64 bit compatibility

[christophetd]

64 bit compatibility

[cha0tic87]

+1

This doesn't work with 64-bit Office. The typedefs need modifying and I also don't think the getPidByName() function words for 64-bit processes. The latter I can get around with WMIC but I'm unsure how to modify the typedefs or function declarations for 64-bit.

Niiiice work on the 32-bit though.

[christophetd]

Hi,

Thanks for the update. I double checked, and indeed the Office version I own is a 32-bit version... Apologies for the confusion. I have updated the README to reflect this.

If someone could contribute to a 64-bit version, that'd be awesome - I do not have access to a 64-bit Office version at the time.

[christophetd]

Hi,

As indicated in the readme, I tested this PoC on Windows 10 64 bits - can you provide your OS and office version?

Thanks

[tanujain]

I am trying it on Windows 10 and Office 365 MSO (16.0) 64-bit.

[cha0tic87]

Looking for any progress by anyone on this. Personally I've got to the point where the parent PID spoofing on x64 works, but the argument spoofing does not. There are no errors from any of the API calls, and I believe the issue is currently with the call to WriteProcessMemory(), but I don't know how to debug further.

[christophetd]

What I would suggest to do is:

• Put a breakpoint just before the call to WriteProcessMemory
• Using Process Hacker, dump the PEB (cf https://blog.christophetd.fr/wp-content/uploads/2019/03/PH-mapped-PEB.png), say to a file named peb1.bin
• Execute the call to WriteProcessMemory
• Dump the PEB again in peb2.bin
• Do a diff peb1.bin peb2.bin to see if anything was written to the PEB, and if yes what changed. You can PM me the files on Twitter if you'd like me to take a look

[py7hagoras]

@christophetd I submitted a pull request yesterday for the 64 bit implementation. Tested it with Office 365 (2016) 64-bit on 64 bit system. Learnt a lot while doing this.

[christophetd]

Merged! (#5)