CreateRemoteThread方式实现进程注入

该程序首先查找自己的父进程，如果父进程是cmd或者powershell，则向父进程注入一个dll，让父进程输出“Hello World!”。

dllmain.cpp

#include <Windows.h>
#include <cstdio>

BOOL WINAPI DllMain(HINSTANCE, DWORD fdwReason, LPVOID)
{
    if (fdwReason == DLL_PROCESS_ATTACH)
    {
        HANDLE hStdOutput = GetStdHandle(STD_OUTPUT_HANDLE);
        DWORD dwOutputMode;
        if (!GetConsoleMode(hStdOutput, &dwOutputMode))
        {
            puts("GetConsoleMode() fail.");
        }
        dwOutputMode |= ENABLE_VIRTUAL_TERMINAL_PROCESSING;
        if (!SetConsoleMode(hStdOutput, dwOutputMode))
        {
            puts("SetConsoleMode() fail.");
        }
        puts("x1b[31mHello World!x1b[0m");
    }
    return TRUE;
}

main.cpp

#include <Windows.h>
#include <TlHelp32.h>
#include <cstdio>
#include <cstring>
#include <process.h>

DWORD GetParentProcessId(DWORD dwProcessID)
{
    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (!hProcessSnap)
    {
        puts("CreateToolhelp32Snapshot() fail.");
        exit(1);
    }
    PROCESSENTRY32 pe = { 0 };
    pe.dwSize = sizeof(PROCESSENTRY32);
    if (!Process32First(hProcessSnap, &pe))
    {
        puts("Process32First() fail.");
        exit(1);
    }
    DWORD dwParentProcessID = 0;
    do
    {
        if (pe.th32ProcessID == dwProcessID)
        {
            dwParentProcessID = pe.th32ParentProcessID;
        }
    } while (Process32Next(hProcessSnap, &pe));
    CloseHandle(hProcessSnap);
    return dwParentProcessID;
}

PTHREAD_START_ROUTINE pLoadLibrary;
PTHREAD_START_ROUTINE pFreeLibrary;

void LoadLibraryRemote(HANDLE hProcess, PCWSTR wcsDllName)
{
    SIZE_T nSize = (wcslen(wcsDllName) + 1) * sizeof(WCHAR);
    PVOID wcsDllNameRemote = VirtualAllocEx(hProcess, NULL, nSize, MEM_COMMIT, PAGE_READWRITE);
    if (!wcsDllNameRemote)
    {
        puts("VirtualAllocEx() fail.");
        exit(1);
    }
    if (!WriteProcessMemory(hProcess, wcsDllNameRemote, wcsDllName, nSize, NULL))
    {
        puts("WriteProcessMemory() fail.");
        exit(1);
    }
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL, pLoadLibrary, wcsDllNameRemote, NULL, NULL);
    if (!hThread)
    {
        puts("CreateRemoteThread() fail.");
    }
    WaitForSingleObject(hThread, INFINITE);
    VirtualFreeEx(hProcess, wcsDllNameRemote, 0, MEM_RELEASE);
    CloseHandle(hThread);
}

void FreeLibraryRemote(HANDLE hProcess, PCWSTR wcsDllName)
{
    DWORD dwProcessID = GetProcessId(hProcess);
    HANDLE hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessID);
    if (!hModuleSnap)
    {
        puts("CreateToolhelp32Snapshot() fail.");
        exit(1);
    }
    MODULEENTRY32 me = { 0 };
    me.dwSize = sizeof(MODULEENTRY32);
    if (!Module32First(hModuleSnap, &me))
    {
        puts("Module32First() fail.");
        exit(1);
    }
    PVOID hMod = NULL;
    do
    {
        if (!_wcsicmp(me.szModule, wcsDllName))
        {
            hMod = me.hModule;
            break;
        }
    } while (Module32Next(hModuleSnap, &me));
    if (!hMod)
    {
        puts("Assertion fail. Module not found.");
        exit(1);
    }
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL, pFreeLibrary, hMod, NULL, NULL);
    if (!hThread)
    {
        puts("CreateRemoteThread() fail.");
        exit(1);
    }
    WaitForSingleObject(hThread, INFINITE);
    CloseHandle(hModuleSnap);
    CloseHandle(hThread);
}

int main()
{
    HMODULE hMod = GetModuleHandle(L"kernel32");
    if (!hMod)
    {
        puts("GetModuleHandle() fail.");
        exit(1);
    }
    pLoadLibrary = (PTHREAD_START_ROUTINE)GetProcAddress(hMod, "LoadLibraryW");
    if (!pLoadLibrary)
    {
        puts("GetProcAddress() fail.");
        exit(1);
    }
    pFreeLibrary = (PTHREAD_START_ROUTINE)GetProcAddress(hMod, "FreeLibrary");
    if (!pLoadLibrary)
    {
        puts("GetProcAddress() fail.");
        exit(1);
    }
    DWORD dwCurrentProcessID = GetCurrentProcessId();
    DWORD dwParentProcessID = GetParentProcessId(dwCurrentProcessID);
    if (dwParentProcessID == 0)
    {
        puts("Assertion fail. Parent process not exist.");
        exit(1);
    }
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwParentProcessID);
    if (!hProcess)
    {
        puts("OpenProcess() fail.");
        exit(1);
    }
    WCHAR wcsImageName[256];
    DWORD dwSize;
    if (!QueryFullProcessImageName(hProcess, 0, wcsImageName, &dwSize))
    {
        puts("QueryFullProcessImageName() fail.");
        exit(1);
    }
    if (!wcsstr(wcsImageName, L"cmd.exe") && !wcsstr(wcsImageName, L"powershell.exe"))
    {
        puts("Assertion fail. Parent process neither cmd nor powershell.");
        exit(1);
    }
    WCHAR wcsDllName[] = L"HelloWorld.dll";
    LoadLibraryRemote(hProcess, wcsDllName);
    FreeLibraryRemote(hProcess, wcsDllName);
    CloseHandle(hProcess);
}

编译命令

%CC% -shared dllmain.cpp -o HelloWorld.dll
%CC% main.cpp -o HelloWorld.exe