search

rtecCyberSec / Packer_Development

Slides & Code snippets for a workshop held @ x33fcon 2024
BSD 3-Clause "New" or "Revised" License
209 stars 38 forks source link

Mimikatz load_pe error #3

Closed zhihuba closed 5 days ago

zhihuba commented 2 weeks ago

I saw https://github.com/Thoxy67/rspe used in rust for pe load. I tested locally and found that Mimikatz nc cve-2024-26229 would fail. For Mimikatz, I tried to use donut to convert it into shellcode and it was successful. The remaining two still failed. Some details nc is compiled using pascal language. I want to know how you solved it.

S3cur3Th1sSh1t commented 1 week ago

Did you read the comments in the code? ;-)

zhihuba commented 1 week ago

https://github.com/rtecCyberSec/Packer_Development/blob/master/Rust/peload/peload.rs reflective_loader(data.clone()); There doesn't seem to be any difference...

S3cur3Th1sSh1t commented 1 week ago

I‘ll not give you a full solution for it because this whole repository is meant to be used for learning purposes.

You’ll need to fix a bug in the rspe library code itself. So first step instead of just „importing and using“ the library, get the code and troubleshoot where it’s crashing with mimikatz.

This way you will find out: 1) how a reflective PE loader works 2) what’s wrong. 🙃

Providing the full solution will not lead to learning effects here.

Greetings

S3cur3Th1sSh1t commented 5 days ago

By opening an issue in another repo you will not learn ;-) I’m going to close this for now as there is no todo for this repo. 👍