CreateRemoteThread远程注入 使用例子
来源:互联网 发布:c语言double怎么用 编辑:程序博客网 时间:2024/06/06 02:23
CreateRemoteThread远程注入 使用例子
2008-04-15 17:02 2112人阅读 评论(0) 收藏 举报
//CreateRemoteThread 使用 关闭远程进程句柄 processID远程进程的进程ID handle远程进程的进程句柄
CloseRemoteHandle( DWORD processID, HANDLE handle )
{
HANDLE ht = 0;
DWORD rc = 0;
// open the process
HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE|PROCESS_VM_READ, FALSE, processID );
if ( hProcess == NULL )
{
rc = GetLastError();
MessageBox( _T("OpenProcess() failed ") );
return rc;
}
// load kernel32.dll
HMODULE hKernel32 = LoadLibrary( _T("kernel32.dll") );
// CreateRemoteThread()
ht = CreateRemoteThread(
hProcess,
0,
0,
(DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"CloseHandle"),
handle,
0,
&rc );
if ( ht == NULL )
{
//Something is wrong with the privileges, or the process doesn't like us
rc = GetLastError();
MessageBox( _T("CreateRemoteThread() failed ") );
//Free up the kernel32.dll
FreeLibrary( hKernel32 );
CloseHandle( hProcess );
}
switch ( WaitForSingleObject( ht, 2000 ) )
{
case WAIT_OBJECT_0:
//Well done
rc = 0;
MessageBox( _T("Ok "));
break;
default:
//Oooops, shouldn't be here
rc = GetLastError();
MessageBox( _T("WaitForSingleObject() failed ") );
break;
}
//Closes the remote thread handle
CloseHandle( ht );
//Free up the kernel32.dll
if ( hKernel32 != NULL)
FreeLibrary( hKernel32 );
//Close the process handle
CloseHandle( hProcess );
return rc;
}
//CreateRemoteThread 使用 释放远程dll句柄 processID占用dll的远程进程的进程ID lpDllPath dll路径
CloseRemoteDll( DWORD processID, LPCTSTR lpDllPath )
{
HANDLE ht = 0;
DWORD rc = 0;
DWORD dwHandle;
HANDLE hProcess;
hProcess= OpenProcess(PROCESS_CREATE_THREAD | //允许远程创建线程
PROCESS_VM_OPERATION | //允许远程VM操作
PROCESS_VM_WRITE, //允许远程VM写
FALSE, processID );
if ( hProcess == NULL )
{
rc = GetLastError();
//MessageBox( _T("OpenProcess() failed ") );
return rc;
}
HMODULE hKernel32 = LoadLibrary("kernel32.dll");
//向目标进程地址空间写入DLL名称
DWORD dwSize, dwWritten;
CString str;
str=lpDllPath;
dwSize=str.GetLength()+1;
LPVOID lpBuf = VirtualAllocEx(hProcess,NULL,dwSize, MEM_COMMIT, PAGE_READWRITE );
if(!WriteProcessMemory(hProcess,lpBuf,(LPVOID)lpDllPath, dwSize,&dwWritten))
{
rc=GetLastError();
VirtualFreeEx(hProcess,lpBuf,dwSize,MEM_DECOMMIT);
CloseHandle(hProcess);
return rc;
}
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
(DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"GetModuleHandleA"),
lpBuf ,0, NULL);
if(hThread == NULL)
{
rc=GetLastError();
CloseHandle(hProcess);
return rc ;
}
//等待GetModuleHandle运行完毕
WaitForSingleObject(hThread, INFINITE);
//获得GetModuleHandle的返回值
GetExitCodeThread(hThread,&dwHandle);
//释放目标进程中申请的空间
VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT);
CloseHandle(hThread);
// CreateRemoteThread()
ht = CreateRemoteThread(
hProcess,
0,
0,
(DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"FreeLibrary"),
(LPVOID)dwHandle,
0,
&rc );
if ( ht == NULL )
{
rc = GetLastError();
MessageBox( _T("CreateRemoteThread() failed ") );
FreeLibrary( hKernel32 );
CloseHandle( hProcess );
return rc;
}
switch ( WaitForSingleObject( ht, 2000 ) )
{
case WAIT_OBJECT_0:
rc = 0;
MessageBox( _T("Ok "));
break;
default:
rc = GetLastError();
MessageBox( _T("WaitForSingleObject() failed ") );
break;
}
//Closes the remote thread handle
CloseHandle(ht );
//Free up the kernel32.dll
if ( hKernel32 != NULL)
FreeLibrary( hKernel32 );
//Close the process handle
CloseHandle( hProcess );
return rc;
}
CloseRemoteHandle( DWORD processID, HANDLE handle )
{
HANDLE ht = 0;
DWORD rc = 0;
// open the process
HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE|PROCESS_VM_READ, FALSE, processID );
if ( hProcess == NULL )
{
rc = GetLastError();
MessageBox( _T("OpenProcess() failed ") );
return rc;
}
// load kernel32.dll
HMODULE hKernel32 = LoadLibrary( _T("kernel32.dll") );
// CreateRemoteThread()
ht = CreateRemoteThread(
hProcess,
0,
0,
(DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"CloseHandle"),
handle,
0,
&rc );
if ( ht == NULL )
{
//Something is wrong with the privileges, or the process doesn't like us
rc = GetLastError();
MessageBox( _T("CreateRemoteThread() failed ") );
//Free up the kernel32.dll
FreeLibrary( hKernel32 );
CloseHandle( hProcess );
}
switch ( WaitForSingleObject( ht, 2000 ) )
{
case WAIT_OBJECT_0:
//Well done
rc = 0;
MessageBox( _T("Ok "));
break;
default:
//Oooops, shouldn't be here
rc = GetLastError();
MessageBox( _T("WaitForSingleObject() failed ") );
break;
}
//Closes the remote thread handle
CloseHandle( ht );
//Free up the kernel32.dll
if ( hKernel32 != NULL)
FreeLibrary( hKernel32 );
//Close the process handle
CloseHandle( hProcess );
return rc;
}
//CreateRemoteThread 使用 释放远程dll句柄 processID占用dll的远程进程的进程ID lpDllPath dll路径
CloseRemoteDll( DWORD processID, LPCTSTR lpDllPath )
{
HANDLE ht = 0;
DWORD rc = 0;
DWORD dwHandle;
HANDLE hProcess;
hProcess= OpenProcess(PROCESS_CREATE_THREAD | //允许远程创建线程
PROCESS_VM_OPERATION | //允许远程VM操作
PROCESS_VM_WRITE, //允许远程VM写
FALSE, processID );
if ( hProcess == NULL )
{
rc = GetLastError();
//MessageBox( _T("OpenProcess() failed ") );
return rc;
}
HMODULE hKernel32 = LoadLibrary("kernel32.dll");
//向目标进程地址空间写入DLL名称
DWORD dwSize, dwWritten;
CString str;
str=lpDllPath;
dwSize=str.GetLength()+1;
LPVOID lpBuf = VirtualAllocEx(hProcess,NULL,dwSize, MEM_COMMIT, PAGE_READWRITE );
if(!WriteProcessMemory(hProcess,lpBuf,(LPVOID)lpDllPath, dwSize,&dwWritten))
{
rc=GetLastError();
VirtualFreeEx(hProcess,lpBuf,dwSize,MEM_DECOMMIT);
CloseHandle(hProcess);
return rc;
}
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
(DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"GetModuleHandleA"),
lpBuf ,0, NULL);
if(hThread == NULL)
{
rc=GetLastError();
CloseHandle(hProcess);
return rc ;
}
//等待GetModuleHandle运行完毕
WaitForSingleObject(hThread, INFINITE);
//获得GetModuleHandle的返回值
GetExitCodeThread(hThread,&dwHandle);
//释放目标进程中申请的空间
VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT);
CloseHandle(hThread);
// CreateRemoteThread()
ht = CreateRemoteThread(
hProcess,
0,
0,
(DWORD(__stdcall *)(void*))GetProcAddress(hKernel32,"FreeLibrary"),
(LPVOID)dwHandle,
0,
&rc );
if ( ht == NULL )
{
rc = GetLastError();
MessageBox( _T("CreateRemoteThread() failed ") );
FreeLibrary( hKernel32 );
CloseHandle( hProcess );
return rc;
}
switch ( WaitForSingleObject( ht, 2000 ) )
{
case WAIT_OBJECT_0:
rc = 0;
MessageBox( _T("Ok "));
break;
default:
rc = GetLastError();
MessageBox( _T("WaitForSingleObject() failed ") );
break;
}
//Closes the remote thread handle
CloseHandle(ht );
//Free up the kernel32.dll
if ( hKernel32 != NULL)
FreeLibrary( hKernel32 );
//Close the process handle
CloseHandle( hProcess );
return rc;
}
- CreateRemoteThread远程注入 使用例子
- CreateRemoteThread远程注入 使用例子
- createremotethread()远程注入dll
- 在Delphi中利用CreateRemoteThread远程注入例子
- 在Delphi中利用CreateRemoteThread远程注入例子
- 在Delphi中利用CreateRemoteThread远程注入例子
- 在Delphi中利用CreateRemoteThread远程注入例子
- 使用CreateRemoteThread把代码远程注入指定exe执行
- 使用远程线程注入的三个函数CreateRemoteThread、NtCreateThreadEx、RtlCreateUserThread
- 远程线程注入与CreateRemoteThread
- Delphi利用CreateRemoteThread远程注入
- DLL注入练习之远程注入-CreateRemoteThread()
- 注入(3)--远程线程注入(CreateRemoteThread)
- 用createRemoteThread远程注入(非DLL插入)
- CreateRemoteThread函数实现远程注入6部曲
- CreateRemoteThread 使用的两个例子
- [Delphi]利用createRemoteThread远程注入(非DLL插入)
- CreateRemoteThread远程线程向其他进程注入线程
- 利用Spring测试类测试Dao和Service
- 内存泄漏是新手必然要经历的痛,NSMutableArray的正确使用
- VC ADO 编译问题
- Android Property System | Android属性系统
- java io 整理
- CreateRemoteThread远程注入 使用例子
- Hibernate 入门示例
- 项目管理
- linux系统限制磁盘空间的两种方法
- 安装Fedora 15后需做的25件事情
- 单链表 建立, 查找, 删除, 插入 操作
- SqlServer强制断开数据库连接
- 网络监控软件造成的网站打不开问题
- 定时器任务