "DelayLoadMetSrv.h".
|
|
// 3. Add the macro "EnableDelayLoadMetSrv();" after all your includes.
|
|
// 4. Add the line "hMetSrv = remote->hMetSrv;" in your InitServerExtension() function.
|
|
|
|
//===============================================================================================//
|
|
|
|
|
|
|
|
|
|
FARPROC WINAPI delayHook( unsigned dliNotify, PDelayLoadInfo pdli )
|
|
{
|
|
switch( dliNotify )
|
|
{
|
|
case dliNotePreLoadLibrary:
|
|
// If we are trying to delay load metsrv.dll we can just return the
|
|
// HMODULE of the injected metsrv library (set in InitServerExtension).
|
|
if( strcmp( pdli->szDll, "metsrv.dll" ) == 0 )
|
|
return (FARPROC)hMetSrv;
|
|
break;
|
|
case dliNotePreGetProcAddress:
|
|
// If we are trying to get the address of an exported function in the
|
|
// metsrv.dll we must use GetProcAddressR() in case the metsrv was loaded
|
|
// via reflective dll injection
|
|
if( strcmp( pdli->szDll, "metsrv.dll" ) == 0 )
|
|
return GetProcAddressR( pdli->hmodCur, pdli->dlp.szProcName );
|
|
break;
|
|
default:
|
|
return NULL;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
//===============================================================================================//
|