T05 · Unauthorized Access and Privilege Escalation
Error
- Location
ths_memory_reader.py:75- Finding
Privileged Broad Process-Memory Scanning
- Content
View full analysis
bool: """Open the process.""" self.handle = kernel32.OpenProcess( PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, self.pid ) return self.handle is not None and self.handle != -1 ``` ```python def scan_memory(self, pattern: bytes, mask: str = None) -> List[int]: """Scan process memory for a pattern.""" results = [] address = 0 mbi = wintypes.MEMORY_BASIC_INFORMATION() mbi_size = ctypes.sizeof(mbi) while kernel32.VirtualQueryEx( self.handle, ctypes.c_void_p(address), ctypes.byref(mbi), mbi_size ) == mbi_size: if mbi.State == MEM_COMMIT and mbi.Protect in [ PAGE_READWRITE, PAGE_EXECUTE_READWRITE ]: try: data = self.read_bytes(mbi.BaseAddress, mbi.RegionSize) if data: offset = 0 while True: pos = data.find(pattern, offset) if pos == -1: break results.append(mbi.BaseAddress + pos) offset = pos + 1 except: pass address = mbi.BaseAddress + mbi.RegionSize if address >= 0x7FFFFFFF: break ``` The standalone scanner also targets a hardcoded PID: ```python PID = 21152 handle = kernel32.OpenProcess( PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, PID ) if not handle or handle == -1: print("Failed to open process; run with administrator privileges.") sys.exit(1) ``` ### Technical Analysis The project opens another process with `PROCESS_VM_READ` and `PROCESS_QUERY_INFORM ...[truncated 1880 chars]- Remediation
View remediation