zoukankan      html  css  js  c++  java
  • 注入技术--远程代码注入

    1.简介:
    代码注入和远程线程注入dll类似,但是隐蔽性更好,因为不产生文件.但是可靠性差,更加复杂
    代码注入时注入的代码部分是从本进程空间复制过去的,所以不能出现依赖于本进程的数据存在.
    所以注入的代码中数据,地址都是动态生成的, 因此可以考虑将这些数据作为参数传递给注入的代码.
    将代码和数据都注入到目标进程中
    (注意,该代码要以release模式编译才能运行成功,因为debug模式的编译的结构的函数调用是个jmp,而不是直接调用)

    //声明需要用到的函数
    typedef HMODULE(WINAPI *lpLoadLibraryA)(char* filename);
    typedef FARPROC(WINAPI *lpGetProcAddress)(HMODULE hModule, char* funcName);
    typedef int(WINAPI *lpMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);
    typedef struct _thread_param
    {
        lpLoadLibraryA loadFunc;
        lpGetProcAddress GetPFunc;
        char data[4][100]; //保存所有参数
    }thread_param;
    
    DWORD WINAPI threadProc(LPVOID param)
    {
        thread_param* tparam = (thread_param*)param;
        HMODULE hd = tparam->loadFunc(tparam->data[0]); //data的第一个item是user32.dll
        lpMessageBoxA msg = (lpMessageBoxA)tparam->GetPFunc(hd, tparam->data[1]);//data的第2个参数是MessageBoxA
        msg(0, tparam->data[2], tparam->data[3], 0);//data后2个参数是messagebox的参数
    }
    
    DWORD codeInject(DWORD pid)
    {
        HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
        if (hProcess==0||hProcess==INVALID_HANDLE_VALUE)
        {
            return 0;
        }
        thread_param param = { 0 };
        param.loadFunc = (lpLoadLibraryA)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
        param.GetPFunc = (lpGetProcAddress)GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetProcAddress");
        memcpy(&param.data[0], "user32.dll", 11);
        memcpy(&param.data[1], "MessageBoxA", 12);
        memcpy(&param.data[2], "freesec", 8);
        memcpy(&param.data[3], "inject", 7);
    
        DWORD codesize = (DWORD)codeInject - (DWORD)threadProc; //计算线程函数的代码大小
        LPVOID database = VirtualAllocEx(hProcess, 0, sizeof(thread_param), MEM_COMMIT, PAGE_READWRITE);
        DWORD written;
        HANDLE hThread;
        if (database==0)
        {
            CloseHandle(hProcess);
            return 0;
        }
        WriteProcessMemory(hProcess, database, &param, sizeof(thread_param), &written);
        LPVOID codebase = VirtualAllocEx(hProcess, 0, codesize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
        if (codebase == 0)
        {
            VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
            CloseHandle(hProcess);
            return 0;
        }
        WriteProcessMemory(hProcess, codebase, threadProc, codesize, &written);
        if ((hThread=CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)codebase, database, 0, 0))!=0)
        {
            VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
            VirtualFreeEx(hProcess, codebase, codesize, MEM_FREE);
            CloseHandle(hThread);
            CloseHandle(hProcess);
            return 1;
        }
        VirtualFreeEx(hProcess, database, sizeof(thread_param), MEM_FREE);
        VirtualFreeEx(hProcess, codebase, codesize, MEM_FREE);
        CloseHandle(hProcess);
        return 0;
    }
  • 相关阅读:
    光遇————墓土(补充)蜡烛收集
    光遇————雨林
    每日光遇日记
    光遇————墓土
    光遇————云野超级不详细的蜡烛收集
    光遇————晨岛超级详细的蜡烛收集
    高精度
    HDU 1002: A + B Problem II (大数加法)
    HDU 1018:Big Number (位数递推公式)
    D2. Remove the Substring (hard version) (KMP-next数组 ) ( Codeforces Round #579 (Div. 3) )
  • 原文地址:https://www.cnblogs.com/freesec/p/6554518.html
Copyright © 2011-2022 走看看