array of bytes
lazarus / 34-Windows

----------------------------------------------------------------------
fpc2pas · 2021-10-17 09:14

hey

wondering why can't successsfully execute injected code into a process
while if using
const array of byte it works. but when loading the same bytes from
file and converted back into array of bytes it doesn't work.

below is my code

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i  function
StrToByte(const Value: String): TByteArr;varI:
integer;beginSetLength(Result, Length(Value));for I := 0 to
Length(Value) - 1 dobeginResult[I] := ord(Value[I +
1]);end;end;  procedure inject_code(shell_content:string);var
shell_code : TByteArray; shell_content : string; pi:
TProcessInformation;  si: TStartupInfo;  ctx: Context; 
remote_shellcodePtr: Pointer;  Written:cardinal;  AppToLaunch:
string; begin    shell_code :=  StrToByte(shell_content); AppToLaunch
:= 'rundll32.exe';UniqueString(AppToLaunch); FillMemory( @si, sizeof(
si ), 0 );FillMemory( @pi, sizeof( pi ), 0 ); CreateProcess(nil,
PChar(AppToLaunch), nil, nil, False,              CREATE_SUSPENDED,  
          nil, nil,  si, pi );  ctx.ContextFlags := CONTEXT_CONTROL; G
etThreadContext(pi.hThread,ctx);  remote_shellcodePtr:=VirtualAllocEx(
pi.hProcess,Nil,SizeOf(shell_code),MEM_COMMIT,   PAGE_EXECUTE_READWRIT
E);   WriteProcessMemory(pi.hProcess,remote_shellcodePtr,@shell_code,S
izeof(shell_code),written);  ctx.Eip:=integer(remote_shellcodePtr); ct
x.ContextFlags := CONTEXT_CONTROL; SetThreadContext(pi.hThread,ctx); R
esumeThread(pi.hThread);  
i have used Tstringlist to load the following file content
and pass it into
inject_code(list.text) something like that
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i  // here is
shell_content loaded as string $89,$e5,$83,$ec,$20,$31,$db,$64,$8b,$5b
,$30,$8b,$5b,$0c,$8b,$5b,$1c,$8b,$1b,$8b,$1b,$8b,$43,$08,$89,$45,$fc,$
8b,$58,$3c,$01,$c3,$8b,$5b,$78,$01,$c3,$8b,$7b,$20,$01,$c7,$89,$7d,$f8
,$8b,$4b,$24,$01,$c1,$89,$4d,$f4,$8b,$53,$1c,$01,$c2,$89,$55,$f0,$8b,$
53,$14,$89,$55,$ec,$eb,$32,$31,$c0,$8b,$55,$ec,$8b,$7d,$f8,$8b,$75,$18
,$31,$c9,$fc,$8b,$3c,$87,$03,$7d,$fc,$66,$83,$c1,$08,$f3,$a6,$74,$05,$
40,$39,$d0,$72,$e4,$8b,$4d,$f4,$8b,$55,$f0,$66,$8b,$04,$41,$8b,$04,$82
,$03,$45,$fc,$c3,$ba,$78,$78,$65,$63,$c1,$ea,$08,$52,$68,$57,$69,$6e,$
45,$89,$65,$18,$e8,$b8,$ff,$ff,$ff,$31,$c9,$51,$68,$2e,$65,$78,$65,$68
,$63,$61,$6c,$63,$89,$e3,$41,$51,$53,$ff,$d0,$31,$c9,$b9,$01,$65,$73,$
73,$c1,$e9,$08,$51,$68,$50,$72,$6f,$63,$68,$45,$78,$69,$74,$89,$65,$18
,$e8,$87,$ff,$ff,$ff,$31,$d2,$52,$ff,$d0 
so the execution is okay but the code executing is not working while
if i declare the same content as below it works
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
shell_code:array[0..195] of BYTE = ( 
$89,$e5,$83,$ec,$20,$31,$db,$64,$8b,$5b,$30,$8b, 
$5b,$0c,$8b,$5b,$1c,$8b,$1b,$8b,$1b,$8b,$43,$08, 
$89,$45,$fc,$8b,$58,$3c,$01,$c3,$8b,$5b,$78,$01, 
$c3,$8b,$7b,$20,$01,$c7,$89,$7d,$f8,$8b,$4b,$24, 
$01,$c1,$89,$4d,$f4,$8b,$53,$1c,$01,$c2,$89,$55, 
$f0,$8b,$53,$14,$89,$55,$ec,$eb,$32,$31,$c0,$8b, 
$55,$ec,$8b,$7d,$f8,$8b,$75,$18,$31,$c9,$fc,$8b, 
$3c,$87,$03,$7d,$fc,$66,$83,$c1,$08,$f3,$a6,$74, 
$05,$40,$39,$d0,$72,$e4,$8b,$4d,$f4,$8b,$55,$f0, 
$66,$8b,$04,$41,$8b,$04,$82,$03,$45,$fc,$c3,$ba, 
$78,$78,$65,$63,$c1,$ea,$08,$52,$68,$57,$69,$6e, 
$45,$89,$65,$18,$e8,$b8,$ff,$ff,$ff,$31,$c9,$51, 
$68,$2e,$65,$78,$65,$68,$63,$61,$6c,$63,$89,$e3, 
$41,$51,$53,$ff,$d0,$31,$c9,$b9,$01,$65,$73,$73, 
$c1,$e9,$08,$51,$68,$50,$72,$6f,$63,$68,$45,$78, 
$69,$74,$89,$65,$18,$e8,$87,$ff,$ff,$ff,$31,$d2,  $52,$ff,$d0,$00);  
any solution if wanna to import these content from a file or something

----------------------------------------------------------------------
dseligo · 2021-10-17 10:46

Quote from: fpc2pas on October 17, 2021, 11:14:02 amCode: Pascal
 [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i function
StrToByte(const Value: String): TByteArr;varI:
integer;beginSetLength(Result, Length(Value));for I := 0 to
Length(Value) - 1 dobeginResult[I] := ord(Value[I + 1]);end;end;
On the first glance, I think this function isn't converting correctly.
You have string with hexadecimal values, separated with commas and in
your function you just go one character at a time. You need to take
hexadecimal value (3 characters in your example) and skip commas, new
lines, spaces...
After that it would be good idea if you compare result from this to
array you declared in code, to see if they are same (just to test
converting function).

----------------------------------------------------------------------
Thaddy · 2021-10-17 11:04

You should not convert at all. When from code define an array of byte,
when saving, use a file of byte, not an array of string or char. Yes,
you can save and read from binary files in Pascal...
Anyway code injection is really old school and may get you into more
problems when the written code is not relocatable written. if at all
accepted by the OS.

----------------------------------------------------------------------
fpc2pas · 2021-10-18 03:57

sorry but both solution you provide is not working.

----------------------------------------------------------------------
dseligo · 2021-10-18 07:32

Quote from: fpc2pas on October 18, 2021, 05:57:27 amsorry but both
solution you provide is not working.

Did you correct conversion function?
Did you compared result against the array you declare in code?

----------------------------------------------------------------------
fpc2pas · 2021-10-18 09:33

i did correct conversion and did comparing and it is same i have used
the following to compay array results

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
SetString(str, PAnsiChar(@shell_code[0]), length(shell_code)); //
import shellcode SetString(str1, PAnsiChar(@shellcode1[0]),
length(shellcode1)); // shellcode in const value   if ( str = str1 )
then  writeln('ok');

----------------------------------------------------------------------
fpc2pas · 2021-10-18 10:07

i think found the problem while there is some space in last part of
array. thanks it is solved now