StackOverflow再次问好!
我回来寻求使用Python实现DLL注入的帮助,结果相当成功。我正在使用非反射注射('CreateRemoteThread'
)来注射Python27.dll'进入一个过程。这已经成功了。 尝试访问注入的DLL中的函数时出现问题。
即:'Py_InitializeEx'
和
'PyRun_SimpleString'
函数(初始化解释器,允许将简单的字符串传递给解释器)。
这将是一个相当复杂的解释,提前道歉。
我测试代码的第一台虚拟机是x86-XP机器,'Py_InitializeEx'
''如果被调用,操作系统将返回一个错误(OS MessageBox),以防止"数据执行保护" ,"为了帮助保护您的计算机,Windows已关闭此程序"。所以我只是转向DEP,但即使重新启动后,错误仍然存在。
我将测试迁移到x64-Win7(即tskmgr.exe中的DEP列表:P),并攻击非DEP启用的进程。 Windows只是关闭受害者进程。我认为出于同样的原因,只是为了安全'目的,MSoft可能删除了DEP警告。
这让我认为我必须definitley必须做错事,因为我已经看到了Python代码中类似功能的例子。我的问题是,简单地说,谁能告诉我我做错了什么?
提前致谢:)
kernel32 = windll.kernel32
PAGE_READWRITE = 0x04 #Set token values
PROCESS_ALL_ACCESS = ( 0x00F0000 | 0x00100000 | 0xFFF )
VIRTUAL_MEM = ( 0x1000 | 0x2000 )
dllpath = r"C:\Documents and Settings\isolina\desktop\python27.dll"
dlllen = len(dllpath)#Set program variable
pid = 8972
processh = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, int(pid))#Attach to process by gaining a handle
dllpathaddr = kernel32.VirtualAllocEx(processh, 0, dlllen, VIRTUAL_MEM, PAGE_READWRITE)#Allocate room within the processes memory for the code
NULL = c_int(0)
kernel32.WriteProcessMemory(processh, dllpathaddr, dllpath, dlllen, NULL)#Write DLL path to process memory
kernel32h = kernel32.GetModuleHandleA("kernel32.dll")
loadlibh = kernel32.GetProcAddress(kernel32h, "LoadLibraryA")#Get address off LoadLibraryA function
thread_id = c_ulong(0)
if not kernel32.CreateRemoteThread(processh, None, 0, loadlibh, dllpathaddr, 0, byref(thread_id)):#Execute LoadLibraryA on DLL path in target process
print "Check yo' privileges, bro!"
exit()
print "Remote Thread: 0x%08x" %(thread_id.value)
pyhand = kernel32.GetModuleHandleA("python27.dll")
py_initialize_ex = thread_id.value + (kernel32.GetProcAddress(pyhand, 'Py_InitializeEx') - pyhand)
pyrun_simple_string = thread_id.value + (kernel32.GetProcAddress(pyhand, 'PyRun_SimpleString') - pyhand)
print "Py_InitializeEx: 0x{0:08x}".format(py_initialize_ex)
print "PyRun_SimpleString: 0x{0:08x}".format(pyrun_simple_string)
""" Code runs fine with below instruction omitted. """
kernel32.CreateRemoteThread(processh, None, 0, py_initialize_ex, 0, 0, byref(thread_id))#Execute Py_InitializeEx in target process