unhook crashes meterpreter on Win 11 24H2 and Server 2025

[bwatters-r7]

See rapid7/metasploit-framework#20515. I'm posting this in two places because the short-term solution is a fix in Framework, but a long-term solution will need to live here.

[dledda-r7]

I took some time to think about unhook and I think there is some potential in this extension if we manage to fix it.

TODO

Fix the crash

The first thing to do is to fix the crash we have. from what i saw, the crash is happening somewhere here:

metasploit-payloads/c/meterpreter/source/extensions/unhook/refresh.c

Line 336 in ebde369

VOID ScanAndFixSection(PCHAR szSectionName, PCHAR pKnown, PCHAR pSuspect, size_t stLength)

I will try to allocate some time to understand if this bug is happening only while Refreshing a specific dll, of if there is some memory corruption bug we didn't catch.

Enchance the Extension

While in theory this extension could be useful, the way we are accessing to the "clean" dlls make me rethink this extension could do actually something if a real EDR is hooking us.

by looking at

metasploit-payloads/c/meterpreter/source/extensions/unhook/refresh.c

Line 90 in ebde369

hFile = CreateFileW(wszFullDllName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

we can see that the extension is loading the DLL using standard Windows calls. now if we were in a real hooked context, an EDR could technically hook our calls, and swap what we think is the legit dll with the exact copy we have in our hooked process. in that way the memcmp would be "happy" and we will still have an hooked process.

It would make to re-write the logic by using direct syscall or something similar to be sure we are loading the unhooked binary.