hook_create_process.cpp

/*
g++ hook_create_process.cpp ../CatEngine/CatEngine.cpp -lpsapi -shared -o hook_create_process.dll
*/

#include <windows.h>
#include <stdio.h>
#include "../CatEngine/CatEngine.h"

#pragma GCC diagnostic ignored "-Wattributes"

#define getOaObjectName(oa)(oa != NULL && oa->ObjectName->Length != 0 ? oa->ObjectName->Buffer : L"<None>")

/********************** Types **********************/

typedef int NTSTATUS, POOL_TYPE;

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES {
    ULONG           Length;
    HANDLE          RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG           Attributes;
    PVOID           SecurityDescriptor;
    PVOID           SecurityQualityOfService;
}  OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

typedef BOOL (WINAPI *PfnCreateProcessW)(
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
);

typedef BOOL (WINAPI *PfnCreateProcessInternalW)(
    HANDLE hUserToken,
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation,
    PHANDLE hNewToken
);

typedef BOOL (WINAPI *PfnCreateProcessAsUserW)(
    HANDLE hToken,
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
);

typedef BOOL (WINAPI *PfnCreateProcessWithLogonW)(
    LPCWSTR lpUsername,
    LPCWSTR lpDomain,
    LPCWSTR lpPassword,
    DWORD dwLogonFlags,
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInfo
);

typedef NTSTATUS (NTAPI *PfnNtCreateProcessEx)(
    PHANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    HANDLE ParentProcess,
    ULONG Flags,
    HANDLE SectionHandle OPTIONAL,
    HANDLE DebugPort OPTIONAL,
    HANDLE ExceptionPort OPTIONAL,
    BOOLEAN InJob
);

typedef NTSTATUS (NTAPI *PfnNtCreateProcess)(
    PHANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    HANDLE ParentProcess,
    BOOLEAN InheritObjectTable,
    HANDLE SectionHandle OPTIONAL,
    HANDLE DebugPort OPTIONAL,
    HANDLE ExceptionPort OPTIONAL
);

typedef NTSTATUS (NTAPI *PfnNtCreateSection)(
    PHANDLE SectionHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PLARGE_INTEGER MaximumSize,
    ULONG SectionPageProtection,
    ULONG AllocationAttributes,
    HANDLE FileHandle
);

typedef HINSTANCE (WINAPI *PfnShellExecuteW)(
    HWND hwnd,
    LPCWSTR lpOperation,
    LPCWSTR lpFile,
    LPCWSTR lpParameters,
    LPCWSTR lpDirectory,
    INT nShowCmd
);

typedef BOOL (WINAPI *PfnShellExecuteExW)(
    LPSHELLEXECUTEINFOW lpExecInfo
);

/********************** Variables **********************/

PfnCreateProcessW pfnCreateProcessW = NULL;
PfnCreateProcessInternalW pfnCreateProcessInternalW = NULL;
PfnCreateProcessAsUserW pfnCreateProcessAsUserW = NULL;
PfnCreateProcessWithLogonW pfnCreateProcessWithLogonW = NULL;
PfnNtCreateProcessEx pfnNtCreateProcessEx = NULL;
PfnNtCreateProcess pfnNtCreateProcess = NULL;
PfnNtCreateSection pfnNtCreateSection = NULL;
PfnShellExecuteW pfnShellExecuteW = NULL;
PfnShellExecuteExW pfnShellExecuteExW = NULL;

/********************** Routines **********************/

BOOL WINAPI HfnCreateProcessW(
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
)
{
    catMsgW(L"CreateProcessW: Would you like create process? '%s'", lpApplicationName);
    return pfnCreateProcessW(
        lpApplicationName,
        lpCommandLine,
        lpProcessAttributes,
        lpThreadAttributes,
        bInheritHandles,
        dwCreationFlags,
        lpEnvironment,
        lpCurrentDirectory,
        lpStartupInfo,
        lpProcessInformation
    );
}

BOOL WINAPI HfnCreateProcessInternalW(
    HANDLE hUserToken,
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation,
    PHANDLE hNewToken
)
{
    catMsgW(L"CreateProcessInternalW: Would you like create process? '%s'", lpApplicationName);
    return pfnCreateProcessInternalW(
        hUserToken,
        lpApplicationName,
        lpCommandLine,
        lpProcessAttributes,
        lpThreadAttributes,
        bInheritHandles,
        dwCreationFlags,
        lpEnvironment,
        lpCurrentDirectory,
        lpStartupInfo,
        lpProcessInformation,
        hNewToken
    );
}

BOOL WINAPI HfnCreateProcessAsUserW(
    HANDLE hToken,
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
)
{
    catMsgW(L"CreateProcessAsUserW: Would you like create process? '%s'", lpApplicationName);
    return pfnCreateProcessAsUserW(
        hToken,
        lpApplicationName,
        lpCommandLine,
        lpProcessAttributes,
        lpThreadAttributes,
        bInheritHandles,
        dwCreationFlags,
        lpEnvironment,
        lpCurrentDirectory,
        lpStartupInfo,
        lpProcessInformation
    );
}

BOOL WINAPI HfnCreateProcessWithLogonW(
    LPCWSTR lpUsername,
    LPCWSTR lpDomain,
    LPCWSTR lpPassword,
    DWORD dwLogonFlags,
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInfo
)
{
    catMsgW(L"CreateProcessWithLogonW: Would you like create process? '%s'", lpApplicationName);
    return pfnCreateProcessWithLogonW(
        lpUsername,
        lpDomain,
        lpPassword,
        dwLogonFlags,
        lpApplicationName,
        lpCommandLine,
        dwCreationFlags,
        lpEnvironment,
        lpCurrentDirectory,
        lpStartupInfo,
        lpProcessInfo
    );
}

NTSTATUS NTAPI HfnNtCreateProcessEx(
    PHANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    HANDLE ParentProcess,
    ULONG Flags,
    HANDLE SectionHandle OPTIONAL,
    HANDLE DebugPort OPTIONAL,
    HANDLE ExceptionPort OPTIONAL,
    BOOLEAN InJob
)
{
    catMsgW(L"NtCreateProcessEx: Would you like create process? '%s'", getOaObjectName(ObjectAttributes));
    return pfnNtCreateProcessEx(
        ProcessHandle,
        DesiredAccess,
        ObjectAttributes,
        ParentProcess,
        Flags,
        SectionHandle,
        DebugPort,
        ExceptionPort,
        InJob
    );
}

NTSTATUS NTAPI HfnNtCreateProcess(
    PHANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    HANDLE ParentProcess,
    BOOLEAN InheritObjectTable,
    HANDLE SectionHandle OPTIONAL,
    HANDLE DebugPort OPTIONAL,
    HANDLE ExceptionPort OPTIONAL
)
{
    catMsgW(L"NtCreateProcess: Would you like create process? '%s'", getOaObjectName(ObjectAttributes));
    return pfnNtCreateProcess(
        ProcessHandle,
        DesiredAccess,
        ObjectAttributes,
        ParentProcess,
        InheritObjectTable,
        SectionHandle,
        DebugPort,
        ExceptionPort
    );
}

NTSTATUS HfnNtCreateSection(
    PHANDLE SectionHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PLARGE_INTEGER MaximumSize,
    ULONG SectionPageProtection,
    ULONG AllocationAttributes,
    HANDLE FileHandle
)
{
    //catMsgW(L"NtCreateSection: Would you like create process? '%s'", getOaObjectName(ObjectAttributes));
    return pfnNtCreateSection(
        SectionHandle,
        DesiredAccess,
        ObjectAttributes,
        MaximumSize,
        SectionPageProtection,
        AllocationAttributes,
        FileHandle
    );
}

HINSTANCE WINAPI HfnShellExecuteW(
    HWND hwnd,
    LPCWSTR lpOperation,
    LPCWSTR lpFile,
    LPCWSTR lpParameters,
    LPCWSTR lpDirectory,
    INT nShowCmd
)
{
    catMsgW(L"ShellExecuteW: Would you like create process? '%s'", lpFile);
    return pfnShellExecuteW(
        hwnd,
        lpOperation,
        lpFile,
        lpParameters,
        lpDirectory,
        nShowCmd
    );
}

BOOL WINAPI HfnShellExecuteExW(LPSHELLEXECUTEINFOW lpExecInfo)
{
    catMsgW(L"ShellExecuteExW: Would you like create process? '%s'", lpExecInfo->lpFile);
    return pfnShellExecuteExW(lpExecInfo);
}

CcatHookAPI myHook;

#define ATTACH(m, p, cb, v)\
if (myHook.catAPIAttach(m, p, (void*)cb, (void**)v)) {\
catMsg(T("[+] Attach '%s' success!"), p);\
}\
else {\
catMsg(T("[!] Attach '%s' failed!"), p);\
}

#define DETACH(m, p, v)\
if (myHook.catAPIDetach(m, p, (void**)v)) {\
catMsg(T("[+] Detach '%s' succes!"), p);\
}\
else {\
catMsg(T("[!] Detach '%s' failed!"), p);\
}

extern "C" BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason) {
        case DLL_PROCESS_ATTACH:
            catMsg(T("***** DLL_PROCESS_ATTACH *****"));

            ATTACH(T("kernelbase.dll"), T("CreateProcessW"), &HfnCreateProcessW, &pfnCreateProcessW)
            ATTACH(T("kernelbase.dll"), T("CreateProcessInternalW"), &HfnCreateProcessInternalW, &pfnCreateProcessInternalW)

            ATTACH(T("advapi32.dll"), T("CreateProcessAsUserW"), &HfnCreateProcessAsUserW, &pfnCreateProcessAsUserW)
            ATTACH(T("advapi32.dll"), T("CreateProcessWithLogonW"), &HfnCreateProcessWithLogonW, &pfnCreateProcessWithLogonW)

            ATTACH(T("ntdll.dll"), T("NtCreateProcessEx"), &HfnNtCreateProcessEx, &pfnNtCreateProcessEx)
            ATTACH(T("ntdll.dll"), T("NtCreateProcess"), &HfnNtCreateProcess, &pfnNtCreateProcess)
            ATTACH(T("ntdll.dll"), T("NtCreateSection"), &HfnNtCreateSection, &pfnNtCreateSection)

            ATTACH(T("shell32.dll"), T("ShellExecuteW"), &HfnShellExecuteW, &pfnShellExecuteW)
            ATTACH(T("shell32.dll"), T("ShellExecuteExW"), &HfnShellExecuteExW, &pfnShellExecuteExW)
        break;
        case DLL_PROCESS_DETACH:
            DETACH(T("kernelbase.dll"), T("CreateProcessW"), &pfnCreateProcessW)
            DETACH(T("kernelbase.dll"), T("CreateProcessInternalW"), &pfnCreateProcessInternalW)

            DETACH(T("advapi32.dll"), T("CreateProcessAsUserW"), &pfnCreateProcessAsUserW)
            DETACH(T("advapi32.dll"), T("CreateProcessWithLogonW"), &pfnCreateProcessWithLogonW)

            DETACH(T("ntdll.dll"), T("NtCreateProcessEx"), &pfnNtCreateProcessEx)
            DETACH(T("ntdll.dll"), T("NtCreateProcess"), &pfnNtCreateProcess)
            DETACH(T("ntdll.dll"), T("NtCreateSection"), &pfnNtCreateSection)

            DETACH(T("shell32.dll"), T("ShellExecuteW"), &pfnShellExecuteW)
            DETACH(T("shell32.dll"), T("ShellExecuteExW"), &pfnShellExecuteExW)

            catMsg(T("***** DLL_PROCESS_DETACH *****"));
        break;
        default:;
    }

    return true;
}