Skip to content

Commit 5187695

Browse files
dledda-r7dledda-r7
committed
fix: improve decryption error handling in command processing and scheduler threads
1 parent 2e03b92 commit 5187695

4 files changed

Lines changed: 21 additions & 15 deletions

File tree

‎c/meterpreter/source/metsrv/base.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,7 @@ BOOL command_process_inline(Command *command, Remote *remote, Packet *packet)
328328
}
329329
else {
330330
dprintf("[COMMAND] Decryption failed for command %u", commandId);
331-
//break;
331+
break;
332332
}
333333
serverContinue = command->request.inline_handler(remote, packet, &result) && serverContinue;
334334
dprintf("[DISPATCH] executed %u, continue %s", commandId, serverContinue ? "yes" : "no");
@@ -343,7 +343,7 @@ BOOL command_process_inline(Command *command, Remote *remote, Packet *packet)
343343
}
344344
else {
345345
dprintf("[COMMAND] Decryption failed for command %u", commandId);
346-
//break;
346+
break;
347347
}
348348
result = command->request.handler(remote, packet);
349349
}
@@ -360,7 +360,7 @@ BOOL command_process_inline(Command *command, Remote *remote, Packet *packet)
360360
}
361361
else {
362362
dprintf("[COMMAND] Decryption failed for command %u", commandId);
363-
//break;
363+
break;
364364
}
365365
serverContinue = command->response.inline_handler(remote, packet, &result) && serverContinue;
366366
}
@@ -374,7 +374,7 @@ BOOL command_process_inline(Command *command, Remote *remote, Packet *packet)
374374
}
375375
else {
376376
dprintf("[COMMAND] Decryption failed for command %u", commandId);
377-
//break;
377+
break;
378378
}
379379
result = command->response.handler(remote, packet);
380380
}

‎c/meterpreter/source/metsrv/extension_encryption.c‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
#include "extension_encryption.h"
2+
#include "common_metapi.h"
23

34
ExtensionEncryptionManager *g_ExtensionEncryptionManager = NULL;
45

5-
DWORD cyptographic_manager_debug_initialize(LPVOID* lpCryptoContext, LPVOID lpParams) {
6+
DWORD cryptographic_manager_debug_initialize(LPVOID* lpCryptoContext, LPVOID lpParams) {
67
*lpCryptoContext = NULL;
78
return 0;
89
}
@@ -137,7 +138,7 @@ BOOL cryptographic_manager_debug(CryptographicManager* manager, LPVOID lpParams)
137138
}
138139
manager->bInitialized = TRUE;
139140
manager->bNeedsRefresh = FALSE;
140-
manager->initialize = cyptographic_manager_debug_initialize;
141+
manager->initialize = cryptographic_manager_debug_initialize;
141142
manager->encrypt = cryptographic_manager_debug_encrypt;
142143
manager->decrypt = cryptographic_manager_debug_decrypt;
143144
manager->lpCryptoParams = NULL;
@@ -376,7 +377,7 @@ BOOL extension_encryption_encrypt(ExtensionEncryptionStatus* lpExtensionStatus)
376377
ExtensionLoc = lpExtensionStatus->lpLoc;
377378
ExtensionSize = lpExtensionStatus->dwSize;
378379

379-
if (!VirtualProtect(ExtensionLoc, ExtensionSize, PAGE_READWRITE, &dwOldProtect)) {
380+
if (!met_api->win_api.kernel32.VirtualProtect(ExtensionLoc, ExtensionSize, PAGE_READWRITE, &dwOldProtect)) {
380381
dprintf("[extension_encryption][extension_encryption_encrypt] VirtualProtect 1 failed with error 0x%x", GetLastError());
381382
bError = TRUE;
382383
}
@@ -410,7 +411,7 @@ BOOL extension_encryption_encrypt(ExtensionEncryptionStatus* lpExtensionStatus)
410411
bError = TRUE;
411412
break;
412413
}
413-
ret = WriteProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionLoc + i, lpTempBufferWrite, diff, &ByteCounter);
414+
ret = met_api->win_api.kernel32.WriteProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionLoc + i, lpTempBufferWrite, diff, &ByteCounter);
414415
if (!ret || ByteCounter != diff) {
415416
dprintf("[extension_encryption][extension_encryption_encrypt] WriteProcessMemory failed with error 0x%x", GetLastError());
416417
bError = TRUE;
@@ -424,7 +425,7 @@ BOOL extension_encryption_encrypt(ExtensionEncryptionStatus* lpExtensionStatus)
424425
}
425426
}
426427

427-
if (!bError && !VirtualProtect(ExtensionLoc,ExtensionSize,dwOldProtect,&dwOldProtect)){
428+
if (!bError && !met_api->win_api.kernel32.VirtualProtect(ExtensionLoc,ExtensionSize,dwOldProtect,&dwOldProtect)){
428429
dprintf("[extension_encryption][extension_encryption_encrypt] VirtualProtect 2 failed with error 0x%x", GetLastError());
429430
bError = TRUE;
430431
ret = FALSE;
@@ -476,7 +477,7 @@ BOOL extension_encryption_decrypt(ExtensionEncryptionStatus* lpExtensionStatus)
476477
ExtensionLoc = lpExtensionStatus->lpLoc;
477478
ExtensionSize = lpExtensionStatus->dwSize;
478479

479-
if (!VirtualProtect(ExtensionLoc, ExtensionSize, PAGE_READWRITE, &dwOldProtect)) {
480+
if (!met_api->win_api.kernel32.VirtualProtect(ExtensionLoc, ExtensionSize, PAGE_READWRITE, &dwOldProtect)) {
480481
dprintf("[extension_encryption][extension_encryption_decrypt] VirtualProtect 1 failed with error 0x%x", GetLastError());
481482
bError = TRUE;
482483
}
@@ -528,7 +529,7 @@ BOOL extension_encryption_decrypt(ExtensionEncryptionStatus* lpExtensionStatus)
528529
bError = TRUE;
529530
break;
530531
}
531-
ret = WriteProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionLoc + i, lpTempBufferWrite, diff, &ByteCounter);
532+
ret = met_api->win_api.kernel32.WriteProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionLoc + i, lpTempBufferWrite, diff, &ByteCounter);
532533
if (!ret || ByteCounter != diff) {
533534
dprintf("[extension_encryption][extension_encryption_decrypt] WriteProcessMemory failed with error 0x%x", GetLastError());
534535
bError = TRUE;
@@ -542,7 +543,7 @@ BOOL extension_encryption_decrypt(ExtensionEncryptionStatus* lpExtensionStatus)
542543
}
543544
}
544545

545-
if (!bError && !VirtualProtect(ExtensionLoc,ExtensionSize,dwOldProtect,&dwOldProtect)){
546+
if (!bError && !met_api->win_api.kernel32.VirtualProtect(ExtensionLoc,ExtensionSize,dwOldProtect,&dwOldProtect)){
546547
dprintf("[extension_encryption][extension_encryption_decrypt] VirtualProtect 2 failed with error 0x%x", GetLastError());
547548
bError = TRUE;
548549
ret = FALSE;
@@ -611,4 +612,4 @@ DWORD extensionFindDecrypt(LPVOID lpHandlerFunction) {
611612

612613
return ERROR_SUCCESS;
613614

614-
}
615+
}

‎c/meterpreter/source/metsrv/extension_encryption.h‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
#ifndef _METERPRETER_METSRV_EXTENSION_ENCRYPTION_H
2+
#define _METERPRETER_METSRV_EXTENSION_ENCRYPTION_H
3+
14
#include <winsock2.h>
25
#include <windows.h>
36
#include "rc4.h"
@@ -69,4 +72,6 @@ BOOL extension_encryption_remove(ExtensionEncryptionStatus* lpStatus);
6972
BOOL extension_encryption_encrypt(ExtensionEncryptionStatus* lpStatus);
7073
BOOL extension_encryption_decrypt(ExtensionEncryptionStatus* lpStatus);
7174
void extension_encryption_encrypt_unused();
72-
DWORD extensionFindDecrypt(LPVOID lpHandlerFunction);
75+
DWORD extensionFindDecrypt(LPVOID lpHandlerFunction);
76+
77+
#endif // _METERPRETER_METSRV_EXTENSION_ENCRYPTION_H

‎c/meterpreter/source/metsrv/scheduler.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ DWORD THREADCALL scheduler_waitable_thread( THREAD * thread )
300300
extensionFindDecryptValue = extensionFindDecrypt(entry->routine);
301301
if (extensionFindDecryptValue && extensionFindDecryptValue != EXTENSION_ENCRYPTION_EXTENSION_NOT_ENCRYPTABLE) {
302302
dprintf("[SCHEDULER] scheduler_waitable_thread ( 0x%08X ), decryption of the extension failed");
303-
//break;
303+
break;
304304
}
305305
dprintf("[SCHEDULER] scheduler_waitable_thread ( 0x%08X ), the extension is decrypted successfully!");
306306
entry->routine( entry->remote, entry->context, thread->parameter2 );

0 commit comments

Comments
 (0)