用于将“TCP Relay”托管程序集注入非托管进程的工具

用于将“TCP Relay”托管程序集注入非托管进程的工具

TCPRelayInjecter2

Author: Arno0x.

As opposed to my first version of this project, this second version:

uses a completely different approach (no more CLR loading into the remote process, not necessary),supports both 32 or 64 bits target process.

This tool is used to inject a "TCP Relay" managed assembly (TcpRelay_x86.dll or TcpRelay_x64.dll) into an unmanaged process. The relay is basically listening on a TCP port and relaying (forwarding) the received connection to another destination port, either locally (localhost) or, optionnaly, to a remote IP.

Note: TCPRelayInjecter only relays TCP connections.

Background and context

I created this tool in order to bypass Windows local firewall rules preventing some inbound connections I needed (in order to perform some relay and/or get a MiTM position). As a non-privileged user, firewall rules could not be modified or added.

The idea is to find a process running as the same standard (non-privileged) user AND allowed to receive any network connection, or at least the one we need. You can find such a process by analyzing the local FW rules:

netsh advfirewall firewall show rule name=all

From there we just have to inject a TCP Relay assembly in the process fulfilling your needs, passing it some arguments like a local port to listen to, a destination port and an optionnal destination IP to forward the traffic to.

Compile

The injecter comes in two flavors achieving exactly the same goal: there's a C++ version (TcpRelayInjecter.cpp) and there's a C# version (TcpRelayInjecter.cs). You only need to compile one of these two files. It might be easier though to compile the C# injecter as it doesn't require VisualStudio or any other C++ compiler, it just needs the csc.exe compiler which comes with the .Net framework installed with any recent Windows OS.

Targetting 32 bits processes:

You'll need the 32 bits version of both the DLL and the injecterCompile the DLL: *Refer to the comments in the headers of the TcpRelay.csModify the .Net DLL to export the EntryPoint method as explained in the file header comments. Compile the injecter either using TcpRelayInjecter.cpp or TcpRelayInjecter.cs. Refer to the file header comments for compilation instructions.

Targetting 64 bits processes:

You'll need the 64 bits version of both the DLL and the injecterCompile the DLL: Refer to the comments in the headers of the TcpRelay.csModify the .Net DLL to export the EntryPoint method as explained in the file header comments. Compile the injecter either using TcpRelayInjecter.cpp or TcpRelayInjecter.cs. Refer to the file header comments for compilation instructions.

Usage

Prior to running the tool, ensure the binary files are all in the same path:

TcpRelayInjecter_x86.exeTCPRelay_x86.dll

or

TcpRelayInjecter_x64.exeTCPRelay_x64.dll

Then use the following command line:

TcpRelayInjecter_x86|x64.exe [destination_IP]

target_process_name: the name of the executable we want to inject the TCP Forwarder intolistening_port: the TCP port to use for listening for inbound connectionsdestination_port: the TCP port to which forward the traffic (typically another process would be listening on that port)destination_IP: Optionnal, the destination IP to which forward the traffic, if not specified, defaults to localhost

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。