So in this video, we'll be taking a look at the creating sections and mapping these sections into our
process, copying the payload into that view.
And then we'll be simply mapping that same view into the remote process and execute the shared code.
So first, these sections are kind of like shared memory.
You can, whenever you want to write some data into some large file, like 400 MB B or one GB or two
GB of file.
So then you don't need to load the entire file.
You can load some part of that file and you can write to that part of the file.
And also these sections are used to further shared memory.
So that means one process can write and another process can read from these sections.
So first we'll be creating the section and then we'll be using a map view of the section.
So that's a whole section or some part of the section can be mapped into our own process at the space
using this function and D map your section.
And in that memory we can do some changes.
You can write some data and you don't need to commit to specifically the operating system will automatically
save the changes and when other process maps the sections view, then the latest changes for this data
will be reflected into the process at the space.
So function we are will be using our the created section.
So this is the W the can use this function.
We will be using the integrated section.
So you can copy this from the paint work for the anti mafia section.
We need to make some small modifications here.
This is also the in parameter, so you need to pass the reference.
So first let's create the section.
I have already declared all of these here.
So.
So let's go and create, let's see the first parameters out so we get the handle to the section and
the desired axis.
Object attributes maximum size section page production.
So we'll be dictating, read, write, execute and allocation attributes and the hand.
So here you can see the section can be created using the file handle as well.
And then we can view some part of file using the map section.
So we will be passing null because we already have the shared code.
So this is the shared code generated by a 64 bit calculator.
So let's create the section and create section.
And the first parameter is out.
So it's a int and pointer section and.
And the deserted axis is.
So I have already copied this from pin work.
If you type in the access mask you will get all these values.
So I will be declaring x section all access.
And object attributes.
You can pass this null and maximum size.
So you need to pass this payload amount of size.
So let's just say max size equals 2000 hexadecimal bytes.
So reference max size and the section page production.
I think.
Section pace protection.
We need to pass the read, write, execute.
So pass this.
140.
Education attributes.
So we are going to commit this fund.
The last one is five handed.
We don't have anything so zero.
So we should be good to go and return.
Value is the status code.
And we are going to check if section and not is equal to in 2.0.
If equal to 2.0, then that means the function failed and we need to print.
The return value that is there is.
Eris, that is what we're going to do is we are going to print the section handed.
And.
And we are going to close this.
We can use the function card and t cross.
Section and.
So let's build this one and let's run this.
And we got that section.
So we have successfully created the section.
Now we can map this using the map view of the New York section.
So I did not find this in MSDN.
So first one is a section handle, and the second one is process handle.
So base address is optional.
If you did not specify the this will allocate for you and zero which commit size so we can pass them
null and the view size.
This will pass the maximum size and inherit this position.
So we need to pass the value.
One or two will be passing view on map and then actually the aggregation type commit and action is praise
prediction for the page prediction of our local process.
We can specify read, right, because we are not executing in our local process where we allocating
same view will be mapping the view onto the remote process and then we can allocate, read, execute
on that remote process.
So let's go and create an RT map, view our section.
So the first one is the section handle.
And the next one is the process.
And so we can get that using process, get current process that handle.
The third one is zero bit.
So we need to, let's say.
So this one is the.
Okay.
So normally no reference for this.
And next one is also commit size.
And an external section offset.
So it should be zero.
So here you can see it is also in parameter, but in the P in work it's only out parameter.
So first time I got this function fade because of this.
So you wrong section offset is equal to zero.
So let's follow this one by one zero bits, comet size and different section offset.
And the same will be for The View.
View size is equal to.
Maximum size.
Reference view size.
So we can pass the search to further view and map.
And the last one is also there are two men commit, commit.
So pass this one.
And the next one is the stage production.
So we can pass only the page rewrite.
Page rewrite.
We do not give the best address.
So sorry for that.
I forgot the best address.
So Pointer Bay's address scores to zero.
Sandy says reference base address.
Oh, this one is.
So that's if the bills address the calls to the cause to the point zero.
Then Mapper.
There's to.
And it's what we can do is we can just print out the best address there is address.
These are the start to spring.
So after printing the best address, we can actually and map this.
We can use an.
And the unmanned U.S.
prog handle.
And the base visitors.
So let's build this one and let's put a breakpoint at this, uh, before unmapped section.
So let's go and run this.
So we got the error.
So we need to convert to hexadecimal.
And Google for anti status codes.
So in varied parameter.
So I found the error.
So we need to change this.
Uh, commit to zero because it's already committed in this clear section so we can pass this zero here.
Now, let's run this, and we have the address.
And if you go this, we have our analysis.
So let's continue.
Or no.
What we can do is we can copy our
let's say let's copy normally the normal ASCII characters.
So by temp is equal to.
And coding before the GED by itself.
So let's say ABCD.
And we are going to copy this to the best address.
Now let's put the breakpoint before this copy and run this one.
And as you can see, we have nothing.
And let's go and step into this.
And here we can see.
So let's continue this fun.
Now what we're going to do is we are going to copy our character paper to this
view.
And also let's turn this to page, read, write, execute.
Because we are going to test in our legal process, then we can simply map to the remote process.
So copy the payload.
Peter Dutton.
Let's run this.
And let's click on step into and we have the parent here.
You can see that XY.
Now we are going to create the thread at this base address.
Create thread.
So the first one is the attributes we can say zero.
And the next one is tag size zero based address.
Function parameters that are no function parameters.
Creation x zero means we need to start the thread immediately and thread data.
It is close to zero.
Out today.
So we are good to go.
So let's put the breakpoint and start this.
So there is nothing.
Let's copy this instruction, master.
Copy.
And we have the period here.
No.
We are about to create a thread.
Let's run this and here we can see the character got pop.
So let's continue this one and it says So we are good to go.
So after copying into the view so we can just comment this one.
So we have successfully copied the pillar into view and then we need to map the same view into the remote
process.
So what we can do is we can say open process.
So we need to specify a process our access.
So this one or this one.
So you can just simply add these places.
So it was like one.
F.
So we have the process of access.
Process all access and inherit and enforce and the process ID.
We re changing this process.
So it's so not.
So we have the pad 2000 for it's best this year.
And pass this beard here.
It's a beer.
It will be very simple then process under security.
So we will be getting the handle.
So if broken cycles is equal to zero, then it's a fair to open process.
And we have successfully open the process.
Now, all we need is we need to just map this.
Section.
Oh I see.
So you can copy the same variables.
Paste here.
Zero bits to convert to.
So take this to remote base.
So the first one is section handed and the next one is a process that is broken, which you open to
the notepad and then the reference remote base.
Zero bits to.
It seems to.
Her friends are said to.
And the view is.
Preference use size to.
Share and map zero.
And the last one is page read execute.
Execute.
So 20.
And if a remote base is equal to zero.
Then print.
Uh.
Remote mapper.
And this time print printed this return type that is there else.
So there is a success in mapping this section into the remote process.
All we need to do is we need to just create a remote thread.
All Candy.
And the next one is attributes, which can be zero.
Taxes zero and start address is remote base.
And the function parameters.
Zero.
Creation facts zero so that that should start immediately.
And then the thread.
We'll be getting the thread and.
So I think we are good to go.
So let's put the breakpoint at this great remote moderator and run this.
So let's run this.
Okay.
Let's continue.
And we got the category report.
Let's also print the remote base.
So let's run this.
So.
Read Execute.
So here you can see I think this is the exact address.
Driver one so this one and here we can see the exact our calculator has has been mapped into this view
and one thing is you don't need to map the view from the remote process.
So it should be there or and you should not that map because otherwise the outer pair are not going
to run.
So this program is also working for 32 bit.
All you need to do is put that attribute better and change the comparison to x86.