C++ 遠程代碼注入

超級=_=，直接附上注入程序以及dll的代碼。

 

dll 代碼很簡單只是彈窗，可以根據需要擴充。

注入程序由於是練手，只是隨便寫了打開計算器的遠程注入。

從注入到卸載都包含，在程序執行完畢后掃尾巴

// InjectExample.cpp : 定義控制台應用程序的入口點。


#include "stdafx.h"

int EnableDebugPriv(const wchar_t *name)
{
    HANDLE hToken;
    TOKEN_PRIVILEGES tp;
    LUID luid;

    //打開進程令牌環
    if(NULL == OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken))
        return 1;

    //獲得進程本地唯一ID
    if(!LookupPrivilegeValue(NULL,name,&luid))
        return 1;

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    tp.Privileges[0].Luid = luid;
    
    //調整權限
    if(!AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL))
        return 1;
    return 0;
}

BOOL InjectDll(const wchar_t* DllFullPath,const DWORD dwRemoteProcessId)
{
    HANDLE hRemoteProcess;
    EnableDebugPriv(SE_DEBUG_NAME);
    //打開遠程線程 
    hRemoteProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwRemoteProcessId);
    if(!hRemoteProcess)
    {
        printf("OpenProcess Fail,GetLastError: %d",GetLastError());
        return FALSE;
    }

    void *pszLibFileRemote;
    //使用VirtualAllocEx 函數在遠程進程的內存地址空間分配DLL文件名空間
    pszLibFileRemote = VirtualAllocEx(hRemoteProcess,NULL,(wcslen(DllFullPath)+1)*sizeof(wchar_t),MEM_COMMIT,PAGE_READWRITE);
    if(!pszLibFileRemote)
    {
        printf("VirtualAllocEx Fail,GetLastError: %d",GetLastError());
        return FALSE;
    }

    //使用WriteProcessMemory 函數將DLL的路徑寫入到遠程進程的內存空間
    DWORD dwReceiveSize;
    if(0 == WriteProcessMemory(hRemoteProcess,pszLibFileRemote,(void*)DllFullPath,wcslen(DllFullPath)*sizeof(wchar_t),NULL))
    {
        printf("WriteProcessMemory Fail,GetLastError: %d",GetLastError());
        return FALSE;
    }
    printf("WriteProcessMem Success!\r\n");

    //計算LoadLibrary 的入口地址
    PTHREAD_START_ROUTINE pfnStartAddr = NULL;

//#ifdef _UNICODE
    pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(::GetModuleHandle(TEXT("Kernel32")),"LoadLibraryW");
//#else
    //pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(::GetModuleHandle(TEXT("Kernel32")),"LoadLibraryA");
//#endif


    if(NULL == pfnStartAddr)
    {
        printf("GetProcAddress Fail,GetLastError: %d",GetLastError());
        return FALSE;
    }

    //啟動遠程線程 LoadLibrary,通過遠程線程調用創建新的線程
    DWORD dwThreadId=0;
    HANDLE hRemoteThread = CreateRemoteThread(hRemoteProcess,NULL,0,pfnStartAddr,pszLibFileRemote,0,NULL);
    if(hRemoteThread == NULL)
    {
        printf("注入線程失敗,ErrorCode: %d\r\n",GetLastError());
        return FALSE;
    }

    printf("Inject Success ,ProcessId : %d\r\n",dwRemoteProcessId);
    
    WaitForSingleObject(hRemoteThread,INFINITE);
    GetExitCodeThread(hRemoteThread,&dwThreadId);

    //卸載 注入dll
    pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")),"FreeLibrary");
    hRemoteThread = CreateRemoteThread(hRemoteProcess,NULL,0,pfnStartAddr,(LPVOID)dwThreadId,0,NULL);

    //釋放遠程進程控件
    VirtualFreeEx(hRemoteProcess,pszLibFileRemote,wcslen(DllFullPath)*sizeof(wchar_t)+1,MEM_DECOMMIT);
    //釋放句柄
    CloseHandle(hRemoteThread);
    CloseHandle(hRemoteProcess);
    return TRUE;
}

DWORD GetProcessId()
{
    DWORD Pid = -1;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); // 創建系統快照

    //創建系統快照
    PROCESSENTRY32 lPrs; //保存進程信息的結構
    ZeroMemory(&lPrs,sizeof(PROCESSENTRY32));

    lPrs.dwSize = sizeof(lPrs);
    wchar_t *targetFile = L"calc.exe";
    Process32First(hSnap,&lPrs); //取得系統快照中第一個進程信息
    if(wcsstr(targetFile,lPrs.szExeFile)) // 判斷進程信息是否為explore.exe
    {
        Pid = lPrs.th32ProcessID;
        return Pid;
    }
    while(1)
    {
        ZeroMemory(&lPrs,sizeof(lPrs));
        lPrs.dwSize = sizeof(lPrs);
        if(!Process32Next(hSnap,&lPrs))
        {
            Pid=-1;
            break;
        }
        if(wcsstr(targetFile,lPrs.szExeFile))
        {
            Pid = lPrs.th32ProcessID;
            break;
        }
    }
    CloseHandle(hSnap);
    return Pid;

}

int _tmain(int argc, _TCHAR* argv[])
{
    wchar_t myFILE[MAX_PATH];
    GetCurrentDirectory(MAX_PATH,myFILE); //獲取當前路徑
    wcscat_s(myFILE,L"\\InjectDllExample.dll");
    InjectDll(myFILE,GetProcessId());

    return 0;
}

 

 

DLL 代碼:

// dllmain.cpp : 定義 DLL 應用程序的入口點。
#include "stdafx.h"
#include <malloc.h>
#include <stdlib.h>

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    wchar_t *szProcessId = (wchar_t*)malloc(10*sizeof(wchar_t));
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        MessageBox(NULL,L"遠程注入提示",L"RemoteDLL",MB_OK);
        break;
    default:
        return TRUE;
    //case DLL_THREAD_ATTACH:
    //case DLL_THREAD_DETACH:
    //case DLL_PROCESS_DETACH:
        //break;
    }
    return TRUE;
}