infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
metasploit-framework/external/source/byakugan/tenketsu.cpp

424 lines
13 KiB
C++
Raw Blame History

#include <windows.h>
#include <stdlib.h>
#include "byakugan.h"
#include "tenketsu.h"
#include "heapStructs.h"
#define BUFSIZE 4096
// UNDOCUMENTED FUNCTIONS TO ADD
//
// RtlAllocateMemoryBlockLookaside
// RtlFreeMemoryBlockLookaside
//
// RtlCreateMemoryBlockLookaside
// RtlDestroyMemoryBlockLookaside
//
// RtlExtendMemoryBlockLookaside
// RtlResetMemoryBlockLookaside
PCSTR undocdFunc[] = { "ntdll!RtlpCoalesceFreeBlocks", NULL };
ULONG undocdAddr[sizeof (undocdFunc)+1];
struct HeapState heapModel;
BOOLEAN running = FALSE;
// Two things that fucking rock? Bunnies and Jaguars. Werd.
int hookRtlHeap(BYTE type, char *fileName) {
HRESULT Status;
HANDLE process;
DWORD pid;
HANDLE processHandle = 0;
HANDLE threadHandle = 0;
LPVOID stringAddress = NULL;
LPCSTR dllName = "C:\\windbg\\injectsu.dll";
ULONG64 funcAddr64;
ULONG *funcAddr, i;
heapModel.state = heapModel.state ^ type;
if (running) {
dprintf("[Byakugan] Hooks are already injected.\n");
return (0);
}
running = TRUE;
dprintf("[Byakugan] Beginning data gathering thread... ");
if(tenkListener()) {
dprintf("\n[Byakugan] Failed to create heap info back channel :(\n");
VirtualFreeEx(processHandle, stringAddress, strlen(dllName), MEM_DECOMMIT);
CloseHandle(processHandle);
return (-1);
}
dprintf("Success!\n[Byakugan] Injecting Tenketsu Heap Monitoring DLL... ");
Status = g_ExtSystem->GetCurrentProcessSystemId(&pid);
if (Status != S_OK)
return (-1);
if(!(processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid))){
dprintf("\n[Byakugan] Unable to OpenProcess().\n");
return (-1);
}
if(!(stringAddress = VirtualAllocEx(processHandle, NULL, strlen(dllName), MEM_COMMIT, PAGE_EXECUTE_READWRITE))){
printf("\n[Byakugan] VirtualAllocEx() failed.\n");
CloseHandle(processHandle);
return (-1);
}
if(!WriteProcessMemory(processHandle, (LPVOID)stringAddress, dllName, strlen(dllName), NULL)){
dprintf("\n[Byakugan] WriteProcessMemory() failed.\n");
VirtualFreeEx(processHandle, stringAddress, strlen(dllName), MEM_DECOMMIT);
CloseHandle(processHandle);
return (-1);
}
dprintf("Success!\n");
// Resolve undocumented functions!
i = 0;
g_ExtSymbols->Reload("/f ntdll.dll");
dprintf("[Byakugan] Resolving undocumented Heap functions...\n");
while (undocdFunc[i] != NULL) {
if (g_ExtSymbols->GetOffsetByName(undocdFunc[i], &funcAddr64) == E_FAIL)
funcAddr64 = NULL;
funcAddr = (ULONG *) &funcAddr64;
if (*funcAddr != NULL)
dprintf("[T] Resolved undocumented function '%s' @ 0x%08x.\n", undocdFunc[i], *funcAddr);
else
dprintf("[T] Unable to resolve undocumented function '%s' :(\n", undocdFunc[i]);
undocdAddr[i] = *funcAddr;
i++;
}
undocdAddr[i] = NULL;
if(!(threadHandle = CreateRemoteThread(processHandle, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(LoadLibrary("kernel32.dll"), "LoadLibraryA"), \
(LPVOID)stringAddress, 0, NULL))){
dprintf("\n[Byakugan] CreateRemoteThread() failed.\n");
VirtualFreeEx(processHandle, stringAddress, strlen(dllName), MEM_DECOMMIT);
CloseHandle(processHandle);
return (-1);
}
CloseHandle(threadHandle);
CloseHandle(processHandle);
// Set up the log file
if (type == 2) {
heapModel.hLogFile = CreateFileA(fileName, GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if (!heapModel.hLogFile) {
dprintf("[T] Unable to open file \"%s\" for writing. :(\n");
}
}
return (0);
}
int tenkListener(void) {
BOOL fConnected;
DWORD dwThreadId;
HANDLE hPipe, hThread;
LPTSTR lpszPipename = TEXT("\\\\.\\pipe\\tenketsu");
hPipe = CreateNamedPipe( lpszPipename,
PIPE_ACCESS_DUPLEX,
PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
PIPE_UNLIMITED_INSTANCES,
BUFSIZE,
BUFSIZE,
NMPWAIT_USE_DEFAULT_WAIT,
NULL);
if (hPipe == INVALID_HANDLE_VALUE) {
dprintf("[Byakugan] CreateNamedPipe() failed.\n");
return (-1);
}
hThread = CreateThread( NULL,
0,
tenkBackChannel,
(LPVOID) hPipe,
0,
&dwThreadId);
if (hThread == NULL) {
dprintf("[Byakugan] CreateThread() failed.\n");
return (-1);
}
CloseHandle(hThread);
return (0);
}
DWORD WINAPI tenkBackChannel(LPVOID lpvParam) {
HANDLE hPipe;
TCHAR buf[BUFSIZE+1];
ULONG bytesRead, bytesWritten;
BOOL fSuccess;
ULONG64 funcAddr64;
ULONG *funcAddr, i;
struct AllocateStruct *aStruct = (struct AllocateStruct *)buf;
struct ReallocateStruct *rStruct = (struct ReallocateStruct *)buf;
struct FreeStruct *fStruct = (struct FreeStruct *)buf;
struct CreateStruct *cStruct = (struct CreateStruct *)buf;
struct DestroyStruct *dStruct = (struct DestroyStruct *)buf;
struct CoalesceStruct *cfbStruct = (struct CoalesceStruct *)buf;
hPipe = (HANDLE) lpvParam;
dprintf("[Byakugan] Waiting for named pipe connection...\n");
for(;!ConnectNamedPipe(hPipe, NULL) == TRUE;) { dprintf("[B] waiting for connection...\n"); }
dprintf("[Byakugan] Connected to back channel. :)\n");
// Load addresses from symbols if possible for undoumented interfaces
i = 0;
while (undocdFunc[i] != NULL) {
dprintf("[T] Sending address of %s\n", undocdFunc[i]);
fSuccess = WriteFile(hPipe, &(undocdAddr[i]), sizeof(ULONG), &bytesWritten, NULL);
if (!fSuccess || bytesWritten != sizeof(ULONG))
dprintf("[T] Failed to send address of %s\n", undocdFunc[i]);
i++;
}
//FlushFileBuffers(hPipe);
dprintf("[T] Sent addresses of %d undocumented functions.\n", i);
initializeHeapModel(&heapModel);
#undef THREEDHEAPFU_ENABLED //Place this in setup.bat
#if 0 //#ifdef THREEDHEAPFU_ENABLED
//Create a heap event proxy, play these back out to 3dheapfu
LPTSTR lpszProxyPipename = TEXT("\\\\.\\pipe\\tenketsuProxy");
BOOL fProxySuccess;
DWORD dwProxyMode = PIPE_READMODE_MESSAGE;
ULONG bytesProxyWritten;
static BOOL fDontAttemptProxyWrite = false;
HANDLE hProxyPipe = CreateFile(lpszProxyPipename,
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
0,
NULL);
if (hProxyPipe == INVALID_HANDLE_VALUE)
dprintf("hProxyPipe == invalid handle\n");
else
dprintf("hProxyPipe == good\n");
SetNamedPipeHandleState(hProxyPipe, &dwProxyMode, NULL, NULL); //?
#endif
while (1) {
fSuccess = ReadFile( hPipe,
buf,
BUFSIZE*sizeof(TCHAR),
&bytesRead,
NULL);
if (!fSuccess || bytesRead == 0) {
dprintf("[Byakugan] ReadFile failed, or read 0 bytes.\n");
continue;
}
#if 0 //#ifdef THREEDHEAPFU_ENABLED
//dprintf("jc: receieved an event of size %d. Forwarding on to ProxyPipe\n", bytesRead);
//WriteFile(hPipe, &freeinfo, sizeof(struct FreeStruct), &bytesWritten, NULL);
if (!fDontAttemptProxyWrite)
{
fProxySuccess = WriteFile(hProxyPipe, buf, bytesRead, &bytesProxyWritten, NULL);
if (bytesRead != bytesProxyWritten)
{
dprintf("Partial write to proxy on last event! ;(\n");
dprintf("event size was %d. wrote %d\n", bytesRead, bytesProxyWritten);
dprintf("Disabling message proxying until explicitly enabled.\n");
fDontAttemptProxyWrite = true;
}
}
#endif
switch ( *((BYTE *) buf) ) {
case ALLOCATESTRUCT:
//dprintf("[T] New Chunk @ 0x%08x\n", aStruct->ret);
//dprintf("Heap: 0x%08x\tFlags: 0x%08x\tSize: 0x%08x\n\n",
// aStruct->heapHandle, aStruct->flags, aStruct->size);
if (heapModel.state & MODEL) heapAllocate(&heapModel, aStruct);
if (heapModel.state & LOG) logAllocate(&heapModel, aStruct);
break;
case REALLOCATESTRUCT:
//dprintf("[T] Realloc'd Chunk @ 0x%08x\n", rStruct->ret);
//dprintf("Heap: 0x%08x\tFlags: 0x%08x\tSize: 0x%08x\n",
// rStruct->heapHandle, rStruct->flags, rStruct->size);
//if (rStruct->ret != (PVOID) rStruct->memoryPointer)
// dprintf("Replaces chunk @ 0x%08x\n", rStruct->memoryPointer);
//dprintf("\n");
if (heapModel.state & MODEL) heapReallocate(&heapModel, rStruct);
if (heapModel.state & LOG) logReallocate(&heapModel, rStruct);
break;
case FREESTRUCT:
//dprintf("[T] Free'd Chunk @ 0x%08x\n", fStruct->memoryPointer);
//dprintf("Heap: 0x%08x\tFlags: 0x%08x\n\n", fStruct->heapHandle, fStruct->flags);
if (heapModel.state & MODEL) heapFree(&heapModel, fStruct);
if (heapModel.state & LOG) logFree(&heapModel, fStruct);
break;
case CREATESTRUCT:
dprintf("[T] New Heap: 0x%08x\n", cStruct->ret);
dprintf("Base: 0x%08x\tReserve: 0x%08x\tFlags: 0x%08x\n",
cStruct->base, cStruct->reserve, cStruct->flags);
//dprintf("Commit: 0x%08x\tLock: 0x%08x\n\n", cStruct->commit, cStruct->lock);
if (heapModel.state & MODEL) heapCreate(&heapModel, cStruct);
break;
case DESTROYSTRUCT:
dprintf("[T] Heap Destroyed: 0x%08x\n\n", dStruct->heapHandle);
if (heapModel.state & MODEL) heapDestroy(&heapModel, dStruct);
break;
case COALESCESTRUCT:
//dprintf("[T] Free Block Consolidation (returned 0x%08x)\n", cfbStruct->ret);
//dprintf("Heap: 0x%08x\tArg2: 0x%08x\tArg3: 0x%08x\tArg4: 0x%08x\n\n",
// cfbStruct->heapHandle, cfbStruct->arg2, cfbStruct->arg3, cfbStruct->arg4);
if (heapModel.state & MODEL) heapCoalesce(&heapModel, cfbStruct);
break;
default:
dprintf("[Byakugan] Tenketsu: Unrecognized data was returned.\n");
}
}
return (0);
}
void tenkHelp() {
dprintf(HELPSTRING);
dprintf("Tenketsu Commands:\n");
dprintf("\tmodel\t- Load tenketsu heap visualization libraries and begin modeling\n");
dprintf("\tlog\t- Load tenketsu heap visualization libraries and begin logging\n");
dprintf("\tlistHeaps\t- List all currently tracked heaps and their information\n");
dprintf("\tlistChunks <heap base>\t- List all chunks associated with a givend heap\n");
dprintf("\tvalidate <heap base> - check the chunk chain and find corrupted chunk headers\n");
}
void tenkListHeaps() {
struct HPool *curHeap;
ULONG i;
dprintf("[T] Currently tracking %d heaps:\n", heapModel.numHeaps);
for (i = 0; i < heapModel.numHeaps; i++) {
curHeap = &(heapModel.heaps[i]);
if (curHeap->inUse == FALSE)
continue;
dprintf("\tBase: 0x%08x\tNumber of Chunks: %d\n", curHeap->base, curHeap->numChunks);
dprintf("\tFlags: 0x%08x\tReserve: 0x%08x\n",
curHeap->flags, curHeap->reserve, curHeap->commit);
dprintf("\tLock: 0x%08x\n\n", curHeap->lock);
}
}
void tenkValidate(PVOID heapHandle) {
struct HPool *heap;
struct DestroyStruct dStruct;
struct HeapChunk *curChunk;
ULONG chunkPtr;
ULONG i, nextIndex;
BOOL screwed = FALSE;
heap = getHeap(&heapModel, heapHandle);
i = heap->inUseHead;
while (i != NULLNODE) {
if (CHUNK(i).free) {
// CHUNK(i).nextInUse must be equal to the next ptr
if(!ReadMemory((ULONG64)(CHUNK(i).addr)+4, (PVOID) &chunkPtr, 4, NULL)) {
dprintf("[T] Unable to read memory at address 0x%08x\n!");
return;
}
// Find next free chunk - continue if there are no more
nextIndex = CHUNK(i).nextInUse;
while (nextIndex != NULLNODE && !(CHUNK(nextIndex).free))
nextIndex = CHUNK(nextIndex).nextInUse;
if (nextIndex == NULLNODE) {
i = CHUNK(i).nextInUse;
continue;
}
// Validate next free chunk
if (CHUNK(nextIndex).addr != (PVOID) chunkPtr) {
dprintf("[T] Corruped next pointer for chunk at 0x%08x\n", CHUNK(i).addr);
dprintf(">\tGot: 0x%08x\tExpected: 0x%08x\n", chunkPtr, CHUNK(nextIndex).addr);
screwed = TRUE;
}
// next free chunk prev, must equal CHUNK(i).addr
if(!ReadMemory((ULONG64)CHUNK(nextIndex).addr, (PVOID) &chunkPtr, 4, NULL)) {
dprintf("[T] Unable to read memory at address 0x%08x\n!");
return;
}
if ((PVOID) chunkPtr != CHUNK(i).addr) {
dprintf("[T] Corruped prev pointer for chunk at 0x%08x\n", CHUNK(nextIndex).addr);
dprintf(">\tGot: 0x%08x\tExpected: 0x%08x\n", chunkPtr, CHUNK(i).addr);
screwed = TRUE;
}
} else {
}
i = CHUNK(i).nextInUse;
}
dprintf("[T] Validation complete: ");
if (!screwed)
dprintf("all known free chunks are correct\n");
else
dprintf("errors found\n");
}
void tenkListChunks(PVOID heapHandle) {
struct HPool *heap;
struct DestroyStruct dStruct;
struct HeapChunk *curChunk;
ULONG i;
heap = getHeap(&heapModel, heapHandle);
dprintf("[T] Currently tracking %d chunks for heap 0x%08x\n",
heap->numChunks, heap->base);
i = heap->inUseHead;
while (i != NULLNODE) {
if (CHUNK(i).inUse) {
dprintf("\tAddress: 0x%08x\tSize: 0x%08x", CHUNK(i).addr, CHUNK(i).size);
dprintf("\tFlags: 0x%08x\t%s\n\n", CHUNK(i).flags,
(CHUNK(i).free)?"FREE'D":"IN USE");
}
i = CHUNK(i).nextInUse;
}
if (heap->numChunks == 0) {
dStruct.heapHandle = heap->base;
heapDestroy(&heapModel, &dStruct);
}
}
Reference in New Issue View Git Blame Copy Permalink