注入技術--遠程代碼注入

1.簡介:
代碼注入和遠程線程注入dll類似,但是隱蔽性更好,因為不產生文件.但是可靠性差,更加復雜
代碼注入時注入的代碼部分是從本進程空間復制過去的,所以不能出現依賴於本進程的數據存在.
所以注入的代碼中數據,地址都是動態生成的, 因此可以考慮將這些數據作為參數傳遞給注入的代碼.
將代碼和數據都注入到目標進程中
(注意,該代碼要以release模式編譯才能運行成功,因為debug模式的編譯的結構的函數調用是個jmp,而不是直接調用)

 

//聲明需要用到的函數
typedef HMODULE(WINAPI *lpLoadLibraryA)(char* filename);
typedef FARPROC(WINAPI *lpGetProcAddress)(HMODULE hModule, char* funcName);
typedef int(WINAPI *lpMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);
typedef struct _thread_param
{
    lpLoadLibraryA loadFunc;
    lpGetProcAddress GetPFunc;
    char data[4][100]; //保存所有參數
}thread_param;

DWORD WINAPI threadProc(LPVOID param)
{
    thread_param* tparam = (thread_param*)param;
    HMODULE hd = tparam->loadFunc(tparam->data[0]); //data的第一個item是user32.dll
    lpMessageBoxA msg = (lpMessageBoxA)tparam->GetPFunc(hd, tparam->data[1]);//data的第2個參數是MessageBoxA
    msg(0, tparam->data[2], tparam->data[3], 0);//data后2個參數是messagebox的參數
}

DWORD codeInject(DWORD pid)
{
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
    if (hProcess==0||hProcess==INVALID_HANDLE_VALUE)
    {
        return 0;
    }
    thread_param param = { 0 };
    param.loadFunc = (lpLoadLibraryA)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    param.GetPFunc = (lpGetProcAddress)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetProcAddress");
    memcpy(&param.data[0], "user32.dll", 11);
    memcpy(&param.data[1], "MessageBoxA", 12);
    memcpy(&param.data[2], "freesec", 8);
    memcpy(&param.data[3], "inject", 7);

    DWORD codesize = (DWORD)codeInject - (DWORD)threadProc; //計算線程函數的代碼大小
    LPVOID database = VirtualAllocEx(hProcess, 0, sizeof(thread_param), MEM_COMMIT, PAGE_READWRITE);
    DWORD written;
    HANDLE hThread;
    if (database==0)
    {
        CloseHandle(hProcess);
        return 0;
    }
    WriteProcessMemory(hProcess, database, &param, sizeof(thread_param), &written);
    LPVOID codebase = VirtualAllocEx(hProcess, 0, codesize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (codebase == 0)
    {
        VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
        CloseHandle(hProcess);
        return 0;
    }
    WriteProcessMemory(hProcess, codebase, threadProc, codesize, &written);
    if ((hThread=CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)codebase, database, 0, 0))!=0)
    {
        VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
        VirtualFreeEx(hProcess, codebase, codesize, MEM_FREE);
        CloseHandle(hThread);
        CloseHandle(hProcess);
        return 1;
    }
    VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
    VirtualFreeEx(hProcess, codebase, codesize, MEM_FREE);
    CloseHandle(hProcess);
    return 0;
}