Skip to content

Commit 699fee0

Browse files
xHector1337xHector1337
committed
update extension_encryption.c
1 parent 524575c commit 699fee0

1 file changed

Lines changed: 103 additions & 9 deletions

File tree

‎c/meterpreter/source/metsrv/extension_encryption.c‎

Lines changed: 103 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,11 @@ BOOL extension_encryption_add(LPVOID lpExtensionLocation, DWORD dwExtensionSize)
188188
BOOL ret = TRUE;
189189
HANDLE hHeap = GetProcessHeap();
190190
ExtensionEncryptionStatus* lpExtensionStatus = NULL;
191+
PIMAGE_DOS_HEADER pDosHeader = NULL;
192+
PIMAGE_NT_HEADERS pNtHeaders = NULL;
193+
PIMAGE_SECTION_HEADER pSectionHeader = NULL;
194+
LPVOID lpTextSection = NULL;
195+
DWORD dwTextSize = 0;
191196

192197
EnterCriticalSection(&g_ExtensionEncryptionManager->cs);
193198

@@ -201,6 +206,50 @@ BOOL extension_encryption_add(LPVOID lpExtensionLocation, DWORD dwExtensionSize)
201206
dprintf("[extension_encryption][extension_encryption_add] Invalid parameters.");
202207
ret = FALSE;
203208
}
209+
if (ret) {
210+
pDosHeader = (PIMAGE_DOS_HEADER)lpExtensionLocation;
211+
}
212+
213+
if (ret && pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
214+
dprintf("[extension_encryption][extension_encryption_add] Invalid DOS Signature.");
215+
ret = FALSE;
216+
}
217+
218+
if (ret) {
219+
pNtHeaders = (PIMAGE_NT_HEADERS)((BYTE*)lpExtensionLocation + pDosHeader->e_lfanew);
220+
}
221+
222+
if (ret && pNtHeaders->Signature != IMAGE_NT_SIGNATURE) {
223+
dprintf("[extension_encryption][extension_encryption_add] Invalid NT Signature");
224+
ret = FALSE;
225+
}
226+
227+
if (ret) {
228+
pSectionHeader = IMAGE_FIRST_SECTION(pNtHeaders);
229+
}
230+
231+
if (ret && pSectionHeader == NULL) {
232+
dprintf("[extension_encryption][extension_encryption_add] Invalid section header");
233+
ret = FALSE;
234+
}
235+
236+
for (WORD i = 0; ret && i < pNtHeaders->FileHeader.NumberOfSections; i++) {
237+
if (!strncmp(pSectionHeader[i].Name, ".text", 5)) {
238+
dprintf("[extension_encryption][extension_encryption_add] .text section of the extension is found!");
239+
lpTextSection = (BYTE*)lpExtensionLocation + pSectionHeader[i].VirtualAddress;
240+
dwTextSize = pSectionHeader[i].Misc.VirtualSize;
241+
break;
242+
}
243+
}
244+
if (lpTextSection == NULL) {
245+
dprintf("[extension_encryption][extension_encryption_add] couldn't get text section of the encryption");
246+
ret = FALSE;
247+
}
248+
249+
if (dwExtensionSize == 0) {
250+
dprintf("[extension_encryption][extension_encryption_add] couldn't get size of text section of the extension");
251+
ret = FALSE;
252+
}
204253

205254
if (ret) {
206255
lpExtensionStatus = (ExtensionEncryptionStatus*)HeapAlloc(hHeap, HEAP_ZERO_MEMORY, sizeof(ExtensionEncryptionStatus));
@@ -212,8 +261,8 @@ BOOL extension_encryption_add(LPVOID lpExtensionLocation, DWORD dwExtensionSize)
212261
if (ret) {
213262
lpExtensionStatus->bEncryptable = TRUE;
214263
lpExtensionStatus->bEncrypted = FALSE;
215-
lpExtensionStatus->lpLoc = lpExtensionLocation;
216-
lpExtensionStatus->dwSize = dwExtensionSize;
264+
lpExtensionStatus->lpLoc = lpTextSection;
265+
lpExtensionStatus->dwSize = dwTextSize;
217266
lpExtensionStatus->dwLastUsedTime = GetTickCount();
218267
dprintf("[extension_encryption][extension_encryption_add] lpExtensionStatus->bEncryptable: %d", lpExtensionStatus->bEncryptable);
219268
dprintf("[extension_encryption][extension_encryption_add] lpExtensionStatus->bEncrypted: %d", lpExtensionStatus->bEncrypted);
@@ -222,7 +271,7 @@ BOOL extension_encryption_add(LPVOID lpExtensionLocation, DWORD dwExtensionSize)
222271
dprintf("[extension_encryption][extension_encryption_add] lpExtensionStatus->dwLastUsedTime: %u", lpExtensionStatus->dwLastUsedTime);
223272
g_ExtensionEncryptionManager->extensionStatuses[g_ExtensionEncryptionManager->dwExtensionsCount] = lpExtensionStatus;
224273
g_ExtensionEncryptionManager->dwExtensionsCount++;
225-
dprintf("[extension_encryption][extension_encryption_add] Added extension at %p of size %u", lpExtensionLocation, dwExtensionSize);
274+
dprintf("[extension_encryption][extension_encryption_add] Added extension text section at %p of size %u", lpExtensionStatus->lpLoc,lpExtensionStatus->dwSize);
226275
}
227276
dprintf("[extension_encryption][extension_encryption_add] Function exiting");
228277
LeaveCriticalSection(&g_ExtensionEncryptionManager->cs);
@@ -265,6 +314,7 @@ BOOL extension_encryption_remove(ExtensionEncryptionStatus* lpExtensionStatus) {
265314
dprintf("[extension_encryption][extension_encryption_remove] Removing extension.");
266315
if (lpExtensionStatus == NULL) {
267316
dprintf("[extension_encryption][extension_encryption_remove] lpExtensionStatus is NULL.");
317+
LeaveCriticalSection(&g_ExtensionEncryptionManager->cs);
268318
return ret;
269319
}
270320
for (DWORD i = 0; i < g_ExtensionEncryptionManager->dwExtensionsCount; i++) {
@@ -294,8 +344,16 @@ BOOL extension_encryption_encrypt(ExtensionEncryptionStatus* lpExtensionStatus)
294344
HANDLE hHeap = GetProcessHeap();
295345
DWORD diff = BUFFER_SIZE;
296346
size_t ByteCounter = 0;
347+
LPVOID ExtensionLoc = NULL;
348+
DWORD ExtensionSize = 0;
349+
DWORD dwOldProtect = 0;
350+
351+
if (lpExtensionStatus == NULL) {
352+
dprintf("[extension_encryption][extension_encryption_encrypt] lpExtensionStatus is NULL");
353+
bError = TRUE;
354+
}
297355

298-
if(!lpExtensionStatus->bEncryptable) {
356+
if(!bError && !lpExtensionStatus->bEncryptable) {
299357
dprintf("[extension_encryption][extension_encryption_encrypt] Extension is not encryptable.");
300358
bError = TRUE;
301359
}
@@ -326,9 +384,16 @@ BOOL extension_encryption_encrypt(ExtensionEncryptionStatus* lpExtensionStatus)
326384
}
327385

328386
if (!bError) {
329-
LPVOID ExtensionLoc = lpExtensionStatus->lpLoc;
330-
DWORD ExtensionSize = lpExtensionStatus->dwSize;
387+
ExtensionLoc = lpExtensionStatus->lpLoc;
388+
ExtensionSize = lpExtensionStatus->dwSize;
389+
390+
if (!VirtualProtect(ExtensionLoc, ExtensionSize, PAGE_READWRITE, &dwOldProtect)) {
391+
dprintf("[extension_encryption][extension_encryption_encrypt] VirtualProtect 1 failed with error 0x%x", GetLastError());
392+
bError = TRUE;
393+
}
394+
}
331395

396+
if (!bError) {
332397
for (DWORD i = 0; i != ExtensionSize; i += diff) {
333398
if ((ExtensionSize - i) < BUFFER_SIZE) {
334399
diff = ExtensionSize - i;
@@ -353,6 +418,13 @@ BOOL extension_encryption_encrypt(ExtensionEncryptionStatus* lpExtensionStatus)
353418
lpExtensionStatus->dwLastUsedTime = GetTickCount();
354419
lpExtensionStatus->bEncrypted = TRUE;
355420
}
421+
422+
if (!bError && !VirtualProtect(ExtensionLoc,ExtensionSize,dwOldProtect,&dwOldProtect)){
423+
dprintf("[extension_encryption][extension_encryption_encrypt] VirtualProtect 2 failed with error 0x%x", GetLastError());
424+
bError = TRUE;
425+
ret = FALSE;
426+
}
427+
356428
LeaveCriticalSection(&g_ExtensionEncryptionManager->cs);
357429

358430
if (lpTempBufferWrite != NULL && lpTempBufferRead != NULL) {
@@ -372,8 +444,16 @@ BOOL extension_encryption_decrypt(ExtensionEncryptionStatus* lpExtensionStatus)
372444
HANDLE hHeap = GetProcessHeap();
373445
DWORD diff = BUFFER_SIZE;
374446
size_t ByteCounter = 0;
447+
LPVOID ExtensionLoc = NULL;
448+
DWORD ExtensionSize = 0;
449+
DWORD dwOldProtect = 0;
375450

376-
if(!lpExtensionStatus->bEncryptable) {
451+
if (lpExtensionStatus == NULL) {
452+
dprintf("[extension_encryption][extension_encryption_decrypt] lpExtensionStatus is NULL");
453+
bError = TRUE;
454+
}
455+
456+
if(!bError &&!lpExtensionStatus->bEncryptable) {
377457
dprintf("[extension_encryption][extension_encryption_decrypt] Extension is not encryptable.");
378458
bError = TRUE;
379459
}
@@ -385,8 +465,15 @@ BOOL extension_encryption_decrypt(ExtensionEncryptionStatus* lpExtensionStatus)
385465
lpExtensionStatus->dwLastUsedTime = GetTickCount();
386466
}
387467

388-
LPVOID ExtensionLoc = lpExtensionStatus->lpLoc;
389-
DWORD ExtensionSize = lpExtensionStatus->dwSize;
468+
if (!bError) {
469+
ExtensionLoc = lpExtensionStatus->lpLoc;
470+
ExtensionSize = lpExtensionStatus->dwSize;
471+
472+
if (!VirtualProtect(ExtensionLoc, ExtensionSize, PAGE_READWRITE, &dwOldProtect)) {
473+
dprintf("[extension_encryption][extension_encryption_decrypt] VirtualProtect 1 failed with error 0x%x", GetLastError());
474+
bError = TRUE;
475+
}
476+
}
390477

391478
if (!bError) {
392479
lpTempBufferRead = (unsigned char*)HeapAlloc(hHeap, HEAP_ZERO_MEMORY, BUFFER_SIZE);
@@ -444,6 +531,13 @@ BOOL extension_encryption_decrypt(ExtensionEncryptionStatus* lpExtensionStatus)
444531
lpExtensionStatus->dwLastUsedTime = GetTickCount();
445532
lpExtensionStatus->bEncrypted = FALSE;
446533
}
534+
535+
if (!bError && !VirtualProtect(ExtensionLoc,ExtensionSize,dwOldProtect,&dwOldProtect)){
536+
dprintf("[extension_encryption][extension_encryption_decrypt] VirtualProtect 2 failed with error 0x%x", GetLastError());
537+
bError = TRUE;
538+
ret = FALSE;
539+
}
540+
447541
LeaveCriticalSection(&g_ExtensionEncryptionManager->cs);
448542

449543
if (lpTempBufferWrite != NULL && lpTempBufferRead != NULL) {

0 commit comments

Comments
 (0)