3 ms·

How did this work exactly? Suppose you are able to inject and execute remote code into the process containing your password in a text field How did you read t

How did this work exactly? Suppose you are able to inject and execute remote code into the process containing your password in a text field How did you read the password out of it? Did you know that the password variable was stored at some particular memory location?

kelnos 5y ago
I don't know much about Windows GUI programming, but in other GUI toolkits I've used, there's usually some sort of text_field.get_current_value() function you can call. Presumably the parent injected some code that repurposes the callback of a button or something so that when you click it, it calls get_current_value() and then dumps it to console or a log file or something.
dark-star 5y ago
I don't think I have that code around anymore, at least I can't find it now. And it's been a while. Here is what I remember: Basically you use VirtualAllocEx() to allocate some memory in the remote thread. The returned pointers are in the context of the target process. You can access that remote memory with ReadProcessMemory() and WriteProcessMemory(), which uses those "remote" pointers to copy data to/from your process. You can then use these memory areas to pass global handles and other stuff around. For accessing the actual password field data, you use standard Window-Messages with SendMessage() etc.
- mwcampbell 5y ago
  Some Windows screen readers used, and maybe still use, the same technique to get data out of the SysListView32 common control, since the parameters and results of that control's window messages aren't marshaled by the OS. Edit: Looks like NVDA still does. https://github.com/nvaccess/nvda/blob/master/source/NVDAObjects/IAccessible/sysListView32.py https://github.com/nvaccess/nvda/blob/master/source/NVDAObje...
  - heinrich5991 5y ago
    Permanent link (press 'y' anywhere on Github): https://github.com/nvaccess/nvda/blob/b5f82f878f344ab26004f39a291da5d65a57efb0/source/NVDAObjects/IAccessible/sysListView32.py https://github.com/nvaccess/nvda/blob/b5f82f878f344ab26004f3....
- unnouinceput 5y ago
  This technique is a classic one. I remember learning about it in late 90's after I got infected with a malware that hid itself from Task Manager. That made me also write my own Task Manager. To this day (Win10/Win11) you can hide your program from Task Manager using this technique and any malware that respect itself does it.
stevekemp 5y ago
That reminds me of the "Shatter Attack" - which basically involved posting messages to the event-loop/window of a different process: https://en.wikipedia.org/wiki/Shatter_attack https://en.wikipedia.org/wiki/Shatter_attack You could do that to call WM_GETTEXT, against an input-control, for example.

kelnos 5y ago

I don't know much about Windows GUI programming, but in other GUI toolkits I've used, there's usually some sort of text_field.get_current_value() function you can call. Presumably the parent injected some code that repurposes the callback of a button or something so that when you click it, it calls get_current_value() and then dumps it to console or a log file or something.

dark-star 5y ago

I don't think I have that code around anymore, at least I can't find it now. And it's been a while. Here is what I remember: Basically you use VirtualAllocEx() to allocate some memory in the remote thread. The returned pointers are in the context of the target process. You can access that remote memory with ReadProcessMemory() and WriteProcessMemory(), which uses those "remote" pointers to copy data to/from your process. You can then use these memory areas to pass global handles and other stuff around. For accessing the actual password field data, you use standard Window-Messages with SendMessage() etc.

mwcampbell 5y ago
Some Windows screen readers used, and maybe still use, the same technique to get data out of the SysListView32 common control, since the parameters and results of that control's window messages aren't marshaled by the OS. Edit: Looks like NVDA still does. https://github.com/nvaccess/nvda/blob/master/source/NVDAObjects/IAccessible/sysListView32.py https://github.com/nvaccess/nvda/blob/master/source/NVDAObje...
- heinrich5991 5y ago
  Permanent link (press 'y' anywhere on Github): https://github.com/nvaccess/nvda/blob/b5f82f878f344ab26004f39a291da5d65a57efb0/source/NVDAObjects/IAccessible/sysListView32.py https://github.com/nvaccess/nvda/blob/b5f82f878f344ab26004f3....
unnouinceput 5y ago
This technique is a classic one. I remember learning about it in late 90's after I got infected with a malware that hid itself from Task Manager. That made me also write my own Task Manager. To this day (Win10/Win11) you can hide your program from Task Manager using this technique and any malware that respect itself does it.

stevekemp 5y ago

That reminds me of the "Shatter Attack" - which basically involved posting messages to the event-loop/window of a different process: https://en.wikipedia.org/wiki/Shatter_attack https://en.wikipedia.org/wiki/Shatter_attack You could do that to call WM_GETTEXT, against an input-control, for example.