diff --git a/Cargo.lock b/Cargo.lock index dbf1ff9..53d082f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -154,43 +154,6 @@ version = "1.0.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0" -[[package]] -name = "core-foundation-sys" -version = "0.8.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" - -[[package]] -name = "crossbeam-deque" -version = "0.8.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d" -dependencies = [ - "crossbeam-epoch", - "crossbeam-utils", -] - -[[package]] -name = "crossbeam-epoch" -version = "0.9.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" -dependencies = [ - "crossbeam-utils", -] - -[[package]] -name = "crossbeam-utils" -version = "0.8.20" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80" - -[[package]] -name = "either" -version = "1.13.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0" - [[package]] name = "error-chain" version = "0.12.4" @@ -251,15 +214,6 @@ dependencies = [ "adler", ] -[[package]] -name = "ntapi" -version = "0.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8a3895c6391c39d7fe7ebc444a87eb2991b2a0bc718fdabd071eec617fc68e4" -dependencies = [ - "winapi", -] - [[package]] name = "object" version = "0.36.3" @@ -326,26 +280,6 @@ dependencies = [ "getrandom", ] -[[package]] -name = "rayon" -version = "1.10.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa" -dependencies = [ - "either", - "rayon-core", -] - -[[package]] -name = "rayon-core" -version = "1.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2" -dependencies = [ - "crossbeam-deque", - "crossbeam-utils", -] - [[package]] name = "regex-syntax" version = "0.6.29" @@ -371,18 +305,18 @@ checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f" [[package]] name = "serde" -version = "1.0.208" +version = "1.0.209" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cff085d2cb684faa248efb494c39b68e522822ac0de72ccf08109abde717cfb2" +checksum = "99fce0ffe7310761ca6bf9faf5115afbc19688edd00171d81b1bb1b116c63e09" dependencies = [ "serde_derive", ] [[package]] name = "serde_derive" -version = "1.0.208" +version = "1.0.209" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24008e81ff7613ed8e5ba0cfaf24e2c2f1e5b8a0495711e44fcd4882fca62bcf" +checksum = "a5831b979fd7b5439637af1752d535ff49f4860c0f341d1baeb6faf0f4242170" dependencies = [ "proc-macro2", "quote", @@ -403,29 +337,15 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" [[package]] name = "syn" -version = "2.0.75" +version = "2.0.76" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f6af063034fc1935ede7be0122941bafa9bacb949334d090b77ca98b5817c7d9" +checksum = "578e081a14e0cefc3279b0472138c513f37b41a08d5a3cca9b6e4e8ceb6cd525" dependencies = [ "proc-macro2", "quote", "unicode-ident", ] -[[package]] -name = "sysinfo" -version = "0.31.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b92e0bdf838cbc1c4c9ba14f9c97a7ec6cdcd1ae66b10e1e42775a25553f45d" -dependencies = [ - "core-foundation-sys", - "libc", - "memchr", - "ntapi", - "rayon", - "windows 0.57.0", -] - [[package]] name = "toml" version = "0.5.11" @@ -459,45 +379,13 @@ version = "0.11.0+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423" -[[package]] -name = "winapi" -version = "0.3.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419" -dependencies = [ - "winapi-i686-pc-windows-gnu", - "winapi-x86_64-pc-windows-gnu", -] - -[[package]] -name = "winapi-i686-pc-windows-gnu" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" - -[[package]] -name = "winapi-x86_64-pc-windows-gnu" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" - -[[package]] -name = "windows" -version = "0.57.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12342cb4d8e3b046f3d80effd474a7a02447231330ef77d71daa6fbc40681143" -dependencies = [ - "windows-core 0.57.0", - "windows-targets", -] - [[package]] name = "windows" version = "0.58.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6" dependencies = [ - "windows-core 0.58.0", + "windows-core", "windows-targets", ] @@ -509,47 +397,23 @@ dependencies = [ "clap", "rand", "regex_generate", - "sysinfo", - "windows 0.58.0", + "windows", "winres", ] -[[package]] -name = "windows-core" -version = "0.57.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d2ed2439a290666cd67ecce2b0ffaad89c2a56b976b736e6ece670297897832d" -dependencies = [ - "windows-implement 0.57.0", - "windows-interface 0.57.0", - "windows-result 0.1.2", - "windows-targets", -] - [[package]] name = "windows-core" version = "0.58.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99" dependencies = [ - "windows-implement 0.58.0", - "windows-interface 0.58.0", - "windows-result 0.2.0", + "windows-implement", + "windows-interface", + "windows-result", "windows-strings", "windows-targets", ] -[[package]] -name = "windows-implement" -version = "0.57.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9107ddc059d5b6fbfbffdfa7a7fe3e22a226def0b2608f72e9d552763d3e1ad7" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - [[package]] name = "windows-implement" version = "0.58.0" @@ -561,17 +425,6 @@ dependencies = [ "syn", ] -[[package]] -name = "windows-interface" -version = "0.57.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "29bee4b38ea3cde66011baa44dba677c432a78593e202392d1e9070cf2a7fca7" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - [[package]] name = "windows-interface" version = "0.58.0" @@ -583,15 +436,6 @@ dependencies = [ "syn", ] -[[package]] -name = "windows-result" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5e383302e8ec8515204254685643de10811af0ed97ea37210dc26fb0032647f8" -dependencies = [ - "windows-targets", -] - [[package]] name = "windows-result" version = "0.2.0" @@ -607,7 +451,7 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10" dependencies = [ - "windows-result 0.2.0", + "windows-result", "windows-targets", ] diff --git a/Cargo.toml b/Cargo.toml index a387d6f..b055f08 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -25,10 +25,10 @@ name = "wag" path = "./src/main.rs" [dependencies] -base64 = { version = "0.22.1" } windows = { version = "0.58.0", features = [ "Win32_System_Pipes", "Win32_Foundation", + "Win32_System_Diagnostics_ToolHelp", "Win32_Security", "Win32_Storage_FileSystem", "Win32_UI_Shell", @@ -38,10 +38,10 @@ windows = { version = "0.58.0", features = [ "Win32_System_Threading", "Win32_System_Memory", ] } +base64 = { version = "0.22.1" } clap = { version = "4.5.16", features = ["derive"] } rand = "0.8.5" regex_generate = "0.2.3" -sysinfo = "0.31.3" [build-dependencies] winres = "0.1.12" diff --git a/src/actions/processes/spoofing.rs b/src/actions/processes/spoofing.rs index c166c31..ecad2e7 100644 --- a/src/actions/processes/spoofing.rs +++ b/src/actions/processes/spoofing.rs @@ -9,14 +9,24 @@ use crate::actions::Runnable; use clap::Parser; use core::ffi::c_void; -use rand::prelude::SliceRandom; -use std::{error::Error, mem::size_of, thread, time::Duration}; -use sysinfo::System; +use std::{ + error::Error, + ffi::OsString, + fmt::{Display, Formatter, Result as FormatterResult}, + mem::size_of, + os::windows::ffi::OsStringExt, + thread, + time::Duration, +}; use windows::{ - core::PSTR, + core::{Owned, PSTR}, Win32::{ Foundation::{CloseHandle, HANDLE}, System::{ + Diagnostics::ToolHelp::{ + CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, PROCESSENTRY32W, + TH32CS_SNAPPROCESS, + }, Memory::{GetProcessHeap, HeapAlloc, HEAP_FLAGS}, Threading::{ CreateProcessA, InitializeProcThreadAttributeList, OpenProcess, TerminateProcess, @@ -37,25 +47,58 @@ pub struct Spoofing { help = "Full path to the executable eg: c:\\temp..." )] executable: String, + #[clap( + short = 'p', + long, + required = true, + help = "Full path to the parent executable eg: c:\\temp..." + )] + parent_executable: String, +} + +#[derive(Debug)] +struct ProcessNotFound; + +impl Error for ProcessNotFound {} + +impl Display for ProcessNotFound { + fn fmt(&self, formatter: &mut Formatter) -> FormatterResult { + write!(formatter, "Process not found") + } } -fn get_user_pid() -> u32 { - let s: System = System::new_all(); - let mut ppid_list: Vec = Vec::::new(); - for (pid, process) in s.processes() { - if process.user_id().is_some() { - ppid_list.push(pid.as_u32()); +fn get_pid_from_name(name: &str) -> Result> { + let snapshot: Owned = + unsafe { Owned::new(CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)?) }; + let mut process_entry: PROCESSENTRY32W = PROCESSENTRY32W::default(); + process_entry.dwSize = size_of::() as u32; + + unsafe { + Process32FirstW(*snapshot, &mut process_entry)?; + } + + loop { + if OsString::from_wide( + process_entry + .szExeFile + .into_iter() + .take_while(|&byte| byte != 0) + .collect::>() + .as_slice(), + ) == name + { + return Ok(process_entry.th32ProcessID); + } + + if unsafe { Process32NextW(*snapshot, &mut process_entry) }.is_err() { + break; } } - let new_ppid: u32 = ppid_list - .choose(&mut rand::thread_rng()) - .unwrap() - .to_owned(); - new_ppid + + Err(Box::new(ProcessNotFound)) } -fn create_ppid(name: &String) -> bool { - let new_ppid: u32 = get_user_pid(); +fn create_ppid(name: &String, new_ppid: u32) -> bool { println!("Use the PPID {}", new_ppid); println!("Open the Parent Process"); let mut parent_process_handle: HANDLE = @@ -130,7 +173,10 @@ impl Runnable for Spoofing { /* Version 20240209 */ fn run(&self) -> Result> { println!("PPID spoofing"); - let result: bool = create_ppid(&self.executable); + let result: bool = create_ppid( + &self.executable, + get_pid_from_name(&self.parent_executable)?, + ); Ok(!result as i32) }