C# Use the hooked Sandboxie module to log messages

[C#] Use the hooked Sandboxie module to log messages - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] Use the hooked Sandboxie module to log messages (/showthread.php?tid=5839436)

Use the hooked Sandboxie module to log messages - gigajew - May 21, 2018

You can use the hooked module SbieDll.dll if the application was started with Sandboxie, to log messages in it's own dedicated window (this creates an opportunity for social engineering)

[Image: OqUMMzu.png]

RE: Use the hooked Sandboxie module to log messages - Dalvik - May 21, 2018

Code 
return (T)(Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T)) as object);

Why not just:

Code 
return (T)Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T));

RE: Use the hooked Sandboxie module to log messages - 0xDEAD10CC - May 22, 2018

(May 21, 2018 09:22 PM)Dalvik Wrote:
Code
return (T)(Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T)) as object);
Why not just:

Code
return (T)Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T));

Because you cannot cast Delegate to typeof(T) directly like this. The reason he can't use as on T directly though is because of his lack of type constraints that restrict it to be a reference type, which a Delegate type is... I would have done it like this:

Code 
internal static T CreateDelegateFunc<T>(string library, string function)

    where T : class

{

    IntPtr moduleHandle = GetModuleHandle(library);

    if (moduleHandle == IntPtr.Zero)

        return null;

    IntPtr procAddress = GetProcAddress(moduleHandle, function);

    if (procAddress == IntPtr.Zero)

        return null;

    return Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T)) as T;

}

Instead of boxing it... And I also gave the function a more appropriate name.

Code 
CreateDelegateFunc<Beep>("kernel32.dll", "Beep")?.Invoke(700, 500);

RE: Use the hooked Sandboxie module to log messages - Dalvik - May 22, 2018

(May 22, 2018 09:21 AM)0xDEAD10CC Wrote: - Absolute facts -

Ah you're right I forgot about the type constraint that was required for that.

RE: Use the hooked Sandboxie module to log messages - int - May 22, 2018

is this the new exploit meta?

RE: Use the hooked Sandboxie module to log messages - gigajew - May 22, 2018

If you're going to bitch about type constraints you should also know that it requires the c# language version 7.3 or higher to use (for abstract delegate type constraint) which is not really considered a feasible requirement for a snippet like this. I want people who use VS 2012 to be able to use my code with minimal modifications if they need to

RE: Use the hooked Sandboxie module to log messages - 0xDEAD10CC - May 22, 2018

(May 22, 2018 05:29 PM)gigajew Wrote: If you're going to bitch about type constraints you should also know that it requires the c# language version 7.3 or higher to use (for abstract delegate type constraint) which is not really considered a feasible requirement for a snippet like this. I want people who use VS 2012 to be able to use my code with minimal modifications if they need to

Really now? 🤨

[Image: iElVRqo.png]

You really have absolutely no clue about C# do you? I'm not using a delegate type constraint. Lastly, that compiled in VS 2008 using .NET 3.5 (C# 3.0)... Please stop posting against this now. Use a compiler and test your theories... class indicates that T must be a reference type, and since the semantics behind the as keyword require that the type can be assigned null (not a valuetype value) -- I'll let you put 2 and 2 together, hopefully this time you can.

Even without delegate type constraints or any of that, you can simply:

Code 
if (!typeof(Delegate).IsAssignableFrom(typeof(T)))

    throw new InvalidOperationException("Generic type must be a delegate type");

The constraint I was using came out long before null propagation, which is what you're obviously allowing as it's in your example code for Invoke().

RE: Use the hooked Sandboxie module to log messages - gigajew - May 22, 2018

Okay, I was wrong and I did not realize you could type constraint using 'class' and changing the cast as T instead of (T). I also changed it to return null as you had done. Anyway, I was playing around with ESET/Nod32 and looking at their library responsible for hooks in processes and realized they export a function called UninstallHooks() with no parameters. This could actually work:

Code 
   /// <summary>

    /// ESET/Nod32 hook uninstall signature

    /// </summary>

    [SuppressUnmanagedCodeSecurity]

    private delegate void UninstallHooks();

    /// <summary>

    /// Remove ESET/Nod32 hooks if possible

    /// </summary>

    static void RemoveNod32Hooks()

    {

        CreateApi<UninstallHooks>("eplgHooks.dll", "UninstallHooks")?.Invoke();

    }

RE: Use the hooked Sandboxie module to log messages - 0xDEAD10CC - May 22, 2018

(May 22, 2018 07:22 PM)gigajew Wrote: Okay, I was wrong and I did not realize you could type constraint using 'class' and changing the cast as T instead of (T). I also changed it to return null as you had done. Anyway, I was playing around with ESET/Nod32 and looking at their library responsible for hooks in processes and realized they export a function called UninstallHooks() with no parameters. This could actually work:

Code
/// <summary> /// ESET/Nod32 hook uninstall signature /// </summary> [SuppressUnmanagedCodeSecurity] private delegate void UninstallHooks(); /// <summary> /// Remove ESET/Nod32 hooks if possible /// </summary> static void RemoveNod32Hooks() { CreateApi<UninstallHooks>("eplgHooks.dll", "UninstallHooks")?.Invoke(); }

The way to find out would be to try. Seems very odd that someone would export that in an AV solution. I don't use that one so I don't know.

RE: Use the hooked Sandboxie module to log messages - gigajew - May 22, 2018

ESET is a pretty reputable AV company, I would probably say it's one of the better ones out there having tried it for a couple of years. Now I stay pretty free of infections in general with the default AV software because I don't really do a lot of fishy things online. But ESET has successfully removed any suspicious executables I've had in the past.

A side note: AVG and Avast seem to be pretty much the same software in the base. Edit: just read about it Avast bought AVG so if you happen to find an exploit in either of the platforms you hit two flies in one. They both share their hook names: aswhookx.dll, and aswhooka.dll which I'm guessing since they depend on ntdll CreateThread I suppose they put their initialization in DllMain() and don't expose any exports

RE: Use the hooked Sandboxie module to log messages - Dalvik - May 22, 2018

(May 22, 2018 06:11 PM)0xDEAD10CC Wrote: Lastly, that compiled in VS 2008 using .NET 3.5 (C# 3.0)...

Any reason you're using VS 2008 over 2017?

(May 22, 2018 06:11 PM)0xDEAD10CC Wrote:

The constraint I was using came out long before null propagation, which is what you're obviously allowing as it's in your example code for Invoke().

That is one sexy theme. Are you using VS code? Or is it just a custom theme for VS?

RE: Use the hooked Sandboxie module to log messages - 0xDEAD10CC - May 22, 2018

(May 22, 2018 09:47 PM)Dalvik Wrote: Any reason you're using VS 2008 over 2017?

That is one sexy theme. Are you using VS code? Or is it just a custom theme for VS?

1) For the demonstration that class constraint works on older C# language versions, .NET framework, and IDE's. (Read above - I could have changed settings in 2017 but to immediately illustrate the point I just compiled the code in 2008 which will never support C# 7+.) I still have 2017 Enterprise and Rider 2018. I keep 2015 Enterprise though as well for driver development.

2) That's still my VS 2008 (which I keep around for .NET compact framework library work because there's work I still need to maintain on Windows CE)

:)

RE: Use the hooked Sandboxie module to log messages - Dalvik - May 23, 2018

(May 22, 2018 10:26 PM)0xDEAD10CC Wrote: 1) For the demonstration that class constraint works on older C# language versions, .NET framework, and IDE's. (Read above - I could have changed settings in 2017 but to immediately illustrate the point I just compiled the code in 2008 which will never support C# 7+.) I still have 2017 Enterprise and Rider 2018. I keep 2015 Enterprise though as well for driver development.

Why keep around older versions? I assume 2017 also works for driver development or am I completely wrong here?

(May 22, 2018 10:26 PM)0xDEAD10CC Wrote: 2) That's still my VS 2008 (which I keep around for .NET compact framework library work because there's work I still need to maintain on Windows CE)

Ah okay. I assumed that since the theme was different that you used a different IDE, and it looked similar to VSC.

RE: Use the hooked Sandboxie module to log messages - 0xDEAD10CC - May 24, 2018

(May 23, 2018 07:53 AM)Dalvik Wrote: Why keep around older versions? I assume 2017 also works for driver development or am I completely wrong here?

Ah okay. I assumed that since the theme was different that you used a different IDE, and it looked similar to VSC.

No it doesn't, you're wrong. (https://stackoverflow.com/questions/43698680/where-is-wdf-template-after-installing-wdk) Only 2015 has the template AFAIK, and I also only have Installshield LE on my 2015 installation. Compact framework projects will not work on newer VS versions either unless you hack it and I'd rather just leave it alone.

RE: Use the hooked Sandboxie module to log messages - Dalvik - May 24, 2018

(May 24, 2018 11:34 AM)0xDEAD10CC Wrote: No it doesn't, you're wrong. (https://stackoverflow.com/questions/43698680/where-is-wdf-template-after-installing-wdk) Only 2015 has the template AFAIK, and I also only have Installshield LE on my 2015 installation. Compact framework projects will not work on newer VS versions either unless you hack it and I'd rather just leave it alone.

Well I stand corrected. Though in my defense, driver development is basically Chinese to me.