{"id":6476,"date":"2019-06-28T19:37:52","date_gmt":"2019-06-28T19:37:52","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6476"},"modified":"2019-06-28T19:38:10","modified_gmt":"2019-06-28T19:38:10","slug":"talking-to-and-handling-edit-boxes","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/06\/28\/talking-to-and-handling-edit-boxes\/","title":{"rendered":"Talking to, and handling (edit) boxes"},"content":{"rendered":"\n

In my older posts<\/a> I mentioned that data injection techniques are as important as code execution. If you can sneak in some data into another process’ address space w\/o being caught… you get a foot in a door for a stealth code execution\/evasion.<\/p>\n\n\n\n

Writing data to other processes is quite easy, but finding where it is actually stored is much harder. Nowadays, aggressive enumeration \/ scanning of memory regions of other processes’ address space will surely trigger some<\/em> alerts (it’s a technique known as RAM Scraping and some security solutions detect it).<\/p>\n\n\n\n

Luckily, windows messages come to the rescue again – they are still benefiting from a very unrestricted access to memory of other processes while providing a convenient interface to access this goodness (an the interface itself is kinda hard to monitor). <\/p>\n\n\n\n

EM_GETHANDLE<\/a> and EM_SETHANDLE<\/a> messages are used by Edit Controls. When you send the first of these messages you will get an address to a buffer where the edit control stores its text (i.e. whatever you e.g. type in Notepad). When you send the second – you can actually change the address of this buffer to whatever you want, even if temporarily.<\/p>\n\n\n\n

You could therefore launch Notepad, send keystrokes to it to ‘type’ a set of characters – a cleverly crafted shellcode – or simply launch the program to open your payload file as text, and then find the memory of the address where this data is stored via EM_GETHANDLE message, and then finally use one of the known code execution techniques to run this code.<\/p>\n\n\n\n

The shellcode itself needs to be Unicode-compatible (if you use English letters only, each 8-bit character will be converted to Unicode as a 16-bit word with a leading zero; shellcode needs to take this into account). Luckily, the fact characters must be Unicode is actually beneficial, as the characters can be almost anything and these may form a nice binary shellcode (i.e. you could save the shellcode natively as UTF16 and use BOM<\/a> to let Notepad know how to load the file). Notably, E9 and EB (opcodes for unconditional jumps) seem to be easy to inject w\/o any tricks (both of them are Latin letters ‘e’ with accents).<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

In my older posts I mentioned that data injection techniques are as important as code execution. If you can sneak in some data into another process’ address space w\/o being caught… you get a foot in a door for a … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[57],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6476"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6476"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6476\/revisions"}],"predecessor-version":[{"id":6481,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6476\/revisions\/6481"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6476"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6476"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}