Shellcode execution in same thread #16
Description
I have been trying to port the "standard" way for shellcode execution in the local process to Nim (i.e., without remote process creation and/or injection). IMO this is a key tool for the offensive toolset, and example code in the OffensiveNim repository would be greatly useful and appreciated! :)
This would mean porting (either or both of) the following C code snippets for shellcode execution to Nim.
- Using
VirtualProtect()to make the shellcode executable and executing it:
BOOL ret = VirtualProtect (shellcode, strlen(shellcode), PAGE_EXECUTE_READWRITE;oldProtect);
((void(*)(void))shellcode)();- Using
VirtualAlloc()to create executable memory space, moving the shellcode to this location, and executing it from there:
BOOL *exec = VirtualAlloc(0, strlen(shellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy(exec, shellcode, strlen(shellcode));
((void (*)())exec)();Alternatively, if Nim can be used to write directly to the .text section of the memory, the shellcode could be placed and executed from there. As such, calls to Windows APIs can be avoided altogether (see here). I was however unable to find means to write to this section directly using Nim.
I had some stabs at this, but I keep running into walls because I'm not too familiar with low-level programming. The Windows API calls seem to succeed, but I can't properly assign and execute a function pointer in Nim. If anyone got this to work some code snippets would be greatly appreciated :)