Skip to content

Commit 41918bd

Browse files
dledda-r7dledda-r7
committed
fix: using correct base address for extension encryption manager, refactor add function
1 parent 699fee0 commit 41918bd

3 files changed

Lines changed: 43 additions & 66 deletions

File tree

‎c/meterpreter/source/metsrv/extension_encryption.c‎

Lines changed: 39 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -184,9 +184,10 @@ ExtensionEncryptionManager* InitExtensionEncryptionManager(CryptographicManagerT
184184
return g_ExtensionEncryptionManager;
185185
}
186186

187-
BOOL extension_encryption_add(LPVOID lpExtensionLocation, DWORD dwExtensionSize) {
188-
BOOL ret = TRUE;
187+
BOOL extension_encryption_add(LPVOID lpExtensionLocation) {
188+
DWORD dwResult = ERROR_SUCCESS;
189189
HANDLE hHeap = GetProcessHeap();
190+
HANDLE hLib = (HMODULE)lpExtensionLocation;
190191
ExtensionEncryptionStatus* lpExtensionStatus = NULL;
191192
PIMAGE_DOS_HEADER pDosHeader = NULL;
192193
PIMAGE_NT_HEADERS pNtHeaders = NULL;
@@ -195,70 +196,49 @@ BOOL extension_encryption_add(LPVOID lpExtensionLocation, DWORD dwExtensionSize)
195196
DWORD dwTextSize = 0;
196197

197198
EnterCriticalSection(&g_ExtensionEncryptionManager->cs);
199+
do {
200+
dprintf("[extension_encryption][extension_encryption_add] Adding extension");
201+
if (g_ExtensionEncryptionManager->dwExtensionsCount >= MAX_EXTENSIONS) {
202+
BREAK_WITH_ERROR("[extension_encryption][extension_encryption_add] Maximum number of extensions reached.", ERROR_NOT_ENOUGH_MEMORY);
203+
}
198204

199-
dprintf("[extension_encryption][extension_encryption_add] Adding extension");
200-
if (g_ExtensionEncryptionManager->dwExtensionsCount >= MAX_EXTENSIONS) {
201-
dprintf("[extension_encryption][extension_encryption_add] Maximum number of extensions reached.");
202-
ret = FALSE;
203-
}
205+
if (hLib == NULL || hLib == INVALID_HANDLE_VALUE) {
206+
BREAK_WITH_ERROR("[extension_encryption][extension_encryption_add] Invalid parameters.", ERROR_INVALID_PARAMETER);
207+
}
204208

205-
if (lpExtensionLocation == NULL || dwExtensionSize == 0) {
206-
dprintf("[extension_encryption][extension_encryption_add] Invalid parameters.");
207-
ret = FALSE;
208-
}
209-
if (ret) {
210209
pDosHeader = (PIMAGE_DOS_HEADER)lpExtensionLocation;
211-
}
212-
213-
if (ret && pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
214-
dprintf("[extension_encryption][extension_encryption_add] Invalid DOS Signature.");
215-
ret = FALSE;
216-
}
217-
218-
if (ret) {
210+
if(pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
211+
BREAK_WITH_ERROR("[extension_encryption][extension_encryption_add] Invalid DOS Signature.", ERROR_INVALID_PARAMETER);
212+
}
219213
pNtHeaders = (PIMAGE_NT_HEADERS)((BYTE*)lpExtensionLocation + pDosHeader->e_lfanew);
220-
}
221-
222-
if (ret && pNtHeaders->Signature != IMAGE_NT_SIGNATURE) {
223-
dprintf("[extension_encryption][extension_encryption_add] Invalid NT Signature");
224-
ret = FALSE;
225-
}
226-
227-
if (ret) {
214+
215+
if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE) {
216+
BREAK_WITH_ERROR("[extension_encryption][extension_encryption_add] Invalid NT Signature.", ERROR_INVALID_PARAMETER);
217+
}
228218
pSectionHeader = IMAGE_FIRST_SECTION(pNtHeaders);
229-
}
230-
231-
if (ret && pSectionHeader == NULL) {
232-
dprintf("[extension_encryption][extension_encryption_add] Invalid section header");
233-
ret = FALSE;
234-
}
235-
236-
for (WORD i = 0; ret && i < pNtHeaders->FileHeader.NumberOfSections; i++) {
237-
if (!strncmp(pSectionHeader[i].Name, ".text", 5)) {
238-
dprintf("[extension_encryption][extension_encryption_add] .text section of the extension is found!");
239-
lpTextSection = (BYTE*)lpExtensionLocation + pSectionHeader[i].VirtualAddress;
240-
dwTextSize = pSectionHeader[i].Misc.VirtualSize;
241-
break;
219+
if (pSectionHeader == NULL) {
220+
BREAK_WITH_ERROR("[extension_encryption][extension_encryption_add] Invalid section header.", ERROR_INVALID_PARAMETER);
242221
}
243-
}
244-
if (lpTextSection == NULL) {
245-
dprintf("[extension_encryption][extension_encryption_add] couldn't get text section of the encryption");
246-
ret = FALSE;
247-
}
248222

249-
if (dwExtensionSize == 0) {
250-
dprintf("[extension_encryption][extension_encryption_add] couldn't get size of text section of the extension");
251-
ret = FALSE;
252-
}
223+
for (WORD i = 0; i < pNtHeaders->FileHeader.NumberOfSections; i++) {
224+
if (!strncmp(pSectionHeader[i].Name, ".text", 5)) {
225+
dprintf("[extension_encryption][extension_encryption_add] .text section of the extension is found!");
226+
lpTextSection = (BYTE*)lpExtensionLocation + pSectionHeader[i].VirtualAddress;
227+
dwTextSize = pSectionHeader[i].Misc.VirtualSize;
228+
break;
229+
}
230+
}
231+
if (lpTextSection == NULL) {
232+
BREAK_WITH_ERROR("[extension_encryption][extension_encryption_add] couldn't get text section of the encryption.", ERROR_INVALID_PARAMETER);
233+
}
253234

254-
if (ret) {
235+
if (dwTextSize == 0) {
236+
BREAK_WITH_ERROR("[extension_encryption][extension_encryption_add] couldn't get size of text section of the extension.", ERROR_INVALID_PARAMETER);
237+
}
255238
lpExtensionStatus = (ExtensionEncryptionStatus*)HeapAlloc(hHeap, HEAP_ZERO_MEMORY, sizeof(ExtensionEncryptionStatus));
256239
if (lpExtensionStatus == NULL) {
257-
dprintf("[extension_encryption][extension_encryption_add] HeapAlloc failed.");
258-
ret = FALSE;
240+
BREAK_WITH_ERROR("[extension_encryption][extension_encryption_add] HeapAlloc failed.", ERROR_NOT_ENOUGH_MEMORY);
259241
}
260-
}
261-
if (ret) {
262242
lpExtensionStatus->bEncryptable = TRUE;
263243
lpExtensionStatus->bEncrypted = FALSE;
264244
lpExtensionStatus->lpLoc = lpTextSection;
@@ -272,10 +252,10 @@ BOOL extension_encryption_add(LPVOID lpExtensionLocation, DWORD dwExtensionSize)
272252
g_ExtensionEncryptionManager->extensionStatuses[g_ExtensionEncryptionManager->dwExtensionsCount] = lpExtensionStatus;
273253
g_ExtensionEncryptionManager->dwExtensionsCount++;
274254
dprintf("[extension_encryption][extension_encryption_add] Added extension text section at %p of size %u", lpExtensionStatus->lpLoc,lpExtensionStatus->dwSize);
275-
}
276-
dprintf("[extension_encryption][extension_encryption_add] Function exiting");
277-
LeaveCriticalSection(&g_ExtensionEncryptionManager->cs);
278-
return ret;
255+
dprintf("[extension_encryption][extension_encryption_add] Function exiting");
256+
LeaveCriticalSection(&g_ExtensionEncryptionManager->cs);
257+
} while (0);
258+
return dwResult == ERROR_SUCCESS;
279259
}
280260

281261
BOOL extension_encryption_get(LPVOID lpHandlerFunction, ExtensionEncryptionStatus** lpOutExtensionStatus) {

‎c/meterpreter/source/metsrv/extension_encryption.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ typedef struct {
5151
DWORD dwCryptoManagerType;
5252
CryptographicManager cryptoManager;
5353
struct {
54-
BOOL (*add)(LPVOID lpExtensionLocation, DWORD dwExtensionSize);
54+
BOOL (*add)(LPVOID lpExtensionLocation);
5555
BOOL (*get)(LPVOID lpHandlerFunction, ExtensionEncryptionStatus** lpOutExtensionStatus);
5656
BOOL (*remove)(ExtensionEncryptionStatus* lpStatus);
5757
BOOL (*encrypt)(ExtensionEncryptionStatus* lpStatus);
@@ -62,7 +62,7 @@ typedef struct {
6262

6363
ExtensionEncryptionManager *GetExtensionEncryptionManager(VOID);
6464
ExtensionEncryptionManager *InitExtensionEncryptionManager(CryptographicManagerType type, LPVOID lpCryptoParams);
65-
BOOL extension_encryption_add(LPVOID lpExtensionLocation, DWORD dwExtensionSize);
65+
BOOL extension_encryption_add(LPVOID lpExtensionLocation);
6666
BOOL extension_encryption_get(LPVOID lpHandlerFunction, ExtensionEncryptionStatus** lpOutExtensionStatus);
6767
BOOL extension_encryption_remove(ExtensionEncryptionStatus* lpStatus);
6868

‎c/meterpreter/source/metsrv/remote_dispatch.c‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -335,9 +335,7 @@ DWORD request_core_loadlib(Remote *remote, Packet *packet)
335335
PCHAR libraryPath;
336336
DWORD flags = 0;
337337
BOOL bLibLoadedReflectivly = FALSE;
338-
339338
LPVOID lpLibraryLocation = NULL;
340-
DWORD dwLibrarySize = 0;
341339

342340
dprintf("[LOADLIB] here 1");
343341

@@ -395,8 +393,7 @@ DWORD request_core_loadlib(Remote *remote, Packet *packet)
395393
else
396394
{
397395
bLibLoadedReflectivly = TRUE;
398-
lpLibraryLocation = dataTlv.buffer;
399-
dwLibrarySize = dataTlv.header.length;
396+
lpLibraryLocation = (LPVOID)library;
400397
}
401398
dprintf("[LOADLIB] here 9");
402399

@@ -433,7 +430,7 @@ DWORD request_core_loadlib(Remote *remote, Packet *packet)
433430
if (flags & LOAD_LIBRARY_EXTENSION_ENCRYPTABLE && bLibLoadedReflectivly) {
434431
ExtensionEncryptionManager* encryptionManager = GetExtensionEncryptionManager();
435432
if(encryptionManager) {
436-
encryptionManager->add(lpLibraryLocation, dwLibrarySize);
433+
encryptionManager->add(lpLibraryLocation);
437434
}
438435
}
439436
}

0 commit comments

Comments
 (0)