Shellcode Injection VirtualProtectEx Returns Error
Ne0nd0g opened this issue · 0 comments
Ne0nd0g commented
Prerequisite
Environment Data
- Merlin Version:
v1.6.3
- Merlin Build:
- Go Version:
1.19
- Operating System:
Microsoft Windows [Version 10.0.19045.2965]
The CreateThread
, RtlCreateUserThread
, and QueueUserAPC
shellcode injection methods use the VirtualProtectEx call without enough arguments causing the error: Invalid access to memory location.
The call takes 5 arguments but only 3 are provided. Additionally, the error is not returned to server.
BOOL VirtualProtectEx(
[in] HANDLE hProcess,
[in] LPVOID lpAddress,
[in] SIZE_T dwSize,
[in] DWORD flNewProtect,
[out] PDWORD lpflOldProtect
);
merlin-agent/commands/exec_windows.go
Line 193 in e58a788