Add railgun definitions for local exploit relevant functions.

Author: zeroSteiner

lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb

@@ -11,7 +11,7 @@ class Def_kernel32
 
   def self.create_dll(dll_path = 'kernel32')
     dll = DLL.new(dll_path, ApiConstants.manager)
-    
+
     dll.add_function( 'GetConsoleWindow', 'LPVOID',[])
 
     dll.add_function( 'ActivateActCtx', 'BOOL',[
@@ -496,7 +496,7 @@ def self.create_dll(dll_path = 'kernel32')
       ["HANDLE","hProcess","in"],
       ["PBLOB","lpThreadAttributes","in"],
       ["DWORD","dwStackSize","in"],
-      ["PBLOB","lpStartAddress","in"],
+      ["LPVOID","lpStartAddress","in"],
       ["PBLOB","lpParameter","in"],
       ["DWORD","dwCreationFlags","in"],
       ["PDWORD","lpThreadId","out"],

lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_ntdll.rb

@@ -12,6 +12,15 @@ class Def_ntdll
   def self.create_dll(dll_path = 'ntdll')
     dll = DLL.new(dll_path, ApiConstants.manager)
 
+    dll.add_function('NtAllocateVirtualMemory', 'DWORD',[
+      ["DWORD","ProcessHandle","in"],
+      ["PBLOB","BaseAddress","inout"],
+      ["PDWORD","ZeroBits","in"],
+      ["PBLOB","RegionSize","inout"],
+      ["DWORD","AllocationType","in"],
+      ["DWORD","Protect","in"]
+      ])
+
     dll.add_function('NtClose', 'DWORD',[
       ["DWORD","Handle","in"],
       ])
@@ -33,13 +42,13 @@ def self.create_dll(dll_path = 'ntdll')
     dll.add_function('NtDeviceIoControlFile', 'DWORD',[
       ["DWORD","FileHandle","in"],
       ["DWORD","Event","in"],
-      ["PBLOB","ApcRoutine","in"],
-      ["PBLOB","ApcContext","in"],
-      ["PBLOB","IoStatusBlock","inout"],
+      ["LPVOID","ApcRoutine","in"],
+      ["LPVOID","ApcContext","in"],
+      ["PDWORD","IoStatusBlock","out"],
       ["DWORD","IoControlCode","in"],
-      ["PBLOB","InputBuffer","in"],
+      ["LPVOID","InputBuffer","in"],
       ["DWORD","InputBufferLength","in"],
-      ["PBLOB","OutputBuffer","inout"],
+      ["LPVOID","OutputBuffer","in"],
       ["DWORD","OutputBufferLength","in"],
       ])
 
@@ -68,6 +77,11 @@ def self.create_dll(dll_path = 'ntdll')
       ["PDWORD","ReturnLength","inout"],
       ])
 
+    dll.add_function('NtQueryIntervalProfile', 'DWORD',[
+      ["DWORD","ProfileSource","in"],
+      ["PDWORD","Interval","out"],
+      ])
+
     dll.add_function('NtQuerySystemInformation', 'DWORD',[
       ["DWORD","SystemInformationClass","in"],
       ["PBLOB","SystemInformation","inout"],