Ne0nd0g/merlin-agent

Shellcode Injection VirtualProtectEx Returns Error

Ne0nd0g opened this issue · 0 comments

Prerequisite

  • I have searched the opened & closed issues
  • I have searched the WIKI and its FAQ page

Environment Data

  • Merlin Version: v1.6.3
  • Merlin Build:
  • Go Version: 1.19
  • Operating System: Microsoft Windows [Version 10.0.19045.2965]

The CreateThread, RtlCreateUserThread, and QueueUserAPC shellcode injection methods use the VirtualProtectEx call without enough arguments causing the error: Invalid access to memory location. The call takes 5 arguments but only 3 are provided. Additionally, the error is not returned to server.

BOOL VirtualProtectEx(
  [in]  HANDLE hProcess,
  [in]  LPVOID lpAddress,
  [in]  SIZE_T dwSize,
  [in]  DWORD  flNewProtect,
  [out] PDWORD lpflOldProtect
);

_, _, errVirtualProtectEx := VirtualProtectEx.Call(uintptr(pHandle), addr, uintptr(len(shellcode)), PAGE_EXECUTE)